Privacy Policy

SFER LABS LLC · Version 1.0 · Effective August 11, 2026 · Download PDF

This Privacy Policy explains how SFER LABS LLC, 1201 N. Orange Street, Suite 7691, Wilmington, Delaware 19801-1186, USA ("Company," "we," "us") handles personal data in connection with Idelio, https://idelio.pro, our applications, support, research, sales and marketing activities (the "Service").

It applies to website visitors, prospects, account users, customers, research participants and people whose business contact information we lawfully obtain from other sources. When a business customer submits personal data to the Service and determines why and how it is processed, that customer is normally the controller and we act as its processor under our Data Processing Addendum at https://idelio.pro/legal/dpa.

1. Contact and representatives

Controller: SFER LABS LLC, 1201 N. Orange Street, Suite 7691, Wilmington, Delaware 19801-1186, USA. Privacy and data-protection contact: [email protected].

EEA representative: […]. UK representative: […].

2. Data we collect

Depending on your interaction, we may collect:

1. a) Account and identity data: name, username, email, organization, role, country, language, avatar, authentication identifiers and age/eligibility confirmations.
2. b) Transaction data: plan, credits, purchases, invoices, tax location, payment status, renewal, cancellation, refund and chargeback information. Our payment provider receives full payment credentials; we normally receive only limited transaction information.
3. c) Inputs, Outputs and project data: prompts, names, instructions, uploaded files and images, generated assets, edits, project settings, export history and associated metadata.
4. d) Usage and device data: IP address, approximate location derived from IP, browser, device, operating system, timestamps, page and feature events, session and account identifiers, referrer, UTM parameters, API calls, latency, error and performance information.
5. e) Security and trust data: login and access logs, fraud signals, moderation results, safety classifications, policy reports, investigation records and evidence associated with suspected abuse.
6. f) Communications and research data: support tickets, email, call notes or recordings where notified, feedback, survey answers, interview recordings/transcripts, waitlist responses, product requests and consent records.
7. g) Marketing and prospect data: business contact details, employer, role, professional profile, interests, campaign engagement, source and enrichment attributes.
8. h) Preference and rights data: cookie choices, marketing preferences, Global Privacy Control signal, opt-outs, suppression entries and privacy-request records.

Please do not submit sensitive or regulated data unless a feature is expressly approved for it. If Input contains another person's personal data, you are responsible for having an appropriate lawful basis and giving required notices.

3. Sources

We obtain data:

1. a) directly from you, your device and your use of the Service;
2. b) from an organization that provides your account;
3. c) from payment, authentication, support, analytics, security and AI providers;
4. d) from referrals, partners, event organizers or lead providers;
5. e) from public professional sources such as company websites, business directories and professional profiles; and
6. f) from lawfully licensed enrichment or marketing datasets.

Where EEA/UK personal data is obtained indirectly, we provide the information required by applicable law, normally in our first communication and within the applicable statutory period. We do not use unlawfully scraped private data or bypass access controls.

4. Why we use data and EEA/UK legal bases

Our legitimate interests include providing a useful and secure product, measuring demand, prioritizing features, finding business customers, preventing abuse and defending rights. We consider necessity, reasonable expectations, sensitivity and safeguards. You may object as described below.

Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing. We do not condition ordinary Service access on optional marketing, advertising or model-training consent.

5. AI processing and human review

The Service may send Input, Output and technical data to the AI providers in our Technology & Vendor Register. Providers may use automated safety systems and, in limited cases, authorized human review for abuse detection, incident response, support or legal compliance. Flagged material may be kept longer than ordinary requests.

We seek commercial configurations that do not use API customer content to train shared models, but practices vary by provider, endpoint, feature and plan. We do not promise zero-data-retention unless a specific feature is expressly identified as such. Do not submit secrets or sensitive personal data based solely on an assumption that an AI provider stores nothing.

We may review a minimized sample of interactions for QA, safety, debugging or product research under access controls. Training or fine-tuning shared/general models on identifiable customer content requires a separate voluntary opt-in or written B2B terms. We may use properly deidentified statistics and performance measurements to improve products and evaluate models.

6. Analytics, cookies and advertising

We use cookies, local storage, pixels, SDKs and similar technology as described in the Cookie & Tracking Policy. In regions requiring prior consent, non-essential analytics, personalization, session replay and advertising remain disabled until consent. You can change your choices at any time through the Cookie Settings control available from the website footer.

Where applicable, you can opt out of sale, sharing or processing for targeted advertising through the Your Privacy Choices control available through the website or account, or by contacting [email protected]. We treat a valid Global Privacy Control signal as an opt-out for the browser/device and profile we can reasonably associate with it, where required.

7. Marketing choices

You can unsubscribe from marketing email through the link in each message. You can withdraw SMS consent by using the stated keyword and telephone consent through the method provided in the call or at [email protected]. We maintain a limited suppression record so we can respect your choice.

Service, security, billing and legal messages are not marketing opt-ins, although their content must remain limited to the relevant operational purpose.

We do not use purchased or enriched contact data unless the source, permitted uses, provenance and required notices have been reviewed. We do not use sensitive data to infer marketing audiences without valid permission.

8. When we disclose data

The Technology & Vendor Register at https://idelio.pro/legal/technology-vendor-register identifies current technologies, subprocessors and other recipients, including their roles, purposes and available retention/transfer information. Provider additions, removals or substitutions within purposes and data categories already disclosed here may be recorded in that Register without republishing this Policy. We update this Policy and, where required, obtain a new choice before a materially new purpose, data category or more intrusive practice begins.

We may disclose data to:

1. a) infrastructure, hosting, database, storage, security, communications, support, authentication, analytics and AI providers acting for us;
2. b) Paddle and financial, tax and fraud partners for transactions;
3. c) advertising, attribution, audience and campaign providers, only subject to required consent or opt-out rights;
4. d) professional advisers, auditors and insurers under confidentiality duties;
5. e) a buyer, investor or successor in a corporate transaction, subject to appropriate safeguards;
6. f) authorities or other parties when reasonably necessary to comply with law, protect rights or address fraud, security or safety; and
7. g) other parties at your direction or with your consent.

Current subprocessors are listed at https://idelio.pro/legal/technology-vendor-register. We do not disclose Input or Output to data brokers for their independent marketing. Certain advertising disclosures may be considered "sale," "sharing" or targeted advertising under U.S. state law even when no money changes hands; applicable choices are described above and in the U.S. State Privacy Notice.

9. International transfers

We are established in the United States and providers may process data in the United States and other countries. Where EEA, UK or Swiss law restricts transfers, we use an available adequacy decision, the applicable Standard Contractual Clauses, the UK Addendum/IDTA, or another lawful mechanism. We assess transfer risks and use supplementary measures where appropriate. Contact [email protected] for information or an available copy of relevant safeguards, subject to necessary redactions.

10. Retention

We keep personal data only as long as reasonably necessary for the stated purpose, then delete or deidentify it. Default maximum periods are:

We may retain a limited record longer when required by law, to resolve a dispute, enforce agreements or maintain a suppression list. Deletion from backup does not require restoring and altering an isolated backup; if restored, the deletion rule is reapplied.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent, opt out of targeted advertising/sale/sharing/profiling, limit certain sensitive-data uses, and appeal a denied request. EEA/UK users may object at any time to direct marketing, and may object to processing based on legitimate interests.

Submit a request through the Your Privacy Choices control available through the website or account, or email [email protected]. We will verify it proportionately and respond within the applicable period. Authorized agents may act where permitted, subject to verification of authority. We will not discriminate against you for exercising a privacy right.

You may complain to your local supervisory authority. EEA authority contacts are available through the European Data Protection Board; UK users may contact the ICO. We invite you to contact us first, but this is not required.

12. Automated decisions

We may use automated systems for fraud, security, moderation, routing and product personalization. We do not use the Service to make solely automated decisions about individuals that produce legal or similarly significant effects unless we provide a specific notice, lawful basis and required safeguards. Customers are prohibited from using the Service for unapproved high-impact decisions.

13. Security

We use administrative, organizational and technical measures designed for the nature and risk of the data, including access controls, encryption in transit, logging, vulnerability management, backup controls and incident procedures. No system is completely secure. If law requires notice of a breach, we will provide it to affected parties and authorities within applicable deadlines.

14. Children

The Service is not directed to anyone under 18 and we do not knowingly collect their personal data. If you believe a child submitted data, contact [email protected]. We will investigate and delete it where required.

15. Changes

We may update this Policy to reflect legal, technical or business changes. We will post the effective date and give additional notice for material changes. A new incompatible purpose will receive an appropriate notice and lawful basis; an updated policy alone does not create consent.

16. Contact

SFER LABS LLC 1201 N. Orange Street, Suite 7691, Wilmington, Delaware 19801-1186, USA Privacy: [email protected]