Privacy policy

Who we are

Demain is run by getdemain, a company being set up in France. It is not registered yet, so it has no company number (SIREN) yet. Until it is registered, the person responsible for your data (the data controller) is its founder, Maxence Maisonnat.

For any question or request about your data, email privacy@getdemain.com.

What we collect

• Your account. When you sign in with Google, Google shares your name, email address and profile picture. We keep them, along with the sign-in tokens Google gives us, which we store encrypted. We also keep your chat settings.
• Your sign-ins. For each sign-in we store your IP address and your browser details.
• Your workspace. Workspace names, who belongs to them, the email addresses you invite, dashboards you build, tables you type in, web pages you ask us to follow, your plan and how much of the assistant you have used.
• Access to your tools. When you connect a tool, we store the access it gives us (such as tokens, keys, or a cookie you paste). It is encrypted at rest with AES-256.
• Data from your tools. We read data from the tools you connect when you open a dashboard or ask the assistant. We keep short-lived encrypted copies of these results so dashboards load quickly. They expire on their own.
• Your chats. Your messages, the assistant’s replies, and the data the assistant read from your tools to answer you, such as an email or a calendar event.
• Photos and files. Photos and files you add to a chat, stored privately.
• Invite requests. If you ask for an invite, we keep your email address and when you asked. To stop abuse, we count attempts from each IP address for 10 minutes, using a scrambled (hashed) form of the address.
• Apps you connect to us. If you let another AI app use your workspace, we keep that app’s registration and the access you granted it.
• Usage statistics. Vercel Web Analytics and Speed Insights record which pages are visited and how fast they load. They use no cookies.

Why we use it

• To give you the service you signed up for: your account, workspaces, connected tools, dashboards, the assistant and billing. The legal basis is our contract with you (our terms).
• To keep Demain secure and stop abuse, using sign-in details, IP addresses and attempt counters. The legal basis is our legitimate interest in protecting you and the service.
• To see which pages are used and how fast they are, without cookies. The legal basis is our legitimate interest in improving the product.
• To keep billing records the law asks us to keep. The legal basis is our legal obligations.

We do not sell your data, and we do not use it for advertising.

Google user data

Demain’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in with Google only shares your name, email address and profile picture. We read more only when you connect a Google tool as a source, and only what that tool needs:

• Gmail, read only. We search and read your messages to show them on your dashboards and answer your questions. We cannot send, change or delete email.
• Google Calendar. We read your calendars and events. We can also answer an invitation (yes, no or maybe) when you ask us to. We do not change events in any other way.
• Google Sheets. We read the spreadsheets you choose. We change a spreadsheet only when you ask, either in Demain's chat after you approve the change, or through an AI assistant you connected to Demain. We have read-only access to Google Drive to list and open your spreadsheets.
• Google Docs, read only. We read the documents you choose, and we have read-only access to Google Drive to list and open them.
• Google Meet, read only. We read your meeting records, participants, recordings and transcripts.

When you ask the assistant a question, the Google data it needs to answer is sent to an AI model provider to produce the answer. The next section explains how.

We do not use your Google data for advertising, we do not sell it, and we do not use it to build or train AI models of our own. We do not read it ourselves unless you ask us to help with a problem, it is needed for security, or the law requires it.

The assistant and AI providers

The assistant runs on AI models from outside companies, reached through Vercel AI Gateway. When you chat, we send the provider your message, the earlier messages in that chat, your name and email, and the data the assistant reads from your tools to answer you. We also use an AI model for small checks, such as telling whether a failed connection needs you to sign in again. When the assistant searches the web, the search it writes is sent to Perplexity.

Vercel says AI Gateway itself does not keep your prompts or replies and does not use them for training. The model that answers can be served by one of several companies. Their rules on keeping data and on training differ, and some of them are outside the EU, including in the United States and China.

Who processes your data

We use these providers to run Demain. Each one gets only what it needs for its part.

Transfers outside the EU

Our servers and database are in Frankfurt, Germany. Some providers above are in the United Kingdom, the United States or elsewhere, or are companies based there. The United Kingdom is recognised by the EU as protecting data adequately. For the other countries, we rely on the safeguards our providers offer, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it and how to delete it

• Your account stays until you ask us to delete it. There is no delete button yet: email privacy@getdemain.com and we will delete your account and your personal data within one month.
• Connected tools. Disconnecting a tool deletes the access we stored for it.
• Google access. Disconnecting a Google tool in Demain does not cancel the permission you gave on Google’s side. To cancel it, go to your Google account permissions and remove Demain.
• Chats can be deleted at any time. Deleting a chat also deletes the photos you added to it.
• Dashboards and tables can be deleted at any time.
• Cached copies of data from your tools expire on their own after a short time.
• Invite requests stay until we delete them. Ask us and we will.
• Workspaces. You can leave a workspace from its settings. To delete a workspace you own, email us.
• Billing records are kept by Stripe and by us for as long as the law requires.

Cookies

We only use cookies that Demain needs to work. There are no advertising or tracking cookies, which is why we do not show a cookie banner today.

• __Secure-better-auth.session_token. Keeps you signed in. It lasts up to 7 days and is renewed while you use the app.
• __Secure-better-auth.session_data. A short copy of your session so pages load faster. 5 minutes.
• __Secure-better-auth.state. Protects the Google sign-in step from forgery. 5 minutes.
• active_workspace_id. Remembers which workspace you have open, if you belong to more than one. 400 days.
• __vdpl. Set by Vercel, our host, so your browser keeps using the same version of the site during an update. Deleted when you close the browser.

Your browser also stores your light or dark theme choice and your panel sizes in its local storage. They never leave your device.

If we ever add non-essential cookies, we will ask for consent first through the in-app consent banner and update this page before the change ships.

Your rights

Under the GDPR you can ask to see the data we hold about you, correct it, delete it, get a copy to take elsewhere, limit how we use it, or object to how we use it. Email privacy@getdemain.com and we will answer within one month.

If you think we are not handling your data properly, you can complain to the French data protection authority, the CNIL.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters for how we use your data, we will tell you in the app or by email before it applies.