# Privacy policy

**DRAFT — not legal advice — review by counsel required.**

Last updated: [date]. Applies to demander.to, the Demander app and the Demander API.

## 1. Who we are

[Legal entity] ("Demander", "we") of [registered address], company number [company number], runs Demander. Privacy contact: [privacy contact e-mail].

We act in two roles:

| Role | Whose data | Document |
|---|---|---|
| **Controller** | People who use the Demander app (account holders, invited team members), billing contacts, people who contact us, visitors to demander.to | This policy |
| **Processor** | The business contacts, website visitors and conversations that our customers manage in their Demander workspaces | Our customers' own privacy notices, and our [Data Processing Agreement](dpa.md) with them |

If you received an e-mail or message from a Demander customer, that customer is the controller of your data. Their message links to their own privacy notice. See [art14-notice.md](art14-notice.md) for the notice our customers use.

## 2. Data we process as controller

### 2.1 Your account and team

- **Account.** Name, e-mail address, password and interface language.
  - The password is stored only as a salted scrypt hash.
  - We also record when your e-mail address was verified, and a session version that lets you sign out of every session at once.
- **Organisation and workspaces.** Names, your role (owner, admin, marketer, sales or viewer), and your memberships.
- **Invitations.** The invitee's e-mail address, the role offered, who invited them, and when the invitation expires (7 days). We keep only a hash of the invitation link.
- **E-mail verification and password reset.** One-time links that are stored as hashes. Verification links expire after 48 hours, reset links after 1 hour. Requests are rate-limited: one per minute and five per hour.
- **Audit log.** Who changed what in a workspace and when, with the before and after values. This record is how changes can be reviewed and reverted.

### 2.2 E-mails we send you

We send these e-mails ourselves, through our platform e-mail provider (Brevo, France [confirm]):

- **Account e-mails:** e-mail verification and password reset.
- **Team e-mails:** invitations to join an organisation.
- **Security notices**, for example after a password change.
- **Integration alerts.** A connection needs to be reconnected, or a long-lived token expires within 7 days. Only owners and admins with a verified address receive these.
- **Billing notices.** Trial ending, payment failed, or management suspended. A suspension notice lists the campaigns that keep running on your ad platforms.
- **Deletion confirmations.** These list the campaigns still running and what to remove.

These e-mails contain your name, your address and the facts of the notice. They never contain text from third-party platforms.

### 2.3 API tokens and agents

You can create personal API tokens to use the API or to connect an AI agent, for example a Claude connector over MCP at `/v1/mcp`. For each token we store:

- its name;
- the first characters of the token, so you can recognise it;
- a hash of the token (never the token itself);
- its scopes (read, write, approve);
- its expiry (90 days by default, at most 365);
- when it was last used;
- if it was revoked, why.

An agent acts with your permissions. Every change it proposes passes the same approvals, guardrails and audit log as a change made in the dashboard.

### 2.4 Connected platforms

When you connect an ad account, mailbox, CRM, social page or messaging channel, we store:

- the access and refresh tokens, encrypted with AES-256-GCM;
- their expiry times and the scopes granted;
- the account you picked (for example, an ad account id and its currency);
- for mailboxes, the mailbox address;
- for some providers, the provider's id for your user account. We use it so that disconnecting one workspace never revokes a connection that another workspace still uses.

When you disconnect, we revoke the token at the provider where the provider allows it.

### 2.5 Billing

Payments are handled by Stripe, through Stripe Checkout and the Stripe Customer Portal. We receive and keep:

- your Stripe customer and subscription ids;
- your plan and billing interval;
- the subscription status and invoices;
- the billing e-mail address;
- the company name, address and VAT number you enter at checkout.

Card details go to Stripe directly. We never see or store them.

### 2.6 Our website and service logs

- **Server logs.** Our servers log requests (IP address, user agent, path, time) for security and troubleshooting. Secrets in URLs are masked. Logs are kept for [30] days.
- **Error reports.** If the service fails, a scrubbed error report goes to our error-monitoring provider (Sentry, EU data region [confirm]). It carries no request bodies, cookies or query strings, and e-mail addresses, IP addresses and tokens are masked. Users appear by id only.
- **The app** uses no analytics or advertising trackers.
- **demander.to** measures visits with our own tracker, and only after you accept it in the banner. See 2.8.

### 2.7 Support

When you write to us, we keep your messages and contact details to answer you.

### 2.8 Visits to demander.to

The full details are in the [cookie notice for demander.to](site-cookie-notice.md).

- **Only with your consent.** demander.to runs Demander's own tracker, and only after you click Accept in the banner. Until you choose, and after you decline, it does not load: your browser sends it nothing and nothing of it is stored on your device. demander.to sets no cookies and runs no analytics or advertising tools from other companies.
- **What it records.** The pages you open, with time, referrer and campaign (UTM) parameters; the buttons you use (trial, snapshot, demo, pricing calculator), links to other sites, downloads, scroll depth, and when you start and send a form (never what you type); your browser's language, time zone and window width; ad click ids in the address you arrived at.
- **What it stores on your device.** A random visitor id (`dmdr_a`, localStorage), a random visit id (`dmdr_s`, sessionStorage) and the landing page's campaign parameters (`dmdr_l`, sessionStorage), all only after you accept. Your choice itself is kept in `dmdr_consent` (localStorage) for 6 months.
- **Company identification.** From your IP address our server looks up the company behind the network: IP ranges our own records tie to a company, the public registry record of the range (RDAP, through rdap.org and the regional internet registries), reverse DNS and, if we connect one, [Optional providers: IPinfo, Dealfront or Snitcher]. The result is a company, never a person. We keep the company and a hash of the IP address made with a secret that changes every day, not the full address.
- **Browser signals.** With Global Privacy Control there is no company identification and no ad click ids; with Do Not Track there are no ad click ids.
- **Ad platforms.** When a visit that came from an ad reaches a step we count as a conversion, we may report it to that ad platform with the click id.
- **Changing your mind.** Click **Cookie settings** at the bottom of any page and choose Decline. The tracker stops, the identifiers above are deleted from your browser, and it does not load again.

## 3. Google user data

This section applies to data received from Google APIs.

**What we access.**

- **Google Ads** (scope `adwords`) and the **Data Manager API** (scope `datamanager`). We use them to:
  - list the Google Ads accounts you can access and their currency;
  - create and manage the campaigns you approve;
  - read performance reports;
  - upload your own first-party customer lists (Customer Match) and offline conversions.
- **Gmail** (scope `gmail.send`). We send the outreach e-mails you approve from the mailbox you connected. We read the mailbox address from the sign-in token (`email`). We do **not** read, list, modify or delete your e-mail.

**How we use it.**

- Only to provide these features in the Demander interface.
- We do not use Google user data for advertising.
- We do not sell it, or transfer it to anyone except as needed to provide the feature, for security, or to comply with law.
- No person reads it unless you ask us to (support), or it is needed for security or to comply with law.

**What we store.** OAuth tokens (encrypted), the mailbox address, the Google Ads account ids and currency, and the reports we read.

**Limited Use.** Demander's use and transfer of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

**Revoking access.** Disconnect in Settings → Integrations, or at <https://myaccount.google.com/permissions>.

## 4. Data from other platforms

Here is what we access when you connect each platform, and what for.

- **Meta** (Facebook, Instagram, Messenger):
  - ad accounts, campaigns and insights;
  - the Pages and Instagram accounts you pick;
  - posts you approve;
  - Messenger conversations that people start with your Page.
- **LinkedIn:**
  - ad accounts, campaigns and analytics;
  - company and contact lists you upload;
  - conversions;
  - your Company Page's posts.
- **Microsoft:**
  - Microsoft Advertising accounts and campaigns;
  - sending e-mail from Microsoft 365 mailboxes you connect (`Mail.Send` only; we do not read mail).
- **TikTok, Reddit and X:**
  - ad accounts, campaigns, audiences and reports;
  - on X, also posts and direct messages in conversations people start.
- **HubSpot, Pipedrive and Salesforce:** the companies, contacts and deals you choose to sync.

We use this data only to provide the features you use, under each platform's terms.

## 5. Legal bases (GDPR Art. 6)

| Purpose | Basis |
|---|---|
| Providing the service, your account, team invitations, API tokens, connected platforms | Contract (Art. 6(1)(b)) |
| Account, security, integration and billing e-mails | Contract; legitimate interest in keeping the service secure and working (Art. 6(1)(f)) |
| Billing, invoices, tax | Contract; legal obligation (Art. 6(1)(c)) |
| Audit log, server logs, abuse prevention | Legitimate interest (security, accountability) |
| Measuring visits to demander.to, company identification from the IP address, ad click ids (2.8) | Consent (Art. 6(1)(a)); storage on your device under the ePrivacy rules, also with consent |
| Remembering your consent choice on demander.to | Legitimate interest in showing that we asked (Art. 6(1)(f), Art. 7(1)); strictly necessary storage |
| Support | Contract or legitimate interest |

## 6. Who receives data

Our sub-processors are listed in Annex 3 of our [DPA](dpa.md), with what each receives and where. In short:

- **Hetzner Online GmbH** [confirm]: hosting, database and backups, EU (Germany, Finland).
- **Brevo (Sendinblue SAS)** [confirm]: account e-mails, EU (France).
- If configured: backup storage, error reporting and an alert channel.
- **rdap.org and the regional internet registries**: the IP address of a demander.to visitor who accepted tracking, to look up the company (2.8).
- [Optional providers: IPinfo, Dealfront or Snitcher], if we connect one: the same IP address, for the same lookup (2.8).
- **Stripe**: billing.
- **Anthropic**: AI drafting from product and company information; no individual contact data by design.

Platforms you connect receive what you instruct us to send them.

We disclose data to authorities only where the law requires it.

## 7. International transfers

Some providers, for example Anthropic and Stripe Inc., process data outside the EEA. Transfers rely on:

- the EU–US Data Privacy Framework where the provider is certified; or
- the European Commission's Standard Contractual Clauses.

[Counsel: confirm each provider's mechanism.]

## 8. How long we keep data

| Data | Retention |
|---|---|
| Account, memberships, workspace content | Until the deletion of the workspace, organisation or account runs: right away, or at the end of the paid period if you choose that (see §9). |
| Invitation links | Expire after 7 days |
| Verification / reset links | Expire after 48 hours / 1 hour |
| API tokens | Until they expire (90 days by default, at most 365) or you revoke them. The token record is deleted with your account. |
| OAuth connect states (the short-lived record of a connection in progress) | 10 minutes; purged a day after expiry |
| Platform webhook queue (Meta) | 7 days after processing |
| Deletion record | Kept after deletion: the ids of what was deleted and counts, with no names or e-mail addresses |
| AI usage cost records | Kept after deletion: cost, model, token counts, no content |
| Billing records and invoices | [statutory period, e.g. 10 years for accounting records — counsel] |
| Server logs | [30] days |
| demander.to visit records (2.8) | [Retention period, for example 13 months] |
| Your consent choice on demander.to (in your browser) | 6 months, then the banner asks again |
| Database backups | Pruned after 14 days (default `BACKUP_RETENTION_DAYS`); deleted data disappears from backups within that period |

## 9. Deleting your data

This section also serves as the data deletion instructions Meta requires.

**You can delete any of these in the app:**

- a workspace, the organisation or your account (Settings → Security → Danger zone).

Deletion runs **now** or **at the end of the period already paid for** (you can call it off until then). It needs your password and a typed confirmation, and cannot be undone once it runs.

**What deletion does:**

- It deletes the workspace data: contacts, visitors, messages, conversations, audiences metadata and integration credentials.
- It **revokes our access** to connected platforms where the provider allows it. Deleting an organisation also **ends the Stripe subscription**: immediately when you delete now, at the end of the paid period otherwise.
- It **does not delete campaigns, ads or audiences in your own ad accounts.** They stay in your accounts and **keep running**. From then on you are responsible for them, including honouring opt-outs on audiences we uploaded.
- We e-mail the owners a list of campaigns still running and what to remove:
  - the tracking snippet on your website;
  - the reply-subdomain MX record;
  - the app's access in each platform's settings.
- Replies sent to old reply addresses bounce once the workspace is gone.

**Other ways to ask.** Write to [privacy contact e-mail]. For a Facebook Login connection, you can also remove Demander under Facebook Settings → Apps and Websites. We then delete the tokens we hold.

## 10. Your rights

You can ask for:

- access to your data;
- rectification;
- erasure;
- restriction;
- portability.

You can object to processing based on legitimate interest, and withdraw consent where we rely on it (for demander.to, under **Cookie settings** at the bottom of any page). Write to [privacy contact e-mail]. You can also complain to your data protection authority; ours is [lead supervisory authority].

If your data is in a customer's workspace (you were contacted, or visited a customer's website), contact that customer. We will help them answer.

## 11. Security

- **Encryption:** TLS in transit; integration secrets encrypted with AES-256-GCM.
- **Credentials:** passwords hashed with scrypt; API tokens and one-time links stored as hashes.
- **Access:** role-based access; owner/admin roles and a verified e-mail address are needed to connect platforms.
- **Accountability:** an audit log of changes.
- **Location:** hosting in the EU.

## 12. Changes

We will announce material changes by e-mail to account owners, and in the app, at least [30] days before they apply.

---
Source: https://demander.to/legal/privacy/