Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information — your name, email address, organization, and role when you sign up or are invited to a workspace.
• Data you connect or upload — credentials to your data sources (stored encrypted), and any files, datasets, dashboards, and queries you create in the Service.
• Usage data — how you interact with the Service, including pages viewed, features used, and diagnostic and performance information.
• AI assistant inputs and outputs — the prompts you send to the AI assistant and the results it returns, which may include portions of your data needed to answer your request.
• Payment information — billing details processed by our payment provider (Stripe). We do not store full card numbers ourselves.
• Cookies and similar technologies — used to keep you signed in and to secure your session (see "Cookies").

2. How we use information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service;
• Authenticate you and secure your account and organization;
• Process transactions and manage billing and subscriptions;
• Respond to your requests, including those made through the AI assistant;
• Monitor usage, prevent abuse, and maintain the security and integrity of the Service;
• Communicate with you about your account, updates, and support; and
• Comply with legal obligations.

3. AI processing

The AI assistant relies on third-party large language model providers to generate responses. When you use the assistant, the content of your request — which may include portions of your connected data — is transmitted to these providers to process your query.

AI-generated code is executed in an isolated sandbox with no network access and no access to your source credentials. AI outputs may be inaccurate or incomplete and should be reviewed before you rely on them.

4. How we share information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers (subprocessors) — cloud hosting, payment processing (Stripe), model providers, email delivery, and similar vendors that help us operate the Service, under contractual confidentiality obligations;
• Within your organization — content you create may be visible to other members of your organization according to the access controls configured by your administrators;
• Legal reasons — where required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of DigDeep, our users, or others; and
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

5. Cookies

We use strictly necessary cookies to authenticate you and to protect against cross-site request forgery. These cookies are required for the Service to function and keep you securely signed in. We do not use them for advertising.

6. Data retention

We retain your information for as long as your account is active or as needed to provide the Service. We may retain and use certain information as required to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete content or close your account, we delete or de-identify the associated information within a commercially reasonable period, subject to backup and legal-retention requirements.

7. Data security

We implement technical and organizational measures designed to protect your information, including encryption of data-source credentials, role-based and row/column-level access controls, and network isolation for code execution. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. To exercise these rights, contact us using the details below. If you are in the EEA, UK, or a jurisdiction with similar laws (such as California), additional rights may apply, and we will honor them as required.

9. International data transfers

Your information may be processed and stored in countries other than your own, including where our service providers operate. Where required, we take steps to ensure that appropriate safeguards are in place for such transfers.

10. Children's privacy

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at info@treatmentgps.com.