Legal
Privacy Policy
Last updated: June 1, 2026 · Version 1.1
1. Controller Identity and Privacy Officer
Data controller: Darkbyte Systems ("we", "us", "our").
Privacy Officer (DPO): Nick Poulos
Email: [email protected]
For all data protection inquiries, Data Subject Access Requests (DSARs), or complaints, contact the Privacy Officer at the address above. We will respond within 30 days (GDPR) or 45 days (CCPA) of receiving your request.
2. Age Requirement
The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If you are under 18, you may not create an account or use the Service. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly. To report such a case, contact [email protected].
3. Personal Data We Collect
We collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address | You provide directly |
| Authentication data | Password hash, TOTP secret (encrypted), session tokens | Generated on registration/login |
| Billing data | Stripe customer ID, subscription status | Generated when you subscribe |
| Technical data | IP address, browser user agent, last login timestamp | Collected automatically |
| Audit data | Actions performed in the platform with timestamp and IP | Collected automatically |
| Consent records | IP address at time of consent, policy version accepted | Collected at registration |
We do not collect special categories of personal data (health, biometric, racial origin, political opinions, etc.).
4. How and Why We Use Your Data (Legal Bases)
We process your personal data only where we have a valid legal basis:
| Purpose | Legal Basis | Data Used |
|---|---|---|
| Account creation and authentication | Contract (Art. 6(1)(b) GDPR) | Name, email, password hash, TOTP, IP |
| Providing the platform service | Contract (Art. 6(1)(b)) | Account data, usage data |
| Processing subscription payments | Contract (Art. 6(1)(b)) | Email, Stripe customer ID |
| Sending transactional emails | Contract (Art. 6(1)(b)) | Email address |
| Security audit logging | Legal obligation (Art. 6(1)(c)) + legitimate interests (Art. 6(1)(f)) | User ID, IP (pseudonymized), user agent (pseudonymized), action |
| Fraud prevention and account lockout | Legitimate interests (Art. 6(1)(f)) | Failed login counter, IP address |
| Admin support and impersonation | Legitimate interests (Art. 6(1)(f)) — see Section 9 | Account data, session tokens |
| Tax and financial record keeping | Legal obligation (Art. 6(1)(c)) | Billing records, email |
| Compliance with GDPR and DSARs | Legal obligation (Art. 6(1)(c)) | All personal data on file |
We do not sell your personal data to third parties.
5. Sub-Processors and Third-Party Recipients
We share your personal data only with the following sub-processors, each operating under a Data Processing Agreement:
Hetzner
Role: Infrastructure hosting
Data: All data stored in the portal database
Location: Frankfurt, Germany (EU)
Transfer basis: No transfer outside EEA — EU data center
DPA status: Hetzner AV (Art. 28 GDPR) — on file
Stripe
Role: Payment processing
Data: Email address, billing metadata (no raw card numbers stored by us)
Location: United States
Transfer basis: EU–US Data Privacy Framework (DPF); Standard Contractual Clauses
DPA status: Stripe DPA (pending execution)
Backblaze B2
Role: Immutable audit log archive
Data: Pseudonymized audit log records (IP and user agent HMAC-hashed; no names or email addresses)
Location: United States
Transfer basis: Standard Contractual Clauses (EU→US)
DPA status: Backblaze B2 DPA (pending execution)
Cloudflare
Role: CDN, DDoS protection, WAF
Data: IP addresses and HTTP request metadata
Location: Global (US HQ)
Transfer basis: EU–US Data Privacy Framework (DPF)
DPA status: Cloudflare DPA — accepted via dashboard
Resend
Role: Transactional email delivery
Data: Email address, email content (transactional messages only)
Location: United States
Transfer basis: Standard Contractual Clauses (EU→US) — pending DPA execution
DPA status: Resend DPA (pending execution)
Slack
Role: Internal operational alerts (no user PII in payloads)
Data: Alert notifications — error codes and counts only; no personal data
Location: United States
Transfer basis: EU–US Data Privacy Framework (DPF)
DPA status: Slack DPA — accepted via workspace settings
Vercel
Role: Frontend hosting (static assets only)
Data: No personal data — frontend assets only; API calls go directly to our servers
Location: United States
Transfer basis: Standard Contractual Clauses available via Vercel DPA
DPA status: Vercel DPA — accepted via dashboard
Anthropic (Claude API)
Role: AI processing — powers the Business Brain knowledge base and AI-generated insights
Data: When you or your team query the Brain, the query text and relevant excerpts from your knowledge base (which may include customer names, business information, and document content) are transmitted to Anthropic's API to generate a response. Anthropic does not use API traffic to train its models. By default, Anthropic retains API inputs and outputs for up to 30 days for trust and safety purposes. No special category data (health, biometric, etc.) should be submitted.
Location: United States (AWS infrastructure)
Transfer basis: Standard Contractual Clauses (EU→US) — available via Anthropic's Privacy Center
DPA status: Anthropic API Terms of Service (data processing terms included) — accepted on account creation
6. Cross-Border Data Transfers
Our infrastructure is hosted in the EU (Hetzner, Frankfurt). Some sub-processors are located in the United States. For transfers to the US, we rely on the following safeguards:
- EU–US Data Privacy Framework (DPF): Stripe, Cloudflare, and Slack are certified DPF participants.
- Standard Contractual Clauses (SCCs): Backblaze B2, Resend, and Vercel rely on EU Commission-approved SCCs (2021 Implementing Decision) embedded in their DPAs.
- Pseudonymization: Audit log data exported to B2 has IP addresses and user agents HMAC-pseudonymized before transfer, reducing re-identification risk.
You may request a copy of the applicable safeguards by contacting [email protected].
7. Data Retention
| Data Category | Retention Period | Basis |
|---|---|---|
| User account data | Active account: indefinitely. Erased within 30 days of deletion request. | Contract |
| Audit logs (local) | 90 days after shipping to B2, then deleted | Compliance |
| Audit logs (B2 archive) | Permanent (Object Lock — immutable) | Legal obligation / SOC 2 |
| Session tokens (refresh) | 90 days after revocation or expiry | Security |
| AI Brain interactions (queries + responses) | 90 days | Operational / security audit |
| Behavioral events | 365 days | Operational |
| Password reset tokens | 7 days from creation | Security |
| TOTP backup codes | 90 days after use | Security |
| Privacy requests (DSARs) | 7 years | Legal obligation |
| Erasure records | 7 years | GDPR Art. 17 evidence |
| Consent records | Indefinitely (must outlive the data they authorize) | GDPR accountability |
| Billing records | 7 years | Tax / legal obligation |
8. Cookies and Storage
We use the following browser storage mechanisms:
| Name | Type | Purpose | Expiry |
|---|---|---|---|
__Host-refresh_token | HTTP-only cookie (Strictly Necessary) | Keeps you logged in between sessions. Without this cookie the Service cannot function. | 7 days (sliding with activity) |
db_cookie_consent | localStorage | Records that you have acknowledged this cookie notice. Not a cookie — no data sent to server. | 1 year |
We do not use advertising cookies, analytics cookies, or any third-party tracking cookies. The session cookie is strictly necessary for the Service to operate and does not require your consent under the ePrivacy Directive, though we disclose it here for transparency.
9. Admin Access and Impersonation
Darkbyte Systems staff with the "admin" role may impersonate your account for the purposes of technical support, onboarding assistance, and debugging. This means an admin can act on your behalf within the platform.
The following safeguards apply to all impersonation sessions:
- Admin TOTP (two-factor authentication) is required — password alone is insufficient
- Every impersonation session is logged in our immutable audit trail with the admin's identity, timestamp, and target account
- Impersonation tokens are short-lived and cannot be reused
- Admins may not perform financial transactions or change security credentials while impersonating
You may request a log of all impersonation sessions on your account by submitting a Data Subject Access Request to [email protected].
10. AI Processing and the Business Brain
The Service includes an AI knowledge base (“the Brain”) that indexes your business content — foundation profile, company documents, CRM customer records, employee information, and time-sensitive notes — and answers questions submitted by you and your team.
The following practices apply to all Brain interactions:
- What is transmitted to Anthropic: Your query and relevant excerpts from your knowledge base (which may include customer names, business addresses, pricing information, and other business data you have uploaded) are sent to Anthropic’s Claude API to generate a response. The scope of what is retrieved is limited based on which module initiates the query — the Voice AI module, for example, cannot retrieve financial or customer records.
- Anthropic does not train on your data: Anthropic’s API terms explicitly prohibit using API traffic to train or improve their models. Your business data is not used to train Claude or any other AI system.
- Anthropic’s 30-day retention window: By default, Anthropic retains API inputs and outputs for up to 30 days for trust and safety review. We are working toward enterprise-tier Zero Data Retention (ZDR), which would eliminate this window entirely.
- What we store: We store Brain query interactions (your question, the sources used, the AI’s response) in our database for up to 90 days for audit and quality purposes. Queries are scanned before storage and redacted if they contain patterns suggesting accidentally-pasted credentials or sensitive identifiers.
- No PHI: Do not submit Protected Health Information to the Brain. See our Terms of Service §8 for the PHI prohibition.
11. Cross-Client Aggregation and Platform Intelligence
To provide benchmarking features and improve the platform, Darkbyte Systems may derive anonymized insights from usage patterns across its customer base. The legal basis for this processing is our legitimate interests in improving the Service (GDPR Art. 6(1)(f)), subject to the following strict safeguards:
- No raw data crosses customer boundaries. Your business content — documents, pricing, customer records, employee data — is never shared with, disclosed to, or used in outputs for any other customer.
- Minimum population threshold. Cross-customer statistical insights are only generated when the platform has at least 25 active customers, so no individual customer is re-identifiable in any aggregate output.
- Aggregation is one-directional. Your data contributes to anonymized statistics; those statistics produce platform insights; those insights cannot be traced back to any individual customer.
- No individual-level sharing. Benchmark outputs such as “your delivery efficiency compared to similar businesses” are derived from statistical aggregates, not from another customer’s raw records.
- Opt-out. You may opt out of contributing to cross-customer aggregation at any time by contacting [email protected]. Opting out does not affect your access to the Service or your own per-client insights.
12. Your Rights
Depending on your location, you have the following rights regarding your personal data. To exercise any right, submit a request to [email protected] with subject line "DSAR — [Right]". We respond within 30 days (GDPR) or 45 days (CCPA).
| Right | What it means | Available under |
|---|---|---|
| Access (Art. 15) | Obtain a copy of all personal data we hold about you | GDPR, UK GDPR, CCPA |
| Rectification (Art. 16) | Correct inaccurate or incomplete personal data | GDPR, UK GDPR |
| Erasure (Art. 17) | Request deletion of your personal data (subject to legal retention obligations) | GDPR, UK GDPR, CCPA |
| Portability (Art. 20) | Receive your data in a machine-readable format (JSON or CSV) | GDPR, UK GDPR |
| Restriction (Art. 18) | Restrict processing while a dispute is resolved | GDPR, UK GDPR |
| Objection (Art. 21) | Object to processing based on legitimate interests | GDPR, UK GDPR |
| Opt-out of sale | We do not sell personal data — this right is moot | CCPA |
You may also delete your account directly from within the platform (Account Settings → Delete Account), which triggers immediate anonymization of your personal data. Some data (audit logs, billing records, DSAR records) may be retained as required by law even after deletion.
Immutable audit archive exception: Audit log records exported to our Backblaze B2 archive before May 2026 may contain your IP address in its original form. These records are stored with Object Lock and cannot be physically deleted. We document this in our erasure registry and retain your erasure request as required by GDPR Article 17(3)(b)/(e) (legal obligation / public interest). New records export only pseudonymized data.
Right to lodge a complaint: If you are in the EU/EEA, you may lodge a complaint with your national data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.
13. Security
We protect your personal data using the following technical measures:
- All data in transit encrypted with TLS 1.2+ (enforced by Cloudflare and Hetzner)
- TOTP secrets and OAuth integration tokens encrypted at rest using AES-128-CBC + HMAC-SHA256 (Fernet)
- Integration credentials (OAuth tokens) use per-customer envelope encryption: each customer has a unique encryption key; a master-key compromise cannot expose all customers’ credentials in a single step
- Passwords stored as bcrypt hashes (never plaintext)
- JWT access tokens expire after 15 minutes; refresh tokens after 7 days of inactivity
- Accounts locked after 5 failed login attempts (30-minute lockout)
- New accounts checked against known compromised password databases (HIBP k-Anonymity API)
- All admin actions require TOTP two-factor authentication
- Audit logs cryptographically chained with SHA-256 to detect tampering
- Database access controlled by row-level security (RLS) isolating tenant data
14. Changes to This Policy
We may update this Privacy Policy when our processing changes or regulations require it. Material changes will be notified by email and by an in-platform notice at least 14 days before they take effect. We will increment the policy version and re-collect consent where legally required. The date at the top of this page reflects the last update.
15. Contact
For any privacy questions, data subject rights requests, or to report a concern:
Privacy Officer: Nick Poulos
Email: [email protected]
Response time: Within 3 business days for acknowledgment; 30 days for full response