1Scope
This Privacy Policy describes how we collect, use, and share personal data through app.departmentofproduct.com and related services. It applies to account holders, invited teammates, and visitors to the Service.
Legal
Privacy Policy
What personal data we hold, what we do with it, who processes it on our behalf, and the rights you have over it.
2Information we collect
- Account data — name, work email, and password (handled by our authentication provider; we never see your plaintext password).
- Workspace & company data — company name, website, description, products, business model, target customer, and team size, entered during onboarding or company-profile setup.
- Billing data — billing address and subscription details. Card numbers are collected and stored directly by Stripe; we never receive or store full card numbers.
- Usage data — pages viewed, searches and questions asked of the assistant, features used, and diagnostic/error data. On the marketing site this is collected first-party and without cookies: we record the page, the referring site and a coarse device and country, and de-duplicate visits with a daily-rotating hash that is never stored on your device and cannot identify you across days.
- Voice data — if you use the voice assistant, your spoken audio is processed by our voice platform (ElevenLabs) to produce a transcript and response; conversation recordings/transcripts may be retained briefly for quality and abuse prevention as described in Section 5.
3How we use it
We use personal data to: provide and operate the Service; authenticate accounts and enforce workspace membership; process billing through Stripe; personalise assistant and voice responses to your company’s context; monitor and fix errors; prevent abuse and enforce our Terms of Service; and communicate service, security, and billing notices. We do not sell personal data.
4AI processing
Questions you ask the research assistant, and the context needed to personalise the answer (such as your company profile), are sent to our AI provider (Anthropic) to generate a response. Voice sessions are additionally processed by our voice platform (ElevenLabs) to convert speech to text and back. These providers process this data under contract, on our instructions, and do not use it to train their own models outside the terms of that contract.
5Subprocessors
We use the following subprocessors to provide the Service:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Authentication, database, storage | Account, workspace, and usage data |
| Stripe | Payment processing & invoicing | Billing details, payment method |
| Anthropic | AI research assistant & content generation | Assistant queries, company context |
| Voyage AI | Semantic search embeddings | Search queries, company context |
| ElevenLabs | Voice assistant | Voice audio, transcripts |
| Resend | Transactional email (invites, receipts, notices) | Name, email address |
| Sentry | Error monitoring | Diagnostic/error data |
| Vercel | Hosting & infrastructure | All Service data, in transit and at rest |
6Cookies
We use only strictly necessary cookies — to keep you signed in and to protect the Service against fraud and abuse. We do not set analytics, advertising, or third-party tracking cookies.
7Sharing & disclosure
We share personal data with the subprocessors listed above, each bound by a data-processing agreement; with professional advisors where necessary; and where required by law, regulation, or valid legal process. If we’re involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this Policy.
8Retention
We retain account and workspace data for as long as the workspace is active, and for a limited period afterward to satisfy legal, accounting, and dispute obligations. Voice recordings and transcripts are retained by our voice platform for 30 days and then automatically deleted, unless retained longer to investigate abuse. We do not keep our own copy of voice audio or transcripts. You can request deletion at any time — see Section 10.
9Security
We use industry-standard technical and organisational measures — encryption in transit, access controls, and row-level data isolation between workspaces — to protect personal data. No system is completely secure; if we become aware of a breach affecting your data, we will notify you as required by law.
10Your rights
Depending on your location, you may have the right to access, export, correct, or delete your personal data, and to object to or restrict certain processing. You can export or delete your account data directly from Settings → Privacy in the app, or contact us at the address below.
11International transfers
Our subprocessors may store or process data outside the United Kingdom, including in the United States. Where personal data leaves the UK we rely on appropriate safeguards, namely the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with each provider’s data-processing agreement.
12Children’s privacy
The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from anyone under 16.
13Changes to this policy
We may update this Policy from time to time. For material changes, we’ll notify the workspace owner by email or in-product notice before they take effect.
14Contact
Questions or requests about this Policy or your data: support@departmentofproduct.com