Platform Privacy Policy

This policy applies to the Dedale Intelligence Platform. If you are looking for information about how we handle personal data through our website at www.dedale.com, see our Privacy Policy and our Cookie Policy.

1. Who we are

The Dedale Intelligence Platform ("Dedale", "we", "us") is operated by Dedale Intelligence, SIREN 893 636 340 (RCS France), 7 rue de Madrid, 75008 Paris, France.

For any question about this policy or to exercise your rights, contact privacy@dedale.com.

2. Scope

Dedale is a B2B SaaS platform that provides private equity funds and corporates with intelligence on technology companies. We refer to the content available on the platform collectively as "Intelligence Research".

This policy explains how we handle the personal data of people who hold a user account and use the platform ("users"). In this policy, "your organization" means the company you are affiliated with, which holds the subscription or is in commercial discussions with Dedale. The contract is between Dedale and your organization, not with you personally.

Individuals whose information appears in our Intelligence Research are covered by a separate notice; see section 9.

3. How access is granted

Access to the platform is granted only in the context of an ongoing commercial discussion or a contract between Dedale and your organization. There is no public self-registration.

Depending on how your organization is set up, your user account is created in one of two ways:

• Password-based access. We create your user account and issue your initial credentials.
• Single sign-on (SSO). Your user account is created the first time you sign in, from the information your organization's identity provider sends us.

4. Personal data we process

• Identity and user account. Name, email and, for password-based access, a hashed password. Source: you, your organization, or your organization's identity provider.
• Organization membership. The organization you belong to and its subscription-level settings. Source: set by us.
• Usage data. Pages viewed, features used, searches performed, Intelligence Research accessed or downloaded, request volumes. Source: captured by our backend and in your browser, see section 11.
• Support. When our team reproduces an issue you report, they can view the platform as you see it; this is logged. Source: internal.
• Communications. Email address and delivery status for transactional emails such as user account setup, password recovery and notifications. Source: you or your organization for the email address, our email provider Brevo for delivery status.
• Content you create. Collections, saved filters and views, feedback you submit. Source: you.
• Ask Dedale requests. The questions you ask and the answer generated. Source: you.
• MCP requests. The request sent to our MCP server, the client used, and the intent of your request. Source: your MCP client application.
• Connection data. Your IP address and request metadata. Source: our CDN provider, Cloudflare.
• Technical and security logs. Error and diagnostic logs, which may incidentally include personal data present at the time of an error. Source: our error-monitoring provider, Sentry.
• Browser storage. Session cookies and analytics identifiers. Source: set in your browser.

We do not knowingly collect payment card data, special-category data such as health or religious belief, or biometric data.

5. Why we process it, and on what legal basis

We process users' personal data on the basis of legitimate interest (GDPR Article 6(1)(f)), plus legal obligation where the law requires us to keep or disclose data. We do not rely on performance of a contract for users: our contract is with your organization, and you are not a party to it.

Our legitimate interest is to deliver the subscription your organization pays for and to provide you with a reliable and relevant service, including proactively sharing research that matches your needs.

Your organization subscribes to access our Intelligence Research, and the platform is how that content is delivered. We cannot grant you that access without a user account linked to your organization.

• Create and maintain your user account, and authenticate you. Data: identity and user account, organization membership. Legal basis: legitimate interest in delivering the subscription to the people your organization designates.
• Apply your organization's access rights and subscription terms. Data: organization membership, usage data. Legal basis: legitimate interest in giving each user only the Intelligence Research their organization is entitled to.
• Send you transactional emails. Data: identity and user account, communications. Legal basis: legitimate interest in setting up and securing your access.
• Answer your questions through Ask Dedale. Data: the content of your request, content you create. Legal basis: legitimate interest in delivering a feature included in the subscription.
• Help you when you contact support. Data: support, content you create. Legal basis: legitimate interest in resolving the issue you raised.
• Detect abuse and protect our Intelligence Research. Data: usage data captured server-side, technical and security logs. Legal basis: legitimate interest in detecting scraping, unusual download volumes and account sharing, and in protecting our intellectual property.
• Understand what Intelligence Research users look for, and improve the platform. Data: usage data. Legal basis: legitimate interest in making sure the subscription delivers the content users need.
• Keep the platform secure and diagnose failures. Data: technical and security logs. Legal basis: legitimate interest in security and service continuity, and legal obligation where it applies.
• Reach out to you about relevant research. Data: usage data, identity and user account. Legal basis: legitimate interest in proactively sharing Intelligence Research that matches what your organization is looking for.

The data is limited to professional information about your use of a work tool your organization provides.

You can object at any time to processing based on legitimate interest, as explained in section 12. We may continue processing where we have compelling legitimate grounds, such as securing the platform, or where it is required to comply with a legal obligation.

6. AI features

Dedale offers two AI-related features: Ask Dedale, an in-app research assistant, described in section 6.1, and an MCP server that lets compatible AI applications query the Intelligence Research you have access to, described in section 6.2.

No model training. None of your data, whether your requests, the content you create, your usage data or the Intelligence Research you access, is used to train or fine-tune AI models, either by Dedale or by any third party. Data you retrieve through a third-party AI application via our MCP server is subject to that application's own terms, see section 6.2.

No automated decisions. Dedale does not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects (GDPR Article 22). AI features only generate answers and drafts for you to read and use.

6.1 Ask Dedale, the in-app AI research assistant

Ask Dedale is an in-app feature that uses AI models to answer your questions and draft research using Intelligence Research, including the Projects and Requests delivered to your organization. Requests are routed through our own gateway to third-party model providers.

Our gateway stores the content of your requests for 90 days, and keeps request metadata such as date, model used and volume for 90 days, for service operation, usage tracking and troubleshooting.

These providers process the content of your request, and the Intelligence Research retrieved to answer it, only to generate a response. We use each of them under their paid API terms, which prohibit them from using your data to train their models:

• Anthropic. Retention up to 30 days. Processing region: global.
• Mistral. Retention up to 30 days. Processing region: EU.
• Google. Retention up to 55 days. Processing region: global.

A provider may retain data for longer where needed to investigate abuse or comply with the law, under its own terms.

Because Anthropic and Google process requests globally, content sent to Ask Dedale, including content from your Projects and Requests, may be processed outside the EEA. See section 8 for more details.

Answers from Ask Dedale are generated by AI models and may contain errors. Please verify them before relying on them.

6.2 MCP integration (Model Context Protocol)

The Model Context Protocol is an open standard that lets AI applications connect to external data sources and tools.

We expose an MCP server so that MCP-compatible client applications can query the Intelligence Research you already have access to.

• No AI provider on our side. Unlike Ask Dedale, the MCP server sends nothing to an AI provider. It only returns data in response to a request; no content reaches Anthropic, Mistral or Google through us.
• Authentication. Access requires an OAuth 2.1 token issued by Ory. The token is tied to your user session, so the MCP server only returns data you are already authorized to see.
• No new account. Connecting an MCP client does not create a new user account or collect additional identity data. It gives an authorized client a different way to reach the same data.
• Analytics. Information transmitted as part of the MCP protocol, such as the client application you connect and the intent of your request, is recorded in our analytics, see section 11.
• Your client application. Data returned by the MCP server goes to the client application you connected, and is then handled under that application's own terms and privacy practices, including its own policy on model training.

7. Providers involved in processing

The following providers process personal data on our behalf, as processors under the data processing terms that apply to their paying customers:

• Hetzner. Hosting provider for our services and our file storage. Data: everything the platform stores, including files you or we upload. Hosting region: EU.
• Ory. Identity, authentication, session and OAuth token management. Data: name, email, password hash, user account metadata. Hosting region: EU.
• PostHog. Product analytics. Data: user ID, name, email, organization, feature usage events. Hosting region: EU.
• Typesense. Search index. Data: indexed copies of Intelligence Research, scoped search keys. Hosting region: EU.
• Cloudflare. Reverse proxy and CDN in front of the platform; also hosts uploaded images. Data: your IP address and request metadata for every request, and images included in the Intelligence Research. Hosting region: global.
• Microsoft 365. Document storage the platform retrieves files from. Data: file content and metadata; no user account data. Hosting region: EU.
• Sentry. Error monitoring. Data: stack traces, request metadata, incidental personal data. Hosting region: EU.
• Brevo. Transactional email delivery. Data: email address, message content and status. Hosting region: EU.
• Anthropic. AI-generated answers and reports, Ask Dedale only. Data: your request content and the Intelligence Research needed to answer it. Hosting region: global.
• Mistral. AI-generated answers and reports, Ask Dedale only. Data: your request content and the Intelligence Research needed to answer it. Hosting region: EU.
• Google. AI-generated answers and reports, Ask Dedale only. Data: your request content and the Intelligence Research needed to answer it. Hosting region: global.
• Airtable. Business data store holding the user records platform accounts are provisioned from, and feeding our Intelligence Research catalog. Data: name and email of users, business and editorial content. Hosting region: US.

We do not sell personal data, and we do not share it with data brokers or other platforms for their own marketing purposes.

8. International data transfers

The following providers may process personal data outside the European Economic Area:

• Anthropic and Google, for the content of Ask Dedale requests, processed globally.
• Cloudflare, for your IP address and request metadata, processed on its global network.
• Airtable, for the user records accounts are provisioned from, stored in a US tenant.

These transfers rely on each provider's standard data processing terms for paying customers, which incorporate the European Commission's Standard Contractual Clauses (GDPR Article 46(2)(c)). Where a US provider is certified under the EU-US Data Privacy Framework, transfers to it are also covered by the Commission's adequacy decision of 10 July 2023 (GDPR Article 45). You can request a copy of the relevant safeguards at privacy@dedale.com.

9. Individuals featured in our Intelligence Research

This policy does not cover individuals whose information appears in our Intelligence Research, such as the experts we interview. Their data is collected and processed as part of their own engagement with Dedale, and is governed by the contract and privacy information provided to them at that time.

If you are one of these individuals and want to know what we hold about you, correct it, or object to its use, contact privacy@dedale.com.

10. How long we keep data

• User account data. For the duration of your organization's contract with Dedale. After the contract ends, we keep a limited set of data, namely identity, contact details and contractual records, in a restricted-access archive for up to five years, solely to establish, exercise or defend legal claims. Everything else is deleted within 30 days of the contract ending.
• Ask Dedale requests, our gateway. Request content is retained by Dedale for 90 days for service operation, usage tracking and troubleshooting, then deleted.
• Ask Dedale requests, AI providers. Retained by the AI provider that handled them for the period stated in section 6.1, except where a provider retains them longer to investigate abuse or comply with the law, under its own terms.
• Analytics events. 13 months, and no longer than 25 months, then deleted or anonymized.
• Error logs. 12 months, then deleted.
• Backups. Deleted data may remain in encrypted backups for up to 90 days before being overwritten.

11. Analytics and tracking

When you log in, the platform enables product analytics and identifies you by your user ID and email. Logging out stops this and clears the association. Events are captured both by our backend and in your browser.

We rely on legitimate interest, as set out in section 5, for this processing, for three purposes:

• Abuse detection and IP protection. Spotting abnormal usage patterns that would breach your organization's subscription terms.
• Delivering the subscription. Understanding which Intelligence Research users look for, so the content proactively matches what organizations pay for.
• Reaching out about relevant research. When your searches show interest in a topic we cover or plan to cover, our team may contact you to share relevant Intelligence Research.

This data is:

• First-party. Events go to our analytics provider, listed in section 7, never to third-party ad-tech or advertising trackers.
• Internal use only. Used solely to operate, secure and improve the platform. We do not sell, license or share this data with data brokers or advertising platforms.
• Never used to train AI models, as stated in section 6.

We also record information transmitted through our MCP server, described in section 6.2, such as the intent of a request.

You can object to analytics processing at any time, as explained in section 12.

12. Your rights

Wherever you are based, you can:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure, subject to legal retention obligations or the establishment, exercise or defence of legal claims;
• object to processing based on legitimate interest, on grounds relating to your situation (GDPR Article 21). We will stop unless we have compelling legitimate grounds, such as protecting the platform against abuse, or the data is needed for legal claims;
• request restriction of certain processing;
• request a copy of the data you provided to us;
• give instructions about what happens to your personal data after your death (Article 85 of the French Loi Informatique et Libertes);
• lodge a complaint with a data protection authority. Ours is the French CNIL, www.cnil.fr.

There is no self-service option in the product to delete your account. User account deletion is performed by Dedale on request. To exercise any of these rights, email privacy@dedale.com; we will verify your identity before acting on the request.

We respond within one month of receiving your request. This period may be extended by two months for complex requests, in which case we will let you know.

13. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, least-privilege access controls and regular security reviews.

Access is controlled through permissions enforced on every request, and through OAuth 2.1 for API and MCP access. Any staff access to your user account for support purposes is logged.

14. Children's privacy

The platform is a professional B2B tool and is not directed at, or knowingly used by, children. We do not knowingly collect or process personal data relating to minors.

15. Changes to this policy

We may update this policy as the platform evolves. Material changes will be communicated to you, for example by email or in-app notice, before they take effect.

16. Contact

Dedale Intelligence, 7 rue de Madrid, 75008 Paris, France. privacy@dedale.com