Platform privacy

Didro Platform Privacy Notice

This notice explains how Didro handles personal data when people use the Didro platform: the web application, its AI agents, and the integrations a user chooses to connect, such as Google, Microsoft and Atlassian accounts.

Summary

Didro SAS provides the platform to organizations under a direct contract. For their workspace content, the customer decides and Didro processes it on the customer's behalf.
Connected Google, Microsoft and Atlassian accounts are read-only, used only when a user asks an agent a question, and only in that user's private conversations.
To answer, agents send the relevant content to AI model providers that may not train on it. Didro does not sell data, use it for advertising, or train models on customer content.
Google user data follows Google's Limited Use requirements.
Users can disconnect an account at any time, and can exercise their data protection rights through their organization or by contacting Didro.

Scope

This notice applies to the Didro platform. It supplements the Didro website privacy policy, which covers visits to the public website. Didro provides the platform to organizations under a direct contract; a customer may be a consulting firm working for its own clients. The data protection terms of that contract also apply and prevail for the customer's workspace data.

Data controller and processor

For the content of a customer's workspace, including projects, files, conversations and data retrieved from connected accounts, the customer organization is the controller and Didro is its processor: Didro processes this content only on the customer's instructions, as set out in the customer's contract.

Didro is the controller for the data it needs to run the service itself: user accounts, sign-in and security records, billing, cookies and service diagnostics. Diagnostic records can contain workspace content; Didro uses them only to operate and improve the service, as the customer's contract permits.

Company: Didro SAS
Registered office: 13 rue Saint-Lazare, 75009 Paris, France
Privacy contact: Vassili@didro.ai

Data we process

Account data comes from the user, or from their organization when it invites them. Workspace content comes from users and the customer. Data from connected accounts comes from the provider the user connects.

Workspace content can include personal data about people who do not use the platform, such as the senders of an email, meeting attendees or the authors of a document. The customer, as controller, is responsible for informing them.

Account data: name, email address, organization, role, and authentication and security records.
Workspace content: projects, uploaded files, workshop material, requirements, conversations with Didro's agents, and the documents and answers the agents produce.
Data from connected accounts, only when a user connects an account and asks the agent to use it, as described below.
Usage and technical data: pages and features used, performance measurements, error reports, device and browser information, and IP address.

Connected accounts

A user can connect their own Google, Microsoft or Atlassian account in the platform's account settings and choose which services to enable. Access is read-only: Didro's agents can search and read, but never send, create, modify or delete anything in a connected account.

Data is retrieved only when the user asks an agent a question that needs it, and only from the services the user enabled. Didro does not synchronize, copy or index a connected account in the background. Connected accounts can be used only in the user's own private conversations: what an agent retrieves is visible only to that user, unless the user chooses to share a document produced from it.

Access tokens are stored encrypted by Didro and are never shown to the AI models. Disconnecting an account stops all access immediately and deletes its access token; it is also how a user withdraws the authorization they gave.

Gmail and Outlook: search and read email messages, threads and attachments.
Google Calendar and Outlook Calendar: list calendars, read events, and check free/busy availability.
Google Drive, OneDrive and SharePoint: search, list and read files the user can already access.
Microsoft Teams: read transcripts of meetings the user can already access.
Jira: search and read issues in the project the user connected.
Basic identity (the email address, and the name where the provider shares it) to show which account is connected.

Google user data

Didro uses Google user data only to provide and improve user-facing features of the platform that the user requested: finding, reading and citing messages, events and files so that the agent can answer the user's question.

When a user connects a Google account, Didro requests read-only access to the services the user chooses, together with the user's email address:

Gmail: gmail.readonly
Google Calendar: calendar.calendarlist.readonlycalendar.events.readonlycalendar.events.freebusy
Google Drive: drive.readonly
Identity: openiduserinfo.email

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular, Didro:

does not use Google user data for advertising, and does not sell it;
does not transfer Google user data to others, except as necessary to provide or improve user-facing features (for example, sending an excerpt to the AI model provider that generates the answer), to comply with law, for security purposes, or as part of a merger, acquisition or sale of assets after obtaining the user's explicit prior consent;
does not use Google user data to develop, improve or train generalized AI or machine-learning models, and does not allow its AI providers to do so;
does not allow people to read Google user data, unless the user gives explicit consent for specific data, it is necessary for security purposes such as investigating a bug or abuse, it is required to comply with law, or the data has been aggregated and anonymized for internal operations;
opens diagnostic records and session recordings that contain Google user data only to investigate a specific problem, logs each such access, and never adds Google user data to datasets used to evaluate or train models;
lets users remove its access at any time from their Google Account, at myaccount.google.com/permissions.

Purposes and legal bases

Didro does not use customer content to train or fine-tune AI models, does not sell personal data, and does not use it for advertising.

To provide the platform: run the agents, answer users' requests, produce documents and keep conversation history. For workspace content, including data from connected accounts, Didro acts on the customer's instructions and the customer's legal basis applies; for accounts and sign-in, Didro relies on its legitimate interest in providing the service its customer contracted for.
To secure the platform: authenticate users, enforce permissions, and detect and investigate misuse. Legal basis: Didro's legitimate interest in keeping the service secure.
To support users when they ask for help. Legal basis: Didro's legitimate interest in helping users of its customers.
To maintain and improve reliability and quality, using diagnostic records of how the platform and its agents behave, including session recordings. Records that contain Google user data are opened only to investigate a specific problem, as described above. Legal basis: Didro's legitimate interest in keeping the service reliable, or consent where the law requires it for cookies, analytics and session recordings.
To meet legal obligations, such as billing, accounting and responding to lawful requests. Legal basis: legal obligation.

AI processing

Didro's agents send the content needed to answer a request, which can include excerpts of files, messages or events, to an AI model provider, which returns the answer. Didro uses these providers under terms that prohibit training models on this content and limit its retention to zero where the provider offers it, or otherwise to a short period for abuse monitoring, typically up to 30 days. Didro may use the following AI model providers; the providers and regions used for a customer are set out in its contract:

Mistral AI (France), directly or through Scaleway Generative APIs (France)
Anthropic (United States)
OpenAI (United States)
Amazon Web Services, through Amazon Bedrock
Microsoft, through Azure AI Foundry
Baseten (United States)

Automated decisions

Didro's agents assist users with their work. They do not make decisions that have legal or similarly significant effects on anyone.

Sub-processors

Didro relies on the following service providers to run the platform. Each processes personal data only on Didro's instructions and under data protection terms.

Scaleway or Amazon Web Services, depending on the hosting option in the customer's contract: application hosting, database, file storage, and the isolated environments where agents open and process documents.
Cloudflare: network delivery and protection of the platform's web traffic.
The AI model providers listed above.
Exa: web search, when an agent searches the public web. Exa receives the search query the agent writes, which may include words from the user's request, and the web addresses it visits.
Resend: transactional email, such as invitations and sign-in messages.
Sentry: error monitoring, limited to technical metadata.
PostHog: product analytics and session recordings.
Braintrust: diagnostic records of the agents' activity.

Where data is hosted

Didro offers two hosting options, chosen in each customer's contract: a European option, hosted by Scaleway in France, and an international option, hosted on Amazon Web Services in a region agreed with the customer. Workspace content, conversations and files are stored in the chosen location.

Some service providers may process data in other countries, including the United States: Anthropic, OpenAI, Baseten, Exa, Resend, Sentry, Braintrust and Cloudflare. Where the GDPR applies, transfers outside the European Economic Area rely on an adequacy decision, such as the EU-U.S. Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses. A copy of the applicable safeguards is available from the privacy contact.

Retention and deletion

Workspace content is kept while the customer's contract is active, until a user or the customer deletes it.
Didro does not keep a copy of a connected account. What an agent retrieved is kept only as part of the conversation in which it was used, and of any document produced from it, and is deleted with them.
Deleted conversations and files are removed from Didro's systems, including backups, within 30 days.
Account data is kept for the life of the account and deleted within 30 days after the account is closed.
When a customer's contract ends, its workspace data is deleted within 30 days, including from backups, unless the customer requests an export first or the law requires Didro to keep it longer.
Diagnostic records are kept for no more than 90 days. Sign-in and security logs are kept for 12 months. Billing records are kept for 10 years, as required by French accounting law.

Cookies in the platform

The platform uses cookies that are necessary to sign users in and keep their session secure. Where the law requires consent for product analytics and session replay, they run only if the user accepts them, and the user can change that choice at any time in the platform.

Security

Data is encrypted in transit and at rest. Access is limited by organization, project and user permissions, enforced on every request. Access to production systems is restricted to authorized Didro personnel who need it.

Your rights

Depending on applicable law, you can ask to access, correct, delete, restrict or export your personal data, object to certain processing, and withdraw any consent you gave. For workspace content, contact your organization's administrator; Didro will assist the customer in answering your request. For anything else, contact Didro at the privacy email above.

You can also lodge a complaint with your data protection supervisory authority. Didro's lead authority in the European Union is the Commission nationale de l'informatique et des libertés (CNIL) in France.

Children

The platform is intended for professional use and is not directed at children.

Changes

Didro will update this notice when its practices change and will change the date above. Significant changes will be announced in the platform before they take effect. If Didro changes how it uses data from a connected account, it will ask the affected users for their consent again before using that data in the new way.

Contact

For any question about this notice or to exercise your rights, contact Didro.

Privacy contact: Vassili@didro.ai
Postal address: Didro SAS, 13 rue Saint-Lazare, 75009 Paris, France