Privacy policy

DRAFT — not legal advice — review by counsel required.

Last updated: [date]. Applies to demander.to, the Demander app and the Demander API.

1. Who we are

[Legal entity] ("Demander", "we") of [registered address], company number [company number], runs Demander. Privacy contact: [privacy contact e-mail].

We act in two roles:

Role	Whose data	Document
Controller	People who use the Demander app (account holders, invited team members), billing contacts, people who contact us, visitors to demander.to	This policy
Processor	The business contacts, website visitors and conversations that our customers manage in their Demander workspaces	Our customers' own privacy notices, and our Data Processing Agreement with them

If you received an e-mail or message from a Demander customer, that customer is the controller of your data. Their message links to their own privacy notice. See art14-notice.md for the notice our customers use.

2. Data we process as controller

2.1 Your account and team

Account. Name, e-mail address, password and interface language.
The password is stored only as a salted scrypt hash.
We also record when your e-mail address was verified, and a session version that lets you sign out of every session at once.
Organisation and workspaces. Names, your role (owner, admin, marketer, sales or viewer), and your memberships.
Invitations. The invitee's e-mail address, the role offered, who invited them, and when the invitation expires (7 days). We keep only a hash of the invitation link.
E-mail verification and password reset. One-time links that are stored as hashes. Verification links expire after 48 hours, reset links after 1 hour. Requests are rate-limited: one per minute and five per hour.
Audit log. Who changed what in a workspace and when, with the before and after values. This record is how changes can be reviewed and reverted.

2.2 E-mails we send you

We send these e-mails ourselves, through our platform e-mail provider (Brevo, France [confirm]):

Account e-mails: e-mail verification and password reset.
Team e-mails: invitations to join an organisation.
Security notices, for example after a password change.
Integration alerts. A connection needs to be reconnected, or a long-lived token expires within 7 days. Only owners and admins with a verified address receive these.
Billing notices. Trial ending, payment failed, or management suspended. A suspension notice lists the campaigns that keep running on your ad platforms.
Deletion confirmations. These list the campaigns still running and what to remove.

These e-mails contain your name, your address and the facts of the notice. They never contain text from third-party platforms.

2.3 API tokens and agents

You can create personal API tokens to use the API or to connect an AI agent, for example a Claude connector over MCP at /v1/mcp. For each token we store:

its name;
the first characters of the token, so you can recognise it;
a hash of the token (never the token itself);
its scopes (read, write, approve);
its expiry (90 days by default, at most 365);
when it was last used;
if it was revoked, why.

An agent acts with your permissions. Every change it proposes passes the same approvals, guardrails and audit log as a change made in the dashboard.

2.4 Connected platforms

When you connect an ad account, mailbox, CRM, social page or messaging channel, we store:

the access and refresh tokens, encrypted with AES-256-GCM;
their expiry times and the scopes granted;
the account you picked (for example, an ad account id and its currency);
for mailboxes, the mailbox address;
for some providers, the provider's id for your user account. We use it so that disconnecting one workspace never revokes a connection that another workspace still uses.

When you disconnect, we revoke the token at the provider where the provider allows it.

2.5 Billing

Payments are handled by Stripe, through Stripe Checkout and the Stripe Customer Portal. We receive and keep:

your Stripe customer and subscription ids;
your plan and billing interval;
the subscription status and invoices;
the billing e-mail address;
the company name, address and VAT number you enter at checkout.

Card details go to Stripe directly. We never see or store them.

2.6 Our website and service logs

Server logs. Our servers log requests (IP address, user agent, path, time) for security and troubleshooting. Secrets in URLs are masked. Logs are kept for [30] days.
Error reports. If the service fails, a scrubbed error report goes to our error-monitoring provider (Sentry, EU data region [confirm]). It carries no request bodies, cookies or query strings, and e-mail addresses, IP addresses and tokens are masked. Users appear by id only.
The app uses no analytics or advertising trackers.
demander.to measures visits with our own tracker, and only after you accept it in the banner. See 2.8.

2.7 Support

When you write to us, we keep your messages and contact details to answer you.

2.8 Visits to demander.to

The full details are in the cookie notice for demander.to.

Only with your consent. demander.to runs Demander's own tracker, and only after you click Accept in the banner. Until you choose, and after you decline, it does not load: your browser sends it nothing and nothing of it is stored on your device. demander.to sets no cookies and runs no analytics or advertising tools from other companies.
What it records. The pages you open, with time, referrer and campaign (UTM) parameters; the buttons you use (trial, snapshot, demo, pricing calculator), links to other sites, downloads, scroll depth, and when you start and send a form (never what you type); your browser's language, time zone and window width; ad click ids in the address you arrived at.
What it stores on your device. A random visitor id (dmdr_a, localStorage), a random visit id (dmdr_s, sessionStorage) and the landing page's campaign parameters (dmdr_l, sessionStorage), all only after you accept. Your choice itself is kept in dmdr_consent (localStorage) for 6 months.
Company identification. From your IP address our server looks up the company behind the network: IP ranges our own records tie to a company, the public registry record of the range (RDAP, through rdap.org and the regional internet registries), reverse DNS and, if we connect one, [Optional providers: IPinfo, Dealfront or Snitcher]. The result is a company, never a person. We keep the company and a hash of the IP address made with a secret that changes every day, not the full address.
Browser signals. With Global Privacy Control there is no company identification and no ad click ids; with Do Not Track there are no ad click ids.
Ad platforms. When a visit that came from an ad reaches a step we count as a conversion, we may report it to that ad platform with the click id.
Changing your mind. Click Cookie settings at the bottom of any page and choose Decline. The tracker stops, the identifiers above are deleted from your browser, and it does not load again.

3. Google user data

This section applies to data received from Google APIs.

What we access.

Google Ads (scope adwords) and the Data Manager API (scope datamanager). We use them to:
list the Google Ads accounts you can access and their currency;
create and manage the campaigns you approve;
read performance reports;
upload your own first-party customer lists (Customer Match) and offline conversions.
Gmail (scope gmail.send). We send the outreach e-mails you approve from the mailbox you connected. We read the mailbox address from the sign-in token (email). We do not read, list, modify or delete your e-mail.

How we use it.

Only to provide these features in the Demander interface.
We do not use Google user data for advertising.
We do not sell it, or transfer it to anyone except as needed to provide the feature, for security, or to comply with law.
No person reads it unless you ask us to (support), or it is needed for security or to comply with law.

What we store. OAuth tokens (encrypted), the mailbox address, the Google Ads account ids and currency, and the reports we read.

Limited Use. Demander's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. Disconnect in Settings → Integrations, or at https://myaccount.google.com/permissions.

4. Data from other platforms

Here is what we access when you connect each platform, and what for.

Meta (Facebook, Instagram, Messenger):
ad accounts, campaigns and insights;
the Pages and Instagram accounts you pick;
posts you approve;
Messenger conversations that people start with your Page.
LinkedIn:
ad accounts, campaigns and analytics;
company and contact lists you upload;
conversions;
your Company Page's posts.
Microsoft:
Microsoft Advertising accounts and campaigns;
sending e-mail from Microsoft 365 mailboxes you connect (Mail.Send only; we do not read mail).
TikTok, Reddit and X:
ad accounts, campaigns, audiences and reports;
on X, also posts and direct messages in conversations people start.
HubSpot, Pipedrive and Salesforce: the companies, contacts and deals you choose to sync.

We use this data only to provide the features you use, under each platform's terms.

Purpose	Basis
Providing the service, your account, team invitations, API tokens, connected platforms	Contract (Art. 6(1)(b))
Account, security, integration and billing e-mails	Contract; legitimate interest in keeping the service secure and working (Art. 6(1)(f))
Billing, invoices, tax	Contract; legal obligation (Art. 6(1)(c))
Audit log, server logs, abuse prevention	Legitimate interest (security, accountability)
Measuring visits to demander.to, company identification from the IP address, ad click ids (2.8)	Consent (Art. 6(1)(a)); storage on your device under the ePrivacy rules, also with consent
Remembering your consent choice on demander.to	Legitimate interest in showing that we asked (Art. 6(1)(f), Art. 7(1)); strictly necessary storage
Support	Contract or legitimate interest

6. Who receives data

Our sub-processors are listed in Annex 3 of our DPA, with what each receives and where. In short:

Hetzner Online GmbH [confirm]: hosting, database and backups, EU (Germany, Finland).
Brevo (Sendinblue SAS) [confirm]: account e-mails, EU (France).
If configured: backup storage, error reporting and an alert channel.
rdap.org and the regional internet registries: the IP address of a demander.to visitor who accepted tracking, to look up the company (2.8).
[Optional providers: IPinfo, Dealfront or Snitcher], if we connect one: the same IP address, for the same lookup (2.8).
Stripe: billing.
Anthropic: AI drafting from product and company information; no individual contact data by design.

Platforms you connect receive what you instruct us to send them.

We disclose data to authorities only where the law requires it.

7. International transfers

Some providers, for example Anthropic and Stripe Inc., process data outside the EEA. Transfers rely on:

the EU–US Data Privacy Framework where the provider is certified; or
the European Commission's Standard Contractual Clauses.

[Counsel: confirm each provider's mechanism.]

8. How long we keep data

Data	Retention
Account, memberships, workspace content	Until the deletion of the workspace, organisation or account runs: right away, or at the end of the paid period if you choose that (see §9).
Invitation links	Expire after 7 days
Verification / reset links	Expire after 48 hours / 1 hour
API tokens	Until they expire (90 days by default, at most 365) or you revoke them. The token record is deleted with your account.
OAuth connect states (the short-lived record of a connection in progress)	10 minutes; purged a day after expiry
Platform webhook queue (Meta)	7 days after processing
Deletion record	Kept after deletion: the ids of what was deleted and counts, with no names or e-mail addresses
AI usage cost records	Kept after deletion: cost, model, token counts, no content
Billing records and invoices	[statutory period, e.g. 10 years for accounting records — counsel]
Server logs	[30] days
demander.to visit records (2.8)	[Retention period, for example 13 months]
Your consent choice on demander.to (in your browser)	6 months, then the banner asks again
Database backups	Pruned after 14 days (default `BACKUP_RETENTION_DAYS`); deleted data disappears from backups within that period

9. Deleting your data

This section also serves as the data deletion instructions Meta requires.

You can delete any of these in the app:

a workspace, the organisation or your account (Settings → Security → Danger zone).

Deletion runs now or at the end of the period already paid for (you can call it off until then). It needs your password and a typed confirmation, and cannot be undone once it runs.

What deletion does:

It deletes the workspace data: contacts, visitors, messages, conversations, audiences metadata and integration credentials.
It revokes our access to connected platforms where the provider allows it. Deleting an organisation also ends the Stripe subscription: immediately when you delete now, at the end of the paid period otherwise.
It does not delete campaigns, ads or audiences in your own ad accounts. They stay in your accounts and keep running. From then on you are responsible for them, including honouring opt-outs on audiences we uploaded.
We e-mail the owners a list of campaigns still running and what to remove:
the tracking snippet on your website;
the reply-subdomain MX record;
the app's access in each platform's settings.
Replies sent to old reply addresses bounce once the workspace is gone.

Other ways to ask. Write to [privacy contact e-mail]. For a Facebook Login connection, you can also remove Demander under Facebook Settings → Apps and Websites. We then delete the tokens we hold.

10. Your rights

You can ask for:

access to your data;
rectification;
erasure;
restriction;
portability.

You can object to processing based on legitimate interest, and withdraw consent where we rely on it (for demander.to, under Cookie settings at the bottom of any page). Write to [privacy contact e-mail]. You can also complain to your data protection authority; ours is [lead supervisory authority].

If your data is in a customer's workspace (you were contacted, or visited a customer's website), contact that customer. We will help them answer.

11. Security

Encryption: TLS in transit; integration secrets encrypted with AES-256-GCM.
Credentials: passwords hashed with scrypt; API tokens and one-time links stored as hashes.
Access: role-based access; owner/admin roles and a verified e-mail address are needed to connect platforms.
Accountability: an audit log of changes.
Location: hosting in the EU.

12. Changes

We will announce material changes by e-mail to account owners, and in the app, at least [30] days before they apply.