Privacy policy

NYXL (“Sigcore”, “we”) operates the website at https://sigcore.io and the Sigcore wallet infrastructure service. This policy explains what personal data we collect, why, and the choices you have. For anything not covered here, write to [email protected].

We collect only what the service needs to work:

• Account data. Name, work email, organisation name and the public part of any passkey you register. We never see passkey private keys or passwords in plain text.
• Service data. Wallet names, public keys and addresses, policy configuration, approval decisions and signing activity. Private keys are generated and kept inside secure hardware and are never available to us.
• Technical data. IP address, browser type, device identifiers used for session security, and server logs needed to keep the service secure and reliable.
• Communications. Messages you send us through the contact form or by email.

We do not use third-party advertising trackers on this website.

• To provide, secure and support the service you signed up for.
• To verify identity and prevent fraud, abuse and unauthorised access.
• To bill you for paid plans.
• To send service notices, such as approval requests, security alerts and changes to these terms.
• To reply when you contact us.
• To meet legal and regulatory obligations.

Where data-protection law requires a legal basis, we rely on the performance of our contract with you, our legitimate interest in running a secure service, your consent where we ask for it, and compliance with legal obligations.

We share personal data only with:

• Infrastructure and payment providers that process data on our behalf under contract.
• Your organisation's administrators, for data that belongs to their organisation.
• Authorities, where the law requires it.

We do not sell personal data.

We keep account and service data for as long as your account is active and for a limited period afterwards to meet legal, audit and security obligations. Signed operation receipts and audit logs are retained for the period required by applicable regulation. You can ask us to delete your account at any time.

The service runs inside hardware-isolated enclaves. Key material never leaves them. Data at rest is encrypted, access is logged in a tamper-evident audit trail, and operations are governed by multi-party approval. Our security page describes the model in detail.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. To exercise any of these rights, email [email protected]. We respond within the time the law allows.

Where data moves between countries, we rely on recognised transfer mechanisms such as standard contractual clauses and keep technical safeguards in place regardless of location.

This website stores your theme preference in your browser. The dashboard uses strictly necessary cookies and local storage to keep you signed in and to protect your session. We do not set analytics or advertising cookies.

We will post any changes to this policy on this page and update the date above. For material changes we will also notify account holders by email.