Privacy Policy

Last updated: 19 October 2026

This policy explains how Demaai AB ("Dema", "we", "us") collects and uses personal data when we decide why and how it is processed, that is, when we are the controller. It covers:

people who visit our website, dema.ai;
people we talk to about our products, including prospects and our customers' business contacts;
people who attend our events and webinars;
people who use the Dema platform, for the purposes we decide ourselves;
people who contact us; and
people who apply for a job with us.

How we use cookies and similar technologies on dema.ai is explained in our Cookie Policy.

If you shop with a store that uses Dema. Online stores use Dema to analyse their orders and website activity. When we process shoppers' order, customer and tracking data for a store, we do so as the store's processor, on its instructions and under our Data Processing Addendum. The store's own privacy policy applies to that data, and the store is the right place to exercise your rights. If you contact us instead, we will forward your request to the store where we can identify it.

1. Who we are

Demaai AB, company registration number 559376-0118, Birger Jarlsgatan 7, 111 43 Stockholm, Sweden.

We have appointed a Data Protection Officer, who can be reached at dpo@dema.ai for any question about this policy or how we handle personal data.

2. What we collect and why

Visiting our website

What we collect. When you visit dema.ai, our servers record technical information such as your IP address, the pages you request, the time of the request and your browser type. Depending on the choices available in our Cookie settings, we and our partners may also collect information about how you use the site, such as pages viewed, clicks and the campaign that brought you to us, together with online identifiers. Albacross may also identify the company you are browsing from based on your IP address.

Without analytics consent, Dema may perform limited cookieless measurement. We use your IP address and user agent to generate a keyed pseudonymous identifier that changes each day. The analytics event includes that identifier, page and campaign information, and country. Lead submissions and demo bookings may also be recorded as conversion events using the form location and, for a booking, a derived booking identifier, currency and proxy conversion value. These cookieless events do not include your email address, raw IP address or user agent, do not store an identifier in your browser, and are not linked across days.

Why. We use technical information to operate and secure the website and to fix problems, based on our legitimate interest in running a reliable, secure website. We use limited cookieless measurement based on our legitimate interest in understanding website use while minimising the data involved. We use cookie-based analytics and marketing information to understand how the website is used, measure our marketing and show relevant ads, based on your consent. You can change your choice at any time through the "Cookie settings" link in our website footer. Our Cookie Policy lists the tools we use.

How long. We keep website technical information only for as long as reasonably needed to operate, secure, measure and troubleshoot the website, meet legal obligations and handle potential claims. Current cookie names and durations are available in Cookie settings.

Forms, demo bookings and sales conversations

What we collect. When you fill in a form, book a demo or talk to our sales team, we collect your name, work email address, company, job title, phone number if you give it, the topics you are interested in, your chosen meeting time and any message you send us. We also record your IP address and, if you have accepted marketing cookies, the HubSpot identifier stored in your browser. Your browser looks up your IP address using the third-party service ipify. We keep a record of our emails, meetings and notes about our conversations with you.

We may also find business contact details of people who are likely to be interested in Dema from public professional sources, such as company websites and LinkedIn, and from B2B data providers.

Why. We use this information to respond to your request and arrange meetings (steps you ask us to take before entering into a contract), and to follow up with relevant information about Dema, based on our legitimate interest in promoting our products to businesses. Where the law requires your consent to send you marketing emails, we ask for it. Every marketing email includes a way to unsubscribe, and you can object at any time by emailing dpo@dema.ai. If you have accepted marketing cookies, we also use your submission to measure our advertising, as explained in our Cookie Policy.

We keep this information in our customer relationship management and sales engagement tools.

How long. We keep this information while we are in contact with you or while you remain interested in Dema, and afterwards only as long as needed for relevant business records, legal claims or legal obligations.

Recorded meetings

We may record, transcribe and summarise business meetings to support sales and customer follow-up and maintain appropriate records. We give notice before recording and rely on consent where required by law. Otherwise, we rely on our legitimate interest in keeping an accurate record after considering the impact on participants. You can object or ask us not to record.

How long. We keep recordings, transcripts and summaries only for as long as reasonably needed for those purposes, legal obligations and potential claims. You can contact us for more information about the retention criteria that apply.

Events and webinars

What we collect. When you register for one of our events or webinars, we collect your name, email address, company and job title, and information about your participation, such as attendance and questions or poll answers. If you tell us about dietary requirements or accessibility needs, we collect that too.

For some events we book travel and accommodation for attendees. For those, we also collect your name as shown in your passport, passport number, issuing country and expiry date, nationality, date of birth, gender and phone number, and share them with our event partners and the travel and accommodation providers who make the bookings.

Why. We use registration information to run the event and to follow up afterwards, based on our legitimate interest in hosting events for our community and customers. We use dietary, accessibility and passport information only to cater for you and book your travel, based on your explicit consent, which you give when you submit the form.

How long. We keep event information only as long as needed to run and follow up on the event, arrange travel, meet legal obligations and handle potential claims. More sensitive travel information is kept only while needed for those purposes.

Using the Dema platform

This section applies to people who use the Dema platform on behalf of one of our customers.

What we collect.

Account information: your name, email address, role, company and profile image, and sign-in and security information such as log-in times, IP address and device. Sign-in is handled by our authentication provider, Clerk; we never see your password.
Usage information: the pages and features you use and how you interact with them, collected with product analytics and session-recording tools. Contentsquare (formerly Hotjar) is configured to suppress all on-page content before recordings are sent. Its additional controls suppress keystrokes in configured input fields, numeric text, email addresses and location information.
Product communications: in-app notices and banners shown through Intercom, and whether you interact with them. To identify the intended recipient and their company, Intercom receives your internal user identifier, name, work email address and company identifier. Dema's current implementation hides Intercom's default launcher and does not provide a Dema chat launcher.
Support and feedback: conversations with our support team through email or shared Slack channels, and feedback you submit through our feedback tool (Featurebase).
Technical information: error reports and diagnostic data when something goes wrong (Sentry).
Connected accounts: when you connect a third-party account, such as Google or Meta, the name and email address of that account.

Why.

To administer user access, provide the platform in the context of our contract with the customer you work for, and keep it secure, based on our legitimate interests in providing and securing the service.
To understand how the platform is used, support users, produce aggregate product-usage reporting for management and investors, and improve it, based on our legitimate interest in operating and improving our product. Mixpanel product analytics and Contentsquare session recording use cookies or similar browser storage, are enabled for authenticated platform users and are not controlled by the marketing website's Cookie settings.
To support you and send service emails, such as security notices and reports you subscribe to, based on our legitimate interests in supporting the service and communicating with users.
To tell you about new features and events, based on our legitimate interest in keeping users informed about the service. Where applicable law requires consent, we ask for it. You can unsubscribe at any time.

The data you and your colleagues put into the platform (for example, the store's order and customer data, and prompts to our AI assistant) belongs to the customer you work for, and we process it on the customer's behalf under our Data Processing Addendum. Your organisation's administrators can see how its users use the platform.

How long. We keep account, usage, product-communication, support and technical information for as long as needed to provide and secure the platform, communicate with users, support the customer relationship, meet legal obligations and handle potential claims.

Customers' business and billing contacts

We collect the names, contact details and roles of people who sign contracts with us or handle billing, and keep invoices and payment records. We use this information to manage the contract (contract and legitimate interest) and to meet our accounting obligations (legal obligation). We keep accounting records for the period required by applicable law.

When you contact us

When you email us, we collect your contact details and the content of your message, and use them to respond, based on our legitimate interest in answering enquiries. We keep this correspondence for as long as needed to handle your enquiry and any follow-up.

Applying for a job

When you apply for a job with us, we collect your name, contact details, CV, cover letter and any other information you choose to share, as well as interview notes and the results of any assessments we ask you to complete. We use an applicant tracking system, assessment provider and meeting tools to support recruitment. We process this information to assess your application, which is a step you ask us to take before entering into an employment contract, and based on our legitimate interest in recruiting the right people. We keep application information for as long as needed for the recruitment process, legal obligations and potential claims, or for future opportunities where we have an appropriate lawful basis.

3. Our integrations with Google, Meta and Slack

When one of our customers connects a Google, Meta or Slack account to the Dema platform, we access data from that account to provide the features the customer has chosen. We handle that data on the customer's behalf, and do not use it for advertising, sell it or use it to train AI models for other customers. The full details are in our Google API Disclosure, Meta API Disclosure and Slack App Disclosure. In summary:

Google

Dema's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Depending on what the customer connects, we access campaign and performance data from Google Ads and may create, update or manage campaigns, budgets, targeting and creatives when the customer instructs us to do so. We may also access analytics data from Google Analytics, search performance data from Google Search Console, product and account status data from Google Merchant Center, datasets in BigQuery, and spreadsheets in Google Sheets that a user asks us to work with. If a user connects Gmail, we can only send emails that the user asks our AI assistant to send; we cannot read their inbox. We use this data only to provide and improve the user-facing features of the Dema platform, share it only with the service providers that help us provide those features, and do not use Google Workspace data to train generalised AI or machine-learning models.

Slack

When a workspace installs the Dema Slack app, we process messages sent to or mentioning the Dema assistant, replies in its threads, Slack user and workspace identifiers and, when a user links their Slack account, that user's Slack email address. If a user individually connects their Slack account, the assistant can also, on that user's behalf, search and read conversations and files the user has access to and take actions such as sending messages. Message content is kept as conversation history in the Dema platform. Stored authorisation tokens are encrypted.

Deleting integration data

A customer can disconnect an integration in the Dema platform at any time. Disconnection stops future access through that connection but does not necessarily delete data previously imported into Dema. Customers can instruct us to delete Customer Personal Data under the Data Processing Addendum. Individuals can contact the relevant customer or email dpo@dema.ai, and we will handle the request as required by applicable law.

4. Who we share personal data with

We share personal data only as described in this policy:

Service providers that process personal data on our behalf, under contracts that require them to protect it and use it only on our instructions. They provide website hosting, consent management, server-side tagging, customer relationship management, sales engagement, email and productivity, customer support, product analytics, error monitoring, email delivery, authentication, event and webinar hosting, meeting recording, workflow automation, AI services and recruitment.
Advertising and analytics partners, such as Google, Meta, LinkedIn and Albacross, where their technologies are used in accordance with applicable law and your choices. For the collection and transmission of data through the Meta Pixel and the LinkedIn Insight Tag, we may act as joint controllers with Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company. Each provider is responsible for its own further processing and for handling rights relating to that processing.
Our customers. If you use the Dema platform, the customer you work for can see your account and how you use the platform.
Event partners and travel providers, for events where we arrange travel and accommodation.
Professional advisers, such as lawyers, auditors and insurers, where needed.
Authorities, where we are required to by law or need to protect our rights.
Buyers or investors, if our business is involved in a merger, acquisition or sale of assets, subject to confidentiality.

We do not sell personal data for money.

5. International transfers

Some of our service providers process personal data outside the EU, the EEA or the United Kingdom. Where required, we protect those transfers using a lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum. You can ask for information about applicable safeguards by emailing dpo@dema.ai.

6. How long we keep personal data

We keep personal data for as long as we reasonably need it to provide and improve our services, maintain our business relationships, meet legal and contractual obligations, resolve disputes, protect our rights and keep our services secure. When personal data is no longer needed, we delete or anonymise it.

When deciding how long to keep personal data, we consider its amount, nature and sensitivity, the risk of harm from unauthorised use or disclosure, the purposes for which we use it, the duration of our relationship with you or the relevant customer, operational and security needs, applicable limitation periods, and legal or regulatory requirements. Cookie durations are available in Cookie settings. You can contact us for more information about the criteria that apply to a particular category of personal data.

7. Your rights

If you are in the EU, the EEA, the United Kingdom or Switzerland, you have the right to:

access the personal data we hold about you and receive a copy of it;
have inaccurate or incomplete personal data corrected;
have your personal data erased;
restrict how we use your personal data;
receive your personal data in a portable format and have it transferred to another organisation (portability);
object to our use of your personal data based on legitimate interests, and at any time to its use for direct marketing;
withdraw your consent at any time, where we rely on consent, without affecting processing that took place before; and
not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. We do not make such decisions.

How to request access to your data or exercise your rights

Email dpo@dema.ai and tell us which right you want to exercise. We may ask you for information to confirm your identity before we act on your request. We respond within the periods required by applicable law and will tell you if a lawful extension applies. There is no charge unless applicable law permits one.

If you ask for access, we will give you a copy of your personal data together with information about how we use it, where we got it, who we share it with and how long we keep it. If you use the Dema platform, you can also update your account details in your account settings.

Complaints

If you are unhappy with how we handle your personal data, please contact us first. You also have the right to complain to a data protection supervisory authority. Our lead supervisory authority is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY). You can also contact the authority where you live or work: in the United Kingdom, the Information Commissioner's Office, and in Switzerland, the Federal Data Protection and Information Commissioner.

8. Additional information for US residents

This section applies to residents of California and other US states with comprehensive consumer privacy laws, to the extent those laws apply to us. It supplements the rest of this policy.

Categories of personal information we collect. In the past 12 months, we have collected the following categories of personal information, from the sources and for the purposes described in section 2:

identifiers, such as name, email address, phone number, IP address and online identifiers;
professional information, such as company and job title;
commercial information, such as contract and billing records;
internet or other electronic network activity, such as website and platform usage;
approximate geolocation derived from IP addresses;
audio and visual information, such as meeting recordings;
characteristics of protected classifications under California or federal law, such as age, gender, nationality, disability or accessibility information provided for events and travel;
inferences, such as the company you are browsing from and your likely interest in our products; and
sensitive personal information, namely passport numbers for event travel bookings and account log-in credentials, which we use only to book travel and to authenticate you.

Disclosure for business purposes. In the past 12 months, we have disclosed the categories above for business purposes as follows:

identifiers, professional information and commercial information to customer relationship management, sales, productivity, billing, authentication and support providers, to manage relationships, accounts, communications and support;
identifiers, internet or network activity, approximate geolocation and inferences to hosting, security, website analytics, product analytics and advertising providers, to operate and secure our services and measure website and product use;
audio and visual information and characteristics of protected classifications to meeting, transcription, event and travel providers, to conduct and document meetings and events and arrange requested travel or accessibility support; and
sensitive personal information to authentication providers or, for event travel details, event and travel providers, for the limited purposes described in section 2.

We keep these categories for the periods described in section 6.

Sale and sharing. We do not sell personal information for money. For purposes of US state privacy disclosures, in the past 12 months our use of advertising cookies and pixels may have constituted selling, sharing or targeted advertising involving identifiers, internet or network activity and approximate geolocation. Those categories were disclosed to advertising and analytics partners such as Google, Meta, LinkedIn and Albacross for advertising measurement and cross-context behavioural advertising. We did not sell or share the other categories listed above. You can opt out by turning off marketing cookies through the "Cookie settings" link in our website footer, by sending a Global Privacy Control signal or by contacting us. We process GPC automatically as an opt-out from selling, sharing and targeted advertising where applicable; it does not disable necessary technologies or first-party measurement that is not used for those purposes. Our Cookie Policy explains the effect of the signal in more detail. We do not knowingly sell or share the personal information of consumers under 16.

Your rights. Depending on your state, you may have the right to know what personal information we have collected about you and to access it, to correct it, to delete it, to receive it in a portable format, and to opt out of its sale, sharing or use for targeted advertising. We use sensitive personal information only for purposes that do not give rise to a right to limit its use. We will not discriminate against you for exercising your rights.

How to make a request. Email dpo@dema.ai. For access, correction and deletion requests, we may verify your request by matching the information you provide with the information we hold. We do not require identity verification for a request to opt out of sale, sharing or targeted advertising, although we may ask for information needed to apply the request. You may use an authorised agent to make a request on your behalf; we may ask the agent for proof of authorisation and, where verification is permitted, ask you to confirm your identity directly. We respond within the periods required by applicable law.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing dpo@dema.ai with the subject line "Privacy request appeal". We will respond within the time the law requires. If you are not satisfied with the outcome, you may contact your state's attorney general.

De-identified data. Where we hold de-identified information, we maintain it in de-identified form and do not attempt to re-identify it.

9. Security

We use technical and organisational measures designed to protect personal data at a level appropriate to the risk. No method of transmission or storage is completely secure.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will provide notice where required by applicable law.

11. Contact us

For any question about this policy or our handling of personal data, contact our Data Protection Officer at dpo@dema.ai, email info@dema.ai, or write to us at Demaai AB, Birger Jarlsgatan 7, 111 43 Stockholm, Sweden. Privacy requests sent to info@dema.ai are handled by our Data Protection Officer.

Turn data into decisions.

Book an intro Explore the platform