Privacy
Effective 31 August 2026This document describes accurately what the software does with data, checked against the code rather than adapted from a template. That is the part a lawyer cannot write, and it is not a substitute for the part they can. No lawyer has reviewed this text. Do not rely on it in a contract until one has.
This deployment has not been configured with an operating entity, a contact address, a governing jurisdiction. Those appear as blanks below rather than being guessed at, because an invented address in a legal document is a worse problem than a missing one: it looks answered.
What Datum stores, who else can see it, and how to get rid of it. Every category below was written from the database schema, so it describes this system rather than a template.
Two different roles, and the difference matters
For your own account data, your name, your login, your billing, the operator of Datum is the controller and decides what happens to it.
For the enquiries you send through Datum, you are the controller and the operator of Datum is your processor. Those messages are your customers' data, not ours. We act on your instructions, and the data processing agreement sets out what that means.
What is stored
| Category | Detail | Where |
|---|---|---|
| Account and people | Your company name, and for each person their name, email address and a scrypt hash of their password. Never the password itself. | businesses, users |
| Work you send us | The subject, body and sender address of every enquiry or quote request you paste, upload or forward. This is the one that may contain YOUR customers' personal data, which is why the agreement below treats you as its controller. | work_items |
| What the agent did | Each run's decision, the boundary that produced it, the draft written, the model cost, and the full audit trail. | runs, approvals |
| Mail we sent for you | Recipient, subject, body, delivery status and any quote PDF attached, kept as the record of what actually left. | outbound_emails |
| Your price book and baselines | Trade rates, target and floor margins, and the operating figures the ROI ledger measures against. | catalog_rows, businesses |
| Your logo | Re-encoded as a clean PNG on upload, which drops any location data or other metadata the original carried. | businesses |
| Billing | Plan, subscription status and Stripe identifiers. Card details are held by Stripe and never reach Datum. | businesses |
| Your AI model key, if you supply one | Encrypted at rest with Fernet. Never written to logs, never included in an export, and not readable from the interface once saved. | businesses.model_key_enc |
| Operational records | Whether an inbound delivery was accepted and whether a backup reached its destination. Deliberately holds no message content, no addresses and no subjects. | ops_events |
What is not
- No advertising, and no data sold or shared for it. There is no advertising in this product and no arrangement with anyone who does it.
- No third-party analytics or tracking. No Google Analytics, no pixels, no session recording. Nothing on any page reports your behaviour to a third party.
- No tracking cookies. One cookie is set, and only when you sign in: a signed session cookie that keeps you logged in. It is not used to follow you anywhere.
- No card numbers. Payment details go directly to Stripe and are never received by Datum.
- No message content in operational records. The page the operator uses to check the system's health shows outcomes, never addresses, subjects or bodies.
Who else touches it
Running a service means using other services. These are the ones that can see customer data, what they see, and whether they are switched on for this deployment right now.
| Who | What they do | What they see | Where | On here? |
|---|---|---|---|---|
| Railway | Application hosting and the PostgreSQL database where all account data lives | Everything stored by the product | United States | in use |
| Resend | Sending and receiving email on your behalf | Message content, sender and recipient addresses, and any quote PDF attached | United States | in use |
| Cloudflare R2 | Encrypted off-site database backups | A full database backup, kept for 30 days | Automatic, Cloudflare's global network | in use |
| Stripe | Subscription billing | Billing contact and payment details. Card numbers are handled by Stripe and never reach Datum | United States | not in use |
| Your chosen AI model provider | Drafting replies and quote wording, only if you supply an API key. With no key, Datum uses its built-in rule engine and no message ever leaves this system for a model | The text of the enquiry being processed | Depends on the provider you choose | per account |
This table is generated from the deployment's own configuration, not maintained by hand, so it cannot drift out of date. A sub-processor list that says something is not in use when it is would be a contractual problem rather than an untidy page.
Sending your work to an AI model
By default, nothing leaves. With no model key configured, Datum uses its own rule engine and the text of your enquiries never goes to any AI provider. If you supply an API key in Settings, the enquiry being processed is sent to the provider you chose, under whatever terms you have with them. The key itself is encrypted at rest, never logged, and never included in an export.
The price is never set by a model. Every figure in a quote is arithmetic over your own price book. That is a product decision rather than a privacy one, but it is the reason a wrong answer from a model cannot become a wrong number on a document.
How long it is kept
- While your account exists, work items, runs and sent mail are kept, because the audit trail is the product.
- Backups are kept for 30 days and then pruned.
- When you delete your account, everything belonging to it is removed from the live database immediately. Backups already taken still contain it until they age out of the 30 day window.
Deleting your data
Settings has a delete button. It asks you to type the business name, then performs a hard delete: the business row and every record that belongs to it, including sent mail with its attachments, pending invitations, the price book, every run and its audit trail.
That is a real erasure, not a hidden flag. There is a test that fails if any table carrying a business identifier is left out of it, which exists because an earlier version of that function quietly left several behind.
Getting a copy
Settings has an export. It contains your account data, work items, runs and mail. It deliberately excludes your AI model key, because an export is a file people email to themselves.
Security
- Passwords stored as scrypt hashes, never in plain text.
- Changing a password invalidates every existing session immediately.
- Session cookies are Secure, HttpOnly and
__Host-prefixed. - Every form is protected against cross-site request forgery.
- A strict Content-Security-Policy: no inline scripts can run, even if markup escaping were missed somewhere.
- Model keys encrypted at rest, and stripped from logs and exports.
- Every account's data is separated at the database row level, and there is a test that fails if one account can read another's.
Not yet: two-factor authentication, and a list of active sessions you can sign out remotely. Both are planned and neither exists today, which is worth knowing before you decide what to put in here.
Contact
A contact address has not been configured for this deployment. Until it is, requests should go to whoever operates it.