Privacy Policy
This Privacy Policy explains how Sanklad Digital Ltd (company number 14223393, registered office 7 Brookfields Place, Coventry, CV6 4QF, United Kingdom; "Delegated", "we", "us") collects, uses and protects personal data when you use delegated.to, our cloud workspaces, the Delegated desktop app, the Delegated phone app, and the apps included with Delegated (Anjal, PandaQueue and PandaCrawl).
1. Who is responsible for your data
- We are the controller of your account, billing, website and service-operation data: the data we need to run Delegated for you.
- We are your processor for the data in your workspace (your conversations with your agents, your tasks, documents, inbox and the data your agents work with). For that data you, the customer, are the controller, and our Data Processing Agreement applies.
2. Data we collect
- Account data: name, email address, sign-in identifiers, and the members you invite.
- Business profile: what you tell us about your business during setup (name, website, what you do, your goals).
- Workspace data: your chats with your agents, tasks, routines, documents and pages, the team inbox, activity and audit logs, and data your agents read from or send to apps you connect.
- Connections: access tokens and keys for the AI plan and apps you connect. These are held on your workspace server or in our backend, are not shown to your browser or phone, and are used only to act for you.
- Billing data: subscription and payment details from Stripe. We never see or store full card numbers.
- Desktop app: your licence key, a machine identifier for your licence seats, and crash and error reports.
- Phone app: a notification token for your phone (if you allow notifications) and the workspace you last opened.
- Preferences: your time zone (so routines run on your clock) and notification settings.
- Support and feedback: messages you send us and suggestions you give in the setup guide.
- Operational data: logs, diagnostics, usage and security telemetry.
- Analytics and device data: page views, click events, session duration, referrer URL, approximate location (city/region derived from IP), browser type, operating system, screen size and similar technical signals collected via cookies and similar technologies. Once you sign in, we associate a pseudonymous user identifier with this activity so we can measure product usage per account.
- How you found us: the site that referred you, any campaign tags in the link, the first page you visited and, if you choose to answer, how you heard about us. We link this to your account when you sign up and to your checkout, so we know which channels bring customers. If you decline analytics cookies, we don't keep the referring visit.
3. Your AI plan and the apps you connect
- Your agents run on the AI plan you connect (for example ChatGPT, Claude, Gemini or another provider). Your conversations and the data your agents work with are sent to that provider so they can respond. Your agreement with that provider governs how it handles the data.
- If you run your team on a Claude plan, you sign in to Anthropic directly inside Anthropic's own software on your workspace. Your Claude sign-in and token never pass through us.
- Before your own plan is connected, the setup guide runs on an AI model we provide. It sees only the setup conversation.
- Apps you connect (for example Gmail, Calendar, Notion, Slack, Meta, HubSpot) receive and return data as your agents use them, under those companies' own policies.
- We do not use your data to train AI models, and we do not sell your data.
4. How we use data, and our lawful bases
- To provide the service (running your workspace and agents, sending notifications, billing): performance of our contract with you.
- To keep it secure and reliable, and to improve it (logs, diagnostics, crash reports, product analytics after sign-in): our legitimate interests in operating a secure, working product.
- To measure marketing and use analytics cookies on our website: your consent, which you can withdraw at any time.
- To support you and send service updates: contract and legitimate interests.
- To meet legal obligations (tax, accounting, responding to lawful requests): legal obligation.
5. Who we share data with
We use service providers to run Delegated. They process data for us under contracts that protect it. Our workspace sub-processors are listed in the Data Processing Agreement. In summary:
- Hetzner Online GmbH: cloud workspace servers and our website (Germany).
- Convex, Inc.: account and workspace records (United States).
- Cloudflare, Inc.: network connections to workspaces.
- Stripe: payments and subscription billing.
- Resend: service and notification emails.
- Composio, Inc.: brokering some app connections (such as Gmail and Google Calendar) on cloud workspaces.
- Apple Inc.: delivering phone notifications (a title and short text only).
- Sentry (Functional Software, Inc.): desktop app crash and error reports.
- An AI model provider for the setup guide, before you connect your own AI plan (details on request).
- Amazon Web Services (Amazon SES), Zoho (ZeptoMail) and TypeSafe: sending and sorting email in workspace inboxes.
- Retell AI and Twilio: only if you add the AI Receptionist. Recall.ai and AssemblyAI: only if you turn on meeting notes.
For our website and marketing we also use the following. They run on our marketing pages only, not inside the product (the console, workspace and account pages):
- Google Analytics 4 (Google LLC): product and marketing analytics. It collects pageviews, events, device and approximate location data, and (after sign-in) a pseudonymous user identifier we send via the Measurement Protocol to attribute conversions such as sign-ups and purchases. See Google's Privacy Policy and Google Analytics Opt-out.
- PostHog: website analytics and session recordings on marketing pages. Inside the product it records page views only, never your screen.
- Meta (Facebook): conversion measurement via the Meta pixel on marketing pages, and, when you register for a webinar, your email and name in hashed form through Meta's Conversions API. See Data deletion for removing data we have received from Meta.
We may also disclose data where the law requires it, or to a buyer of our business, who would be bound by this policy.
6. International transfers
Cloud workspace servers are in Germany. Some providers above process data in the United States or elsewhere. Where data leaves the UK or EU for a country without an adequacy decision, we rely on appropriate safeguards such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.
7. Cookies, analytics and consent
We use cookies and similar technologies (including the _ga Google Analytics cookie) to measure how visitors use the site, remember preferences and attribute conversions. On your first visit a cookie banner lets you accept all cookies, reject non-essential cookies, or choose by category (Strictly Necessary, Analytics, Marketing).
We implement Google Consent Mode v2: until you grant analytics or marketing consent, Google's tags operate in a "denied" state and do not store identifiers in your browser. You can change your preferences at any time by clearing your cookies or contacting us at kamal@delegated.to.
For signed-in users we send a pseudonymous account identifier to Google Analytics (as user_id) and to our Stripe checkout so purchase events recorded server-side can be attributed to the same session. We do not send your name, email address, password or payment card data to Google Analytics.
8. How long we keep data
- Account and billing records: while your account is open, then as long as tax and accounting law requires (usually six years).
- Cloud workspace data: while your plan is active. After it ends we keep your workspace for 30 days so you can export it or come back, then delete it; any backup copies are deleted within a further 30 days.
- Desktop app data: stays on your computer until you delete it.
- Logs and diagnostics: kept only as long as needed for security and troubleshooting.
- Phone notification tokens: removed when Apple reports them no longer valid, or when you ask us to delete your account.
9. Security
Each cloud workspace runs on its own server. Connections use HTTPS/TLS, and the phone app's link to a desktop computer is end-to-end encrypted. Access is limited to authorised people, sensitive agent actions need your approval by default, and your workspace keeps an audit log of what your agents did. No system is perfectly secure, and we will tell you promptly about a breach that affects your data.
10. Your rights
Under UK and EU data protection law you can ask to access, correct, delete, restrict or port your personal data, object to processing based on legitimate interests, and withdraw consent at any time. You can export your workspace yourself from Settings. To exercise any right, email kamal@delegated.to. For data in a workspace that belongs to someone else (for example your employer), contact them first, as they are its controller. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
11. Children
Delegated is for business use by people aged 18 or over. We do not knowingly collect data from children.
12. Data deletion
You may request deletion of your personal data and any data we have received from third-party platforms (including Meta/Facebook) at any time. To request deletion:
- Email kamal@delegated.to with the subject line "Data Deletion Request".
- Include the email address associated with your account.
- Say whether you want your whole account deleted or only specific third-party platform data (for example Meta Ads data).
We will process your request within 30 days and confirm deletion by email. We will remove your personal data, access tokens, campaign data and any other platform data received from third-party services. Some data may be kept where the law requires it or for legitimate purposes such as fraud prevention. You can also delete your account yourself in the phone app.
13. Changes to this policy
We will update this policy when how we handle data changes, and tell you about material changes by email or in the service before they take effect.
14. Contact
Sanklad Digital Ltd · Company number 14223393
7 Brookfields Place, Coventry, CV6 4QF, United Kingdom
Email: kamal@delegated.to