1. Introduction

Deemerge ("we," "us," or "our") provides an AI-powered tool that analyzes business messages from connected services such as Slack to surface situations that require user action. This Privacy Policy describes the data we collect when you use our website (deemerge.ai), our product (the Deemerge dashboard), and any connected integrations; how we use that data; who we share it with; and the rights you have over it.

This policy applies to:

• Visitors to deemerge.ai
• People who sign up for our waitlist or product
• Authorized users of the Deemerge product
• People whose messages or profile information appear in workspaces connected to Deemerge (e.g., members of a connected Slack workspace)

We are a US-based business operating product infrastructure in the United States. If you have questions about this policy, contact us using the details in Section 14.

2. Information We Collect

We collect information in three broad categories: information you provide directly to us, information we receive from connected services, and information collected automatically when you use our product or website.

2.1 Information you provide directly

• Account and waitlist information. When you create an account or join our waitlist, we collect your name, work email address, company name, company size, role, and country.
• Authentication data.  We use Clerk, a third-party authentication provider, to manage sign-in. Clerk may collect login identifiers, session tokens, and security signals on our behalf.
• Communications. When you contact us, we keep a record of the exchange to respond to you and improve our service.

2.2 Information we receive from connected services

When you connect Slack (or, in the future, other messaging services such as Gmail or Outlook) to Deemerge, we receive data from that service based on the permissions you grant. Section 4 describes Slack specifically in detail.

2.3 Information collected automatically

• Usage data. Pages visited, features used, time spent in the product, and similar diagnostic information.
• Device and technical data. IP address, browser type, operating system, and device identifiers.
• Cookies and similar technologies. We use cookies to maintain sessions, remember preferences, and measure traffic. You can manage cookies through your browser settings.

3. How We Use Information

We use the information we collect to:

• Operate the product — ingest messages from connected services, analyze them, and present the resulting insights ("JOBs") on your dashboard.
• Authenticate users and secure accounts.
• Communicate with you about your account, product updates, and (with your consent or as otherwise permitted) marketing.
• Improve the product by analyzing aggregated, non-identifying usage patterns.
• Comply with legal obligations and enforce our terms.

We do not sell personal data. We do not use customer message content for advertising. We do not use customer message content to train AI models.

4. Slack Data — What We Receive and How We Handle It

This section describes what happens to Slack data when you connect Slack to Deemerge. Slack data is also subject to the broader protections described elsewhere in this policy (security, retention, your rights, deletion).

4.1 What we receive from Slack

When you authorize the Deemerge Slack integration and select which channels to connect, we receive:

• Message text content from the channels you have explicitly selected through the Deemerge dashboard.
• Message metadata, including timestamps, channel identifiers, and thread context.
• Sender and recipient Slack user IDs for the messages we receive.
• User profile information (name, email, role) for members of the connected Slack workspace, so we can attribute messages and surface insights to the correct user.
• Channel metadata, including channel name, members, and settings, for the channels you have connected.

4.2 What we do not receive from Slack

We do not access:

• Direct messages (DMs). Deemerge never reads or stores DM content.
• Messages from channels you have not selected through the Deemerge dashboard.
• File contents. We may see a filename or basic file metadata if it appears in a message, but we do not download or process file bodies.
• Voice or video call content.

4.3 How we use Slack data

We use Slack data solely to operate the Deemerge product for you and your workspace — specifically, to identify situations that require action ("JOBs") and present them to the right user on your team's dashboard. We do not use Slack data for advertising, do not sell it, and do not use it to train AI models.

4.4 How Slack data is processed

Slack messages flow through Deemerge in two stages:

1. Internal extraction. We perform deterministic extraction of identifiers and structural information (e.g., who sent the message, when, and in which channel) entirely within Deemerge's own infrastructure. No external service is involved at this stage.
2. AI analysis. We then send message content to a US-based AI inference provider (currently Google Gemini, with potential fallback to other US-based providers) to interpret the content and identify actionable situations. See Section 5 for details about AI processing, including provider terms

4.5 Slack data retention

• Raw Slack message content  is retained for 24 hours after ingestion and then permanently deleted.
• Derived insights (JOBs, owner assignments, expectations) generated from your Slack data are retained according to your tenant's retention settings.
• Workspace and user metadata  is retained while your Slack connection is active. When you disconnect Slack, ingestion stops immediately; see Section 11 for what happens to retained data after disconnection or account deletion.

4.6 Your rights regarding Slack data

You can disconnect Slack from Deemerge at any time from the dashboard. Disconnection stops new ingestion immediately. To request deletion of derived insights generated from your Slack data, contact us using the details in Section 14, or request full account deletion as described in Section 11.

5. AI Processing and Third-Party AI Providers

Deemerge uses AI models to analyze the content of the messages we ingest. Because customers (and their procurement teams) often want a clear answer to the question "is my data sent to AI?", we want to be explicit.

5.1 Yes — message content is sent to AI providers

To identify actionable situations in your messages, Deemerge transmits message content to large language model (LLM) providers for analysis. This is core to how the product works.

5.2 Which providers we use

• Google (Gemini API) — our primary AI provider. Google operates the Gemini API in the United States and processes data under a Data Processing Addendum (DPA) that prohibits using customer data to train its models.
• Other US-based AI inference providers. We may use additional US-based providers as fallbacks or for specific tasks. All such providers are based in the United States and operate under terms that prohibit training on customer data.

We do not send customer data to AI providers operating from jurisdictions that present data residency concerns. Specifically, we do not send customer data to AI providers hosted in China.

Section 6 lists our current sub-processors. We will update this section if we add, remove, or change providers.

5.3 What AI providers do with the data

Under the terms we have in place:

• AI providers do not train or improve their models on Deemerge customer data.
• AI providers process data only to return a response to the specific inference request we made.
• AI providers retain data only for the limited windows described in their own terms (typically 24 to 72 hours for abuse monitoring, after which it is deleted). Refer to each provider's documentation for current details.

5.4 Data minimization

We send to AI providers only the message content and contextual data needed to perform the analysis. We do not send unrelated workspace data, account credentials, or data from channels you have not selected for ingestion.

6. Sub-Processors and Third Parties

Deemerge uses a small set of vendors to operate the product. Each is bound by a written agreement requiring them to handle data only for the purposes we authorize.

We do not sell or rent personal data to third parties. We do not use customer message content for advertising.

7. Data Retention

We retain data only as long as needed for the purposes described in this policy:

• Raw Slack message content — 24 hours after ingestion, then permanently deleted.
• Derived insights (JOBs, owner assignments) — retained according to your tenant's retention settings.
• Account information — retained for the duration of your account.
• Marketing and waitlist data — retained until you unsubscribe or request deletion.
• Logs and diagnostic data — retained for a limited operational period (typically 30 to 90 days) and then deleted or aggregated.

When you delete your account, we permanently delete all derived customer data within 30 days, except where retention is required by law (e.g., billing records). See Section 11 for details.

8. Data Security

We apply industry-standard controls to protect your data:

• Encryption in transit using TLS 1.2 or higher for all data moving between you, Deemerge, and our integrations.
• Encryption at rest using AES-256 for data stored in our databases and object storage.
• Tenant isolation through row-level security at the database layer, so one customer's data cannot be accessed in queries belonging to another customer.
• Access controls. Production data is accessible only to a limited number of authorized personnel, with audit logging.
• Vulnerability management. We monitor our infrastructure for known vulnerabilities and apply patches on a regular cadence.

We are working toward a SOC 2 Type II audit. We are not currently SOC 2 certified, and we will publicly announce certification when it is complete.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you as required by applicable law.

9. International Data Transfers

Deemerge operates from the United States, and all production infrastructure is hosted within AWS regions in the United States. If you access Deemerge from outside the United States — including from the European Economic Area, the United Kingdom, or other regions — your data will be transferred to and processed in the United States.

Where applicable, we rely on appropriate transfer mechanisms (such as the European Commission's Standard Contractual Clauses) for transfers of personal data from the EEA and UK to the United States.

10. Your Rights

We support the following rights regardless of where you are located:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your data, subject to limited legal exceptions.
• Restriction or objection — ask us to limit or stop certain processing.
• Portability — request a copy of certain data in a structured, machine-readable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

If you are in the European Economic Area, the United Kingdom, or California, you may have additional statutory rights under the GDPR, UK GDPR, or the CCPA/CPRA. We honor those rights in line with applicable law.

To exercise any right, contact us using the details in Section 14. We respond to verified requests within 30 days, or sooner where required by law. If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.

11. Account Deletion and Data Removal

You can request account deletion at any time. When you do:

• New ingestion stops immediately.
• Any active integrations (e.g., Slack) are disconnected.
• All derived customer data (JOBs, insights, account details, message-derived data) is permanently deleted within 30 days.
• We may retain a minimal record needed to comply with legal, accounting, or security obligations (e.g., a record that an account was deleted, retained billing records). This minimal record does not include message content or derived insights.

You can also disconnect Slack independently — this stops ingestion without deleting your Deemerge account or existing derived insights.

12. Children's Privacy

Deemerge is a business product and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it.

13. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you (for example, by email or through an in-product notice) before they take effect. The "Last updated" date at the top of this policy shows when it was last revised. Continued use of Deemerge after changes take effect indicates acceptance of the updated policy.

14. Contact Us

For questions, requests, or to exercise any rights described in this policy:

Email: privacy@deemerge.ai

Contact form: https://www.deemerge.ai/contact

Company: [Legal entity name and registered address — to insert]