Privacy Policy

DerrAI Privacy Policy

Effective Date: 13 February 2026

At DerrAI Inc. ("DerrAI", "we", "us", or "our"), we are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains what information we collect, how we use it, how we store it, and the safeguards we apply.

By using our services, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide when using our services, including:

• Account information (name, email address, organisation)
• Configuration data for workflows and digital agents
• Content you upload or generate within the platform
• Communications you send to us

1.2 Public Data

For public-facing solutions, DerrAI may process publicly available information from websites where required to deliver configured services.

1.3 Private Tenant Data

For private tenant deployments, DerrAI may process data from a client's internal systems where explicitly authorised by the client. Clients may request data residency in a cloud environment they control.

2. How We Use Your Information

We use information solely to:

• Deliver AI-powered digital worker services
• Execute configured workflows and automations
• Generate outputs you request
• Improve system performance and reliability
• Provide customer support

We do not sell personal data.

We do not use customer data for advertising.

We do not use customer data to train general-purpose AI models.

3. Google API Services — User Data Disclosure

DerrAI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.1 Data Accessed

When you connect your Google account to DerrAI, our application may request:

• Gmail (Send only): Permission to send email messages on your behalf via the gmail.send scope.

DerrAI does not read, access, analyse, or store Gmail inbox content when only send functionality is enabled.

3.2 How We Use Google User Data

Google access is used solely to send email messages that you initiate or configure within the DerrAI platform.

We do not:

• Read your Gmail inbox
• Access email message content
• Use Google user data for advertising
• Use Google user data to train general-purpose AI or machine-learning models

3.3 Storage of Google Data

• OAuth access and refresh tokens are stored securely on Microsoft Azure.
• Tokens are encrypted at rest and in transit.
• Access is restricted to authorised systems required for service delivery.
• Tokens are retained only as long as needed to provide the configured service.

3.4 Sharing of Google Data

• We do not sell Google user data.
• We do not transfer Google user data to third parties except:

• As required to provide the enabled service functionality
• As required by law
• To our cloud infrastructure provider (Microsoft Azure) acting as a sub-processor under contractual safeguards

3.5 User Control and Revocation

You may revoke DerrAI's access at any time through your Google Account permissions.

Upon revocation, DerrAI will cease sending email via your Gmail account and delete stored OAuth credentials within 30 days, unless retention is legally required.

3.6 Limited Use Statement

DerrAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Sharing and Disclosure

DerrAI does not share client or user data with third parties except:

• With explicit client authorisation for integrations
• To contracted sub-processors providing infrastructure services
• Where required by applicable law

All sub-processors are subject to appropriate data protection agreements.

5. Data Retention and Residency

5.1 Data Retention

We retain data only as long as necessary to:

• Deliver the services requested
• Meet contractual obligations
• Comply with applicable laws

Retention periods vary by data type and jurisdiction.

5.2 Data Residency

Clients may request preferred data storage regions (e.g., Australia, United States, or other supported Azure regions).

6. Data Security

DerrAI employs industry-standard safeguards including:

• Encryption at rest and in transit
• Role-based access controls
• Secure infrastructure on Microsoft Azure
• Continuous monitoring and logging
• Incident response procedures

In the event of a data breach, we will notify affected clients as required by law.

7. Cookies and Tracking Technologies

The DerrAI application platform does not use tracking cookies.

Our public website may use minimal essential cookies necessary for site functionality and basic performance analytics. We do not use third-party advertising tracking technologies.

8. International Data Transfers

Where cross-border transfers occur, DerrAI complies with applicable legal frameworks to ensure consistent data protection standards.

9. Children's Privacy

DerrAI's services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

If we become aware that such data has been collected, we will delete it promptly.

10. User Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal information
• Request correction of inaccurate information
• Request deletion (subject to legal obligations)
• Request data portability where applicable

To exercise these rights, contact us at the email below.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements or service functionality.

We encourage users to review this policy regularly.

12. Contact Information

If you have any questions regarding this Privacy Policy or our data practices, please contact:

Gavin O'Kane

Chief Technology Officer

Email: gavin@doozer.ai

DerrAI Inc.