Platform Privacy Policy

This Privacy Policy explains who we are and spells out how we collect, use, and disclose information that relates to you, as defined under applicable data protection laws ("Personal Data") and how to exercise your privacy rights. If you have any questions or concerns about our use of your Personal Data, please contact us using the details provided in Section 13 below.

About Us

Permutation Labs, 86 avenue de Wagram, 75017 Paris, France ("Dust", "we", "our", or "us"), develops and provides a platform to build LLM apps and AI assistants with access to your company's knowledge that allows you to get more done, faster, leveraging composable tools to retrieve and share internal information effectively.

1. About this Privacy Policy

This Privacy Policy applies to you when you access or use the Dust platform, that is to say, our online software-as-service platform, including any related APIs provided by Dust, together with all related applications ("Platform"), participate in our user research activities or otherwise interact or communicate with us.

2. Who is responsible for processing your personal data?

This Privacy Policy only applies where we are processing your Personal Data for our own purposes and are acting as Data Controller under the General Data Protection Regulation (UE) 2016/679 ("GDPR").

It does not cover the Personal Data Dust collects, uses, and discloses when acting as a Data Processor under the GDPR on behalf of its Customers ("Customer Personal Data") and under their instructions in connection with Dust Platform. We invite you to contact your company or organization if you have any questions about its privacy practices.

As Data Controller, Dust will process Customer Personal Data to provide the Platform and for other limited purposes as outlined in Section 6 below.

Where Dust is the Data Controller, if you have any questions about this Platform Privacy Policy or about our data protection practices, you can contact us. See how to contact us in Section 13 below.

3. The Personal Data we collect

Dust collects and processes your Personal Data when you use the Platform. This includes:

4. How do we use and process your Personal Data and what legal basis do we rely on?

We always process your Personal Data in accordance with the applicable laws.

We process your Personal Data for the following purposes:

• To provide the Platform to our Customers in accordance with the agreement with them
• To manage our relationship with our Customers, including managing payments, contracts, and transactions
• Contacting our Customers about events, demos, webinars, and new features
• For internal development

What legal basis are we relying on?

We process your Personal Data based on:

• The performance of a contract with our Customers
• The necessity to comply with our legal obligations
• Our legitimate interest
• Your consent, where your consent is legally required

Where we rely on your consent, you may at any time withdraw your consent by contacting us. See how to contact us in Section 13 below.

5. How long do we keep your Personal Data?

Your Personal Data will be stored in accordance with applicable data protection laws and data protection authorities guidelines to the extent necessary for the processing purposes set out in this Platform Privacy Policy and in accordance with our Data Retention Policy.

6. When and with whom do we share your Personal Data?

Within Dust, only authorized personnel have access to your Personal Data.

We may also disclose your Personal Data to third parties to carry out our usual business practices. Disclosures will only be so that we can process your Personal Data for the purposes set out above. Dust may share your Personal Data to the following third parties:

Our service providers

Some of our service providers may perform actions on our behalf, under our instructions, in accordance with our agreement and in compliance with appropriate technical and organizational security measures to protect your Personal Data.

Dust seeks to conclude data processing agreements with its service providers to ensure that your personal data is used, stored and transferred securely and in accordance with the applicable laws and Dust's instructions.

Foundational Model Providers (OpenAI, Anthropic, Mistral, Google, Fireworks) are prohibited from using any customer and personal data for model training. They apply a "Zero Data Retention" policy, meaning that Customer Content will not be logged for human review and will not be saved to disk or retained by those providers. Certificates can be found in the Sub-Processors list.

Our affiliates

We may share, disclose and transfer your Personal Data with our current and future subsidiaries and affiliated companies for all purposes mentioned in Section 4 above.

Third Parties involved in a corporate transaction

We may also disclose or transfer your Personal Data to fulfil our legal obligations or when a legal authority requires a disclosure. We may also disclose your Personal Data if we are a party of a business sale, such as a merger or an acquisition.

Third parties you connect to Dust

Google: We access your Google User Data only to facilitate and enhance the functions of our application. Specifically, we synchronize your Google Docs, Google Slides, pdfs, and plain text files that are within the folders you select when connecting your Google Drive account to Dust. You can change this selection at any time or request us to delete all your data.

The sole purpose of this data is to allow you to use your Google User Data on the Dust Platform. Dust will not use this data for any other purpose like advertising or marketing.

Dust use and transfer of information received from Google API's to any other app will adhere to Google API Services User Data Policy, including Limited Use requirements.

You can see how your data is stored securely in Section 8 below.

7. How do we transfer your Personal Data globally?

Your Personal Data may be accessed, transferred, stored and/or processed outside the European Economic Area (EEA), specifically in the United States. If your Personal Data is transferred outside the European Union (EU), we make sure that (i) the transfer is performed to a country recognized by an adequacy decision from the European commission; or (ii) the transfer is covered by appropriate safeguards, such as the Standard Contractual Clauses published by the EU commission.

8. How do we secure your Personal Data?

We use industry-standard physical, procedural, and electronic security measures to protect your Personal Data held with our service providers and us, and keep them updated taking into account the state of the art-

More precisely, we store the usage data inside of an encrypted database, inaccessible from the Internet. The data we access is stored securely in our database. We use PostgreSQL, Google Cloud infrastructure, Google Infrastructure Security Design, and Google Cloud Platform. We also use QDrant Cloud, which is a vector database to store embeddings. We commit to ensuring your data is safe and secure at all times.

Access to personal data is also protected with user-specific logins, passwords, and user rights. Our premises are also safe and secure.

9. What are your privacy rights, and how can you exercise them?

Subject to applicable data protection laws, you have privacy rights in respect of the Personal Data we process about you:

• Request confirmation that we are processing your Personal Data
• Request access to the Personal Data we process about you
• Request that we delete, update or correct the Personal Data we hold about you
• Request that we restrict the way in which we use your Personal Data
• Request that we apply the right of data portability, where applicable
• Object to our Processing of your Personal Data
• Withdraw the consent that you have given us to process your Personal Data where we process it on the basis of your consent
• Lodge a complaint with the relevant data protection authority regarding our Processing of your Personal Data

To exercise one or more of the rights mentioned above, please contact us as outlined in Section 13 below.

10. Your California Privacy Rights

If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. You may make one request each year by emailing us at privacy@dust.tt.

11. Children's Privacy

Our Platform is not designed to attract children under the age of 16. We do not knowingly collect Personal Data from children and do not wish to do so. If we learn that a person under the age of 16 is using our Platform, we will prohibit and attempt to block such use and will make reasonable efforts to promptly delete any Personal Data stored with us with regard to such person. If you believe that we might have any such data, please contact us as outlined in Section 13 below.

12. Links to other websites or services

Our Website or Platform may include links to third-party websites and services that are not operated by us. When you click these links, you will be directed away from our Website or Platform. A link to a third-party website or service does not mean that we endorse it or the quality or accuracy of information presented on it. If you decide to visit a third-party website or service, you are subject to its privacy practices and policies, not ours. This Privacy Policy does not apply to any Personal Data that you provide to these other websites and services.

13. How to contact us?

You may contact us regarding this Platform Privacy Policy or our Processing of your Personal Data at privacy@dust.tt.

You can also contact our Data Protection Officer at dpo@dust.tt.

14. Updates and Amendments to this Platform Privacy Policy

The "Effective Date" at the top of this webpage mentions when this Platform Privacy Policy was last revised. We may update and amend this Platform Privacy Policy from time to time. Any changes will become effective when we post a revised version of this Platform Privacy Police.

If we make changes that materially alter your privacy rights, Dust will provide additional notice, such as via email or through the platform directly.

Your use of our Platform is subject to the terms in the version of this Platform Privacy Policy that is posted at the time of your use of the Platform and we encourage you to review this Platform Privacy Policy any time you use our Platform.