Privacy policy

This policy explains what DemarcLabs collects when you use app.demarclabs.com, why, and who else sees it. We keep it short on purpose.

What we collect

• Account details: your name, work email, company, and the team you belong to.
• Workspace data: the services, locations, quotes, projects, bills, renewals, files and notes you or your advisor enter, and the fields the Service proposes from documents you ask it to read, kept alongside your confirmed values.
• Billing details: plan, invoices and payment status. Card numbers go directly to Stripe; we never see or store them.
• Usage and error logs: pages requested, timestamps, browser type and the technical details of any error, so we can keep the Service working.

How we use it

• To run the Service: showing you your workspace, sending sign-in links, and sending the email alerts you choose on the Email alerts page.
• To bill you for a paid plan.
• To provide support. DemarcLabs staff can view a workspace read-only to help; each visit is logged and visible to that workspace.
• To provide advisory services, when your company has chosen DemarcLabs as its advisor.

We do not sell your data. We do not use an advisor’s client information to market to those clients. We do not use your data to train AI models.

Who else sees it

We rely on a small number of providers that process data on our behalf, each under its own privacy and security terms:

• Supabase (database, sign-in and file storage, hosted in the United States)
• Vercel (web hosting)
• Stripe (payments)
• Resend (sign-in links and alert emails)
• OpenAI (document reading: when you ask the Service to read a bill, quote or contract, the pages of that file are sent to OpenAI to extract the fields, and the result is shown to you to confirm. OpenAI’s API terms do not allow it to train on this data.)
• Sentry (error reporting; no personal data beyond what an error message contains)

Within the Service, your workspace is visible to your own team, to the advisor firm your company has chosen, and to DemarcLabs support staff. Carriers and other providers are not users of the Service and see nothing unless you share it with them.

Cookies

We use one cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Keeping it safe

Data is encrypted in transit and at rest. Access between companies is enforced in the database itself, not only in the application. Staff access is read-only and recorded.

How long we keep it

For as long as your workspace exists. When you ask us to delete it, we remove it within 30 days, except for billing records we must keep for tax purposes and backups, which age out on their own schedule.

Your choices

• Change which emails you receive on the Email alerts page. Sign-in links and billing emails cannot be turned off while you have an account.
• Ask us for a copy of your data, or to correct or delete it, at hello@demarclabs.com.

Changes

If we change this policy in a way that matters, we will email account admins before the change takes effect.