Privacy policy.

01Who we are

Delegent Ltd is the controller of personal data described in this Privacy Policy.

• Company registered in: England and Wales
• Company number: 17205523
• Registered office: 20 Poynders Road, London, SW4 8NZ
• Contact: privacy@delegent.team

For questions about this Privacy Policy or to exercise your rights, contact us at the address above.

We have not appointed a Data Protection Officer (DPO) as we are not legally required to do so. The primary contact for privacy matters is the founder, reachable at privacy@delegent.team.

02Scope of this Privacy Policy

This Privacy Policy covers personal data we process as a controller in connection with:

1. the Site, including marketing pages, demo booking, and trial signup;
2. the Trial of our product, including the features and integrations enabled for your account;
3. communications with you (email, sales conversations, support); and
4. our business administration, security, and legal compliance.

When you use our product under a paid subscription, we typically act as a processor of customer personal data on behalf of your organisation. That processing is governed separately by our Data Processing Agreement (DPA) annexed to our Master Services Agreement (MSA), not by this Privacy Policy.

03Personal data we collect

We collect and process the following categories of personal data.

3.1 Information you provide directly

• Demo booking (via Calendly): name, email address, company name, team size, current tool stack, meeting time, and any other information you choose to include.
• Trial registration: name, email address, company name, role, and authentication identifier from your Google or Microsoft account (we do not store passwords), and any other registration details.
• Trial usage: any content, notes, files, or data you upload to the Trial.
• Integration use: the third-party services you authorise, your consent and connection status, request metadata, and the Delegent content exchanged through the integration.
• Google account data you connect: if you connect Gmail, Google Calendar, or Google Meet, the email, calendar, and meeting data described in section 14.
• Communications: the content of emails, support requests, or other messages you send us.

3.2 Information collected automatically

When you visit the Site or use the Trial, we automatically collect:

• Technical data: IP address, browser type and version, operating system, device type, time zone, and referring URL.
• Usage data: pages viewed, time spent, links clicked, and product feature usage during the Trial.
• Log data: server logs recording access, errors, and security events.

3.3 Information from third parties

• Calendly: when you book a demo, Calendly shares the booking details with us.
• Public sources: we may look up publicly available information about you or your organisation (e.g. LinkedIn profile, company website) in connection with sales and account management.

3.4 Cookies and similar technologies

We use only strictly necessary cookies required for the operation of the Site and Trial (e.g. session cookies, authentication, security, load balancing, embedded Calendly functionality). We do not use marketing, advertising, or non-essential analytics cookies on the Site.

We use Vercel Web Analytics to count page views and a small set of CTA interactions. It is cookieless, does not track you across sites, and stores only aggregated, anonymous data.

If we add any non-essential cookies in future, we will request your consent through a cookie banner before setting them.

04How we use personal data and legal bases

We process your personal data on the following legal bases under Article 6 GDPR:

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your interests or fundamental rights. You can request details of this assessment by contacting us.

05Marketing communications

5.1 We may send you marketing emails about our product, features, events, and related content if you have given consent or where we have a lawful basis under the GDPR / Privacy and Electronic Communications Regulations (PECR) — for example, where you are an existing prospect, Trial user, or business contact in the same line of business.

5.2 You can opt out of marketing emails at any time by clicking the “unsubscribe” link in any email or by emailing privacy@delegent.team.

5.3 Opting out of marketing does not affect transactional or service-related communications (e.g. account, security, or legal notices).

06Who we share personal data with

We share personal data only with the following categories of recipients, and only as necessary for the purposes set out above:

• Third-party services you choose to connect: requested Delegent content may be shared with the service you connect, which processes it under its own terms and privacy policy. You can disconnect a service in the app or ask Delegent support to revoke a connection.
• Service providers (processors) acting on our instructions, including:
  • Website and application hosting, and analytics: Vercel, including Vercel Web Analytics.
  • Product database and storage: Supabase (Dublin, Ireland / EU region).
  • AI processing: OpenAI, which processes content you bring into the product to provide Delegent’s AI features.
  • Website fonts: Google Fonts, requested by your browser when you view the Site.
  • Demo scheduling: Calendly.
  • Email and communications: Google Workspace.
• Professional advisers: legal, accounting, tax, and audit advisers, bound by confidentiality obligations.
• Government authorities, regulators, courts, and law enforcement where required by law, court order, or to protect our legal rights.
• Successors in interest: in connection with any merger, acquisition, financing, reorganisation, sale of assets, or insolvency, in which case personal data may be transferred to the successor entity, subject to confidentiality obligations.

We do not sell personal data, and we do not share personal data with advertisers or data brokers.

07International transfers

7.1 Trial product data is stored using Supabase, with our project in Dublin (Ireland / EU region). The Site, the Delegent app, and Vercel Web Analytics are provided by Vercel, and AI processing is provided by OpenAI, which may process data in the United States. Some providers may process data outside the EEA or UK; section 7.2 explains the safeguards we use for applicable transfers.

7.2 Some of our service providers may be located outside the EEA or the UK (for example, in the United States). Where personal data is transferred outside the EEA or the UK to a country not deemed to provide adequate protection, we put in place appropriate safeguards required by GDPR / UK GDPR, which may include:

1. Standard Contractual Clauses (SCCs) approved by the European Commission, together with the UK International Data Transfer Addendum where applicable;
2. the EU–US Data Privacy Framework where applicable; or
3. any other lawful transfer mechanism.

7.3 You can request a copy of the safeguards in place by contacting privacy@delegent.team.

08How long we keep personal data

We keep personal data only for as long as necessary for the purposes set out in this Privacy Policy, including to satisfy legal, accounting, or reporting requirements.

We may retain personal data for longer where required by law or where reasonably necessary to establish, exercise, or defend legal claims.

09Your rights

Under GDPR / UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete personal data corrected.
• Right to erasure (“right to be forgotten”) — to have your personal data deleted in certain circumstances.
• Right to restriction of processing — to limit how we use your personal data in certain circumstances.
• Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object — to object to processing based on legitimate interests, including direct marketing (which we will always respect).
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making — we do not carry out any automated decision-making producing legal or similarly significant effects on you.

To exercise any of these rights, contact us at privacy@delegent.team. We will respond within one month, though we may extend this by two further months for complex requests, in which case we will inform you.

We may need to verify your identity before responding. There is normally no fee, but we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

Right to complain

You have the right to complain to the data protection supervisory authority in your country. If you are in the UK, you may contact the Information Commissioner’s Office (ICO). If you are in the EU or EEA, you may contact your national data protection authority.

We would appreciate the opportunity to address your concerns before you contact a supervisory authority.

10Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These include:

• encryption in transit (TLS) and at rest where appropriate;
• access controls and authentication on our systems;
• Row Level Security in our database layer;
• restricting access to personal data to those who need it;
• regular review of security practices;
• contractual safeguards with our service providers.

No method of transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay, in accordance with applicable law.

11Children

The Site and Trial are not directed to children under 18, and we do not knowingly collect personal data from anyone under 18. If you become aware that a child has provided us with personal data, please contact privacy@delegent.team and we will take steps to delete it.

12Third-party links

The Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing personal data.

13Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent version. If we make material changes, we will take reasonable steps to notify you (for example, by email or by a notice on the Site). Continued use of the Site or Trial after changes take effect constitutes acceptance of the updated Privacy Policy.

14Google user data

This section applies whenever you sign in to Delegent with Google or connect a Google account to the Delegent app at app.delegent.team. It explains what Delegent accesses through Google’s APIs, why, and what happens to it. It applies in addition to the rest of this Privacy Policy.

14.1 What we access and why

Signing in with Google gives Delegent only your basic profile: your name, email address, and Google account identifier, which we use to create and secure your account. Signing in does not give Delegent access to your Gmail, Calendar, or Meet data. Each of those is a separate connection that you choose to make, with its own Google consent screen, and you can use Delegent without any of them.

We use Google user data only to provide these features to you, and we request no more access than they need.

14.2 How we store and protect it

• What is stored. Emails you bring into Delegent, the attachments of emails filed to a workstream, calendar events you import, and meeting transcripts you import are stored in your Delegent workspace. Emails Delegent checks during a sync but does not bring into your inbox are not stored; only a message identifier is kept so they are not checked again.
• Where. In our product database and private file storage, provided by Supabase (Dublin, Ireland / EU region). The Delegent app runs on Vercel, which handles the data in transit between Google and our database.
• Access credentials. The tokens Google issues when you connect are stored in our database and used only to carry out the actions described in this section for your own account.
• Protection. Data is encrypted in transit (TLS). Access is restricted to your account by authentication and Row Level Security in our database, and reaches other Delegent users only where you choose to share a workstream with them. The measures in section 10 also apply.

14.3 Who we share it with

Google user data is disclosed only to the following recipients, and only as needed to provide the features above:

• Supabase (database and file storage) and Vercel (application hosting), as processors acting on our instructions.
• OpenAI, as a processor acting on our instructions. The content of emails, attachments, calendar events, and meeting transcripts is sent to OpenAI’s API to classify it, summarise it, extract tasks and decisions, draft replies and documents, and answer your questions in Delegent’s AI chat.
• People you share with. If you file an email or attachment to a workstream and share that workstream, the people you share it with can see it. Your Google connection itself is never shared.
• AI assistants you connect. If you choose to connect a third-party AI assistant to your Delegent account, it can retrieve content from your workspace at your request, under that provider’s own terms.
• Authorities, where we are required to by applicable law.

We do not sell Google user data. We do not use it for advertising, including personalised or interest-based advertising, and we do not share it with advertisers or data brokers. We do not use it to develop, improve, or train generalised artificial intelligence or machine learning models, and we do not permit our processors to do so.

Delegent staff do not read your Google user data unless you have agreed to it for specific content (for example, when you ask us for support), it is necessary for security purposes such as investigating abuse, or it is necessary to comply with applicable law.

14.4 Retention, disconnecting, and deletion

• Retention. Google user data you have brought into Delegent is kept as part of your workspace for as long as your account is active, and afterwards only for the periods set out in section 8, unless you ask us to delete it sooner.
• Disconnect in Delegent. You can disconnect Gmail and Google Calendar in the app (Settings → Integrations) at any time. This deletes the Google access credentials we hold and stops further access. Content you have already imported stays in your workspace until it is deleted.
• Revoke at Google. You can also remove Delegent’s access at any time from your Google Account at myaccount.google.com/permissions.
• Request deletion. To have your Google user data, or your whole account, deleted from Delegent, email privacy@delegent.team from the address on your account. We will respond within the time limits in section 9.

14.5 Limited Use

Delegent’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15Contact us

If you have any questions, requests, or concerns about this Privacy Policy or our processing of your personal data, contact us: