Privacy Policy

1. Who we are

Your data is yours. We use it only to run Dagny for you, we never sell it, and you can access, export, or delete it at any time.

Dagny is operated by Agencies AS (org. nr. 937 604 408), Frydenlundgata 6 A, 0169 Oslo, Norway. We are the data controller for the personal data described in this policy. For questions about privacy or to exercise your rights, email hello@bydagny.com.

Where we process personal data on behalf of a paying customer — for example, information about the visitors or contacts of a website we build and run for them — we act as a data processor and that processing is governed by our Data Processing Agreement.

2. What we collect

• Account & identity. Your email address and authentication details, used to sign you in and contact you.
• Business details you give us. Business name, address, phone, industry, services, goals, existing website, brand assets, and social links — the inputs we need to build and run your business.
• Enrichment data. Publicly available information we fetch about your business from your website, Google Business Profile, the Norwegian Business Register (Brønnøysund / Brreg), and similar public sources to fill gaps.
• Payment details. Billing email and subscription status. Card payments are handled by Stripe — we never see or store your full card number.
• Usage & device data. How you interact with the app, IP address, browser/device type, pages viewed, and aggregated session analytics and heatmaps.
• Support communications. Messages you send us by email or in-app chat.
• Connected services (optional). If you connect a tool such as Slack, Linear, Attio, Granola, or GitHub, we access only the data covered by the permissions you grant, to power the workspace assistant. You can disconnect at any time.

3. Why we use it & our legal basis

Under the GDPR, we rely on the following legal bases:

• To provide the service — operate the AI agents and workspace you use to run and grow your business (marketing, content, sales, support, analytics, and operations across the tools you connect), and build, host, and maintain your website. Basis: performance of our contract with you (Art. 6(1)(b)).
• Enriching your business profile — fetching publicly available information about your business so we can set up and run Dagny for you faster and better. Basis: legitimate interests.
• Billing and fraud prevention. Basis: contract and our legitimate interests (Art. 6(1)(f)).
• Transactional email — sign-in links, build status, and billing notices. Basis: contract.
• Improving and securing Dagny — analytics, error monitoring, and abuse prevention, in aggregate. Basis: legitimate interests.
• Non-essential cookies and product analytics. Basis: your consent (Art. 6(1)(a)) on our marketing pages; contract and legitimate interests (Art. 6(1)(b) and (f)) for analytics within the signed-in product and onboarding, where it is operational to the service.
• Legal compliance — tax, accounting, and responding to lawful requests. Basis: legal obligation (Art. 6(1)(c)).

We may send you occasional product updates, tips, and offers about Dagny. You can opt out at any time using the unsubscribe link or by emailing us — this does not affect transactional messages about your account. Basis: consent or legitimate interests.

We do not sell your personal data and we do not use it for third-party advertising.

4. AI processing

Running the service involves sending relevant personal data — the business information and context you provide, the content of your prompts, and data from tools you connect — to AI model providers, accessed through the Vercel AI Gateway, so they can generate content, take the actions you request, and operate your agents. We use these providers under terms that limit their use of the data to providing the service, prohibit using your data to train their models, and provide for transient processing rather than long-term retention. AI output can contain mistakes; you can review and change anything, and you remain responsible for what is published or sent.

Dagny's automated processing is not used to make decisions that produce legal or similarly significant effects on an individual. You stay in control: you can review, adjust, or stop what the agents do.

5. Who we share it with

We share personal data only with the service providers (sub-processors) needed to run Dagny, each bound by a data-processing agreement and permitted to use the data only on our instructions:

We may also disclose data where required by law, or in connection with a merger, acquisition, or sale of assets (with notice to you).

6. International transfers

Some of our providers are located outside the EEA, primarily in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (and equivalent safeguards) to protect it. A copy of the relevant safeguards is available on request.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the service. After your account closes, we delete or anonymise personal data within 90 days, except where we must retain it to meet legal obligations — for example, invoicing and accounting records, which Norwegian law requires us to keep for five years. Personal data held in routine backups is deleted on the normal backup-rotation cycle.

8. Security

We use encryption in transit, access controls, reputable infrastructure providers, and the principle of least privilege to protect your data. No system is perfectly secure, but we work to protect personal data against unauthorised access, loss, or misuse, and will notify you and the authorities of a qualifying personal data breach as required by law.

9. Your rights

If you are in the EEA/UK, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email hello@bydagny.com. We respond within one month.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) (www.datatilsynet.no) or your local supervisory authority.

10. Cookies & tracking

We use cookies and similar technologies that are strictly necessary to run the app (for example, keeping you signed in), and — with your consent where required — analytics and session tools (Mixpanel, Microsoft Clarity) and our support chat (Intercom) to understand and improve how Dagny is used.

On our public marketing pages, those analytics and session tools load only after you accept them in the cookie banner. Inside the signed-in product and the onboarding flow they are always active: they are operational to the service you are using, let us provide support, and help us keep the product working reliably. Basis: performance of our contract with you and our legitimate interests (Art. 6(1)(b) and (f)). Strictly necessary cookies are always on everywhere.

You can change or withdraw your consent for the marketing pages at any time: manage cookie settings. You can also control cookies through your browser settings.

11. Children

Dagny is a business tool not intended for children. We do not knowingly collect personal data from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email or in-app, and the “last updated” date above will change. Continued use of Dagny after an update means you accept the revised policy.

This policy works alongside our Terms of Service and, for data we process on your behalf, our Data Processing Agreement.

13. Contact

Agencies AS, Frydenlundgata 6 A, 0169 Oslo, Norway. hello@bydagny.com.