SigmaPLM

Privacy Policy

Last updated 16 October 2026

This policy explains what personal data SigmaPLM collects when you use sigmaplm.com (the "Service"), why, and the choices you have. It applies to visitors of the website, users of a workspace, and supplier portal users. Where your organisation has created a workspace, it decides what goes into that workspace and is the controller of that content; we process it on its behalf.

1. What we collect

  • Account data: name, work email, password (stored only as a salted hash), role, and the workspace you belong to.
  • Workspace content: parts, bills of materials, documents and files, change records, quality records, supplier and quote data, and anything else your organisation enters.
  • Usage and security data: an audit log of actions in your workspace (who did what, when, from which IP address), sign-in events, and server logs containing IP address, browser type and the pages or API routes requested.
  • Billing data: plan, invoices and payment status. Card details are entered directly with our payment processor, Stripe, and never reach our servers.
  • Support correspondence: emails you send to support@sigmaplm.com.

2. How we use it

To provide and secure the Service, to authenticate you, to send transactional email (invitations, password resets, approval requests, billing notices), to respond to support requests, to detect abuse, and to meet our legal obligations. We do not sell personal data and we do not use workspace content for advertising or to train machine-learning models.

3. Cookies, local storage and analytics

The application keeps your session tokens and interface preferences in your browser's local storage. We do not set advertising cookies and we do not load third-party analytics or advertising scripts.

We run our own first-party analytics to understand how the website and sign-up flow are used: page views and sign-up funnel events are sent to our server with a random visitor identifier kept in your browser's local storage (session-only when your browser sends Do Not Track), the pages visited, referrer, browser and device type, and a country-level location derived on our server. Your IP address is hashed before it is stored and is not kept in clear. Signed-in users' events are linked to their account so we can see which visits led to a workspace. This data is used only to improve the Service and is never sold or shared with advertisers.

4. Who we share it with

  • Our hosting provider, which stores the Service's servers and backups.
  • Stripe, for payment processing, when a workspace is on a paid plan.
  • Our email delivery provider, for transactional email.
  • Other members of your workspace, and suppliers you invite to the supplier portal, according to the roles and records your organisation chooses to share.
  • Authorities, where we are legally required to do so.

5. Retention

Account and workspace data is kept for as long as the workspace exists. When an administrator deletes a workspace from Settings, its data and files are removed from live systems immediately and from backups within 30 days. Server logs are rotated within 30 days. Billing records are kept for as long as tax law requires.

6. Security

Traffic is encrypted in transit (TLS). Passwords are stored as bcrypt hashes and session refresh tokens as SHA-256 hashes. Every record and file is scoped to its workspace, and released documents are watermarked on download. We take nightly backups. No system is perfectly secure; if we become aware of a breach affecting your data we will notify affected workspace administrators without undue delay.

7. Your rights

Depending on where you live you may have rights to access, correct, export, restrict or delete your personal data, and to complain to a supervisory authority. Workspace administrators can export and delete all workspace data from Settings; individual users can update their profile in the app. For anything else, or to exercise a right your organisation cannot handle for you, email support@sigmaplm.com and we will respond within 30 days.

8. International transfers

The Service is hosted by our hosting provider in a single region, and support is provided from where SigmaPLM's operator is located. If you use the Service from another country, your data is transferred to that region. We apply the safeguards described above regardless of where you are.

9. Children

The Service is for businesses and is not directed at anyone under 16. We do not knowingly collect their data.

10. Changes and contact

We will post updates to this policy here and, for material changes, notify workspace administrators. Questions or requests: support@sigmaplm.com. See also our Terms of Service.