Privacy Policy
Last updated: January 26, 2026
SigmaBlox, operated by Merge Combinator LLC ("SigmaBlox," "we," "our," or "us"), provides the technology combine platform for national security problem solvers at sigmablox.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services.
Summary: We collect information necessary to operate the defense tech combine, facilitate connections between participants and coaches, and improve our platform. We do not sell your personal data. You have rights to access, correct, and delete your information.
1. Information We Collect
Information You Provide Directly
When you interact with SigmaBlox, you may provide us with:
- Account Information: Name, email address, and authentication credentials when you create an account or sign in through VIA
- Company Information: Company name, description, mission areas, technology readiness level (TRL), funding stage, and team details
- Profile Information: Professional biography, expertise areas, contact preferences, and profile photos
- Application Information: Cohort applications including technical details, business information, and product capabilities
- Communications: Messages, feedback, story contributions, and inquiries you send through the platform
Information Collected Automatically
When you use our services, we automatically collect:
- Device Information: Browser type, operating system, device type, and screen resolution
- Usage Data: Pages visited, features used, time spent on pages, and navigation patterns
- Log Data: IP address, access times, referring URLs, and error logs
- Session Data: Authentication state and session identifiers
2. Cohort Application Data
When you apply to participate in a SigmaBlox cohort, we collect detailed information to evaluate your application and support your participation:
Application Categories
| Category | Data Types | Purpose |
|---|---|---|
| Contact Information | Name, email, phone, company role | Communication and verification |
| Company Profile | Name, description, website, founding date, team size | Company identification and directory |
| Technical Information | TRL level, mission areas (Fires, Plans, C2, Autonomy), capabilities | Program matching and cohort organization |
| Business Information | Funding stage, revenue status, customer references | Program eligibility and support planning |
| Product Information | Use cases, integrations, competitive positioning | Matchmaking with coaches and partners |
3. Participant Directory
SigmaBlox maintains a directory of companies, coaches, and cohort participants with tiered access controls:
Access Tiers
| Tier | Visible Information | Who Can Access |
|---|---|---|
| Public | Company name, logo, mission area, brief description | Anyone visiting sigmablox.com |
| Authenticated | Extended profiles, coach bios, expertise areas | Signed-in platform members |
| Participant | Contact details, detailed capabilities, engagement history | Active cohort participants and coaches |
| Admin | Full application data, internal notes, attendance records | SigmaBlox administrators only |
You control what information appears in your public profile through your company onboarding and profile settings.
4. Authentication and VIA
We use VIA (Verified Identity Access), our authentication system powered by Authentik, to secure access to protected features of SigmaBlox.
Data Processed During Authentication
| Data Type | Purpose | Retention |
|---|---|---|
| Email address | Account identification and SSO linking | Duration of account |
| Display name | Personalization and attribution | Duration of account |
| Group memberships | Access control (participant, coach, admin tiers) | Duration of membership |
| OAuth tokens | Session management | Session duration (typically 24 hours) |
| Login timestamps | Security auditing | 90 days |
Third-Party SSO Providers
When you authenticate using Google or other SSO providers through VIA, those providers share limited profile information with us according to their own privacy policies. We encourage you to review:
5. Video and Media Content
SigmaBlox collects and displays video content from cohort participants:
Types of Media
- Pitch Videos: Company pitch recordings submitted during cohort events
- Profile Photos: Team and individual photos for directory listings
- Company Logos: Brand assets for platform display
- Event Recordings: Recordings of combine events and sessions
Media Permissions
By submitting media content to SigmaBlox, you grant us a non-exclusive license to:
- Display content within the SigmaBlox platform
- Share with authorized platform members according to access tiers
- Use in promotional materials (with separate consent for external use)
- Archive for historical cohort records
You may request removal of your media content at any time by contacting privacy@mergecombinator.com.
6. User Activity Data
To improve your experience and facilitate connections, we track certain platform activities:
Favorites and Interests
- Saved Companies: Companies you bookmark for later review
- Saved Coaches: Coaches you're interested in connecting with
- Cohort Follows: Cohorts you're tracking
Notes and Annotations
- Private Notes: Personal notes you create about companies or coaches (visible only to you)
- Shared Notes: Notes you choose to share with your team or cohort
- Tags and Reminders: Organization tools you create for your workflow
Engagement Metrics
- Event attendance and participation
- Profile views and interactions
- Feature usage patterns
7. Cookies and Tracking Technologies
Types of Cookies We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential Cookies | Authentication, security, and site functionality | Session or up to 7 days |
| Preference Cookies | Remember your settings and display preferences | Up to 1 year |
| Analytics Cookies | Understand usage patterns and improve services | Up to 2 years |
Managing Cookies
Most web browsers allow you to control cookies through their settings. Note that blocking essential cookies may prevent you from accessing authenticated features of the platform.
Do Not Track
We honor Do Not Track (DNT) signals from your browser. When DNT is enabled, we limit data collection to essential functionality only.
8. Information Sharing and Disclosure
We do not sell your personal information.
We may share your information with:
- Platform Participants: Directory information visible according to access tiers (see Section 3)
- Merge Combinator: As our parent organization, for coordinated program operations and the Defense Builders network
- Service Providers: Third parties that help us operate our services under strict data protection agreements
- Legal Requirements: When required by law, court order, or government request
- Business Transfers: In connection with a merger, acquisition, or sale of assets
- Safety: To protect the rights, safety, and property of SigmaBlox, our users, or the public
Service Providers
Our key service providers include:
- Google Cloud: Infrastructure and hosting
- Cloudflare: Content delivery and security
- Airtable: Data management for cohort operations
- Ghost: Content management platform
9. Data Retention
We retain your information for as long as necessary to provide our services:
- Account Data: Retained while your account is active and for 3 years after deletion request
- Cohort Application Data: Retained for 5 years for program records and alumni network
- Company Profiles: Retained while company is active on platform
- Media Content: Retained until removal requested or 5 years after last cohort participation
- Usage Logs: Retained for 90 days
- Session Data: Deleted upon session end or within 24 hours
10. Data Security
We implement industry-standard security measures to protect your information:
- Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3
- Access Controls: Tiered access controls limit who can access personal data
- Infrastructure Security: Hosted on secure, compliant Google Cloud infrastructure
- Authentication Security: Multi-factor authentication available through VIA
- Regular Audits: We regularly review and update our security practices
While we take reasonable precautions, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.
11. Your Rights and Choices
You have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information (subject to legal retention requirements)
- Portability: Request your data in a machine-readable format
- Opt-Out: Unsubscribe from marketing communications at any time
- Profile Control: Manage your directory visibility through profile settings
- Media Removal: Request removal of video or media content you submitted
To exercise these rights, contact us at privacy@mergecombinator.com. We will respond to your request within 30 days.
12. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to Know: Request information about categories and specific pieces of personal information collected
- Right to Delete: Request deletion of your personal information, subject to certain exceptions
- Right to Opt-Out: Opt out of the "sale" of personal information. Note: We do not sell personal information as defined by the CCPA
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
Categories of Information Collected
In the past 12 months, we have collected:
- Identifiers (name, email, IP address)
- Professional information (company, role, expertise)
- Commercial information (funding stage, customers)
- Internet activity (browsing history, usage data)
- Audio/visual information (pitch videos, profile photos)
13. European Privacy Rights (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):
- Legal Basis: We process your data based on consent, contract performance, legitimate interests, or legal obligations
- Data Subject Rights: You have rights to access, rectification, erasure, restriction, portability, and objection
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time
- Right to Lodge a Complaint: You may file a complaint with your local data protection authority
Data Controller
Merge Combinator LLC is the data controller for your personal information. For GDPR inquiries, contact privacy@mergecombinator.com.
14. International Data Transfers
We are based in the United States and process data primarily in the US. If you access our services from outside the US, your information may be transferred to, stored, and processed in the US or other countries where our service providers operate.
For transfers from the EEA, UK, or Switzerland, we use appropriate safeguards including:
- Standard Contractual Clauses approved by the European Commission
- Data processing agreements with our service providers
15. Children's Privacy
SigmaBlox is a professional platform for defense technology companies and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@mergecombinator.com.
16. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will:
- Update the "Last updated" date at the top of this policy
- Notify registered users via email
- Display a notice on the platform
We encourage you to review this policy periodically for any changes.
17. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Email: privacy@mergecombinator.com
- Mail: Merge Combinator LLC, Privacy Inquiries, San Francisco, CA
For security-related concerns, please contact security@mergecombinator.com.
This Privacy Policy applies to sigmablox.com and its subdomains. For the Merge Combinator platform privacy policy, please visit mergecombinator.com/privacy.