Privacy Policy

This Privacy Policy describes how Dariaz Intelligence (“we,” “us,” or “our”) collects, uses, processes, and protects information gathered through Dariaz.com and its associated software-as-a-service application (collectively, the “Service”).

Dariaz Intelligence provides multi-tenant AI automation, content scheduling, CRM synchronization, inbound/outbound voice receptionist, SMS messaging, email communications, and lead-discovery workflows for business subscribers (“Tenants”).

This policy applies when you visit our website, register for an account, or interact with our Service. With respect to personal data and customer contacts imported, ingested, or processed by our Tenants through the platform, Dariaz Intelligence operates strictly as a technical data processor acting on the instructions of the Tenant, who remains the primary data controller.

We collect information across several functional categories to operate the Service:

Account and Profile Credentials

Your name, email address, password hash, role classification, and multi-factor authentication (MFA) metadata. If you sign in using third-party single sign-on (such as Google OAuth), we receive your verified email address and basic profile identifier.

Business DNA Profile Data

Company name, industry, operating hours, geographic target zones, brand voice parameters, value propositions, service menus, pricing sheets, objection-handling guidelines, and customer FAQs submitted directly by you or compiled with your confirmation.

Tenant CRM Data

Contacts, pipeline deal stages, interaction notes, tasks, tags, and lifecycle statuses, used solely to execute your configured workflows. The CRM is provided by Dariaz on HubSpot: your records are held in a HubSpot account operated by Dariaz alongside other Tenants' records, each record is labelled with the workspace that owns it, and every read and write is filtered on that label so no workspace can see or change another's data.

Communications and Call Telephony

Call metadata (timestamps, caller IDs, call durations), voice call audio recordings, speech-to-text transcripts, AI-generated call summaries, SMS text content, delivery statuses, opt-in records, and opt-out/STOP events.

Marketing and Email Outreach Data

Recipient email addresses, subject lines, body content, sender verification data, delivery confirmations, bounce events, and unsubscribe logs.

Lead Discovery Data

Publicly available or platform-authorized business information retrieved on your behalf, including business names, phone numbers, public social profiles, websites, verified physical addresses, and business email addresses publicly listed on the business's own website.

Integration Credentials

Third-party OAuth refresh tokens, access tokens, and API secret keys (e.g., Twilio, SendGrid, Meta, Google, LinkedIn, HubSpot, HeyGen, Stripe).

System Telemetry and Audit Records

IP addresses, browser agents, access timestamps, authentication attempts, database mutation audit trails, billing consumption metrics (API tokens, call minutes, SMS counts, emails sent), and system error logs.

Dariaz Intelligence processes data strictly to fulfill operational and contractual requirements, including:

• Provisioning, authenticating, and securing your organization’s dedicated multi-tenant workspace.
• Generating customized marketing copy, social scripts, video scripts, review responses, and business workflows guided by your Business DNA.
• Operating the event-driven AI Receptionist to screen incoming inquiries, answer business questions, log lead data, and schedule appointments.
• Triggering event-driven follow-ups, SMS notifications, and authorized marketing campaigns based on your configured workflows.
• Syncing bi-directional updates with your external CRM.
• Metering platform consumption (call minutes, telephony units, email batches, AI tokens) and enforcing account quotas and spend caps.
• Enforcing role-based access control, monitoring platform security, detecting fraud, and maintaining immutable audit records.
• Complying with statutory requirements under Canadian law (including PIPEDA and CASL) and responding to lawful process.

AI work runs either in response to an event (a user request, an incoming voice call, or a webhook) or on a schedule the Tenant controls. The nightly Auto-Pilot, which finds new leads and drafts outreach and follow-ups for the morning, can be switched off at any time in Settings → Automation. Drafted messages to a Tenant's contacts or prospects are never sent without the Tenant's approval.

To deliver the Service, data is securely transmitted to vetted technical infrastructure providers:

AI Language Model Providers (e.g., Anthropic Claude API)

Prompt templates, Business DNA context, and interaction snippets are sent to generate content, analyze calls, and draft responses. Data sent via enterprise API is subject to enterprise confidentiality agreements. Each request carries only the data of the workspace it is made for.

CRM (HubSpot)

Contacts, deals, notes, and tasks are stored in a HubSpot account operated by Dariaz, logically separated by workspace as described under Tenant CRM Data.

Business Listings (Google Maps Platform)

Search terms built from your Business DNA (business types and service area) are sent to find prospective customers; public business details are returned.

Telephony and SMS Infrastructure (e.g., Twilio)

Voice streams, SMS payloads, phone numbers, and delivery receipts are routed through licensed telecommunications carriers.

Email Infrastructure (e.g., SendGrid)

Marketing and transactional email payloads and unsubscribe header data are routed through compliant email relay providers.

Avatar and Video Synthesis (e.g., HeyGen API)

Approved video scripts and branding parameters are processed for video production workflows.

Database and Authentication Hosting (e.g., Supabase / PostgreSQL)

Secure cloud hosting providing database services, auth infrastructure, and continuous backups.

Payment Processing (e.g., Stripe)

Payment card transactions, invoicing, and subscription renewals are handled directly by Stripe. Dariaz Intelligence never stores or processes raw credit card numbers or CVV codes.

When you connect Google integrations (such as Google Sign-In or Google Business Profile management):

• Our application requests only the minimum OAuth scopes necessary to authenticate your user profile or retrieve and post authorized business profile updates and reviews.
• We do not transfer, sell, or disclose Google user data to third parties for advertising or unsolicited targeting.
• We adhere strictly to the Google API Services User Data Policy, including the Limited Use requirements.

We implement security controls aligned with the technical architecture of our platform:

Tenant Isolation

All database tables enforce PostgreSQL Row-Level Security (RLS) linked to your unique Organization ID. Cross-tenant access is programmatically blocked at the database engine level.

Encryption Standards

Data in transit is encrypted using modern TLS (1.2/1.3). Sensitive integration keys, OAuth tokens, and confidential webhook secrets are encrypted at rest using industry-standard symmetric encryption algorithms (AES-256).

Security Limitations

While Dariaz Intelligence implements rigorous defense-in-depth measures, no transmission over the public internet or digital storage facility is 100% impenetrable. We cannot guarantee absolute security against malicious, unauthorized intrusions.

Active Accounts

Data is maintained as long as your workspace account remains active and in good standing.

Account Cancellation Grace Period

Upon formal cancellation, your account enters a 30-day grace period during which workspace data remains accessible for export or reactivation.

Purge Cycle

Following expiration of the 30-day grace period, all primary tenant records, database rows, integration credentials, Business DNA profiles, and stored transcripts are scheduled for permanent, irreversible database purging within 30 days.

Exempted Data

Limited anonymized billing ledger entries, security access logs, and audit records will be retained where strictly mandated by statutory accounting, tax, or legal defense obligations.

Tenants are solely responsible for ensuring that all personal data, contact lists, lead uploads, phone numbers, and customer information provided to Dariaz Intelligence have been collected with proper notice, informed consent, and legal authorization under applicable privacy laws (including PIPEDA, CASL, the US TCPA, and state privacy frameworks).

If you are an individual customer or lead whose data was imported or processed by a Dariaz Intelligence Tenant, you must contact that business directly to exercise your rights of access, correction, or deletion.

Dariaz Intelligence reserves the right to amend this Privacy Policy at any time. Material changes will be communicated via an in-app banner or electronic notification to the registered Account Owner email. Continued use of the Service following notice constitutes acceptance of the updated terms.

For questions regarding this policy, to request data deletion, or to submit a privacy complaint, contact our designated privacy officer at: