Daneel AI

Privacy Policy

Last updated · Markdown

Last updated: 2026-04-24

Effective date: 2026-04-24

Back to daneel.injen.io

Purpose

Daneel AI Chrome Extension is a private AI reading and research assistant for the web pages, websites, and local documents the User chooses to engage with. Every feature in the extension is an implementation of that single purpose: helping the User understand content they have already decided to read.

All design decisions in Daneel flow from this purpose. Daneel reads, fetches, or processes content only in response to an explicit User action — asking a question about the current page, importing a document into a vault, or starting a site index.

Privacy summary

Daneel runs AI inference inside the User's browser or against backends the User configures. Prompts, AI responses, indexed website content, and local document contents stay on the User's device.

The only personal data we store on our servers is payment and license-related: a purchase record and a per-license activation counter. Details are in section 3.

We do not sell User data and do not train AI models on User content.

Table of contents

1. Who we are

Daneel AI is developed and operated by WAEBS, a French company trading under the Injen.io brand.

WAEBS is the data controller within the meaning of the EU General Data Protection Regulation (GDPR) for the personal data processed in connection with Daneel AI.

For EU residents, the lead supervisory authority is the French data protection authority (CNIL, cnil.fr).

2. Scope of this policy

This policy covers:

This policy does not cover:

3. Information collected — and what is not

3.1. What is NOT collected

WAEBS does not collect, transmit, or retain on its servers any of the following:

3.2. What is collected or processed

A. Payment and purchase records (at the time of a Daneel Pro purchase)

Data stored:

Source of the data:

Stripe's hosted Checkout page. Once a payment succeeds, Stripe sends a webhook to the Daneel backend (POST /api/webhook/stripe) with the fields listed above.

Where the data is stored:

A row in a Supabase (PostgreSQL) database, hosted in Supabase's EU West (Ireland, eu-west-1) region. Access is restricted to WAEBS administrators through authenticated Supabase service credentials.

Purpose:

Retention:

Retained for as long as the license is active, plus the minimum period required by French tax and accounting law — typically ten years — after which records are anonymised or deleted.

Legal basis (GDPR):

B. License-key activation counter

Data stored:

Each license key has an activation_count integer and a last_activated_at timestamp. Every time a device calls the Daneel backend to unlock Daneel with that key, the counter is incremented by one and the timestamp is updated.

Data NOT stored alongside the counter:

The IP address of the activating device, the device fingerprint, the operating system, the hostname, the browser fingerprint, and any other identifier tied to the machine are not recorded. Only the running count and the timestamp of the most recent activation.

Source of the data:

The Daneel extension contacts the /api/activate endpoint when a User enters a license key.

Where the data is stored:

The same Supabase database row as the license itself, keyed by the license key.

Purpose:

License keys are sold per User. A counter that climbs far beyond the number of seats purchased indicates the key is being shared or leaked in violation of the license terms. This is a license-enforcement signal, not a user-tracking mechanism.

Retention:

Retained for the lifetime of the license. Reset or deleted when the license is revoked or refunded.

Legal basis (GDPR):

Art. 6(1)(f) — legitimate interest (protecting the integrity of a paid product against unauthorised sharing).

C. License validation requests

Data processed:

When the extension calls the /api/activate or /api/refresh endpoint, it transmits the license key and a product version string. As with any HTTP request, standard network metadata (source IP, timestamp, user-agent header) is observable at the edge and may be retained in operational logs for a short window (typically 30 days) for abuse mitigation and debugging, after which logs are rotated or deleted.

Retention:

Legal basis (GDPR):

D. Extension update pings

When Chrome automatically updates Daneel from the Chrome Web Store, it pings Google's update servers. This is handled entirely by Google Chrome and the Chrome Web Store, not by WAEBS. It is governed by Google's privacy policy.

E. Anonymous product analytics

Daneel ships with optional, anonymous product analytics that help WAEBS understand which features are used and catch regressions. This is enabled by default and can be turned off at any time in Settings → Privacy → Telemetry.

Transport: Google Analytics 4 (GA4). Events are sent from the extension's service worker directly to Google's endpoint, not via WAEBS servers. Google acts as a data processor for this data.

What is sent in each event:

What is never sent:

Conversation text, prompts, AI responses, URLs of pages the User visits, document content, file names, or any error messages that could contain user text. Telemetry payloads contain only enumerated event names, booleans, integers, and durations.

How to disable:

Open Daneel → Settings → Privacy → turn off "Anonymous product analytics". No event is sent after the toggle is off.

Legal basis (GDPR):

Art. 6(1)(f) — legitimate interest in improving the product. This interest is balanced against User rights by (a) making the data non-identifying, (b) providing a clear opt-out, and (c) not linking telemetry events to any license record.

WAEBS does not use crash reporting services (e.g. Sentry, Bugsnag). Errors surface in the extension's own UI and in the browser's developer console; they are not transmitted to WAEBS.

F. Correspondence

When a User emails WAEBS (for example at think+daneel-privacy@injen.io or a support address), WAEBS retains the message, the email address, and its responses as long as necessary to resolve the query and for a reasonable follow-up window afterwards.

4. How data flows

4.1. AI content flow , primary Daneel usage

A question is typed into Daneel
            ↓
The Daneel extension (running inside the User's browser)
            ↓
The LLM backend the User chose:
   • WebGPU (100% in-browser, no network at all)
   • Chrome Built-in Gemini Nano (Chrome ships the model locally)
   • A self-hosted Ollama server (typically localhost)
   • An Azure OpenAI deployment operated by the User
   • Anthropic Claude API (with the User's own API key)
            ↓
The response streams back to the extension
            ↓
Stored in the browser's IndexedDB / chrome.storage.local,
on the User's device only

WAEBS never appears in this flow. There is no proxy, no relay, no mirror, no sampling point. WAEBS could not read the User's prompts or responses even if it wanted to, because they are never sent to WAEBS.

4.2. Payment and licensing flow (one-time, at purchase)

User clicks "Buy Pro" on daneel.injen.io
            ↓
Redirect to Stripe Checkout (hosted by Stripe)
            ↓
Card details entered on Stripe's servers
(WAEBS never sees the card)
            ↓
Stripe webhook → POST /api/webhook/stripe (Daneel backend)
            ↓
Row inserted into Supabase:
    { email, stripe_customer_id, license_key, plan,
      amount, currency, country, status, timestamps }
            ↓
License key is delivered to the purchasing email via Resend,
and also shown on the /api/success page in the browser
so the User can copy it into the extension

4.3. License validation flow (on activation and periodic refresh)

User pastes the license key in Daneel's Settings → License
            ↓
Extension → POST /api/activate on daneel.injen.io (HTTPS)
            ↓
Daneel backend:
   • Looks up the key in Supabase
   • Verifies it is not revoked
   • Increments activation_count, updates last_activated_at
   • Signs a 7-day ES256 JWT containing plan + feature flags
            ↓
JWT returned to the extension, cached locally,
and verified offline using a public key bundled
in the extension

The JWT is refreshed in the background before expiry via POST /api/refresh. No user content is part of these requests — only the license key and a product version string.

5. Chrome extension permissions

Daneel declares the following permissions in its manifest.json. Each one is listed here with its purpose and what it does not do.

activeTab

storage and unlimitedStorage

scripting

tabs

identity

webNavigation

declarativeNetRequest

alarms

notifications

host_permissions: <all_urls>

6. Third-party services (sub-processors)

The following processors may receive or store data on behalf of WAEBS, each strictly for the operational purpose listed:

Processor What they do Data they receive Their policy
Stripe, Inc. (US) Payment processing, Checkout UI, and the automatic payment receipt email sent to the purchasing email address Email, card details (entered directly by the User), billing country, amount, currency stripe.com/privacy
Supabase, Inc. (US; data hosted in EU West / Ireland) Database (PostgreSQL) and backend hosting Purchase records, license keys, activation counters supabase.com/privacy
Vercel, Inc. (US; EU regions available) Hosting the Daneel backend serverless endpoints and the public marketing site Standard HTTP request metadata (IP, user-agent, timestamp) handled at the edge for routing and abuse-mitigation vercel.com/legal/privacy-policy
Resend (Ireland, EU West / eu-west-1) Transactional email delivery. Daneel sends the license-key confirmation email from noreply@daneel.injen.io via Resend after a successful purchase The purchasing email address, the license key, and the email body resend.com/legal/privacy-policy
Google LLC (Chrome Web Store) Extension distribution and automatic updates Standard Chrome Web Store update telemetry, handled by Google policies.google.com/privacy
Google Analytics 4 (Google LLC) Optional anonymous product analytics (enabled by default, can be turned off in Settings → Privacy) Event names from a fixed catalog, device/browser properties, timezone-derived coarse geography policies.google.com/privacy
ipapi.co Used only if the User opts in to IP-based geography enrichment (ipGeoEnabled toggle, off by default). A single HTTP call on service-worker startup The User's IP address (as part of any HTTP request) ipapi.co/privacy
LLM backends the User configures AI inference The User's prompts and context, as the User chooses. Not WAEBS sub-processors — the User picks and controls them Each provider's own terms

7. Data storage and security

AI content and user data.

Lives entirely inside the User's browser (IndexedDB, chrome.storage.local) or on infrastructure the User or the User's employer operates (a self-hosted Ollama server, an Azure OpenAI tenant). WAEBS has no access.

Payment and license data.

Lives in the Daneel Supabase (PostgreSQL) database, in the EU West (Ireland) region. Encrypted at rest by Supabase. Access is restricted to WAEBS administrators via authenticated service credentials. Row-level security policies are applied on the server-side API layer.

Transit.

All network calls from the extension to the daneel.injen.io endpoints use HTTPS / TLS 1.2 or higher.

Retention.

Breach notification. In the event of a data breach affecting the Supabase records, WAEBS will notify affected Users by email within 72 hours of becoming aware of the breach, consistent with GDPR Articles 33 and 34, and notify the CNIL as required.

8. Data sharing and sale

9. International data transfers

Stripe and Vercel are US-headquartered companies. Supabase is US-headquartered but offers regional data residency; Daneel's Supabase project uses the EU West (Ireland, eu-west-1) region, so license and payment records are primarily stored inside the EU. Resend is headquartered in Ireland and its infrastructure used for Daneel runs in the eu-west-1 region. Standard cross-border support and operations may still involve incidental access from outside the EU.

Where personal data is transferred to the United States or to any country that does not have an EU Commission adequacy decision, WAEBS relies on:

Stripe and Supabase both publish SCC-backed Data Processing Addenda.

10. User rights

10.1. Users in the European Union, European Economic Area, United Kingdom, or Switzerland (GDPR / UK GDPR / Swiss FADP)

Users have the right to:

To exercise these rights, Users may email think+daneel-privacy@injen.io from the address associated with the purchase. WAEBS responds within 30 days.

10.2. California residents (CCPA / CPRA)

California residents have the right to:

To exercise these rights, California residents may email think+daneel-privacy@injen.io.

10.3. Other jurisdictions

Residents of Brazil (LGPD), Canada (PIPEDA), and other jurisdictions with equivalent frameworks may exercise analogous rights by contacting WAEBS at the same address.

11. Children's privacy

Daneel AI is not directed at children. WAEBS does not knowingly collect personal data from anyone under 13 (United States, COPPA) or, where applicable, under 16 (European Union). If WAEBS becomes aware that it has inadvertently collected data from a minor, it will delete that data promptly. Guardians who believe their child has provided personal data may contact think+daneel-privacy@injen.io.

12. Changes to this policy

13. Contact

For any question, request, or complaint about this policy or a User's personal data:

14. Chrome Web Store Limited Use disclosure

Daneel AI's use and transfer of information received from Google APIs to any other app will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Daneel AI does not currently use Google OAuth or any Google user-data API. If that ever changes, the following additional Limited Use language applies, verbatim:

Daneel AI's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This page is served as both HTML and Markdown at the same URL. The .md version is intended for automated processing and AI crawlers and is linguistically identical to the rendered page.