Sigma Browser

GDPR overview

The homepage carries a one-line claim, that Sigma complies with GDPR and CCPA, and the publisher is established in Estonia, so the Regulation applies by place of establishment and no Article 27 representative is needed or named. The privacy policy lists rights to know, access, correct, transfer, restrict and delete, extends them to the whole customer base rather than EU residents alone, promises no discriminatory treatment for exercising them, and allows consent to be withdrawn at any time. Grounds for refusing a request are spelled out: legal retention duties, anti-fraud and security investigations, the privacy of others, frivolous or impractical demands. Beyond that the documentation is thin. No legal basis is cited, no data protection officer is named, no retention period is given, no international transfer mechanism is described, no subprocessor is listed, and the policy carries no effective date. The only contact is the general support address.

Who owns the data?

The terms are more expansive than the marketing. Section 5 provides that any content or materials you submit through the Services grant Sigma a perpetual, irrevocable, transferable, sub-licensable, worldwide and royalty-free licence to reproduce, use, modify, display, distribute, translate and create derivative works from them, through multiple tiers and across any media. The privacy policy pulls the other way: users are described as essentially anonymous, credentials and task data are said not to be kept after execution, and the local Eclipse model is presented as technically inaccessible to the vendor. Ownership itself is never asserted in either document, so the licence is the operative text.

Reuse rights

Sigma grants you a non-transferable, non-sublicensable, non-assignable and non-exclusive licence to use the Services for personal or internal business purposes. Within that scope nothing in the terms restricts what you do with the answers, summaries, images or code the tool produces for you: no attribution and no prior permission are required. The restrictions bear on the product itself. You may not sublicense, sell, rent, lease, transfer, reproduce, distribute, host or otherwise commercially exploit the Services, embed Sigma into a service you provide to a third party without written consent, reverse-engineer or decompile it, or reuse Sigma's own content, including its images and text, in another project. On the vendor's side, cookies serve session management and preferences, while third-party cookies collect visitor statistics and measure marketing campaigns and can be refused in browser settings.

Data retention & training

Hosting summary

No hosting country, region or provider is named anywhere on the site. The only infrastructure statement is a negative one, made about the local mode: no servers, no storage, no cost. A cloud side clearly exists, since the AI chat is reachable as a web application and the agent runs through an API key in standard browsing, but where that side is hosted is never documented, and no subprocessor is listed. The publisher is established in Estonia and the terms place the agreement under Estonian law, with arbitration in Tallinn, so the governing jurisdiction is clear even though the data location is not. The site itself is served behind Cloudflare on an anycast address, which describes the delivery network rather than where user data resides and should not be read as a hosting disclosure. Anyone with a data residency requirement will have to ask the publisher directly, as the published documentation does not answer the question.