Privacy Notice

Version: 2026-09-22

1. Who we are

d5s B.V. (“d5s”) is a Dutch besloten vennootschap with its registered office in Amsterdam, registered with the Dutch Business Register under number 42132069 and VAT identification number NL869866552B01 (“we”, “us”).

This Notice explains how we process personal data when you visit d5s websites, create or use an account, buy or evaluate our services, communicate with us, or otherwise interact with d5s.

For these activities, d5s normally decides why and how personal data is used and acts as controller. When a customer submits personal data in workspace content for d5s to process on the customer's instructions, the customer is normally the controller and d5s is its processor. That processing is governed by the applicable Data Processing Addendum (“DPA”), not only by this Notice.

2. How to contact us

• Privacy: privacy@d5s.tech
• General: hello@d5s.tech
• Legal: legal@d5s.tech
• Security reports: security@d5s.tech
• Postal address: Nieuwezijds Voorburgwal 104-108, 1012 SG Amsterdam

d5s is established in the Netherlands and has not appointed an Article 27 EU representative. Privacy questions and rights requests can be sent to privacy@d5s.tech.

2.1. Delete your d5s account

To request deletion of your d5s account and the personal data associated with it, email privacy@d5s.tech with the subject “Delete my d5s account”. Include the email address associated with your account so we can identify it. You can make this request without signing in or reinstalling the d5s app. We may verify your identity before completing the request.

If you have an active subscription, cancel it in Billing. If you own a team organisation or shared workspace, ownership may need to be transferred or the organisation deleted; active integrations may need to be disconnected. If you cannot access your account or complete these steps, explain this in your email so we can help you with the closure request.

Account closure deletes or irreversibly anonymises your account and profile data within 30 days after closure. Customer content in your personal workspace is removed as part of closure. Content controlled by another customer or organisation is handled on that customer's instructions: direct requests about that content to the customer, and we will assist as required by the DPA. Closing your individual account does not by itself delete another customer's workspace.

The retention periods and exceptions in section 9 apply:

• Organisation and customer content has a 30-day retrieval period after service termination, followed by up to 30 additional days to complete deletion from active systems.
• Billing, invoice, credit, and tax records are retained for seven years after the end of the relevant financial year, or longer where a specific legal obligation requires.
• Ordinary application and infrastructure logs are generally retained for seven days. Security-incident evidence, audit and usage records, communications, and authorised legal holds are retained only for the purposes and periods described in section 9.
• Closing an account removes local acquisition, milestone, and undelivered product-analytics records. Already-delivered pseudonymous PostHog events are not deleted individually and expire within the existing retention period of no more than one year.
• Backups and non-current object versions expire within seven days after active-system deletion and remain isolated and unavailable for ordinary use until then.

3. Personal data we process

Depending on how you use d5s, we may process:

1. Account and profile data: name, business email, profile image, organisation, workspace membership, role, authentication identifiers, and preferences.
2. Commercial data: employer, job title, sales communications, quotes, Order Forms, subscription, plan, seats, billing contact, invoice data, VAT information, payment status, and transaction references. Payment-card details are handled by Stripe and are not intended to be stored by d5s.
3. Customer content: prompts, messages, instructions, files, generated outputs, memories, configurations, connector data, tool results, approvals, and other content submitted to or produced through a workspace.
4. Usage and audit data: feature activity, model/tool choices, timestamps, account and workspace identifiers, usage quantities, account-creation and order records, administrative changes, and audit events.
5. Device, network, and log data: IP address, browser/device type, operating system, request metadata, cookie or local-storage identifiers, diagnostic data, security events, and error reports.
6. Support and communications: contact-form email address and message, attachments, call or meeting notes and the names of participants, feedback, survey responses, communications preferences, and limited network/security metadata used to prevent abuse.
7. Waitlist and marketing data: name, email, company, role, country, intended use, deployment preference, consent record, and campaign interaction.
8. Data from authorised integrations: information a user instructs d5s to retrieve from a connected third-party service, subject to the permissions granted for that integration.

We ask customers not to submit special-category data, criminal-offence data, children's data, or other highly sensitive personal data unless the parties have expressly agreed that processing, safeguards, and instructions in writing.

4. Why we use personal data and our legal bases

We process personal data:

1. To provide and administer the service: create accounts and workspaces, authenticate users, run requested agents and tools, provide support, meter usage, administer subscriptions, and perform our contracts. Legal bases: contract performance and our legitimate interests in providing an enterprise service.
2. To bill and keep records: process payments, issue invoices, maintain accounting and tax records, and prevent payment fraud. Legal bases: contract, legal obligation, and legitimate interests.
3. To secure and improve d5s: detect abuse, investigate incidents, debug errors, monitor reliability, protect customers, and improve product usability and performance. Legal bases: legitimate interests and, where applicable, legal obligations.
4. To communicate: respond to contact and access requests, send requested confirmation and access-invitation messages, provide service and security notices, manage evaluations, and conduct proportionate business-to-business sales. Legal bases: steps requested before a contract, contract performance, and our legitimate interests.
5. To send optional marketing: send product news only where the recipient has made a separate, optional choice. Refusing marketing does not prevent an access request, confirmation message, or requested invitation. Legal basis: consent. You may withdraw consent at any time.
6. To comply with law and protect rights: respond to lawful requests, enforce agreements, establish or defend claims, and meet regulatory duties. Legal bases: legal obligation and legitimate interests.

Where we rely on legitimate interests, we balance those interests against the rights and reasonable expectations of the affected people. You may request further information about that assessment.

When product analytics is enabled for the EU service, d5s measures sign-up, activation, repeat agent use, checkout and purchase conversion, referral outcomes, and acquisition-channel performance. Events are sent from d5s servers after authentication and contain a pseudonymous d5s user identifier, event timestamp, application region, normalized acquisition categories and campaign fields, and a strict allowlist of event-specific sign-up surface, completion surface, session kind, hours-since-sign-up, checkout flow, organisation kind, plan, currency, subscription status, and referral campaign properties.

This product-analytics integration does not intentionally populate dedicated fields with Customer Content, prompts, messages, names, email addresses, raw URLs or referrers, end-user IP addresses, user agents, device identifiers, external billing identifiers, or promo-code values. Person profiles, automatic event capture, session replay, browser persistence, and GeoIP enrichment are disabled. d5s relies on its legitimate interest in measuring and improving product usability and performance. You may object to this processing using the contact details above.

5. Customer content and AI services

d5s processes customer content to provide the features requested by authorised users and administrators. Depending on the selected configuration, content may be sent to model or infrastructure providers identified in our Subprocessor List.

d5s does not use customer content to train a d5s general-purpose model.

Users and organisation administrators can manage AI-processing privacy preferences in Settings. A personal or organisation no-training preference applies to the work governed by that preference. Otherwise, provider training and retention depend on the selected service and the applicable provider terms disclosed in the Subprocessor List. Google information is also subject to the additional use restrictions in section 5.1. d5s does not promise Zero Data Retention unless it is expressly stated for the applicable feature or Order.

AI-generated content may be inaccurate and may contain personal data supplied in the input or returned by an authorised source. Customers are responsible for choosing appropriate inputs, access permissions, review, and downstream use.

5.1. Google API data

When you connect a Google account, d5s requests permissions for the Google features you choose. Depending on the connection, d5s accesses email messages and drafts, Drive files, calendars and events, Search Console information, or BigQuery data. We use that information to carry out the connected features and workflows you request, such as finding and summarising information, preparing replies, scheduling events, and analysing data. Permissions and the connected account's own access determine which information is available.

Google information and outputs derived from it may be stored in your workspace, including conversations, retained tool results, files and project memory. When your requested feature uses AI, relevant information is sent to the model and infrastructure providers identified in our Subprocessor List. Transfers for these user-facing features require your consent. The Google-specific restrictions in this section apply to both the original information and information derived from it, and take precedence over more general descriptions elsewhere in this Notice.

We do not use Google Workspace API data or its derivatives to develop, improve or train generalised, non-personalised or foundational AI or machine-learning models.

We do not sell Google API data, use it for advertising, or use it to determine creditworthiness or for lending purposes. Human access is limited to your affirmative permission to view specific information, security investigations, legal requirements, or aggregated information used for internal operations as permitted by Google's Limited Use requirements. We limit transfers to those permitted by those requirements, including transfers needed for the user-facing features you consent to, security purposes, legal compliance, or a business transfer with your explicit prior consent.

d5s's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

Disconnecting a Google connection removes d5s's saved credentials and disables that saved connection. You can also remove d5s's access in your Google Account settings. Disconnecting does not itself delete information already retrieved into conversations, files or project memory. Deleting a conversation does not delete project memory derived from it. Requests to erase stored information, including information retained after a connection or memory entry is removed from view, can be sent to privacy@d5s.tech. The retention periods, backup treatment and limited legal exceptions in section 9 apply.

6. Sources of personal data

We receive personal data:

• directly from you;
• from your employer, organisation administrators, or other authorised users;
• from services you authorise d5s to connect to;
• automatically from devices, browsers, and service activity;
• from payment, authentication, infrastructure, support, and security providers;
• from public business sources or referral partners for proportionate B2B sales activity.

7. Who receives personal data

We may disclose personal data to:

1. authorised users and administrators within the relevant organisation or workspace;
2. infrastructure, hosting, authentication, email, mailbox, diagnostics, and model-routing providers listed in our Subprocessor List, including AWS, Vercel, WorkOS, Resend, Google Workspace, Slack, Sentry, Cloudflare, and the provider that serves a requested model call;
3. PostHog Inc., acting as our processor for privacy-limited product analytics in PostHog Cloud EU when that integration is enabled;
4. Stripe and other payment, fraud-prevention, tax, or financial-service recipients acting as processor, independent controller, or both for their respective activities;
5. third-party integrations, model endpoints, communication destinations, or other recipients that a customer or user directs us to use;
6. Google when the application retrieves directly hosted Google Fonts resources;
7. professional advisers, auditors, insurers, financing counterparties, and transaction advisers subject to appropriate confidentiality;
8. public authorities or other parties when required by law or reasonably necessary to protect rights, security, and safety; and
9. a successor in a merger, acquisition, financing, reorganisation, or sale, subject to appropriate safeguards.

We do not sell personal data or share it for cross-context behavioural advertising.

8. International transfers

Core customer data is stored in the regional AWS environment selected for the service, initially eu-central-1 (Frankfurt) for the EU service. Privacy-limited product-analytics events for the EU service are stored in PostHog Cloud EU in Frankfurt. Identity, website delivery, email, diagnostics, payments, AI Gateway, model inference, provider support, and customer-directed integrations may involve processing in the United States or other countries identified in the applicable provider terms or Subprocessor List.

Where a recipient is outside the European Economic Area, d5s uses an applicable adequacy decision, the European Commission Standard Contractual Clauses, the EU-US Data Privacy Framework where available, or another lawful transfer mechanism, with supplementary measures where required. Customer-directed integrations transfer data to the destination selected by the customer under that destination's terms. Contact privacy@d5s.tech to request information about applicable safeguards.

9. Retention

We keep personal data only as long as necessary for the purposes above, including legal, accounting, security, and dispute requirements:

• account and profile data: while the account is active, then deleted or irreversibly anonymised within 30 days after closure, except for the limited records described below;
• organisation and customer content: while the service is active, during a 30-day retrieval period after termination, and for up to 30 additional days while deletion from active systems completes;
• billing, invoice, credit, and tax records: seven years after the end of the relevant financial year, or longer where a specific legal obligation requires;
• ordinary application and infrastructure logs: generally seven days; security-incident evidence may be isolated for the investigation and any related legal-claim period;
• audit and usage records: retained only for the applicable security, billing, abuse-prevention, or legal purpose, with closed-user and deleted-resource identifiers anonymised when direct identification is no longer required;
• product-analytics events accepted by PostHog: retained for no more than one year under the configured PostHog Cloud EU retention boundary. Closing an account removes local acquisition, milestone, and undelivered-event records, while already-delivered pseudonymous events are not deleted individually and remain until that retention period ends;
• contact, support, and sales communications: until the request or commercial relationship is resolved, then only while reasonably needed for follow-up, a legal claim, or an applicable record-keeping obligation;
• unconfirmed access requests: seven days from submission, after which the record is deleted by the automated cleanup process;
• confirmed access requests: until general availability opens, the request is provided, refused, withdrawn, or 24 months have passed, whichever occurs first;
• optional marketing records: until consent is withdrawn or the marketing activity ends; a minimal suppression record may be retained as necessary to honour the opt-out; and
• backups and non-current object versions: deleted data remains isolated and unavailable for ordinary use and expires within seven days after active-system deletion.

If a backup is restored, d5s reapplies completed deletion and anonymisation records before returning the restored system to ordinary use. Legal holds are limited to authorised records, purposes, and periods.

10. Your rights

Subject to applicable law, you may ask to:

• access your personal data;
• correct inaccurate or incomplete data;
• erase data;
• restrict processing;
• object to processing based on legitimate interests or direct marketing;
• receive portable data you provided where applicable;
• withdraw consent without affecting earlier lawful processing;
• lodge a complaint with the Autoriteit Persoonsgegevens or another competent supervisory authority.

When d5s processes customer content only on a customer's instructions, please direct your request to that customer. We will assist the customer as required by the DPA. We may verify identity and may retain limited information where law permits or requires it.

11. Automated decisions

d5s does not make decisions about individuals that produce legal or similarly significant effects solely by automated means in its controller activities.

Customers control their own workflows and must implement appropriate human review and legal safeguards before using automation in consequential contexts.

12. Security

We use technical and organisational measures designed to protect personal data, taking account of risk. Where we process personal data on a customer's behalf, the measures we commit to are described in Annex 2 of the Data Processing Addendum. No method of storage or transmission is completely secure.

13. Cookies and browser storage

Our Cookie Notice explains the cookies and similar technologies used on d5s websites and applications, their purposes, providers, and retention. Where consent is required, we request it before setting the relevant technology and provide a way to withdraw it.

14. Children

d5s is a business service and is not intended for children. Users must be at least 18 or the age required to enter a binding business agreement in their jurisdiction. We do not knowingly collect children's personal data in our controller activities.

15. Changes

We may update this Notice as our services or legal obligations change. The page will show the current version and effective date. We will provide additional notice of material changes where required.

16. Complaints

Please contact privacy@d5s.tech first so we can try to resolve your concern. You may also complain to the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens https://autoriteitpersoonsgegevens.nl/