Privacy policy

This policy explains what DemarcLabs collects when you use demarclabs.com and app.demarclabs.com, why, and who else sees it. We keep it short on purpose.

What we collect

• Account details: your name, work email, company, and the team you belong to.
• Workspace data: the services, locations, quotes, projects, bills, renewals, files and notes you or your advisor enter, and the fields the Service proposes from documents you ask it to read, kept alongside your confirmed values.
• Billing details: plan, invoices and payment status. Card numbers go directly to Stripe; we never see or store them.
• Usage and error logs: pages requested, timestamps, browser type and the technical details of any error, so we can keep the Service working.

How we use it

• To run the Service: showing you your workspace, sending sign-in links, and sending the email alerts you choose on the Email alerts page.
• To bill you for a paid plan.
• To provide support. DemarcLabs staff can open a workspace to help. Staff can look but not change anything; the DemarcLabs owner can change records at your request, and an advisor firm’s private records open only under a time-limited support pass the firm is told about. Each visit and change is logged and visible to that workspace.
• To connect you with a partner advisor, when your company asks for one.

We do not sell your data. We do not use an advisor’s client information to market to those clients. We do not use your data to train AI models.

Who else sees it

We rely on a small number of providers that process data on our behalf, each under its own privacy and security terms:

• Supabase (database, sign-in and file storage, hosted in the United States)
• Vercel (web hosting and anonymous page-view counts)
• Stripe (payments)
• Resend (sign-in links and alert emails)
• OpenAI (document reading: when you ask the Service to read a bill, quote or contract, the pages of that file are sent to OpenAI to extract the fields, and the result is shown to you to confirm. OpenAI’s API terms do not allow it to train on this data.)
• Sentry (error reporting; no personal data beyond what an error message contains)
• Cloudflare (DNS for demarclabs.com)

Within the Service, your workspace is visible to your own team, to the advisor firm your company has chosen, and to DemarcLabs support staff. Carriers and other providers are not users of the Service and see nothing unless you share it with them. If someone on your team shares a renewal brief by link, anyone with that link can read that one brief until the link expires (30 days) or your team stops sharing it.

Cookies

We use a cookie to keep you signed in and, for people with access to more than one firm or account, a cookie that remembers which one they are working in. Page views are counted without cookies. We do not use advertising or cross-site tracking cookies.

Keeping it safe

Data is encrypted in transit and at rest. Access between companies is enforced in the database itself, not only in the application. Staff access is limited as described above and recorded. The security page has the details.

How long we keep it

For as long as your workspace exists. When you ask us to delete it, we remove it within 30 days, except for billing records we must keep for tax purposes and backups, which age out on their own schedule.

Your choices

• Change which emails you receive, turn on two-factor sign-in, and see your recent sign-ins on My settings. Sign-in links and billing emails cannot be turned off while you have an account.
• Download the data we hold about you, or delete your account, from My settings. For anything else, write to hello@demarclabs.com.

Changes

If we change this policy in a way that matters, we will email account admins before the change takes effect.