Privacy Policy

Anthony Suherli, contactable at anthonysuherli@gmail.com, is the controller of your personal data.

• Account data:your email address and authentication identifiers. Accounts are created and managed by Supabase Auth, using either email + password or "Continue with Google" / "Continue with GitHub" OAuth sign-in — in the OAuth case we receive the email address and basic profile identifier associated with your Google or GitHub account.
• Your Content: the knowledge bases, sources, findings, and queries you submit or that the Service researches and ingests on your behalf. This is stored in our Supabase Postgres database, scoped to your account.
• Usage & device data: product-analytics events (page views, feature usage, session identifiers, browser/device info, approximate location derived from IP) captured via PostHog.
• Early-access / waitlist data: if you request an invite at delapan.ai/signup before you have an account, we collect the email address you submit (and, on some forms, a name and short use-case description) to contact you about the beta.
• Payment data: none. delapan is currently a free, invite-only beta with no paid plans, so we do not collect or process any payment information.

• To provide, operate, secure, and improve the Service.
• To research and process Your Content — e.g. running web searches, extracting page content, and generating findings using the model and search providers listed below.
• To send account and service email (e.g. verification, password reset, beta invites).
• To communicate service notices and, with consent where required, product updates.
• To comply with legal obligations.

We do not sell your personal data. We do not use Your Content to train our own models. Processing Your Content (e.g. research, enrichment, synthesis) is performed using the third-party model providers listed in Section 5, under their own API terms — which, as of this writing, do not use API inputs to train their models by default.

Performance of our contract with you; your consent (e.g. certain analytics or marketing); our legitimate interests (security, improvement); and legal compliance.

We share data with service providers strictly to run the Service, including:

• Supabase — Postgres database (hosted in the AWS us-west-2 region), authentication, and storage.
• Vercel — hosts the delapan.ai website and application, and provides the AI Gateway used to route some model calls.
• Railway — hosts the backend API (api.delapan.ai).
• PostHog — product analytics.
• Resend — transactional email delivery.
• Anthropic and OpenAI — large-language-model providers used to research, extract, and synthesize findings, and to generate embeddings; called directly and via Vercel AI Gateway.
• Tavily — web search and page-content extraction used during knowledge-base research.

We require these processors to protect data and use it only on our instructions.

Your data may be processed outside Indonesia — our database is hosted in the AWS us-west-2 region (Oregon, US), and our hosting and model providers may process data in the US and other regions. Where required, we rely on appropriate safeguards (e.g. standard contractual clauses) for cross-border transfers, consistent with the PDP Law and GDPR.

We keep personal data while your account is active and as needed for the purposes above, then delete or anonymise it within a reasonable period, unless law requires longer retention. Early-access/waitlist entries are kept until you are invited to the beta or you ask us to delete them.

Subject to applicable law (PDP Law / GDPR), you may request to access, correct, delete, restrict, or port your data, withdraw consent, or object to processing. Contact anthonysuherli@gmail.com. You may also lodge a complaint with the relevant data-protection authority.

We use reasonable technical and organisational measures, including encryption in transit and Postgres row-level security to scope Your Content to your account. No system is perfectly secure; we will notify you of breaches as required by law.

The Service is not directed to children under the age required for consent in your jurisdiction. We do not knowingly collect their data.

We use cookies/local storage that are necessary to operate the Service (e.g. keeping you signed in) and PostHog analytics cookies to understand feature usage. We do not currently show a separate cookie-consent banner for non-essential cookies; if that changes, or if we serve visitors in a jurisdiction that requires one, we will add it before it applies to you.

We may update this Policy; material changes will be notified via the Service or email.

Privacy questions / rights requests: anthonysuherli@gmail.com.