Last updated 3 November 2026

Privacy policy

Delegmate gives an organisation AI teammates: teammates with their own Google Workspace accounts in that organisation, who work with its people in Gmail, Calendar, Chat, Meet, Drive and the apps it connects. This policy says what we handle to do that, why, who else sees it, and what you can do about it.

Who is responsible

The organisation that uses Delegmate (the customer) decides what its teammates do and what they may reach. For the data its teammates handle, the customer is the controller and we are its processor, under our data processing agreement. For the accounts of the admins who sign in to our dashboard, and for our own business records, we are the controller.

What we handle

• Admin accounts: the name, work email and picture of people who sign in to the dashboard with Google, and what they do there (an activity list the customer’s admins can see).
• The organisation’s directory: names, emails and roles of its people, so a teammate knows its colleagues and whom it works for.
• What a teammate’s own account holds and receives: its email, calendar, chats, files shared with it, and meetings it joins, including what is said in them.
• Its working record: the jobs it was given, what it did and why, notes it keeps to do its work, and pages it publishes.
• Logins it is given: through its vault, encrypted (AES-256-GCM) and never shown back to anyone, the teammate included.
• Connected apps: what a teammate reads and writes in apps the organisation connects to it, such as Slack or a CRM.
• Billing: the plan, credits and what used them. Payment details are collected and held by Paddle, our reseller; we never see card numbers.

A teammate reaches only what its own account can reach: what is shared with it, sent to it, or open to everyone in the organisation. It does not read other people’s mailboxes, calendars or drives.

Why

To run the teammates the customer set up, under our contract with it; to bill for them; to keep the service secure and working; and to meet legal duties. We do not sell personal data, use it for advertising, or profile people.

Google user data

Delegmate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the teammates the customer set up and the features it uses. We do not sell it, use it for advertising, or use it to train general-purpose AI models, and people at Delegmate read it only with the customer’s permission, for security, or where the law requires.

AI

Teammates think with large language models from Anthropic (Claude), OpenAI and Google, reached through OpenRouter, and speak in calls with OpenAI’s voice model. What a teammate is working on is sent to these models to do that work. Under their terms for business use, they do not train their models on it.

Who else processes it

We use these providers, each only for its part:

• DigitalOcean: hosting, database and backups.
• OpenRouter, Anthropic, OpenAI and Google: AI models, as above.
• E2B and Kernel: a teammate’s computer and web browser.
• Composio: connections to apps the organisation chooses.
• Slack: where the organisation puts its teammates in its Slack.
• Resend: email from Delegmate itself, such as weekly summaries and alerts, sent from Ireland. Teammates’ own email does not go through it.
• Sentry: reports of errors in Delegmate’s own software, with names, addresses and message content taken out before they are sent.
• Mintlify: our public documentation at docs.delegmate.com, including its search and assistant. Nothing from your organisation is sent to it.
• Paddle: checkout, payments, invoices and tax, as merchant of record (and a controller of payment data under its own policy).

Some are in the United States. Transfers out of the EU, the UK and Georgia rely on the European Commission’s standard contractual clauses or an equivalent safeguard.

How long we keep it

• For as long as a teammate exists. A removed teammate’s data is deleted 30 days after it is removed (so one removed by mistake can be added back), as it is 30 days after its organisation withdraws Delegmate’s access and does not restore it.
• An organisation can delete all its data in Settings at any time; it is deleted within minutes.
• Database backups are encrypted and kept for 14 days, then deleted.
• Billing records are kept as long as tax law requires.

The teammate’s Google account and its files stay in the organisation’s Workspace, under its control.

Security

See our security page. In short: encryption in transit and for secrets at rest, encrypted backups, least access, and an activity record the customer’s admins can read.

Your rights

Depending on where you are (for example under the GDPR or Georgia’s Law on Personal Data Protection), you may ask to see, correct, delete, restrict or receive a copy of your personal data, object to its use, and complain to a data protection authority (in Georgia, the Personal Data Protection Service). If your organisation uses Delegmate, ask its admin first: it controls the teammates and can download or delete everything in Settings. Otherwise, write to us at [email protected]; we answer within 30 days.

Cookies

We use one cookie, to keep you signed in to the dashboard. No analytics or advertising cookies.

Changes

We will post changes here and tell customers of significant ones before they take effect.

Questions: [email protected] · Terms · Privacy · Refunds · Data processing · Security