Government and Law Enforcement Data Requests

This policy explains how Siloet, inc. ("Siloët") responds when a court, law enforcement agency, regulator, or other public authority asks us to disclose information about a person who uses Siloët. It applies to every such request, wherever it comes from.

We publish it for two reasons. It tells authorities where to serve legal process and what records actually exist, which avoids requests for data we do not hold. And it tells the creators who use Siloët what we will do on their behalf.

Nothing here waives any right or objection available to Siloët or to the person whose information is sought, and nothing here is a commitment to disclose.

Legal process must name Siloet, inc. Authorities should contact privacy@siloet.ai to confirm the current address for service before serving, so that process is directed correctly and without delay.

A courtesy copy may be sent to privacy@siloet.ai. Email alone is not service unless we have agreed to accept it in writing for a particular matter, and sending email does not start any response period.

We do not accept service through support channels, social media, or messages to individual members of staff.

Requests that identify an account precisely are answered faster and more narrowly. Please include:

• The email address of the Siloët account, which is the only identifier we can reliably search on.
• The specific categories of records sought. A request for "all data" will be met with an objection asking you to narrow it.
• A bounded time period.
• The issuing authority, the matter or case reference, and a named contact with a direct line.
• Whether a non-disclosure order accompanies the request, and its expiry date.

Most requests directed at a content platform assume the platform stores the content. Siloët does not. Read this section before drafting a request.

What we hold:

• Account records: the email address used to sign up, the account creation time, and an internal account identifier.
• Connection records for a linked TikTok or Instagram account: the identifier that platform assigns, the permissions granted, and the times the connection was made and expires.
• Credentials for those connections, which we will not disclose. See section 8.

What we do not hold:

• Posts, captions, images, video, or any other content from a connected account. Siloët reads that content live from TikTok or Instagram at the moment a creator looks at it, and does not retain it.
• The drafts a creator selects, which remain on their own device.
• Private messages, comments, or follower lists. Siloët does not request the permissions that would allow it to read them.
• Payment details or government identifiers.

Where an authority seeks the content of a creator's posts, the holder of that content is TikTok or Meta, and process should be directed to them.

Siloet, inc. is a United States entity. We require valid legal process appropriate to the data requested and to the law that applies to the request.

What counts as appropriate varies with the category of data, the issuing authority, and the jurisdiction, so we assess each request against the law governing it rather than against a fixed table. In general, the more sensitive the category, the more exacting the process we expect, and requests for the content of communications attract the highest standard available under applicable law.

A request that seeks more than its legal basis supports will be answered to the extent that basis allows, and objected to for the remainder.

Siloet, inc. is a United States entity, and a request from an authority outside the United States will generally need to come through a recognised channel of international legal assistance, such as a mutual legal assistance treaty or letters rogatory. We ask requesting authorities to proceed that way.

Where a request engages the data protection law of another jurisdiction, including restrictions in European law on transfers compelled by a third-country authority, we take legal advice before responding. We assess each such request on its own terms rather than applying a standing rule.

Where we believe in good faith that an emergency involving danger of death or serious physical injury requires disclosure without delay, and applicable law permits it, we may in our discretion disclose the information that bears on that emergency.

Law of this kind permits such disclosure; it does not require it, and we treat it as a narrow exception rather than a channel. Emergency requests should be in writing, on official letterhead, and should describe the nature of the emergency. We record the basis for any emergency disclosure at the time it is made.

Every request is reviewed before any response is given. No member of staff may disclose information in response to a request on their own authority.

The review asks, in order, whether the request:

• comes from an authority with jurisdiction over Siloet, inc., and is validly issued, signed, dated, and served;
• is supported by an instrument sufficient for the category of data sought, under section 5;
• is specific as to accounts, categories, and time period rather than overbroad; and
• conflicts with any other legal obligation that binds us.

Requests that are not routine, and every emergency request, are reviewed with outside legal counsel. The review and its reasoning are recorded whatever the outcome, including where we conclude the request is valid and comply with it in full.

We treat the access and refresh credentials held for a connected TikTok or Instagram account as outside the ordinary scope of a request for account records. Those are live credentials to an account held by another company rather than records about it, and disclosing one would grant continuing access well beyond what a request directed at Siloët is usually seeking. Our strong presumption is against disclosing them, and no request for them is answered without legal advice.

Where the review in section 8 concludes that a request is unlawful, procedurally defective, or broader than its legal basis supports, we object.

In practice we first ask the requesting authority to narrow the request, which resolves most overbreadth without litigation. Where an authority declines to narrow a request we consider unlawful, we instruct counsel on a motion to quash or to modify. We preserve the data in question while any challenge is pending.

The cost or inconvenience of a challenge is not a reason to skip the assessment of whether one is warranted.

Where we are permitted to do so and it is practicable, our policy is to notify a person before disclosing information about them, with enough time for them to seek to challenge the request. We will not give notice where:

• a court order or applicable law prohibits or restricts notice;
• notice would create a risk of death, serious physical injury, or the destruction of evidence in an emergency under section 7; or
• the account is being used to harm a child.

Where notice is delayed by an order, we record the date that order expires and give notice once it lapses.

We respond with the narrowest set of records that answers the request: the specific fields named, for the specific accounts named, for the specific period named. We do not volunteer adjacent data because it is convenient to export, and we do not disclose information about people other than the subject of the request where it is possible to avoid it.

This follows from how Siloët is built as well as how we respond. Our Data Minimization Policy explains what we collect and the categories we have chosen not to hold at all.

We honour valid preservation requests, preserving records that exist at the time of the request for the period applicable law provides, and for any extension properly sought.

A preservation request does not require disclosure, and does not cause us to begin collecting information we would not otherwise hold.

We maintain an internal register of requests from public authorities. Each entry records the date and requesting authority, the legal instrument, the data sought, the legality review and its reasoning, who was involved in the decision, what was disclosed and what was withheld, whether notice was given, and the outcome of any challenge.

The register is reviewed quarterly. It is maintained whether or not any request has been received.

We may seek reimbursement of reasonable costs incurred in responding, where the law permits. We do not treat cost as a reason to delay a response to a valid request.

Questions about this policy, from authorities or from the people who use Siloët, can be sent to privacy@siloet.ai. That address is for questions about the policy. Service of legal process follows section 2.