Privacy Policy

Data controller: Distortion Labs SAS, 66 avenue des Champs-Élysées, 75008 Paris, France — registered with the Paris Trade and Companies Register (RCS Paris) under No. 921 758 694. Privacy contact / requests: [email protected] Effective date: 1 June 2026

Our guiding principle: collect only what we need, and process it solely to provide the service you signed up for.

Scope. Where this policy describes processing the content of your instance, that applies to the managed-hosting plans (Indie and Team). If you self-host, you run the software on your own infrastructure and we process none of your workspace data. Studio (bespoke) engagements are governed by their own agreement. The account, billing and marketing-site sections apply whenever you have an account or use damn.dev.

1. Who is responsible for what

• For your account and billing data, Distortion Labs is the data controller.
• For the content inside your hosted instance (your workspaces, agents, messages, files), you are the data controller and Distortion Labs acts as a data processor, operating the infrastructure on your instructions. A Data Processing Agreement (DPA) is available.

2. Personal data we collect (as controller)

• Account: name, email, hashed password, workspace/subdomain.
• Billing: billing name, address, country, VAT ID and payment metadata. Card details are handled directly by Stripe — we never see or store full card numbers.
• Operational / infrastructure: server and security logs, IP addresses, timestamps and diagnostics needed to provision, secure and operate your hosted instance.
• Communications: emails and support messages you send us.

We do not read or use the contents of your workspace. The only personal data we actively process is what you share with us — your account, billing and support information. We do not log in to your instance to view its contents: any support access to your instance happens only with your explicit, time-limited and logged consent. To keep the service running we retain infrastructure-level access to the underlying server (e.g. for security patching and disaster recovery), used only as necessary and never to read your workspace data.

3. Legal bases (GDPR Art. 6)

• Performance of a contract — create your account, provision your instance, bill you.
• Legitimate interests — secure, operate and improve the service and prevent abuse (balanced against your rights and freedoms).
• Legal obligation — accounting, tax and compliance.
• Consent — where required (e.g. optional communications); withdrawable at any time.

4. Subprocessors / third parties

We rely on a small number of trusted providers:

Your agents may also send data to AI model providers you configure (e.g. OpenAI, Anthropic, OpenRouter, Ollama) — that is your choice and governed by their policies.

5. International transfers

Where a provider processes data outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission and appropriate supplementary safeguards.

6. Retention

We keep account and billing data for as long as your account is active and as required by law (invoices for 10 years under French law). When you delete your account, your instance and its data are permanently deleted without undue delay, subject only to legally required retention of billing records.

7. Your rights (GDPR Art. 15–22)

You may access, rectify, erase, restrict, object to and port your personal data, and withdraw consent at any time. Email [email protected]. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).

8. Security

We use encryption in transit, access controls, isolated per-customer instances, and audit logging. No system is perfectly secure; we will notify you and the CNIL of a qualifying personal-data breach as required by law.

9. Cookies

The marketing site uses only essential cookies. The application uses an essential cookie to keep you logged in. We do not use advertising or cross-site tracking cookies.

10. Changes

We may update this policy; material changes are notified by email or on the site.

Contact: [email protected] — Distortion Labs SAS, 66 avenue des Champs-Élysées, 75008 Paris.