Privacy Policy
Last updated: 2026-06-23
TL;DR
The Sideband app runs locally and stores your component library on your own machine; we don’t host your catalogue. Your components, symbols, footprints, BOMs, supplies, manufacturers, and inventory live in your local install. Some features process your Altium files for you, for example rendering symbols and footprints, building 3D models, analysing boards and projects, importing or restyling, and the like. To do that, the app sends the relevant file to our processing service, which works on it transiently and returns the result without storing it. This policy covers all of that, plus the website, your account, licensing and billing.
1. Who we are
Sideband is built and operated by Fermium Ltd (“we”, “us”), a company registered in England & Wales (No. 12425065), with its registered office at 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom. We are the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at hello@getsideband.com.
2. What this policy covers
This policy applies to https://getsideband.com, the account you create, the licensing flow that activates Sideband on your machines, payments, and the processing service that several app features use. Your Sideband library is stored on your own device and you remain its controller; we don’t hold a copy. When a feature processes your files server-side, the file is sent to us only for that purpose and is not retained. Section 4 explains exactly what happens.
3. Information we collect
- Account. The details you give at sign-up and in your profile (name, email, and optionally company, job title and team), so we can authenticate you, give you download access and run your team.
- Website. Anything you choose to send us through the contact form (name, email, company, message), plus basic technical data (IP address, browser type, pages viewed) needed to serve and secure the site.
- Licensing & activation. When the app activates, refreshes or releases a paid seat it sends us your licence key, a non-identifying machine hint, your operating system and the app version. We use this to issue entitlements, enforce seat counts and support you. It does not include your library data.
- Billing. When you subscribe, our merchant of record Paddle collects and processes your payment details and billing address. We receive the resulting subscription and transaction records (plan, status, country, the last four digits and card type), never your full card number.
- Design files you submit for processing. When you use a feature that processes your designs server-side, the app sends the relevant Altium file (for example a
.SchLib,.PcbLib,.PcbDoc,.SchDoc,.PrjPcb,.IntLibor the like) to our processing service. This is covered in detail in section 4.
4. Processing your design files
A number of Sideband‘s features run on a server-side processing service rather than on your device. Examples include rendering symbol and footprint previews, tessellating 3D/STEP models, analysing imported boards and projects, extracting or merging libraries, restyling symbols, importing parts, and similar operations we may add over time. When you trigger one of these, the app sends the specific Altium file (or, for LCSC/EasyEDA imports, the generated part) to the service over an encrypted, authenticated connection. That connection enters through our edge provider (Cloudflare) and reaches the processing service, which runs on Fly.io (primarily in Amsterdam) and on a virtual server we operate at OVH in Canada.
Your design files are your confidential data and intellectual property, not personal data about you, so they sit outside most of this policy. We include them here for transparency. To the extent a file happens to contain personal data (for example a name in its metadata), we act only as your processor, on your instructions, under our Terms of Service; you remain the controller.
Either way, the file is processed transiently: it is held only in temporary memory and scratch storage for the moment it takes to return your result, then discarded. We do not store your design files, build a copy of your library, share them with anyone, or use them to train models or for any purpose other than returning the result you asked for. The same applies to anything derived during processing (for example extracted metadata, rendered previews, geometry and the like). This is the only way your library data leaves your machine, and it only happens when you use one of these features.
Prefer to keep everything in-house? The processing service can be self-hosted on your own infrastructure, so your design files never leave your network. If you’d like to run it yourself, get in touch for details.
5. How we use it, and our lawful basis
We use this data to run your account and sign-in, provide download and licensing access, perform the file processing you request, take payment, respond to enquiries, keep the service secure, and meet legal and tax obligations. Under UK GDPR our lawful bases are: performance of a contract (your account, licensing, subscription and the processing features you use), legitimate interests (securing the service, understanding aggregate usage, and product improvement), and legal obligation (accounting and tax). We do not sell personal data, and we do not use your design files for anything beyond returning the processing result you asked for. We never store them or use them to train anything.
6. Cookies and analytics
The site uses the minimal cookies it needs to function (such as keeping you signed in) and a privacy-friendly analytics and error-tracking tool, PostHog, to understand aggregate traffic and diagnose faults. Analytics are hosted in the EU and routed through our own domain, so your visit isn’t shared with third-party ad networks. We run no advertising trackers and do not track you across other sites. You can block cookies in your browser; the site will continue to work.
7. Sub-processors
We rely on a small number of vetted providers to run the website, account, licensing, billing and file processing. Each acts on our instructions under a data-processing agreement. The current list is:
| Provider | Purpose | Region |
|---|---|---|
| Cloudflare, Inc. | Website and API hosting, CDN, DNS, DDoS/bot protection, transactional email delivery, and the secure TLS edge that processing traffic enters through | USA / global |
| Supabase, Inc. | Account authentication and the database behind your account, licensing and billing records | EU |
| Paddle.com Market Ltd | Payment processing, billing, sales tax and our merchant of record | UK |
| PostHog, Inc. | Privacy-friendly product analytics and error tracking (EU cloud, routed through our own domain) | EU |
| Fly.io, Inc. | Platform hosting the processing service that transiently renders, converts and analyses the Altium files you submit (files are not stored) | EU (Amsterdam) and other fleet regions |
| OVH Hosting, Inc. | Same as previous | Canada |
8. International transfers
We are based in the UK and our customers are worldwide. The processing service runs on Fly.io (primarily in the EU) and on our own server at OVH in Canada, and our edge provider Cloudflare operates globally. Transfers to Canada rely on the UK and EU adequacy decisions for Canada; transfers to the USA or any other region are covered by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, together with appropriate safeguards. Wherever you are, the same protections in this policy apply to your data.
9. Data retention
We keep personal data only as long as needed for the purpose it was collected, or as the law requires. Design files you submit for processing are not retained. They exist only in temporary storage for the moment processing takes, then are discarded. Account and licensing records are kept while your account is active and deleted on request, subject to legal retention. Billing and tax records are retained for the period required by law (typically six years in the UK). Contact-form messages are kept while we handle your enquiry and for a reasonable follow-up period.
10. Your rights and contact
Depending on where you live, you may have rights to access, correct, export, delete or restrict your personal data, and to object to certain processing. To exercise any of these, email hello@getsideband.com. If you are in the UK or EEA and think we’ve handled your data wrongly, you can also complain to your data protection authority. In the UK, that is the Information Commissioner’s Office (ico.org.uk). We may update this policy from time to time; material changes will be reflected by the “last updated” date above.