Privacy Policy

1. Who we are

DeltaBook, operating deltabook.ai. Contact: hello@deltabook.ai.

2. What we collect

• Account: email, authentication data via our provider, plan state.
• Product content: your models, weights, threads, questions, and entered prices - your data, stored to provide the service; the record is append-only by design.
• Telemetry: product events (builds, runs, opens). Question text is captured as length and hash only, never raw; your raw question text lives only in your own thread. Cross-user surfaces derive from explicitly shared or curated aggregate content only, never auto-harvested private threads.
• Demand signals: unmet data and parameter requests are logged as aggregate product signal, never individual surveillance, never entering any prediction path.
• Payment: when billing launches, card data is handled by Stripe; DeltaBook does not store card numbers.
• With consent only, never default: precise location; full-session usage capture. Both are off until you opt in through an explicit consent control.

3. What we do not do

• No sale of personal data. No advertising use of your content.
• No market-facing contact: DeltaBook does not send market alerts, price signals, or urgency messaging. Product notifications are in-app and post-settlement.
• Enterprise tenant data: isolated per tenant, never mixed, never trained on, never migrated to any public substrate.

4. Model training

We use your content to provide and improve the services. We do not use your content to train AI models today. There is a setting for it, in Settings, and it is off until you turn it on - if you never touch it, the answer is no. We keep a dated history of what you chose and never rewrite it. Nothing you created before you turned it on was ever covered. Turning it off stops anything new from being covered; it does not withdraw permission already attached to what you made while it was on - delete that content if you want it out. Enterprise and commercial content is never trained on, and a frozen record is never training material: we commit to that, and today nothing is training substrate at all.

5. Sharing

Subprocessors for hosting, database, compute, email, and payments: Vercel, Supabase, Railway, Resend, Stripe. Legal compulsion. No other sharing.

6. Retention and deletion

Deleting your account erases your private data - threads, journal, uploads, and models never declared - within 30 days. A declared public record remains, without your name, marked withdrawn: personal data is detached from the record, so what persists contains no personal data and the record’s integrity holds. If a jurisdiction requires more, the remedy is deeper anonymization of the residual record, never removal of the record itself. Enterprise data retention follows the tenant agreement.

7. Your rights

Access, correction, deletion, and portability per applicable law. Requests: hello@deltabook.ai.

8. Transfers

Data is processed in the US and provider regions, with safeguards via provider agreements.