Privacy Policy

1. Introduction

DELLIGHT.AI Limited ("Company," "we," "us"), DIFC License CL12872. Registered address on file: DIFC Innovation One, Level 3, Dubai. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website or contact us about our products.

2. Information We Collect

We may collect the following types of information: name and contact details you provide by email or through other direct written communication; business information relevant to evaluating product fit, scoping potential engagements, or responding to your inquiry; account details when you create an account on this website, which our authentication provider Clerk collects at sign-up: the email address you register with, a name if you give one, the sign-in method you choose, and the account identifier Clerk assigns; purchase and billing records when you pay for a subscription or fixed-fee service through Stripe checkout, meaning the name and email on the account, the billing address you enter with Stripe, the item, the amount, and the payment status, but never full card numbers, which are entered with and held by Stripe; and standard technical request data from our hosting provider, such as IP address or browser information, for basic site delivery and security.

When you create an account, we keep a registration record of that account in our own database (your account identifier, the email address, and when the account was created). When you buy something, we keep the subscription and purchase records for that account in the same database: the plan or service, its status, the billing period, the amount, and the payment status, together with the customer reference Stripe assigns to you.

Business contact information from public sources. We may collect business contact details that a company publishes for business enquiries, such as a company name, a generic business email address (for example hello@ or info@) and a business postal address, from that company's own website or public business directories. We use these only to send an individual, relevant business proposal about our services. We do not buy contact lists, scrape staff directories, or use tracking pixels in these messages.

3. How We Use Your Information

We use the information we collect to respond to your inquiries, evaluate potential product fit or scoping requests, document direct written communications and any applicable agreements, operate your account and sign you in, fulfill paid subscriptions and fixed-fee services, including processing payments, renewals, cancellations, and refunds through our payment processor, maintain basic site delivery and investigate abuse or availability issues, and comply with legal obligations, including tax and accounting requirements that attach to paid transactions.

We also use published business contact details to send a business proposal to a company that publishes a business-enquiry contact, where the proposal is relevant to that company's services, on the basis of our legitimate interest in offering business-to-business services. Every such message identifies DELLIGHT.AI Limited and lets the recipient opt out by replying "no". We then stop contacting that company and keep only a minimal record of the opt-out so that it is honoured permanently.

4. Data Security

We currently rely on the security controls available in our current website hosting and direct written workflows. We will publish more specific product security terms if product-specific systems go live. However, no method of transmission over the internet is 100% secure.

5. Product-Specific Privacy

BEACON stores your online questionnaire, draft answers, submitted answers and supporting reference notes in our application database hosted by Supabase. The record is linked to your signed-in account and is available to our authorized review team. Questions and answers are not sent to AI providers by this form. Submitted versions are preserved for review; ask contact@dellight.ai for corrections or deletion. Do not enter passwords, secret keys, document-access links or personal customer details. The practice example keeps its made-up answers only in the current page and does not send them to our servers.

Product stages are stated per product — from in development to available now. Self-serve checkout exists for the stated offers — ULYSSES Pro and Premium subscriptions, AI Presence Audits, Agent-Readiness Audits, and the AMPLIFY Briefing — through Stripe-hosted payment pages; every other engagement is request-based. That checkout requires an account on this website and runs through Stripe checkout started from our own server. Any product-specific privacy terms for scoped evaluations are documented in direct written agreements until public product-specific terms are published.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

Account, registration, subscription, and purchase records are kept while your account exists. If you ask us to delete your account, we delete the account with Clerk and the registration record in our database. Records of payments you have made are kept for as long as tax and accounting law requires, and are not used for anything else in that time.

7. Third-Party Services

We rely on third-party providers for website hosting. Account sign-in on this website is operated by Clerk, our authentication provider, which holds the email address, sign-in method, and account identity you register with and processes them under its own privacy policy (clerk.com/privacy). The same account signs you in to ULYSSES at ulysses.dellight.ai. Payments are processed by Stripe: checkout runs on Stripe-hosted pages that our server opens for you, and the card details and billing address you enter there are collected and processed by Stripe under its own privacy policy (stripe.com/privacy). We receive transaction records, never full card numbers. Stripe also uses payment data for its own purposes, such as fraud prevention and meeting its own legal duties, and for those purposes Stripe acts as an independent controller. Clerk and Stripe may process your data outside the DIFC; transfers of personal data outside the DIFC take place under the transfer provisions of the DIFC Data Protection Law. If analytics providers are added later, this page will be updated before those flows go live. We do not sell your personal data to third parties.

8. Your Rights

We process personal data as a controller under the DIFC Data Protection Law, DIFC Law No. 5 of 2020. You have the right to access, correct, or delete your personal data; to object to or restrict the processing of your data; to request data portability; and, where processing rests on consent, to withdraw that consent. To exercise these rights, contact us at contact@dellight.ai. To delete your account, write to contact@dellight.ai from the email address on the account. You also have the right to lodge a complaint with the DIFC Commissioner of Data Protection. If you are outside the DIFC, you may hold equivalent rights under the law that applies to you.

9. Cookies and Browser Storage

We do not currently publish a separate cookie-management program or tracking-tool inventory for this site. When you sign in, Clerk sets two cookies on the dellight.ai domain: __session, which keeps you signed in, and __client_uat, which records when your sign-in state last changed. They exist only to operate your account, and the same sign-in carries to ulysses.dellight.ai. Stripe's checkout pages run on Stripe's own domains and set the cookies Stripe needs for payment processing and fraud prevention, governed by Stripe's cookie policy. If cookies beyond basic site delivery and sign-in are introduced on this site itself, this page will be updated before those tools go live.

To vary the homepage welcome on return visits, we store the headline position and the time the site was last visible in your browser's local storage. A return after at least 30 minutes away advances the headline. This preference contains no visitor identifier and is not sent to our servers. You can reset it by clearing this site's browser data. If browser storage is unavailable, the default headline is shown.

10. Sub-processors

The providers below process personal data on our behalf. The list states what this website's code and the linked product services call today, and it is updated before a new provider goes live.

• Vercel hosts this website and receives the standard technical request data described in section 2.
• Supabase hosts this website's database, in its Singapore region, where briefs submitted through the intake form at /book, the site's own first-party page and submission events, and the account registration, subscription, and purchase records described in section 2 are stored. The ULYSSES service keeps a separate Supabase database in the United States (us-east-1) for scan requests and results.
• Clerk operates account sign-in for this website and for ULYSSES, in the United States, and holds the email address, sign-in method, and account identity you register with.
• Stripe processes payments as described in section 7, in the United States, and holds the billing address and card details you enter at checkout.
• Cloudflare runs the Turnstile bot check on the ULYSSES scan form and stores ULYSSES scan artifacts in its R2 object storage.
• Fly.io hosts the ULYSSES product web at ulysses.dellight.ai, and hosts the SUPERHUMAN-X gateway in Ashburn, Virginia, USA.
• OpenRouter receives the text of this website's own internal working notes to compute search embeddings. Visitor submissions and scan inputs are not sent to it.
• Cerebras: AI inference, USA.
• Tavily: web search, USA.
• Upstash: gateway database, Ashburn, Virginia, USA.
• Google: Google Play Billing and Play Integrity (subscription and genuine-app checks).
• Google Workspace (Gmail): sending sign-in code emails.

What reaches an AI model

Three places on this website or the linked products take text you type. Each is described here in the terms the code supports, and nothing beyond that is promised.

• ULYSSES scan (ulysses.dellight.ai). You enter a website domain and an email address. The engine derives the company name from the domain and asks a fixed set of questions about that company, its sector and a named competitor where one is set. Those questions go to the model APIs listed here. Your email address is stored with the scan request and is not part of any question. The model APIs called are OpenAI, Anthropic, xAI, Google (Gemini, with Google Search grounding). Scan requests and results are stored by the ULYSSES service in its own database (Supabase, United States) and object storage (Cloudflare R2).
• Ask box in the Clara greeter on this website. Each request to the Clara service at clara.dellight.ai carries the question you just typed. When you ask a follow-up, it also carries your previous question and up to 300 characters of Clara's previous answer. Free text is forwarded as you wrote it, so do not type anything you would not send to a third party. While you are on this site, the exchange stays in your browser: in the greeter panel, and in your browser's session storage when you pass it to the intake form. If you choose to send a brief from that exchange, your question and Clara's answer are stored with the brief in the same place as the intake form, this website's Supabase database. Clara is a separate service, and which model answers inside it is not visible from this website's code, so it is not claimed here.
• Intake form at /book. Nothing goes to an AI provider. The brief, your name, reply-to email, company, role and optional website are stored in this website's Supabase database and read by a person. This website's Supabase database, Singapore region.

SENTINEL runs as a separate service at sentinel.dellight.ai. This website only links to it and sends it nothing you enter here.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the effective date.

12. Contact

For questions about this Privacy Policy, contact DELLIGHT.AI Limited at contact@dellight.ai. Registered address on file: DIFC Innovation One, Level 3, Dubai. DIFC License CL12872.

SUPERHUMAN-X (Android app)

This section explains how the SUPERHUMAN-X app ("the app") handles information. DELLIGHT.AI Limited (DIFC licence CL12872, DIFC Innovation One, Level 3, Dubai) is the controller under the DIFC Data Protection Law (DIFC Law No. 5 of 2020). The rest of this policy also applies. Where this section is more specific, it takes priority for the app.

What the app does

When you turn on Companion, the app listens to the conversation around you through your phone's microphone. When it judges that a fact or figure would help the discussion, it speaks a short expert insight into your earpiece. Expert insights are written by AI. Companion works on the topic being discussed, not on the people discussing it. It does not identify who is speaking, does not create voice prints, and does not build profiles of anyone. Companion keeps listening while the app is in the background or the screen is off, and a notification shows the whole time it is on. You can pause or stop it from the app or the notification.

Without a subscription, Companion writes expert insights on your phone, where your phone supports on-device AI, and the app does not send conversation text to our cloud service. Subscribers to SUPERHUMAN-X Plus get expert insights from our cloud service, described below.

You can also ask the app something directly, by typing or by voice. When you ask by voice, the app turns your speech into text on your phone, using your phone's own on-device speech recognition, and it does not keep or send the audio. Without a subscription, what you ask is handled on your phone, where your phone supports on-device AI, and is not sent to our cloud service. For subscribers, the text of what you ask is sent to our cloud service, described below.

What stays on your phone

• Audio. The app turns speech into text on your phone, using on-device speech recognition. It sends text, not audio, to our servers, and it does not save audio recordings.
• Calendar. If you allow calendar access, the app reads a few upcoming events on your phone to suggest topics. Calendar details are not sent off your phone.
• History and settings. Recent expert insights and what you asked are kept in the app's memory. They are cleared when the app closes or you clear them. Companion conversation context, including the list of topics the app has spoken about, is cleared when you stop Companion. Settings, usage counts and subscription status stay on your phone, and the app does not back them up to the cloud.

Your account

To use SUPERHUMAN-X you create an account with your email address. We send a 6-digit code to that address to confirm it is yours. We use your email address only to run your account and keep it secure, and to send you service and billing notices, such as security alerts and changes to your subscription or to this policy. We do not send marketing email and we do not share your email address with anyone for their own use.

• Where it is kept: in DELLIGHT's gateway database, hosted by Upstash in Ashburn, Virginia, USA. Your account is linked to the Google Play subscription you use with it.
• How codes are sent: through Google Workspace (Gmail), from no-reply@dellight.ai. Codes expire after 10 minutes and work once. Our database stores only a scrambled (keyed-hash) form of each code.
• On your phone: the app keeps a sign-in key and a masked form of your email address (for example a•••@example.com). It is not backed up to the cloud.
• Deleting your account: Support → Delete account in the app, or see "Your choices" below.

What leaves your phone, who receives it, and where

When you create your account, and for a subscriber while Companion is on or when you ask the app something directly:

What our gateway does not keep: conversation text, the text of what you asked, search queries, expert insights or search results. These are never written to its logs or database. The one exception is a report you choose to send (below). Subscription tokens and Google Play order numbers are stored only as scrambled (hashed) values. Your network IP address is used only for short rate limits. It is kept in hashed form for at most three hours and is not used to work out your location.

What Cerebras and Tavily keep:

• Cerebras states that it does not retain the inputs and outputs of its inference service and does not use them to train models. Short-lived technical caching (minutes, at most about an hour) can occur while requests are processed.
• Tavily receives only the short search query, never the conversation text. When you ask the app something directly, the search query can be the text of what you asked. Under its own privacy policy, Tavily may keep queries for as long as needed to provide and improve its service, and may use parts of them to improve its search results.

Payments. Google Play handles purchases. We never see your card or payment details. Google's privacy policy covers the information Google collects when you buy.

Reporting an expert insight. You can report any expert insight from inside the app.

• What a report contains: the reason you choose, any note you type, and the app version.
• The expert insight: by default it also includes the expert insight and what you asked or the search query that produced it. Turn off the include option before sending to leave them out.
• Never attached: audio, the conversation transcript, calendar data and device identifiers.
• Sending: reports go to DELLIGHT's gateway. If your phone is offline, the report waits on your phone and is deleted unsent after 30 days.
• Storage: we keep reports for 30 days to review the safety of expert insights and any privacy, purchase or support matter you report. If you are a subscriber with an active session when you send it, the report is linked to your hashed subscriber code, so a deletion request also removes it.
• Review: the DELLIGHT support team reviews reports, normally within 2 business days.

General support email. "Support" in the app opens a draft in your own email app, addressed to support@dellight.ai. Nothing is sent unless you send it. If you do, we receive your email address and what you wrote.

Other Google services in the app. The app includes Google components for:

• on-device speech recognition and AI (ML Kit and AICore);
• Google Play Billing and Play Integrity;
• the Firebase core library.

These may download speech or AI models from Google. Firebase data collection is turned off in the app. The app contains no analytics, advertising or crash-reporting SDK.

What we do not do

• We ask only for your email address, to create your account. We do not ask for your name or phone number.
• We do not identify the people in a conversation, and we do not create voice prints.
• No advertising, and we do not use an advertising ID.
• We do not sell your information.
• We do not save audio recordings, and our servers accept only text.
• We do not use your conversations to build a profile of you or anyone else.

How long we keep information

Other people in your conversation

Companion is about the topic of a conversation, not the people in it. It hears everyone near your phone, and for subscribers it turns what is said into short text that is used only to respond to the topic being discussed. It does not identify speakers, does not store audio, does not create voice prints, and keeps no transcript on our servers. We do not try to identify people. If someone mentions a name or other personal detail, it is processed only as part of responding to the topic and is not stored by us. As a courtesy, let the people you are talking with know Companion is on, and pause it if anyone prefers. Laws on listening to conversations differ by country. You are responsible for using Companion lawfully where you are.

Subscription, free trial and cancellation

SUPERHUMAN-X Plus is an auto-renewing subscription billed through Google Play: USD 14.99 per month or USD 119.99 per year, or the local price shown in Google Play. New subscribers can get a 7-day free trial on the monthly plan. Unless you cancel before the trial ends, the subscription starts and renews automatically at the shown price. You can cancel at any time in Google Play: Payments & subscriptions > Subscriptions. After you cancel, Plus keeps working until the end of the period you have paid for. Google Play's refund policy applies.

Your choices

• Companion is off until you start it. You can pause or stop it at any time, and pausing turns the microphone off.
• Permissions. You can refuse or withdraw microphone, notification and calendar permission in Android Settings. Without microphone permission, Companion cannot run.
• Not subscribing means no conversation text is sent to our cloud service. Only reports you choose to send leave your phone.
• Reports. Turn off the include option to send only your reason and note.
• Rights. You have the rights described in "Your Rights" above, including access and deletion. Your records are linked to your account and to your Google Play subscription.
  • Delete your account in the app: Support → Delete account. This deletes your email address, your account, its links to your subscription, and the reports linked to it, straight away.
  • Or by email: write to support@dellight.ai from your registered address and ask us to delete your account. We do it within 30 days and confirm by reply.
  • What remains after deletion: usage and rate counters tied to a scrambled subscriber code, with no link to your email. They expire within 31 days. To delete your subscription's records too, include your Google Play order number (it starts with "GPA."). Technical log lines carrying the shortened code also remain for up to 7 days, until Fly.io's logging service drops them.
  • Deleting the app does not delete your account. Cancelling your subscription is done in Google Play.
  • These steps are also on our delete-account page.

Security

The app talks to our gateway only over encrypted connections (HTTPS). Our AI and search provider keys stay on our server and are never in the app. The gateway gives expert insights only to copies of the app installed from Google Play with an active subscription. No method of transmission over the internet is completely secure.

Sign-in codes expire after 10 minutes, allow 5 tries, and can be used once. Code requests are limited per email address and per network, and need a genuine copy of the app.

International transfers

Our gateway, database and AI and search providers are in the United States, so information the app sends leaves the DIFC. We rely on our providers' contractual commitments and security measures to protect it, and we send only what is needed to respond to the topic.

Children

SUPERHUMAN-X is for adults aged 18 and over. It is not designed for or directed at children. We do not knowingly process information from anyone under 18. If you believe a child is using the app, contact us and we will delete any records we can link to them.

Changes

If the app starts handling information in a new way, we will update this section and its effective date before the change reaches the app.

Contact

Privacy questions and requests about SUPERHUMAN-X: support@dellight.ai

DELLIGHT.AI Limited, DIFC Innovation One, Level 3, Dubai, UAE.

You may also complain to the DIFC Commissioner of Data Protection.