Legal

Privacy Policy

CRYSTALIZE documents acquisition and integrity. It does not determine legal admissibility or evidentiary weight.

Last updated: August 2026 · Full corporate policy: app.siriusdetector.com/legal

1. Controller

Intelsirius S.r.l. — Via di San Miniato 26, 52026 Castelfranco Piandiscò (AR), Italy · VAT / P.IVA 02519080515 · REA AR-224865

Privacy / support: info@siriusdetector.com
PEC: intelsirius@pec.it
DPO: Orazio Lacenere

2. ChatGPT data flow

ChatGPT → CRYSTALIZE (OAuth / MCP) → capture backend → Evidence Package (owner-bound). ChatGPT does not become the system of record for your Evidence Package.

3. Categories of personal data

Account identifiers (user_id / OAuth subject)
OAuth tokens/scopes (processed for auth; not shown in widgets)
URL / capture intent and options you submit
Capture metadata (status, hashes, warnings, timestamps)
Evidence Package contents for your account
Technical logs (may include IP, user-agent) for security and abuse prevention
Support requests you send by email
Payment/account metadata when billing is active on the Sirius platform (not sold inside ChatGPT)

4. Purposes & legal bases

Provide preservation / verify services — contract / legitimate interest
Security, audit, fraud prevention — legitimate interest / legal obligation
Account administration & billing outside ChatGPT — contract
Support — contract / legitimate interest

5. What is not sent to the model

Raw package binaries / full page HTML dumps as a default model payload
Filesystem paths, secrets, API keys, stack traces
Passwords, site cookies, session tokens, localStorage credentials

6. Browser Capture (future / not generally available)

Authenticated capture via Sirius Capture handoff is in development and not generally available in the public ChatGPT workflow. When enabled, it is designed so passwords, cookies and session tokens are not shared with ChatGPT. Visible page content you choose to capture may be packaged into your Evidence Package under your account.

7. Recipients / subprocessors (indicative)

Hosting / infrastructure for Sirius Detector / CRYSTALIZE
OpenAI (ChatGPT conversation and tool invocation under OpenAI’s terms)
Technical timestamp authority (TSA) when a technical RFC 3161 token is applied
Payment providers when platform billing is active

8. International transfers

Where processing involves providers outside the EEA, Intelsirius uses appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms required by applicable law). Contact us for details.

9. Retention

Account data and Evidence Packages are retained according to your plan and platform policy while the account is active, and for a limited period thereafter as needed for security, disputes, and legal obligations. Security logs are retained as required for audit and abuse prevention (typically up to 12–24 months unless a longer period is legally required). You may request deletion of account-related data subject to legal retention duties.

10. GDPR rights & complaints

You may request access, rectification, erasure, restriction, portability, and objection where applicable; revoke OAuth access; and request account deletion via info@siriusdetector.com. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local supervisory authority.

11. Cookies

See the Cookie Policy.