Privacy Policy

demiros is a service operated by CIZU ENTERPRISE LLP, KM00081505, 15th Floor, Tower Kosmos, Jaypee Greens Wish Town, Sector 134, Noida, Gautam Buddha Nagar, Uttar Pradesh 201304, India. GSTIN 09AATFC6108L1ZX. This policy explains what we collect, why, and what we do with it. Questions: platform@demiros.ai.

What we collect

• Your account. Your email address, your name if you give it, and how you signed in (password or Google). Authentication is handled by Supabase on our behalf; we never see your password.
• What you ask demiros to do. Your messages, the agents you save, the runs they produce, the results, and the record of what each run did.
• What your agents work with. When you connect a tool (for example Gmail, Slack or GitHub), demiros reads and writes the data that tool holds, as the work you asked for requires. Connections are held by our connections provider, Composio; demiros never stores your passwords for those tools.
• Usage and cost. Model time, sandbox and browser time, web searches and pages, and connector calls, measured per step so we can show you what a run cost.
• What you send through our contact form. Your name, work email, company and its size, why you are writing, and your message. We use it only to reply to you.
• Technical records. Sign-in times, IP address, browser type, and error logs.

We do not use cookies for advertising, and we do not sell anything to advertisers.

Why we hold it

To run the work you ask for; to show you your runs, results and costs; to charge for usage; to keep the service secure and find faults; and to meet legal obligations.

Who else sees it

We use these providers, and only for the purposes above:

• Google Cloud (India) — where the service and its database run.
• Supabase — sign-in, accounts and the emails they require (sign-up confirmation and sign-in links).
• Anthropic — the models that do the reasoning. Your content is sent to the model to produce your result.
• Other model providers (for example OpenAI or Google) — only when your organisation adds its own key for one, and only for the runs that use that key.
• Composio — the connections to your tools, and the files you save to Google Drive or OneDrive, which are uploaded through it.
• Resend — delivers what you send through our contact form to our own inbox, and sends the emails about your account's data: an export ready to download, a deletion scheduled, a deletion done. It also sends the email that an urgent approval is waiting for you, and escalations.
• The tools you connect, which remain yours and are governed by their own terms.

We do not sell personal data, and we do not share it for anyone else's marketing.

Where it lives, and for how long

Your data is stored in Google Cloud's Mumbai region. Some providers above process data outside India; where that happens, it is covered by their own data-transfer terms.

• Account, agents, runs and results: for as long as your account exists, and 30 days after you ask us to delete it.
• Sandbox workspaces: deleted when the run ends; an editor workspace is kept while open and up to 8 hours, its files stored so a stop loses nothing.
• Technical logs: 30 days.
• Contact form messages: until you ask us to delete them.
• Ledger and billing records: as long as the law requires.

Deleting your account or organisation. Your data is deleted 30 days after you ask, unless you restore it. Your connections, keys, sessions and schedules stop at once; for the 30 days you can only restore it or download your data. Then your agents, runs, results, files and connections are erased. Work you did in a company's organisation belongs to that organisation and stays with it: what you owned there passes to its Admins, and your private chats and personal items are erased. The audit log and billing records are kept, showing you as "deleted user". Backups age out on their own schedule.

A copy of your data. Ask for an export and we email you a link when it is ready. It needs you to sign in, and it expires after 7 days.

How it is separated and protected

Each organization's data is walled off at the database level, so one customer's queries cannot read another's. Actions that leave the system — sending an email, changing a record, pushing code — wait for a person's approval, and a saved agent repeats only what a person approved. Access to production is limited to people who need it, and sign-in is handled by Supabase, so we never hold your password.

Your choices

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it, by writing to platform@demiros.ai. You can disconnect any connected tool at any time. If you are in a place with specific data-protection rights (for example the EU or UK), those rights apply and we will honour them.

Children

demiros is for work, and not for anyone under 18.

Changes

If we change this policy in a way that matters, we will tell account holders by email before it takes effect.