Privacy Policy

What we collect

• Account data — email address, name, job title, and organization, as entered at sign-up and onboarding.
• Sign-in credentials — we offer email and password, emailed magic links, and Google sign-in. Passwords are handled by our authentication provider; we never see them in plain text.
• Product usage events — pages viewed and features used, tied to your account. There is no session recording and no form capture; on-screen text is masked before any event is sent.
• API, export, and key activity logs — for each API request: organization, API key, endpoint path, rows returned, and status; for each CSV export: organization, user, surface, filters, and row count; and the last time each API key was used.
• Error diagnostics — stack traces and request context when something breaks, configured to exclude personal data.
• Billing— handled by our payment provider. We store only the provider's customer and subscription identifiers; we never store card numbers.
• Business location addresses — the addresses you enter for your locations and territories are sent to a geocoding provider to place them on the map.
• Calculator uploads — when you upload sales data, it is reduced in your browser to six fields (date, sales amount, location id, location name, staffing hours, units) before anything is sent; only those fields and the resulting analysis are stored.
• Email recipients — the addresses your organization chooses to receive the weekly Brief and alert emails.

How we use it

To operate and secure the service, provision what your organization licensed, bill subscriptions, improve the product, and communicate about the service — including the weekly Brief email and the alert emails your organization configures. We do not run third-party advertising trackers.

Processors

We use these providers under contract; each receives only what its function requires.

• Supabase — database and authentication (US-East).
• Vercel — application hosting.
• Stripe — billing and payments.
• Resend — transactional email: alerts, the weekly Brief, and contact-form messages.
• PostHog — product analytics (US).
• Sentry — error monitoring, configured to exclude personal data.
• Google — sign-in, and geocoding of the business addresses you enter.

Our infrastructure and processors are located primarily in the United States; providers may also process data in other regions under their own terms.

The sources we acquire data from — sports data providers, hotel and ticket marketplaces, weather services — never receive customer data.

Retention

We retain account data while the account is active and for a reasonable period afterwards to complete billing and meet legal obligations.

• Activity data — alert history, API request logs, and CSV export logs are retained for the current football season and purged automatically after the season ends, by January 31 each year. Owners and admins can clear this data earlier at any time from Workspace → Team → Data retention; that in-app clear keeps API request and CSV export logs from the most recent 7 days, which we hold as abuse-detection evidence until the end-of-season purge.
• Weekly Brief delivery records — retained for the season and removed in the same end-of-season purge; the in-app control does not delete them.
• Billing records — retained as required for accounting, tax, and legal purposes. They are not part of any purge.
• Calculator results — the analyses you run on your own uploaded data are yours: they are not part of the end-of-season purge or the in-app clear, and are retained until you delete them or your account is deleted.

We do not yet offer self-serve account deletion; send deletion requests to admin@d1demand.com and we will honor them within 30 days.

Your rights

You may request access to, correction of, or deletion of your personal data at admin@d1demand.com. If you are located in a jurisdiction that grants additional privacy rights, we will honor them as the law requires. We do not sell personal data.