Privacy Policy

Scope and contact

Defense DNA (DDNA) operates the defense-dna.com website and the DDNA engineering platform. This policy explains how we handle information through those services, including connected services and AI-assisted features. A customer organization may control the projects and accounts it provides to its members; its agreement with DDNA may contain additional data-handling terms. This policy does not govern the independent practices of a service you choose to connect to DDNA.

Questions about this policy or requests concerning your information can be sent to contact@defense-dna.com.

Information we process and where it comes from

We receive account and organization details, project membership and permissions, documents and other project content you upload or connect, prompts and instructions you submit, generated results, and messages you send to us. Your organization and other authorized project members may also provide information about you or content you can access.

We process technical and activity information needed to operate and protect the services, such as request and authentication records, device and browser information, IP addresses, timestamps, feature use, and error or security logs. Connected services may provide account identifiers, authorization credentials, file metadata, and content within the permissions you grant. If you join the product waitlist, we process the email address you enter, any optional details you choose to give about your organization type, contractor status, and work domains, which website link brought you to the signup page, and when you confirmed it. If you subscribe to a newsletter or previously bought an item from the website, we process the contact and transaction details needed for that request.

How we use information

We use information to authenticate users, enforce organization and project permissions, provide the features you request, prepare and search project evidence, generate AI-assisted results, respond to support requests, maintain and improve service reliability, investigate abuse or security events, and meet legal obligations. We use a waitlist email address to confirm that you asked to join and to tell you when access opens; the confirmation time sets your place in line, and the optional details help us understand who is waiting and plan access; newsletter contact information to send the updates you request, and prior store order information to resolve payment or fulfillment questions.

Google Drive connections

When you connect Google Drive, DDNA receives your Google account identifier and email address, OAuth credentials, and access to Drive data covered by the permission shown on Google's consent screen. The current Drive permission permits DDNA to see and download files in that account. DDNA uses it to list available file names and metadata for selection, then reads the contents of files you explicitly add to a DDNA project or sync again. Connecting an account alone does not import its files into a project.

For a file you add, DDNA stores its Drive identifier, name, type, link, modification time, associated account, and extracted text as project evidence. Authorized members of that DDNA project can use the imported evidence through project features. Sync retrieves a newer version of the selected file. Disconnecting removes DDNA's stored Google credentials and stops future syncs; it does not automatically remove evidence already imported into a project. You can also revoke DDNA's access in your Google account.

DDNA uses information received from Google Workspace APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used to provide the user-facing project features you request. It is not sold, used for advertising, or used to train general-purpose AI models.

AI model processing

For AI-assisted features, DDNA may send your prompt or requested action, relevant project evidence or excerpts, and instructions needed to perform that feature to a model provider. The provider returns a result that DDNA may store with the project or related service records. The production model route currently uses OpenAI's API. According to OpenAI's API data controls, API content is not used to train its models by default, while standard abuse-monitoring logs may include prompts and responses for up to 30 days, subject to its controls and exceptions. Model-provider processing and retention depend on the applicable provider terms, customer agreements, and configured settings; DDNA does not promise that every model request has zero provider retention.

If DDNA introduces Amazon Bedrock routing, we will update this notice before sending customer project content through that route. The applicable model, endpoint, region, inference routing, logging, and retention controls will depend on its configuration. Bedrock routing alone would not establish a zero-data-retention or zero-operator-access guarantee for every DDNA request.

AI-assistant connections

When you connect an AI assistant such as ChatGPT, Codex, or Claude to DDNA, you authorize that assistant to request DDNA tools on your behalf through a secure connection. The connection can reach the DDNA projects your account is permitted to access, subject to your current membership, role, and the permissions you approve. A project shown during setup is a starting context, not a limit on the connection.

When you ask the assistant to use a DDNA tool, DDNA sends the requested tool result, which may include project content and account-related information, to the assistant provider. Depending on the tool and your request, the assistant may also send text, parameters, or proposed changes to DDNA. Review the assistant provider's privacy policy and your organization's rules before connecting or sharing sensitive project information. The provider controls its own processing and retention of conversations and tool results.

DDNA records connection details and limited operational information needed to authorize calls, maintain security, and troubleshoot the service. You can disconnect an assistant in DDNA to revoke its DDNA connection; this does not delete content already received or retained by the assistant provider. Your project permissions continue to apply to each DDNA tool call.

Who receives information

Authorized members of your organization or project can access information according to their permissions. We share information with providers that host the services, deliver requested AI processing, send communications, or support operations, subject to the services and agreements that apply. Information you choose to send through a connected assistant or other external service is also handled by that service. We may disclose information when required by law or when reasonably necessary to address abuse, security incidents, or the rights and safety of DDNA and others.

DDNA personnel and security

DDNA limits operational and administrative handling of the DDNA system by its own staff and contractors to U.S. persons. This statement covers DDNA personnel; infrastructure providers, model providers, connected services, and customer organizations have their own personnel and access practices.

DDNA uses access controls for project data and stores connected-service credentials in encrypted form. Additional data residency, personnel, or regulated-data commitments are governed by the applicable customer agreement.

Earlier website store orders

For a prior website store checkout, Stripe handled the payment page and processed payment and billing details. DDNA received checkout, payment-status, contact, and shipping information needed to process the order; our website did not receive your full payment-card number. We may have sent the purchased items and the recipient's name, shipping address, and available contact details to Printful for fulfillment. We retain order information as needed to answer support requests and resolve fulfillment problems. After checkout, a temporary cookie may hold the checkout reference for the order-status page and expires after 24 hours.

Cookies and browser storage

The website and platform use cookies or similar browser storage where needed for sign-in, security, and requested features. A previously saved shopping cart may remain in your browser's local storage. The earlier store checkout used the temporary order-status cookie described above. You can manage cookies and local storage in your browser, although disabling storage needed for a feature may prevent it from working.

Retention and your choices

We retain information while needed to provide the service, meet legal obligations, or resolve security and operational issues, subject to applicable customer agreements and project controls. Disconnecting a service removes its stored connection credentials and stops future access through that connection, but does not automatically delete evidence already imported into a project or information already received by a third-party assistant. Waitlist addresses that are not confirmed are deleted after seven days. Deleted information may remain temporarily in backups, logs, or third-party systems under their applicable retention schedules.

You can ask us to access, correct, or delete information associated with your account, leave the waitlist, or stop newsletter communications, by contacting contact@defense-dna.com. We may need to verify your identity and coordinate a request about organization-controlled project data with your organization. You can also manage project permissions through your organization and revoke connected-service access with that provider.

Changes

We may update this policy as DDNA changes. We will post the current version and its effective date here and provide additional notice when a material change to our data practices requires it.