Privacy Policy
Who we are
Deana is operated by DEANA.AI INC., an Illinois corporation, at 220 N Green St, 2nd Floor, Chicago, IL 60607. Questions about this policy or your information go to hello@deana.ai. This policy explains what we collect when you use the Deana service or this website, what we do with it, where it is kept, and the choices you have.
What we collect
Account and business details. Your name, business name, trade, email address, mobile number, business address, how you get paid, and the tax rates and registration numbers you want on your documents. If you give them to Deana, also your logo, licence number, insurance details, and your taxpayer identification number for W-9s.
Text messages. If you tick the box on the signup form or say yes on a call, Deana texts you confirmation codes and reminders at your mobile number. Nothing else, nobody else, and STOP ends it. Details at deana.ai/sms.html.
What you send Deana. Your emails and, later, text messages, including photos of receipts, forwarded emails, and attachments. Deana reads them to do what you ask.
Phone calls. When Deana answers your business's line, answers you on it, or places a call for you, the call is recorded and transcribed, and every call begins by saying so: whoever is on the line hears that they are speaking with an automated assistant and that the call is recorded. We keep what was said as a written transcript, a short summary, and what was booked or agreed; we do not keep the audio. The people who call your business and the people Deana calls for you hear the same notice.
What Deana makes for you. Receipts as filed, estimates, invoices, payment records, job records, weekly summaries, and standing documents.
Your customers' details. The names, email addresses, and addresses of the people you ask Deana to bill, and the record of what was sent to them and when they approved, viewed, or paid. You are responsible for having the right to share that information with us.
Payment. When you pay for Deana, our payment processor collects your card details. We receive confirmation of payment and the last digits of the card; we never see or store the full card number.
Technical records. Delivery records from our email and text providers, the network address and browser type of visitors to our website and signup form, and operational logs that let us find and fix problems. We use a bot check on the signup form, provided by our hosting provider, which may set a cookie for that purpose only. We do not use advertising cookies or trackers.
How we use it
To run Deana for you: reading your messages, filing your records, preparing and sending documents in your name, reminding your customers, answering your questions, and sending you summaries. To keep the service safe: checking that a message really came from you, limiting abuse, and investigating problems. To bill you and to tell you about your account, your trial, and changes to the service. We do not sell your information, share it with advertisers, or use your documents to build profiles of you or your customers.
Automated processing and AI
Deana is software. To understand what you send and to write replies and documents, we use artificial-intelligence models provided by Anthropic, PBC, under commercial terms that prohibit using our data to train their models. The content of your messages and attachments is sent to that provider for processing and is not retained by them beyond what is needed to process the request and to enforce their usage policies. Decisions that matter, such as sending a document to one of your customers, happen only on your instruction, and you receive a copy of everything sent.
How Deana gets better at calls
After each call, Deana notes what the call taught it about how your lines work, such as a number that screens calls or a phone menu to get through, so the next call goes better. These notes are about the mechanics of the call, never personal details, and stay with your account. We also review calls that went badly.
To test a new version of Deana before it answers anyone, we keep a small set of example calls and play them back to it. Before a call is kept this way, names, phone numbers, email addresses and street addresses are removed, so it no longer identifies you, your customers or anyone else on the call. We may use calls and messages de-identified in the same way to develop, test and train the software and models that run Deana. We never sell them, never use them to train models that others can use, and our AI provider does not train on them. To keep your calls out of this entirely, email hello@deana.ai from your registered address.
Where your information lives and how it is protected
Deana runs on Cloudflare, Inc. infrastructure in the United States. Your records and database are encrypted at rest with AES-256 and in transit with TLS. Cloudflare's platform is audited under SOC 2 Type II and ISO 27001; details are at cloudflare.com/trust-hub. On top of that, the most sensitive items, such as taxpayer identification numbers, are encrypted a second time with keys that only our application holds, and Deana never repeats them back in a message. Access to production systems is limited to the people who run the service, protected by multi-factor authentication, and logged.
Deana checks that instructions come from your registered email address, asks for a separate confirmation before sensitive actions, ignores mail that fails authentication checks, and limits how often anyone can attempt to sign up or send. Attachments that arrive by email are held in temporary storage only until they are read and filed, then removed; anything not filed is deleted within three days. No system is perfectly secure; if we learn of a breach affecting your information, we will tell you without undue delay and as the law requires.
Who we share it with
Service providers who process information on our behalf and under contract: Cloudflare (hosting, storage, and the signup bot check), Anthropic (AI processing), Resend (email delivery and receipt), Twilio (text messages and calls, when those features are on), and Stripe (payments). Each receives only what it needs for its part.
Your customers receive the documents and reminders you ask Deana to send, which carry your business name and contact details, not ours.
Authorities, when the law requires it, or to protect the rights or safety of you, us, or others; and a successor, if the business that operates Deana is sold or merged, under this policy.
How long we keep it
Your records are kept for as long as your account is open, because a receipt from three years ago is exactly what you will need at tax time. If you start signing up and stop, the partial account is deleted after 30 days. When you close your account, or it stays paused and unpaid for 90 days, we keep your records for a further 90 days so you can ask for a copy, then delete them from our live systems; backups roll off within 30 days after that. Records we must keep by law, such as billing records, are kept for the period the law requires. Word-for-word transcripts of phone calls are the exception: they are kept for 90 days, long enough to check a summary or settle a question about a call, and then removed; the summary of the call, what was booked and what was agreed stay on the job. De-identified example calls kept for testing and improving Deana, as described above, are kept until they are no longer useful for that.
How your information is protected, in plain terms
Everything travels over encrypted connections (TLS) and is stored encrypted at rest (AES-256) on Cloudflare's platform. Taxpayer identification numbers are encrypted a second time with a key that only the Deana application holds, so they are not readable in the database even by us; sign-in codes and PINs are stored as one-way hashes, never as the digits; one-time codes expire in minutes and work once. Every change to an account, whether made by you, by Deana on your instruction, or by our operations team, is written to an audit log that survives even the deletion of the account, with who made it and how. Our own staff reach customer records only through a signed-in operations portal with time-limited sessions, and that access is logged. Nothing Deana says to you or your customers is derived from other customers' data.
Deana does not rely on caller ID or a sender address as proof of identity. Any instruction that moves money, changes where documents or messages go, or changes who can reach the account is confirmed with a code sent to a different channel you own, and calls to your line from a caller ID the carrier has not vouched for are asked for a PIN.
Your rights, wherever you are
We give every customer the same rights, whatever state or province they live in: to know what we hold about you, to receive a copy of it, to correct it, to delete it, and to tell us not to sell it (we never sell it, and we do not share it for advertising). Residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the other states with consumer privacy laws, and residents of Canada under PIPEDA and of Quebec under its private-sector privacy law (Law 25), have these rights by statute; everyone else has them from us. To exercise any of them, email hello@deana.ai from the address on the account; we answer within 30 days, and we do not treat you differently for asking. Canadian and Quebec customers: your information is stored in the United States, as described above, and our contact for privacy questions is the same address.
Your choices and rights
You can ask Deana for a full copy of your records at any time, correct any detail by telling her, and ask us to delete your account and everything in it by emailing hello@deana.ai from your registered address. We will confirm when it is done. Depending on where you live, including under Canada's PIPEDA and provincial privacy laws, the EU and UK GDPR, and US state privacy laws, you may have further rights to access, correct, port, restrict, or object to our use of your information, and to complain to a privacy regulator. We honour those rights for everyone, wherever they live, and we will never treat you differently for exercising them.
Every email we send you about your account can be replied to. Marketing emails, if we ever send any, will carry an unsubscribe link.
Text messages (SMS)
When you tick the box on the signup form (part of signing up, since account codes are delivered by text), say yes when Deana asks on a call, or reply START, DEANA.AI INC. (the brand behind the Deana® service) texts you at the mobile number you gave us. The texts are one-time confirmation codes for actions you asked for and reminders you set. We do not send marketing texts. Message frequency varies with what you ask Deana to do. Message and data rates may apply.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Your mobile number and the record of your consent are shared only with our messaging carrier, Twilio, and only to deliver the messages described here. Reply STOP to any text to end texts at once, or HELP for help; you can also email hello@deana.ai. Details are at deana.ai/sms.html.
Customers outside the United States
If you are in Canada or elsewhere, your information is transferred to and stored in the United States, where privacy laws may differ from your own. We protect it as described in this policy wherever it is. By using Deana you consent to that transfer.
Children
Deana is for businesses and is not directed to children. We do not knowingly collect information from anyone under 18.
Changes
If we change this policy, we will post the new version here with a new effective date and email account holders about changes that matter before they take effect.