Privacy Policy

1. Who we are

Diabase ("we", "us", "our") is a Scandinavian company building AI tools and infrastructure for European teams. Our primary product is Chisel, a collaborative AI workspace available at chisel.diabase.ai.

For questions about this policy or your data, contact us at privacy@diabase.ai.

2. What data we collect

We collect only what we need to provide and improve our services:

Account data

• Email address
• Name (if provided)
• Organisation name (if provided)
• Password (hashed, never stored in plain text)

Usage data

• Pages visited and features used
• Browser type and operating system
• IP address (anonymised where possible)
• Timestamps of interactions

Waitlist data

• Email address
• IP address
• Referral source

Content data

When you use Chisel, your conversations, workflows, and uploaded files are stored to provide the service. This data belongs to you and is processed according to your workspace settings, including any lockdown mode restrictions you configure.

3. Why we collect it

Under GDPR, we process your data based on the following legal grounds:

• Contract performance — to provide the services you signed up for
• Legitimate interest — to improve our products, prevent abuse, and ensure security
• Consent — for marketing communications (waitlist, newsletters), which you can withdraw at any time
• Legal obligation — to comply with applicable laws and regulations

4. Where your data is stored

All data is stored within the European Union. We do not transfer personal data to countries outside the EU/EEA unless required to provide a specific service you've requested and only with appropriate safeguards in place.

If you enable lockdown mode in Chisel, your content data is restricted to the specific country or region you configure. No exceptions.

5. How we protect your data

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Access controls and authentication
• Regular security assessments
• Incident response procedures

6. Data sharing

We do not sell your data. We do not use your content data to train AI models. We share data only when:

• You explicitly instruct us to (e.g., integrations you configure)
• Required by EU/EEA law or regulation
• Necessary for service providers who process data on our behalf, under strict data processing agreements and within the EU/EEA

7. Data retention

We keep your data only as long as necessary:

• Account data — retained while your account is active, deleted within 30 days of account deletion
• Content data — retained while your account is active, deleted within 30 days of account deletion or upon your request
• Usage data — anonymised or deleted after 12 months
• Waitlist data — retained until you unsubscribe or the waitlist is closed

8. Your rights

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Restriction — limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, email privacy@diabase.ai. We respond within 30 days.

9. Cookies

We use minimal cookies:

• Session cookies — required for the application to function (authentication, CSRF protection). These are strictly necessary and do not require consent.
• Preference cookies — to remember your settings (e.g., language, theme). Set only with your consent.

We do not use third-party tracking cookies or advertising cookies.

10. Third-party services

We minimise the use of third-party services. When we do use them, we ensure they are EU-based or operate under appropriate data processing agreements. We do not use services subject to the US Cloud Act for processing personal data.

11. Children

Our services are not directed at individuals under 16. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. The "last updated" date at the top of this page will always reflect the most recent version.

13. Supervisory authority

If you believe we're not handling your data correctly, you have the right to lodge a complaint with your local data protection authority.

14. Contact

For any questions about this privacy policy or your personal data:

Email: privacy@diabase.ai
General: hello@diabase.ai