The short version

1. What we collect

• When you write to us. Your name, your email address and whatever you put in the message.
• When you buy something. Your name, email, billing details and the record of the purchase. Card numbers go straight to our payment processor and we never see or store them.
• When you run a test with us. The idea you gave us, what we made for it, and the results. The people who respond to your test are covered in section 2.
• When you join a creator campaign. Your handle, the platforms you connected, the posts you submitted, their public view counts, the activity through your link, and what we paid you. For payment we need enough identification to pay you lawfully once you pass certain thresholds.
• When you visit the site. A minimal record of pages viewed, kept in aggregate. See section 9.

We do not ask for and do not want anything sensitive: health, beliefs, politics, biometrics. Please do not send it.

2. Emails left on test pages

This is how we test whether people want something, so it deserves a plain explanation.

When we test an idea we publish a one-page website for it and advertise it. The page states that the product is in development or in early access. If you leave your email address there, you are telling us you would want it. Here is exactly what follows:

• Your address is used to contact you about that product only. It does not go onto a general DECA mailing list, and it is not passed to anyone else's list.
• First, one email to confirm it was you. Until you confirm, you are not counted in the test, and if you never do, nothing else comes.
• About a month later, one question: do you still want it? One press, yes or no. If you say no, nothing more comes.
• To tell real people from automated signups, we keep a scrambled code for the network a signup came from. It cannot be turned back into your internet address.
• If the product gets built, you hear from that product, and you can unsubscribe from the first message onwards.
• If the product does not get built, we tell you. You get one short message saying we did not go ahead, and your address is deleted within thirty days unless you ask us to keep you posted about what the studio does next.
• Signing up separately to hear from DECA is always a separate, optional tick. We never move you from one to the other quietly.

Where a test page takes a payment or a deposit before a product exists, the page says so clearly and the money is fully refundable until the product is delivered.

3. Why we are allowed to

For people in the United Kingdom, the European Economic Area and other places with similar law, our lawful bases are these. To do what you asked, which covers running your test, delivering your build and paying you for a campaign, we rely on performing our contract with you. To write to you about a product you asked about, we rely on your consent, which you can withdraw at any time. To keep our records, prevent fraud in campaigns and improve how our tests work, we rely on our legitimate interests, balanced against your rights. To keep tax and payment records, we rely on our legal obligations.

4. If you are a creator

We read public information from your posts: the view count, whether the post is still live, and the activity through your link. We do not have access to your account, your messages, your followers' details or your analytics beyond what you connect and what is public.

We look at patterns in that activity to detect bought or automated traffic. That review includes a person, not only a machine. If a post is turned down you are told which of the three reasons applies and what we saw, and you can dispute it.

Payment providers need identification from you above certain amounts. That information goes to them for that purpose and we hold only what we must for our tax records.

5. If you are an investor

Before we can show you anything specific we have to confirm you qualify under the applicable rules. That may mean holding documents you provide, or a confirmation from your accountant or lawyer. We keep those records for as long as the law requires us to and we do not use them for anything else.

6. Who else sees it

Only the companies that help us operate, and only for that purpose. They are bound by contract and may not use your information for their own ends. They fall into these groups: hosting and infrastructure; payment processing; email delivery; advertising platforms, which receive aggregate results rather than your details; accounting and legal advisers; and, for investor checks, verification providers.

We do not sell personal information, we do not share it for anyone else's advertising, and we have never received a government request for it. If we are ever required to hand something over, we will tell you unless the law forbids it.

7. How long we keep it

• Messages to us: two years from the last exchange.
• Test sign-ups where the product was not built: thirty days from the notice, then deleted.
• Test sign-ups where the product was built: until you unsubscribe, and thirty days after that.
• Customer and creator records: seven years, because tax law requires it.
• Investor qualification records: as long as required by the rules under which the offering was made.

8. What you can ask for

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for a particular purpose, and ask us to send it to you or someone else in a portable form. You can also withdraw consent at any time.

Write to privacy@decalabs.ai. We answer within thirty days and usually much sooner, and we will not ask you why. If you are in the United Kingdom or the European Economic Area and you are unhappy with how we handled it, you can complain to your data protection authority.

9. Cookies and measurement

This site sets no advertising cookies and no cross-site trackers. We keep a simple, aggregate count of which pages are read so we know what is worth writing.

The pages we publish for demand tests do carry measurement from the advertising platform running that campaign, because that is how the test is counted. Those pages ask for your agreement before any non-essential measurement starts, and declining does not stop you using the page.

10. Where it is held

Our systems are operated in the United States and the European Union. Where information moves between them we use the safeguards the law provides for such transfers, including standard contractual clauses.

11. Changes and contact

When this page changes, the date at the top changes with it. If a change materially affects how we use something you gave us, we will tell you directly rather than quietly updating the page.

Questions, or anything that reads as evasive to you, go to privacy@decalabs.ai and a person will answer.