Privacy Policy

OneGlimpse B.V. is a private limited company registered in the Netherlands, Chamber of Commerce number 78315654, VAT NL861343529B01. We act as the Data Controller for personal data relating to our customers’ accounts, billing, support requests and our own service operations. We act as the Data Processor for personal data contained in messages, contacts and conversations that you and your end users process through the Services.

This policy applies to dmchamp.com, app.dmchamp.com, our APIs and webhooks, and any sub-account on an Agency Customer’s white label domain where DM Champ acts as processor. For end users of an Agency’s white label deployment, the Agency’s own privacy policy controls and DM Champ is the back-end processor (see Section 15).

The Effective Date of this policy is September 2, 2026.

Information you give us directly

• Account information: name, email address, phone number, company name, role, billing address and tax identifiers
• Profile data: profile picture, time zone, language preferences, notification settings
• Workspace configuration: AI agent settings and instructions, entry point routing, FAQ resources, custom function configurations, integration settings
• Communications with us: support tickets, chats and emails, including any attachments you choose to share

Business data you upload or process through the Services

• Contacts you import or that arrive through inbound messages (name, phone, email, social profile identifiers and any custom fields you add)
• Conversation content across supported channels (text, voice notes, images, videos and documents your end users send)
• AI training resources such as FAQs, documents, knowledge base content and product information
• Custom function configurations and the inputs and outputs of any custom functions you run

Payment information

When you subscribe to a paid plan or top up credits, payment information is processed by Stripe. We do not store full card numbers or other sensitive payment credentials on our servers. We do store a token, the last four digits of your card, the card brand, and the billing address associated with your account.

Information we receive from third parties

• OAuth profile data from Google and Meta when you connect those accounts (for example, to enable Calendar booking or to authenticate Instagram or Messenger pages)
• Meta-supplied data about the Facebook Pages and Instagram accounts you connect, including page identifiers, names and messages directed to those pages
• Information from your end users that they send through any channel you have connected to DM Champ

Google user data

When you connect a Google account (Google Calendar, or a YouTube channel in the social scheduler), we use the data we receive from Google APIs only to provide the features you use with it: booking and syncing appointments, uploading and scheduling the videos you choose, showing your channel and its comments, and posting the comment replies you send. The use of raw or derived user data received from Google APIs, including Workspace APIs, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use, transfer or sell Google user data, raw or derived, to create, train or improve generalised or foundational AI or machine learning models, we do not use it for advertising, and people at our company do not read it except with your permission, for security, or where the law requires. The YouTube features use YouTube API Services; by connecting a channel you agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy. You can remove our access at any time in your Google account under Third-party apps and services (myaccount.google.com/permissions) or by disconnecting the account in the app.

Information we collect automatically

• Usage telemetry: pages visited, features used, actions taken, errors encountered
• Device and connection: IP address, browser type and version, operating system, device identifiers, referrer URL
• Approximate location derived from your IP address (typically city-level)
• Server logs and security events, including authentication attempts and rate-limit triggers

• To provide, operate, maintain and improve the Services
• To process AI conversations and media processing (such as voice note transcription and image and video understanding and generation) through the AI providers listed on our Sub-processors page
• To deliver and meter messages across supported channels (WhatsApp, Instagram, Messenger, SMS, web chat)
• To provide customer support and respond to your requests
• To process billing, manage your subscription and detect billing fraud
• To secure the Services, including by detecting and preventing abuse, fraud and security incidents
• To create aggregate, de-identified analytics that help us improve the Services
• To send service emails (security alerts, billing notices, account changes) and, with your separate consent, marketing emails
• To comply with legal obligations and respond to lawful requests

We do not sell personal data. The only data that reaches an advertiser comes from the Meta Pixel and the Google Ads tag on our /lifetime offer page and the Google Ads tag on our ad landing pages under /go/ (see Cookies & Tracking), which tell Meta and Google that a visitor viewed that page, opened the WhatsApp chat from it or clicked through to start a trial, and from the purchase report we send Meta and Google when someone buys the lifetime deal (see Cookies & Tracking).

AI conversations and supporting AI tasks (such as knowledge-base processing, reply quality checks and Automation AI steps) are processed by the AI providers listed on our Sub-processors page; which provider handles a given request depends on the AI model tier you select, the task, and on whether you connect your own Anthropic API key. The same applies to media-processing tasks — transcription of voice notes and understanding and generation of images and videos. Some AI processing runs on hardware we operate ourselves. Our AI providers’ terms prohibit them from training their generally available models on your data. Data from accounts that we own and operate ourselves (such as internal, demo and test accounts) is not Customer Data and may be used to develop, test and improve the Services, including AI model training.

If you connect your own Anthropic API key (BYOK), AI calls that would otherwise be billed by us are billed by Anthropic directly to your account. Your relationship with Anthropic and the terms of your Anthropic account govern that usage in addition to this policy.

You are the Data Controller for end-user messages that you process through DM Champ. We act as the Processor of that data and process it only on your documented instructions, in accordance with the DPA set out in Section 14 of our Terms of Service.

• Contract performance: processing necessary to provide the Services you have signed up for
• Legitimate interests: security, fraud prevention, product improvement, defending legal claims, business-to-business prospecting (with an easy opt-out)
• Consent: marketing emails and any sensitive processing where consent is required
• Legal obligation: tax, accounting, anti-money-laundering and other regulatory requirements that apply to us

Where we rely on legitimate interests, we have carried out a balancing assessment and we can share a summary on request. You can object at any time by contacting [email protected].

We share personal data with Sub-processors who help us provide the Services. We require all Sub-processors to enter into data protection agreements that meet GDPR Article 28 requirements.

The current list is always published at dmchamp.com/subprocessors, where you can also subscribe to be told before it changes.

We do not sell personal data, and apart from the Meta Pixel and the Google Ads tag on our /lifetime offer page, the Google Ads tag on our /go/ ad landing pages and the lifetime deal purchase report to Meta and Google (see Cookies & Tracking) we do not share personal data with third-party advertisers. We may share personal data with professional advisors (legal, accounting, audit) under confidentiality obligations, and we may share data in connection with a merger, acquisition or sale of assets subject to appropriate protections.

Personal data is primarily processed in the European Union (the Netherlands and Germany). Where personal data is transferred outside the European Economic Area, to the countries named per provider on our sub-processor list (the authoritative record of which providers sit outside the EEA and where), we rely on the following safeguards:

• The European Commission’s Standard Contractual Clauses (Decision 2021/914)
• The UK International Data Transfer Addendum to the EU SCCs
• Where applicable, the EU-US Data Privacy Framework for participating recipients
• Adequacy decisions where available for the destination country

A copy of the SCCs we rely on is available on request, with confidential pricing and security details redacted.

• Active account data: retained for the life of your account
• Conversation and message data: retained for as long as the contact exists in your account. Deleting a contact (individually, per list, or through the API) permanently removes that contact’s conversation history from the live systems immediately; you decide the retention period that fits your purpose by deleting contacts when you no longer need them, or by switching on automatic retention (Settings → Data Export → Data retention), which deletes contacts that have had no activity for the number of days you choose (30 days to 10 years) in a daily run
• Financial records: seven years, in line with Dutch tax law
• Backups: up to 90 days after deletion from active systems
• Marketing consent records: retained until you withdraw consent, plus a reasonable period for audit purposes
• Server logs and security events: typically up to 12 months
• Aggregated and de-identified analytics: retained indefinitely; this data does not identify any individual

When you cancel your subscription, your data stays in your account until you delete it, so you can come back to it, and you can export it at any time. Thirty days after your plan ends we release your phone numbers and remove your Instagram and Facebook connection; your contacts, conversations, agents and settings are kept. You can delete your account and its data at any time from Settings → Security & General → Delete Account, or ask us to delete it by emailing [email protected]. A deleted account is switched off straight away and then kept for 30 days in case it was deleted by mistake: you can restore it in that time by signing in, or ask us to erase it at once. After those 30 days it is removed from active systems. Other data you delete, such as contacts and their conversations, is removed from active systems straight away. In both cases it leaves our backups within the retention window above.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights:

• Right of access to the personal data we hold about you
• Right of rectification of inaccurate personal data
• Right of erasure (the “right to be forgotten”) subject to legal limits
• Right to restriction of processing
• Right to data portability in a structured, commonly used, machine-readable format
• Right to object to processing carried out on the basis of legitimate interests, including profiling
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise these rights, contact us at [email protected]. We respond within 30 days; we may extend the response window by up to a further 60 days for complex requests, in which case we will tell you within the first 30 days.

You also have the right to lodge a complaint with a supervisory authority. The Dutch supervisory authority is the Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl/. You can also complain to your local supervisory authority in your country of residence or place of work.

If you are a California resident, you have the following rights under the California Privacy Rights Act:

• Right to Know what personal information we collect, use, disclose and (if applicable) sell or share
• Right to Delete personal information we hold about you, subject to legal exceptions
• Right to Correct inaccurate personal information
• Right to Opt-Out of the sale or sharing of personal information (we do not sell personal information; the Meta Pixel and the Google Ads tag on our /lifetime offer page and /go/ ad landing pages, and the lifetime deal purchase report our server sends to Meta and Google, may count as sharing for cross-context behavioural advertising; a Global Privacy Control signal from your browser stops both tags from loading and, when your browser sends it as you open the WhatsApp chat from /lifetime, also stops the purchase report; you can also opt out of the purchase report by emailing [email protected] with the subject line “CPRA request”)
• Right to Limit the use of sensitive personal information to what is necessary to provide the Services
• Right to Non-Discrimination for exercising your CPRA rights
• The right to designate an authorised agent to make a request on your behalf

To exercise these rights, email [email protected] with the subject line “CPRA request”. We will verify your identity through your account or by other reasonable means before fulfilling the request.

Brazil (LGPD)

Brazilian residents have rights under the Lei Geral de Proteção de Dados that are broadly equivalent to GDPR rights. We honour these rights on request through [email protected].

Canada (PIPEDA)

Canadian residents can submit access and correction requests under the Personal Information Protection and Electronic Documents Act. We respond to PIPEDA requests through the same email address.

United Kingdom (UK GDPR)

UK residents have rights that mirror the EU GDPR. The Information Commissioner’s Office (ICO) is the UK supervisory authority.

The Services are intended for business use only and are not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If we discover that we have collected such data, we will delete it. If you believe a child has provided personal data to us, contact [email protected].

We use cookies and similar technologies only for the following purposes:

• Essential cookies: authentication, session management and security. These are required for the Services to function
• Functional cookies: remember your preferences (language, time zone, UI settings)
• Meta Pixel and Google Ads tag on our /lifetime offer page: that page is the only one on this site that loads the Meta Pixel; it also loads the Google Ads tag, which runs on our /go/ ad landing pages too (below). Both measure our ads. They report a page view, and a lead event when you open the WhatsApp chat from the page. We send no name and none of your quiz answers. Meta and Google set their own cookies for this (such as _fbp and _gcl_au) and each processes the data as an independent controller under its own privacy policy. In the EEA, the UK and Switzerland we ask you first: until you press Accept the Meta Pixel sends no events and sets no cookie, and the Google tag runs without ad cookies and Google only receives cookieless pings. If you press Decline it stays that way. We keep your answer for six months
• Lifetime deal purchase report to Meta and Google: when someone buys the lifetime deal, our server tells Meta and Google Ads that a purchase happened, with the amount and currency, so they can measure the ads for that offer. The buyer's email address, phone number, name, country and our payment customer reference are sent to Meta only as one-way hashes, which Meta uses to match the purchase to an ad view. Google receives the buyer's email address, phone number and name as one-way hashes, plus the country and postal code, which Google uses to match the purchase to an ad click. Meta and Google each process this as an independent controller under their own privacy policies. It is sent for lifetime deal purchases only, never for subscriptions or anything you do inside the app. So that the report can name the ad that led to the sale, when you open the WhatsApp chat from our /lifetime page our server records that visit: the ad click identifiers from the link you arrived on (Meta’s fbclid and its _fbc and _fbp browser identifiers, Google’s gclid, gbraid or wbraid), your IP address, your browser’s user agent, the page address, the campaign tags in that link (its utm parameters), the message prefilled for the chat and the short enquiry reference number at the end of that message. We keep this record for 90 days and then delete it. If you buy, we link the purchase to that visit through the chat, and the purchase report also carries those click identifiers, the IP address, the user agent and the page address (as they are, because Meta and Google need them that way to match the click) plus the phone number you chatted from as a one-way hash. The prefilled message itself is never sent to Meta or Google. To keep those click identifiers if you move around the page before opening the chat, the page also stores them, with the page address, in your browser’s local storage and session storage (dmc_lifetime_click) for up to 30 days. Under the same consent, the /lifetime page also reports to our own server which version of the page and which video you were shown and how much of the video you watched, together with the campaign tags, click identifiers, page address, referrer, IP address and user agent of that page view, under a random page visit identifier kept in your browser’s session storage (dmc_lt_pv) for the tab; we use this only to measure our own ads and delete it after 90 days. A Global Privacy Control signal, or Decline on our ad cookie question, stops the visit from being recorded: our server keeps only the prefilled message and the time, as a note that you opted out, so that if you buy no purchase report is sent to Meta or Google for you. That note is deleted after 90 days like the rest. In the EEA, the UK and Switzerland nothing is stored and the visit is not recorded until you press Accept
• Google Ads tag on our ad landing pages under /go/: the pages our Google ads link to load the Google Ads tag only (no Meta Pixel), with the same rules and the same consent question as above. It reports a page view, when you play a video on the page, when you scroll halfway down, and when you click the button to start a trial. We send no name and nothing you type
• Referral cookie: set only if you arrive through a partner referral link. It stores that partner’s code and the time you clicked, for 90 days, so the partner is credited if you sign up. It is first-party, is never shared with an advertising network and does not follow you to other websites. If you are in the EU/EEA, the UK or Switzerland we ask before setting it; elsewhere it is set when you arrive and you can remove it at any time through your browser’s cookie settings

That is the whole list. Apart from those two tags on /lifetime and the Google tag on /go/ we do not set analytics or advertising cookies, and we do not record your screen or session. Outside the EEA, the UK and Switzerland we do not show a cookie banner. If your browser sends a Global Privacy Control signal, neither tag loads. You can also block or delete these cookies in your browser settings, and limit how the data is used for ads in your Facebook or Instagram ad settings and in Google’s My Ad Center. For the referral cookie, we ask before setting it when a partner link brings you here from a country where that permission is required (we determine the country from your connection, and ask whenever we cannot tell). If you decline, we store nothing beyond a note of your answer so we do not ask again, and a Global Privacy Control signal from your browser counts as declining wherever you are.

To understand how our public website is found, we also measure aggregate traffic sources, such as which search engine or site linked to us. This measurement is cookie-free, does not track you across sites and does not build a profile of you. We treat a Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal information: it stops the Meta Pixel and the Google Ads tag from loading. The lifetime deal purchase report is sent from our server: when your browser sends the signal as you open the WhatsApp chat from /lifetime, we note it and send no purchase report for you, and you can also opt out of it by email as described in the California section.

We use a combination of administrative, technical and physical safeguards to protect personal data, including:

• Encryption in transit using TLS 1.2 or higher
• Encryption at rest of backups and of stored credentials and integration tokens
• Role-based access control with least-privilege principles
• Comprehensive audit logging of administrative actions
• Regular vulnerability scanning and internal security audits
• Confidentiality and data protection obligations for everyone with access to production systems
• Documented incident response procedures, including the 24-hour breach notification commitment to our customers in our Data Processing Agreement

No system can be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and we will notify affected users without undue delay, in line with GDPR Articles 33 and 34.

When you interact with an Agency’s white label deployment of DM Champ, the Agency is the Data Controller for your personal data and DM Champ acts as the Processor. End users of a white label deployment should consult the Agency’s own privacy policy for information about how the Agency uses their data.

The DPA set out in Section 14 of our Terms of Service governs our processor obligations for that data. We process the Agency’s end-user data only on the Agency’s documented instructions and in line with this policy and the DPA.

AI components used by the Services include large language models and speech and media models from the AI providers listed on our Sub-processors page (AI conversations, supporting tasks such as knowledge-base processing, reply quality checks and Automation AI steps, and media processing such as voice note transcription and image and video understanding and generation). The AI agents respond to inbound messages, generate content suggestions, score and route conversations, and execute structured tool calls (custom functions) on behalf of the workspace owner.

The AI does not make legally binding decisions about individuals. We provide a human-in-the-loop mode and recommend its use for high-value transactions and any interaction that materially affects a person’s legal rights or significant interests. You can request human oversight at any time by contacting your account owner.

Some AI processing is essential to provide the Services. You may opt out of optional AI processing (for example, certain analytics or summary generation features) from your dashboard, although doing so may limit functionality.

Marketing emails from DM Champ are sent only with your separate consent or where permitted under legitimate interest for existing customers with a similar product opt-out. Every marketing email contains an unsubscribe link, and you can also manage email preferences from your account.

Service emails (security alerts, billing notices, important account changes and platform incidents) are sent to you regardless of marketing preferences because they are necessary to operate the Services.

We may disclose personal data where we believe in good faith that disclosure is required by law, by a court order, by a subpoena or by a regulatory request, or where disclosure is necessary to protect the rights, safety or property of DM Champ, our customers or the public. Where lawful, we will notify you in advance of any compelled disclosure that affects you.

We may update this policy from time to time. For material changes, we will provide at least 30 days’ notice by email or in-app notice before the changes take effect. For non-material changes, we will post the updated policy here with a revised “Last updated” date.

For privacy questions or to exercise your rights, email [email protected]. Please include enough information for us to verify your identity and to act on your request.

OneGlimpse B.V. is established in the Netherlands, so an Article 27 EU representative is not required. For UK GDPR purposes, we will appoint a UK representative if and when our processing activities make one required; the current placeholder is “UK representative to be appointed if required” and we will update this page when an appointment is made.

• OneGlimpse B.V., the Netherlands
• Chamber of Commerce (KvK): 78315654
• VAT: NL861343529B01
• Email: [email protected]

This policy is published in English. We may provide translations for convenience. In case of any conflict between the English version and a translation, the English version controls.