Privacy Policy

Last updated: July 31, 2026

Dalae SAS (“we”, “us”) operates agentixl. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

Account data

• Email address — provided when you sign up with a password or a magic link. Used for authentication, billing, conversation sharing, and service communications.
• Password — if you choose that sign-in method. Stored hashed by Supabase Auth; we never see it.
• Stripe customer ID — created when you subscribe to a paid plan.

File data

• The spreadsheets you upload — we store the original file and the SQLite representation we derive from it, so your conversations and tool calls keep working over time.
• File metadata — name, size, sheet and cell counts, a SHA-256 hash of the original, and rendered sheet previews.
• Conversations — your chat messages, the tool calls made on your behalf, and their results.

Usage data

• API call counts — tracked per billing period for quota enforcement.
• Storage consumption — total bytes stored, to enforce your plan's quota.

What we do NOT collect

• Passwords you provide to open encrypted workbooks (used in-memory, never persisted)
• Cookies for tracking or advertising (we do not use third-party trackers)

2. How We Use Your Data

• Authenticate you and enforce rate limits and storage quotas
• Parse, render, and modify the spreadsheets you upload
• Answer your questions in the hosted chat, which involves sending the relevant file content to Anthropic's API (see sub-processors below)
• Share a conversation with another user when you explicitly ask us to, by email address
• Process payments and manage subscriptions
• Send transactional emails (account, billing, service status)
• Diagnose and fix technical issues

We do not sell your data. We do not use your files for training AI models, and our AI sub-processor does not train on data submitted through its API.

3. Sub-processors

We use the following third-party services to operate agentixl:

Anthropic is engaged as a sub-processor for the hosted chat only. If you use agentixl exclusively through the MCP server, no file content passes through it on our side — your own AI client receives the results and applies its own provider's terms.

4. Data Retention

• Uploaded files and their SQLite representations: retained while your account is active, so your conversations keep working. Delete them at any time from the app.
• Storage quota eviction: if your account stays over its storage quota (1 GB on Free, 20 GB on Pro) for more than 7 days, we free the stored files of your oldest conversations until you are back under the limit. The conversation and the file's SHA-256 hash survive, so re-uploading the exact same file restores it.
• Conversations and messages: retained while your account is active.
• Account data: retained while your account is active. Deleted within 30 days of an account deletion request.
• Billing records: retained for 10 years as required by French tax law

5. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Object to processing based on legitimate interest
• Lodge a complaint with the CNIL (French data protection authority)

To exercise these rights, email privacy@dalae.fr.

6. Security

All data in transit is encrypted via TLS 1.2+. Data at rest in Supabase — database rows and stored files alike — is encrypted with AES-256. API keys are stored as a SHA-256 hash; the plaintext is shown once at creation and cannot be recovered afterwards. See our Trust Center for detailed security information.

7. Changes

We may update this policy. Material changes will be communicated via email. The “last updated” date at the top reflects the latest revision.

8. Contact

Data controller: Dalae SAS, Paris, France.
Contact: privacy@dalae.fr