Scope
This Privacy Policy describes how defft.ai collects, uses, discloses, and safeguards information when you use our website, mobile application, and related business services. Our services are designed primarily for authorized business users and are not intended for personal or household use.
If your employer, customer, or another organization provides your access to defft.ai, that organization may control the business information submitted through the service. Its agreements and instructions may also govern how that information is handled.
Information we collect
Depending on how you use the service, we may collect:
- Account and profile information, such as your name, work email address, phone number, organization, role, territory, and authentication identifiers.
- Business and customer information you or your organization provide, including company and facility details, business contact information, meetings, opportunities, packaging requirements, recommendations, and related commercial records.
- User content, including visit notes, dictated or transcribed text, photos, videos, audio, documents, responses, and other material you choose to submit.
- Location information when you choose to use map or nearby-account features. The mobile application requests location only while the app is in use and does not request background location.
- Device and service information, such as device type, operating system, app version, notification token, IP address, timestamps, request records, and security or diagnostic information.
- Usage analytics, such as which app screens and business workflows are used, whether requests succeed, broad request-duration ranges, platform/workspace type, and an internal user identifier.
- Communications, including messages and support requests you send to us.
Device permissions
The mobile application may request permission to use:
- Location to show assigned accounts and nearby business locations on a map while you use the app.
- Camera and photo library so you can capture or attach photos and videos to business records.
- Microphone and speech recognition so you can dictate editable visit notes or add audio where that feature is available.
- Notifications to alert you about work items, clarifications, prepared materials, and account activity.
You can decline or change these permissions in your device settings. Some related features may then be unavailable.
How we use information
We use information to:
- provide, authenticate, operate, and improve the service;
- organize field activity, business accounts, meetings, opportunities, and supporting evidence;
- prepare recommendations, summaries, materials, and other requested work products;
- send service notifications and respond to support requests;
- protect users, organizations, and the service from misuse, fraud, and security threats;
- comply with law and enforce applicable agreements; and
- analyze feature usage, service performance and reliability.
We do not sell personal information or customer data, use it for advertising or cross-context behavioral advertising, or share customer data for model training. We use customer data only to provide, support, secure and improve the service as described here.
How we disclose information
We may disclose information:
- Within your organization and to other authorized users according to account roles, assignments, and your organization's instructions.
- To service providers that support hosting, authentication, storage, communications, artificial-intelligence processing, security, usage analytics, diagnostics, and customer support. They may process information only to provide services to us and under appropriate contractual restrictions.
- For legal and safety purposes when reasonably necessary to comply with law, protect rights or safety, investigate misuse, or enforce agreements.
- In a business transaction involving a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.
We do not allow service providers to use customer data submitted through defft.ai for their own advertising or model training.
AI features use OpenAI and Amazon Web Services (Amazon Bedrock). Depending on the feature you request, submitted notes, transcripts, selected media or files and relevant business context may be sent to these providers to produce the requested output. The mobile app asks for permission before sending content for AI processing. Declining leaves ordinary reads and local drafting available. You can reset that permission in Privacy & support.
Our production OpenAI service is configured with zero data retention. This setting does not describe storage by defft.ai, AWS or device speech-recognition services, and does not mean that submitted records are immediately deleted from defft.ai.
Website usage analytics uses Amazon Web Services CloudWatch in the United States. We collect anonymous browser-session IDs, approved page and section names, active viewing time, and limited interaction events such as video controls, calculator use and key clicks. We do not collect names, email addresses, entered calculator values, full URLs, query strings or screen recordings in website activity events. Logs are retained for 90 days. Active time pauses in hidden tabs and after 60 seconds without activity. You can turn off collection using Privacy & usage in the footer; Do Not Track and Global Privacy Control also disable it. The preference applies to this browser. Random visit IDs last for the browser session; privacy and internal-traffic preferences are stored locally in your browser. Infrastructure may separately process request information to operate and secure the service.
Product usage analytics uses PostHog, hosted in the United States. We send limited screen and workflow events with internal user identifiers. We exclude names, email addresses, customer names, notes, prompts, transcripts, file contents, precise location, authentication tokens and raw URLs from these events. Session replay, automatic interaction capture, PostHog model training and optional third-party AI analysis are disabled. PostHog is configured to discard client IP data; defft.ai infrastructure may separately process IP addresses for service operation and security.
Data retention and deletion
We retain information for as long as needed to provide the service, meet contractual commitments, follow the instructions of the organization that controls the account, protect the service, and satisfy legal, accounting, or compliance obligations. Retention periods vary by the type of information and the business context in which it was collected. Our current PostHog free project retains usage events for up to one year. This analytics retention period is separate from retention of submitted business records and files.
Authorized users may request access, correction, export, or deletion of personal information by contacting their organization administrator or support@defft.ai. We will evaluate requests under applicable law and any controlling customer agreement. Some information may be retained where legally required or necessary for security, dispute resolution, or legitimate business records.
Security
We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encryption in transit, and security monitoring where appropriate. No system can guarantee absolute security, so users should protect their credentials and promptly report suspected unauthorized access.
Children
The service is intended for business users and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, contact us so we can review and address it.
Your choices and rights
Accounts are provided and managed by your organization; the app does not offer self-service account creation. You may request account and personal-data deletion through your organization administrator or support@defft.ai. Signing out removes your device session, but does not delete your account, submitted work or locally saved drafts. Native login sessions are stored in encrypted device storage so you can stay signed in across app restarts. You may update certain account information through the service, manage mobile permissions in your device settings, and opt out of nonessential communications where offered. When usage analytics is enabled, you can turn off future collection in the mobile app under Privacy & support, or in the web platform under Privacy & usage. The preference applies to that device or browser and does not restrict core features. Contact support to request deletion of previously collected analytics. Depending on where you live, you may also have legal rights to access, correct, delete, or obtain a copy of personal information, or to object to or restrict certain processing. Contact us to submit a request. We may need to verify your identity and coordinate with the organization that controls your account.
Changes to this policy
We may update this Privacy Policy as our services or legal obligations change. We will post the updated version here and revise the effective date. We may provide additional notice when a change is material.