Privacy Policy

• For your Account and our websites, Demarly decides how personal information is used and is responsible for it as described in this policy.
• For Customer Data— personal information about your own customers, leads and contacts that you or your AI Agents bring into the Services, such as emails in a connected mailbox or records in a connected CRM — we act on your behalf and on your instructions. If you are one of our customers’ contacts, please send privacy requests to the business that uses Demarly; we will help them respond.

(a) Account and business information. Your email address and password (stored by our authentication provider in hashed form); your business name, industry, website, description, products and services, timezone; and your brand settings, such as voice, content pillars, channels and target audience.

(b) Content you provide. Instructions and messages you give AI Agents (including chat with your CEO agent), knowledge-base documents you upload (PDF, Word, text, Markdown and CSV), product images, and the content you review, edit, approve or schedule.

(c) Data from Connected Accounts. When you connect an account, we access the data needed for the features you turn on. This can include email messages and threads, calendar events, files and documents, CRM and support records, analytics, and social media profiles, posts and performance data. We store the connection status; access tokens for most connections are held by the connection provider (Composio or Zernio), and tokens we hold directly, such as your own AI provider keys and ChatGPT or Higgsfield sign-ins, are encrypted.

(d) Customer Data. Names, email addresses, phone numbers, companies and messages of your customers, leads and contacts that come from your Connected Accounts, lead forms or uploads.

(e) Research data.Public web pages, search results, and public social media posts and profiles (for example, competitors’ posts) that AI Agents collect for you.

(f) Usage and activity data. Records of AI Agent runs, workflows, approvals, publishing activity, Credit usage, and AI request logs (model used, token counts, cost, timing and a short summary of the request).

(g) Billing information. Your plan, billing history and Stripe customer and subscription identifiers. Stripe collects your payment card details; we do not receive or store full card numbers.

(h) Consent records.When you accept our Terms and this policy, we record the versions you accepted, the time, your IP address and your browser’s user agent, and your confirmation that you are 18 or older.

(i) Website, quiz and campaign data. If you take our quiz or join a waitlist, the answers you give (such as business type, goals and challenges) and the contact details you enter (name, email, and optionally phone number and company). We also record which campaign or link brought you to us (for example, UTM parameters and a referring creator), page events on our landing pages, and a random visitor identifier, as described in Section 8.

(j) Device and technical data. IP address, browser and device type, and server logs created when you use the Services.

(k) Communications. Emails and messages you send us.

(l) Creator program. If you take part in our creator referral program, your name, referral link, the sign-ups and payments attributed to you, and the payout details you give us.

We use personal information to:

• Provide the Services, including running AI Agents and workflows, drafting and publishing content, and carrying out actions you approve;
• Create and secure your Account, process payments, grant and track Credits, and enforce plan limits and one starting offer per Account;
• Send service messages, such as sign-up confirmation, billing notices, security alerts and notices of changes to our terms;
• Provide support and respond to your requests;
• Measure which campaigns and creators bring sign-ups, and pay creator commissions;
• Understand how the Services are used and improve them, using usage data and aggregated or de-identified information;
• Detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms;
• Comply with law, and establish, exercise or defend legal claims.

We may send you product news if you have not opted out. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.

What AI providers receive. To do the work you ask for, we send AI model providers the parts of your User Content needed for each task. This can include your brand settings, knowledge-base excerpts, content to analyze, research results, and data from Connected Accounts, such as an email you asked an AI Agent to reply to.

Which provider. Most AI requests go through OpenRouter, which forwards each request to the provider that runs the model chosen for that task. Providers may be located in the United States or other countries, and different providers handle data differently. If you connect your own AI provider key or ChatGPT account, requests made with it go to that provider under your agreement with it.

What we never send. We do not send your password, payment card details, or access tokens for your Connected Accounts to AI model providers.

No training. Demarly does not use your User Content, Customer Data or Generated Content to train AI models. We access AI models through business APIs, whose terms generally do not allow the provider to train on API data.

Human access. Demarly staff access your content only when needed to provide support you request, to investigate security incidents or abuse, to comply with law, or with your permission.

If you connect a Google account (for example Gmail, Google Drive, Google Calendar or Google Sheets), we use the Google user data you authorize only to provide the features you use, such as reading and drafting replies to email, finding information in files, and creating events or documents you ask for. Demarly’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train generalized AI models, and do not let people read it except as described in Section 4. You can disconnect a Google account in the Services or revoke access in your Google account settings at any time.

Service providers. We share personal information with providers that process it for us to run the Services:

• Supabase — Database, authentication, file storage and account emails (such as sign-up confirmation)
• Amazon Web Services — Application hosting, secrets storage and operational logs (United States)
• Vercel — Website and app hosting
• Stripe — Payments, subscriptions, invoices and fraud prevention
• OpenRouter — Routes AI requests to the AI model provider that runs your chosen model
• AI model providers — Run AI models for AI Agents — for example Anthropic, OpenAI, Google, Mistral, Meta, xAI, DeepSeek and others, depending on the model used
• OpenAI — Creates search indexes (embeddings) of knowledge-base documents you upload
• Composio — Connects and acts on the apps you connect, such as Gmail, Google Drive, Outlook, Slack and CRMs
• Zernio — Publishes posts to the social accounts you connect for auto-posting
• Apify — Collects public web and social media content you ask AI Agents to research
• Serper — Runs web searches for AI Agents
• Higgsfield — Generates images and video, if you connect a Higgsfield account

Platforms you direct us to.When you ask AI Agents to send, post or save something, we send it to the platform you chose, such as Instagram, TikTok, X, Gmail, Slack or a notification webhook you set up. What happens to it there is governed by that platform’s policies.

Creators.If you sign up through a creator’s referral link, that creator can see an anonymized entry for your Account (such as “Customer 3”), with its subscription status, dates, the payment amounts it was credited for and the commission earned, but not your name, email or content.

Business transfers. In a merger, acquisition, financing or sale of assets, personal information may be transferred, subject to this policy.

Legal and safety. We may disclose information when we believe in good faith it is required by law or legal process, or needed to protect the rights, property or safety of Demarly, our users or others.

With your consent. We share information in other ways when you ask us to or agree.

If you connect social accounts for auto-posting, we send your approved posts, media and posting settings to Zernio, which publishes them to the platform. Posts become public according to the platform and the privacy setting you choose. Where the platform supports it, we label posts as AI-generated. We also collect performance data, such as views and engagement, for posts we publish for you.

We use a small number of first-party cookies and browser storage:

• Essential — sign-in and session cookies from our authentication provider. The Services do not work without them.
• Campaign attribution — on some landing pages, a random visitor identifier (demarly_vid) and the campaign that brought you (demarly_src), kept for up to 1 year, so we can measure which campaigns lead to sign-ups.
• Creator referral— if you arrive through a creator’s link, a cookie (demarly_ref) kept for 30 days so the creator is credited if you sign up.
• Preferences — browser storage that remembers interface settings, such as layouts, dismissed banners and tutorial progress.

We do not use third-party advertising or analytics cookies or pixels, and we do not share cookie data with ad networks. You can block or delete cookies in your browser; blocking essential cookies will stop you from signing in. Because we do not sell or share personal information for advertising, we do not respond differently to “Do Not Track” signals, but we treat a Global Privacy Control signal as a request to opt out of any sale or sharing.

• Account data, content and Customer Data — kept while your Account is open, including after a paid plan ends and your Account moves to the Free Plan. When you ask us to delete your Account, we delete or de-identify this data within 30 days, except as described below.
• Activity and AI request logs — kept while your Account is open, to show usage and Credit history and to investigate problems.
• Server and operational logs — kept for a short period, generally a few weeks.
• Billing, tax and consent records — kept as long as needed for tax, accounting and legal purposes, which can be several years after your Account closes.
• Quiz, waitlist and campaign data — kept until you ask us to delete it or we no longer need it for the purpose it was collected.
• Backups — deleted data may remain in backups for a limited period until they are overwritten.

Data held by a Connected Account (such as your mailbox) stays with that service. Disconnecting an account stops our access; when you disconnect one, we also ask the connection provider to delete its connection.

We use reasonable administrative, technical and physical safeguards, including:

• Encryption in transit (TLS) and encryption at rest by our hosting providers;
• Additional encryption of AI provider keys and sign-in tokens we store;
• Database row-level security so each workspace can access only its own data;
• Secrets kept in a managed secrets store, and limited staff access.

No system is completely secure. Keep your password safe, and tell us at sean@demarly.ai if you suspect unauthorized access. We will notify you of a security breach affecting your personal information as required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you, and get a copy in a portable format;
• Correct inaccurate information;
• Delete your information, subject to legal exceptions;
• Opt out of sale, sharing for targeted advertising, or profiling with legal or similarly significant effects (we do none of these);
• Object to or restrict certain processing, and withdraw consent where we rely on it;
• Appeal a decision we make about your request.

You can update most account and business information in the Services, disconnect Connected Accounts at any time, and unsubscribe from product emails using the link in them. To make any other request, email sean@demarly.aifrom your Account’s email address. We may need to verify your identity, and an authorized agent may make a request for you with proof of authorization. We respond within the time the law requires (generally 30 to 45 days). If we deny your request, you can appeal by replying with “Appeal” in the subject line; if your appeal is denied, you may contact your state attorney general. We will not discriminate against you for exercising your rights.

This section applies to residents of California, Colorado and other states with comprehensive privacy laws. In the past 12 months we have collected these categories of personal information: identifiers (name, email, IP address, account and visitor identifiers); customer records and commercial information (business details, plan and purchase history); internet and network activity (usage and landing-page events); professional information (business name and industry); audio, visual or similar information you upload (such as product images); and inferences you choose to give us (such as quiz answers about your business).

We collect these from you, your Connected Accounts and your devices, for the purposes in Section 3, and disclose them for business purposes to the providers in Section 6. We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly collect information from anyone under 16. We do not use sensitive personal information to infer characteristics about you.

If data protection laws of the European Economic Area, the United Kingdom or Switzerland apply, we process your personal information on these legal bases: to perform our contract with you (providing the Services and billing); our legitimate interests (securing and improving the Services, preventing abuse, campaign measurement and product news to customers), which we balance against your rights; to comply with legal obligations; and your consent, where we ask for it. You may also lodge a complaint with your local data protection authority.

Demarly is based in the United States, and we and our providers process information in the United States and other countries, which may have different data protection laws than where you live. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses.

The Services are for people 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact sean@demarly.ai and we will delete it.

We send service emails about your Account, billing, security and changes to our terms; you cannot opt out of these while your Account is open. You can opt out of product news at any time. If you give us your phone number, for example on a waitlist, we use it only to contact you about your request; we will not send marketing text messages unless you separately agree to receive them.

We may update this policy at any time. We will post the updated version here with its version number and effective date, and for material changes we will also tell you by email or in the Services. We may ask you to accept the changes in the Services, and we will ask for your consent where the law requires it.

Questions about this policy or our data practices, or want to make a request? Contact us:

• Email: sean@demarly.ai
• Mail: Demarly LLC, 1500 North Grant Street, Denver, CO 80203

This policy is governed by the laws of the State of Colorado, except where the law of your place of residence requires otherwise.