What data Delta collects, why, who receives it, how long we keep it, and what you can do about it.
Last updated 18 October 2026
This policy explains how we handle personal information when you use Delta at https://delta-ai.app. Where it says “Delta” it means this service and the assistant in it. It is written to be read, so it is plain and specific. If something here is unclear, write to us at delta@officecrm.app.
1. Who we are
Delta AI is operated by VajraCodeCom (“we”, “us”), trading as VajraCode, 68 Mcilwraith St, South Townsville, QLD 4810, Australia. We are responsible for the personal information described in this policy (the “controller”, in the language of the GDPR).
We are based in Australia and handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Section 10 adds what applies to people in the European Economic Area (EEA) and the United Kingdom.
Contact for anything about your data: delta@officecrm.app.
2. What we collect
- Account data. Your email address. If you sign in with Google or Discord, also the name, picture and verified email address that service gives us (from Discord, your user id, username and avatar). The display name and picture you set yourself, and your preferences (theme, response style, message colours, avatars, the Enter key setting, sidebar width, typing effect).
- Your conversations. The messages you send, Delta’s replies, conversation titles, and summaries Delta writes of them.
- Files you attach. Images, PDFs, Word, text and Markdown files. We keep a copy so you can open it again in the conversation, and the text of documents so Delta can read it. Images are re-saved without their hidden metadata (such as location). They are deleted with the conversation.
- Voice dictation. If you use the microphone button, the recording is sent to be turned into text and is not kept afterwards. Only the text is returned to you.
- What Delta remembers. Short facts and notes she derives from your conversations so she can help later. You can see, correct or delete them (section 9).
- Usage data. How many messages you send, which determines your daily allowance.
- Activity records. A short record that something happened, with the time and your account: signing in or out, creating, renaming or deleting a conversation, sending a message (the fact and a conversation id, never the text), uploading or deleting a file (its type and size, never its name or content), using dictation, changing your profile, picture or preferences, reaching your daily limit, or sending an estimate request. We keep them to run, secure and support the service. They never contain what you wrote or uploaded, and they do not store your IP address.
- Estimate requests. If you ask for an estimate for a customised Delta on Office CRM Platform: your email address, your answers (for example team size, modules, integrations and timing), a reference for your licence if you own the platform, and any message you add. We also keep our own notes about the request and the estimate we prepare, and your answer to it. A claim that you own a licence may be checked.
- Technical data. Your IP address, browser and device type, and error reports, in server logs and error monitoring, used to run, secure and fix the service.
- Emails you send us. If you write to us, we keep the correspondence.
Please do not send us sensitive information you do not need to share. Conversations can reveal things such as health, beliefs or opinions if you choose to write about them; section 3 explains how we treat that.
3. Why we use it
- To provide Delta: sign you in, answer you, keep your conversations, remember what you asked her to, and prepare and send the estimates you ask for. Basis (GDPR): performing our agreement with you.
- To keep the service safe and working: limit abuse, filter harmful content, fix faults, support you, and understand how the service is used through the activity records. Basis: our legitimate interest in a safe, working service. We weigh this against your privacy by keeping the records small, free of content and limited in time and access.
- To meet legal duties and to protect our rights. Basis: legal obligation or legitimate interest.
- Where we ask you for anything else, with your consent, which you can withdraw at any time.
We do not sell your personal information. We do not use your conversations or files to build advertising profiles, to advertise to you, or to train AI models. Delta does not make decisions about you that have legal or similarly significant effects; she is an assistant that writes replies you can check.
If you write about sensitive matters, we use that only to answer you and to provide the service as described here. Where it reveals, for example, your health or your religious beliefs, we rely on your explicit consent, which you give by choosing to write it and which you can withdraw by deleting it or writing to us. You never have to share it. Access to it is limited to what is needed to run, secure and support the service, and is controlled as described in section 7.
Under the Australian Privacy Principles we collect only what is reasonably necessary for these purposes and use it for them or for a related purpose you would reasonably expect.
4. Who receives your data
We use service providers who process data for us, under their own terms and security commitments:
| Provider | What for | What it receives |
|---|---|---|
| OpenAI | Writing Delta’s replies, checking content for safety, creating the search indexes behind her memory, and turning dictated speech into text. | Your message, the recent conversation, the memory context and the content of files you attach for that reply; the audio of a dictation. |
| Hosting and database providers | Storing your account and conversations, and running the service. | All the data in section 2. |
| Amazon Web Services | Storing the encrypted archive (section 7) and the keys that protect it, in Sydney, Australia. | The archive, in encrypted form. |
| Email delivery (Google Workspace) | Sending your sign-in link, and the emails about an estimate you asked for. | Your email address and the message. |
| Sign-in, only if you choose “With Google”. | Your sign-in request. Google gives us your name, email and picture. | |
| Discord | Sign-in, only if you choose “With Discord”. | Your sign-in request. Discord gives us your user id, username, avatar and verified email. |
| Gravatar | Showing your Gravatar picture, if you have one. | A one-way hash of your email address. Our server asks, so Gravatar does not see your browser or IP address. |
| Error monitoring | Finding and fixing faults. | Technical error details. We aim to keep message content out of them. |
OpenAI handles the data it receives under its own terms and privacy policy. We may also disclose data where the law requires it, to protect our rights, or in connection with a sale or restructure of our business. We do not share your conversations with anyone else.
5. Transfers abroad
We are based in Australia and our providers operate in several countries, including the United States and the European Union. The archive described in section 7 is stored in Sydney, Australia. Where we disclose information overseas we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles (APP 8). For people in the EEA and the UK, transfers outside those regions rely on safeguards such as the standard contractual clauses or an adequacy decision, where they apply to the provider.
6. How long we keep it
| Data | How long |
|---|---|
| Account data | While your account is open, and for the withdrawal period in section 7 after you delete it. |
| Conversations and attached files | Until you delete them or your account. The archive copy follows section 7. |
| Activity records | 90 days. Records of changes made by our administrators are kept longer, so that we can show who changed what. |
| Estimate requests and estimates | For as long as needed to deal with the request, and up to 24 months afterwards, unless a customer relationship exists, in which case as long as it and our legal duties require. |
| Sign-in links | One hour. |
| Backups | The latest few days of database backups, then overwritten. |
| Server logs and error reports | For the periods set by our hosting and error-monitoring providers. |
When you delete a conversation or ask us to delete your account, we delete the related data. Some copies may remain briefly in backups, and we keep what the law requires us to keep. When we no longer need personal information and are not required to keep it, we delete or de-identify it.
7. The archive
Beyond the conversations you see in Delta, we keep a protected archive copy of every conversation (messages, titles and summaries) and every file you attach. It is kept for safety and legal reasons: to investigate security incidents and abuse, to resolve disputes, and to respond to legal obligations and lawful requests. We do not use the archive for advertising, profiling or training AI models, and we do not share it except where the law requires.
- It continues after you delete. Deleting a conversation removes it from your view at once. The archive copy remains until its period ends.
- How long. Two years from the day each item was created.
- When you delete your account. Your live data is deleted at once. The archive copy is kept for 30 days, in case you change your mind or the law requires us to keep it, and is then made unreadable by destroying the key that protects it, unless a legal hold or a legal duty requires us to keep it longer.
- How it is protected. It is encrypted and stored separately from the live service, with a separate key for each person. The chat service can write to it but cannot read it.
- Who can read it. Only a designated person, with strong authentication, for a recorded reason, for a limited time and after approval or a mandatory delay. Ordinary administrators cannot read it. Every access is logged and reviewed, and we may publish how many accesses there were.
- Limits on your rights. The archive records what was said, so it cannot be edited. Corrections are made to your live data. We assess a request to object to or restrict the archive against the purposes above.
Our legal bases are our legitimate interests in security and in handling disputes, and legal obligation. See section 3 for how we treat sensitive content.
9. Your rights
You can ask us to:
- give you access to the personal information we hold about you, and a copy you can take elsewhere;
- correct information that is wrong, out of date or incomplete;
- delete your information;
- restrict how we use it, or object to a use based on our legitimate interests;
- withdraw a consent you gave, without affecting what was done before.
Write to delta@officecrm.app from the address concerned. We may need to check who you are first, and we will answer within one month. You can also change your display name, picture and preferences in Settings, delete conversations from the conversation list, and ask Delta in a conversation what she remembers about you and to correct or forget something. Access or deletion may be limited where the law permits or requires it, for example where we must keep records, and we will explain why.
10. Visitors from the EEA and the UK
If you are in the EEA or the UK, the GDPR or the UK GDPR applies to how we handle your information, and VajraCodeCom is the controller. Our legal bases are in section 3, and you have the rights in section 9, including the right to object to processing based on our legitimate interests and to complain to a supervisory authority. Giving us your information is voluntary, but we cannot provide Delta without an email address to sign you in. Transfers are covered in section 5. We have not appointed a representative in the EEA or the UK, or a data protection officer (if the law requires us to, we will name them here): write to delta@officecrm.app for any request or data protection question.
The right to a copy you can take elsewhere is the right to data portability. We make no decision about you based solely on automated processing that has a legal or similarly significant effect (section 3). You can withdraw a consent at any time and complain to a supervisory authority (section 11).
11. Complaints
Please write to us first at delta@officecrm.app so we can put it right. We will answer within a reasonable time, normally 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au). In the European Union, you may complain to the data protection authority of your country (in Portugal, the Comissão Nacional de Proteção de Dados), and in the United Kingdom to the Information Commissioner’s Office.
12. Security
We protect your data with access controls, encrypted connections, keeping provider keys on the server only, and limiting who can see what, and by the measures in section 7. No system is perfectly secure. If a breach is likely to cause you serious harm, we will tell you and the authorities where the law requires us to, including under the Notifiable Data Breaches scheme.
13. Children
Delta is not for people under 16. If you think a child has given us data, write to us and we will delete it.
14. Changes and contact
If we change a provider or how we use your data, we update this page the same day, and tell you in Delta or by email before a significant change applies. The date at the top shows the latest version. Questions, requests and complaints: delta@officecrm.app, or by post to VajraCodeCom, 68 Mcilwraith St, South Townsville, QLD 4810, Australia.