Privacy built for a system of record.

We collect the account details you provide to create and secure a workspace: name, work email, company, billing contacts, and authentication identifiers from Google, Microsoft, or password-based sign-in.

We also collect operational data generated by use of the service: uploaded files, folder names, prompts, outputs, citations, audit events, and basic device and browser metadata. That lets us run the product, secure it, and explain what happened later.

• Account and identity data
• Workspace content, including files and generated outputs
• Usage, diagnostic, and security logs
• Billing and procurement records

We use personal data and workspace data to operate Dataryo, authenticate users, process uploads, generate grounded outputs, prevent abuse, respond to support requests, and meet contractual or legal obligations.

We do not use customer files, prompts, or outputs to train general foundation models. Where model providers process requests on our behalf, they do so under service-provider terms and retention controls aligned to the workspace plan.

Uploaded files remain tied to the workspace that submitted them. Prompts and outputs are stored so the product can preserve context, lineage, and auditability across work.

Some product features route limited content to subprocessors that provide storage, authentication, analytics, billing, or model inference. The current operational controls behind that flow are summarized on the Security page.

We minimize the payload shared with each provider, keep customer content scoped to the requested action, and log the event so admins can understand who accessed what and why.

We share data only with service providers that help us operate Dataryo, with workspace administrators acting on behalf of their organization, or where disclosure is required by law or necessary to protect the service and its users.

• Infrastructure and storage providers
• Authentication, email, and billing vendors
• AI and retrieval providers used to fulfill product requests
• Advisers or authorities when legally required

We do not sell personal data, and we do not share customer content for third-party advertising.

When you use Dataryo AI features, uploaded content and derived file context may be sent to Google Gemini to generate embeddings, answers, transformations, and other requested outputs.

Workspace data is retained for as long as the account is active and for a limited period afterward to support recovery, audit, billing reconciliation, and security review. The exact retention window depends on the workspace plan and any signed order form.

When a workspace or user is deleted, we begin the configured removal workflow for files, derived artifacts, logs, and backups. Some records may be preserved longer where needed for fraud prevention, tax, accounting, or dispute handling.

We use technical and organizational controls designed to protect confidentiality, integrity, and availability, including encryption in transit, encryption at rest, access controls, environment separation, and audit logging.

If data moves across borders, we use contractual and operational safeguards appropriate to the transfer. Regional hosting options and processor controls are handled through the commercial workspace configuration.

Depending on your location, you may have rights to access, correct, export, restrict, or delete personal data. Workspace admins can handle many requests directly inside the product; for the rest, email privacy@dataryo.com.

If your company has a signed agreement with Dataryo, that agreement controls where it conflicts with this page. We may update this notice as the product and regulatory posture change. Material changes will be reflected here with a new effective date.