Daemon Privacy Policy
Daemon is a personal AI assistant made by Revline Group Ltd ("Revline", "we", "us"), a company registered in England and Wales with its registered office at 66 Paul Street, London EC2A 4NA, United Kingdom. This policy explains what information Daemon collects, how it is used, who it is shared with, how long it is kept, and how you can have it deleted. It covers the Daemon service at daemon.revlinehq.com and the Daemon apps.
If you only read one section, read section 3, which covers information we receive from your Google Account.
1. Who is responsible for your data
Revline Group Ltd is the controller of the personal data described in this policy. You can contact us at support@revlinehq.com. Our general support address is support@revlinehq.com.
2. Information we collect
Account information. Your name, email address and the sign-in details needed to run your Daemon account.
Information you give Daemon. The messages, instructions and preferences you send to your assistant, and the facts and reminders it stores at your request.
Information from your Google Account (only if you connect it). See section 3.
Technical information. Basic logs such as timestamps, error reports and device type, used to keep the service secure and working. Error monitoring is provided by Sentry. We do not use advertising or cross-site tracking cookies.
3. Google user data
You choose whether to connect a Google Account. Connecting it is optional. When you do, Google shows you a consent screen listing exactly what you are allowing, and you can approve or decline.
3.1 What we access and why
Daemon requests read-only access to the following:
- Google Calendar (read-only). Event titles, times, attendees and locations, so that Daemon can tell you what is on your day, warn you about clashes, and prepare you for meetings.
- Gmail (read-only). The content and metadata of messages in your mailbox, so that Daemon can summarise your inbox, flag messages that need a reply, and answer questions about your email.
- Basic profile. Your Google email address and account identifier, so that we know which account is connected.
We use Google user data only to provide and improve the user-facing features of Daemon that you can see and use, for you. Daemon does not send email, create or change calendar events, or modify your Gmail or Calendar with these permissions. If we add features that send email or write to your calendar, we will ask you for the additional permission separately, and we will update this policy before we do.
3.2 Google API Services User Data Policy: Limited Use
Revline's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In line with those requirements:
- We use Google user data only to provide or improve the user-facing features of Daemon that are visible in the Daemon interface.
- We do not use Google user data for advertising, including retargeting, personalised advertising or interest-based advertising.
- We do not sell Google user data, and we do not transfer it to data brokers, advertising platforms or information resellers.
- We do not transfer Google user data to anyone except (a) as needed to provide or improve the user-facing features of Daemon, such as the service providers listed in section 6 that process data on our behalf, (b) where necessary to comply with applicable law, or (c) as part of a merger, acquisition or sale of assets, with your prior consent where the law requires it.
- We do not allow humans to read Google user data, unless (a) we have your affirmative consent for specific messages or items, (b) it is necessary for security purposes, such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymised and is used for internal operations.
- We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. Daemon uses third-party AI models only to process your data to answer you, and we require those providers not to train on that data. Any personalisation Daemon learns about you, such as your preferences, is kept in your own tenant and used only for you.
3.3 How Google user data is handled
Daemon fetches your calendar and mailbox content when it needs it to carry out a task for you. It keeps the minimum needed for the feature to work, such as short summaries, extracted facts and reminders you asked for, and the secure tokens that keep your connection alive. We do not build a copy of your whole mailbox.
4. How we use information
We use information to:
- run your Daemon account and deliver the assistant's features to you;
- keep the service secure, prevent abuse and fix faults;
- communicate with you about the service, such as security notices and changes to this policy;
- meet our legal obligations.
We do not sell personal data and we do not use it for advertising.
Our lawful bases under UK GDPR are performance of our contract with you (providing the service), our legitimate interests in securing and improving the service, your consent (for connecting a Google Account, which you can withdraw at any time), and legal obligation.
5. Storage and security
- Per-tenant isolation. Each Daemon customer runs in its own isolated tenant. Database access is restricted by row-level security so that one tenant cannot read another tenant's data.
- Encryption. Data is encrypted in transit using TLS. Sensitive data, including Google user data and your Google access tokens, is encrypted at rest using AES-256-GCM, with encryption keys held separately from the data.
- Access control. Revline staff do not have routine access to your content. Access is limited, logged, and only permitted in the circumstances set out in section 3.2.
- Tamper detection. Stored records are integrity-checked so that unauthorised changes are detected.
No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.
6. Who we share information with
We share information only with service providers that process it on our behalf, under contracts that restrict them to doing so for Daemon and not for their own purposes:
| Provider | Purpose | Data involved |
|---|---|---|
| OVHcloud | Server hosting | All Daemon data, stored encrypted |
| Anthropic | AI model processing | Content your assistant needs to answer you, including Google user data when a task requires it; not used for model training |
| OpenRouter | Routing requests to AI models | Same as above, passed through; not used for model training |
| Sentry | Error monitoring | Technical error data; Google user data is not sent |
We may disclose information where required by law or to protect rights, safety and security. We do not share Google user data for any other purpose.
7. How long we keep data and how to delete it
Disconnecting Google. You can disconnect your Google Account at any time, either in Daemon settings or at myaccount.google.com/permissions by removing access for Daemon. When you disconnect, we stop all access immediately and delete your Google access tokens. We then delete the Google user data we hold for you within 30 days.
Deleting your account. To delete your account and everything stored in it, email support@revlinehq.com from your account address. We will confirm and complete deletion within 30 days. Encrypted backups containing your data are overwritten on their normal cycle, which completes within 35 days after deletion.
Otherwise. We keep account information while your account is open. Technical logs are kept for up to 12 months. We may retain limited records for longer where the law requires it, for example accounting records.
8. Your rights
Under UK GDPR, and similar laws where they apply to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to our processing of it, or move it to another service. You can withdraw consent at any time. To exercise a right, contact support@revlinehq.com. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).
9. International transfers
Some of our providers are located outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK we rely on appropriate safeguards such as the UK International Data Transfer Addendum or an adequacy decision.
10. Children
Daemon is not intended for anyone under 18, and we do not knowingly collect personal data from children.
11. Changes to this policy
We will post any changes on this page and update the effective date. If a change affects how we use Google user data, we will notify you by email or in the app before it takes effect and, where required, ask for your consent again.
12. Contact
Revline Group Ltd, 66 Paul Street, London EC2A 4NA, United Kingdom
Privacy: support@revlinehq.com
Support: support@revlinehq.com