Privacy
Last updated: 3 October 2026
DM Workbench ("we") operates at dmworkbench.com and app.dmworkbench.com. This policy says what personal information we collect, why, how long we keep it, and what rights you have over it.
| Data | Where it comes from | Why we collect it | Legal basis (GDPR) |
|---|---|---|---|
| Account details: email, password hash | You, at signup | To run your account | Contract |
| If you sign in with Google or Discord: your name, your email address and that service's id for your account | Google or Discord, when you press their button | To sign you in without a password | Contract |
| Billing details: plan, invoices, last 4 of card | You, via Stripe | To charge for the service | Contract |
| Content you create in the product: campaigns, cards, canvases, maps, pictures, documents you import | You, while using it | It's the product | Contract |
| Session recordings and transcripts, when you record a sitting | You, when you press record or upload audio | To write up the session and turn it into cards | Contract |
| Support email and messages | You, when you contact us | To answer you | Legitimate interest |
| Server logs: IP address, timestamps, requests | Automatic | Security and debugging | Legitimate interest |
| Analytics: pages viewed, aggregate usage | Google Analytics, only after you opt in | To decide what to improve | Consent |
| Advertising measurement | Meta and Google, only after you opt in | To measure whether ads work | Consent |
We don't collect more than this, and we don't buy data about you from anyone.
Session transcription, the write-ups, module import, Brainstorm, "Fill in with AI" and generated pictures are run by Google's Gemini API. When you use one of them, the text or audio involved is sent to Google to be processed and the result is sent back. We don't use your content to train models, and our agreement with Google says they don't either. Audio you record is kept for the number of days set in your campaign settings (30 by default) and then deleted; the transcript and write-up stay with the campaign.
Optional cookies stay off until you opt in. Details, including every cookie by name, are in the cookie policy. You can change your choice anytime with the "Cookie settings" link in the footer.
We share personal information only with the processors that run the service:
| Processor | What they get | Why |
|---|---|---|
| Railway | Everything the app stores | Hosts the app and its database |
| Cloudflare | Requests to this website and to the app | Hosts the website, routes traffic |
| Stripe | Billing details | Payments |
| Google (Gemini API) | Text and audio you send through the AI features | Transcription and generation |
| Google (Analytics, Tag Manager) | Usage data, after opt-in | Analytics |
| Google, Discord (sign-in) | The sign-in request, if you choose to sign in that way. We receive your name and email from them and send them nothing else. | Signing in |
| Meta | Ad measurement data, after opt-in | Measuring ads |
| Resend | Your email address | Transactional email: verification, password resets, receipts |
We don't sell your personal information. We don't share it for cross-context behavioral advertising unless you opt in to marketing cookies, and we honor Global Privacy Control signals as an opt-out.
We disclose information if the law requires it.
| Data | Kept for |
|---|---|
| Account and content | While your account is active. Deleting the account deletes it. |
| Session audio | 30 days by default, adjustable per campaign |
| Billing records | 7 years (tax law) |
| Analytics | 14 months, the GA4 retention setting |
Everyone: email support@dmworkbench.com and we'll tell you what we hold about you, correct it, or delete it. You can also delete your account yourself from the Account page.
If you're in the EU, UK, or EEA (GDPR): you have the right to access, correct, delete, and export your data, to restrict or object to processing, and to withdraw consent at any time. We respond within one month. You can complain to your local supervisory authority.
If you're in California (CCPA/CPRA): you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing. We don't sell personal information. Use the "Your Privacy Choices" link in the footer to opt out of sharing for advertising, or turn on Global Privacy Control in your browser and we'll apply it automatically. We respond within 45 days, and we won't treat you differently for exercising any of these rights.
To exercise any right, email support@dmworkbench.com from the address on your account. If we can't verify it's you, we'll ask for enough information to check.
Our servers are in the United States. If you're in the EU, that means your data is transferred to the US; our processors operate under Standard Contractual Clauses or the EU-US Data Privacy Framework.
The service isn't directed at children under 16 and we don't knowingly collect their data. If you believe a child has given us personal information, email support@dmworkbench.com and we'll delete it.
If this policy changes materially, we'll email account holders before the change takes effect. The date at the top always says when it was last revised.
Using the service is also covered by our terms and copyright policy.
DM Workbench
support@dmworkbench.com