Privacy, in full.

Effective date: 13 August 2026 · DemandCast is the controller for the personal data described here. Contact: privacy@demandcast.ai.

DemandCast forecasts the local demand environment around business locations. We forecast places, not people: our service needs signals about cities — flights, ships, events, weather, local activity — not profiles of individuals.

What we collect

• Account details: your name, work email and password (stored hashed).
• Your business's public profile: venue name, address, category and opening hours — largely information already public.
• Answers you choose to give us: onboarding confirmations and any calibration inputs you enter (for example covers or ticket sales). Revenue data is never required.
• Your public social profiles — only after you confirm them as yours. We never guess at handles.
• Billing details: handled entirely by Stripe, our payment provider; card numbers never touch our systems.
• Technical logs: IP address, browser type and timestamps, kept for security and operations and retained no longer than 90 days.

What we don't collect: no tracking of your customers, no precise geolocation of individuals, no special-category (sensitive) data — and we ask you not to send us any.

Why we process it (legal bases)

• To provide the service — building and improving your forecasts, operating your account (contract).
• To keep the service safe — security, fraud prevention, abuse handling (legitimate interests).
• To communicate — transactional messages such as trial reminders; marketing only with your consent, withdrawable any time (consent).
• To meet our obligations — accounting, tax and lawful requests (legal obligation).

Shared intelligence, honestly

Zone-level patterns only ever emerge anonymously, and only when at least three independent businesses show the same signal. No venue is ever identifiable, your data stays yours, and we do not sell personal data — to anyone, for anything.

Who helps us run the service

A small number of carefully chosen providers process data under our instructions and data-processing agreements, in three categories: cloud infrastructure, payment processing (Stripe) and email delivery. For commercial confidentiality we don't publish a vendor-by-vendor list, but if a provider is relevant to exercising your rights we will tell you what you need to know — just ask at privacy@demandcast.ai. Data is processed primarily within the European Union; where a provider processes data outside the EEA we rely on adequacy decisions or EU Standard Contractual Clauses.

How long we keep it

Account data for the life of your account. Cancelling your subscription does not automatically purge your records — your account, settings and history are kept so you can return without starting over. When you request deletion (the "Delete all my data" action in your account, or an email to us), we remove your personal data within 30 days, except what the law requires us to keep; backups clear within 90 days. Anonymous zone-level statistics that cannot identify you or your venue may be retained.

Your rights (GDPR)

Access, correction, export, deletion, restriction and objection — write to privacy@demandcast.ai and we respond within 30 days. You may also complain to a supervisory authority; ours is the Agencia Española de Protección de Datos (AEPD).

Wherever you are: we extend these rights to all our customers as a matter of policy, not only where the GDPR applies. If the privacy law of your country gives you additional or different rights, we honour those too — the same email address is the door for all of it.

Security

Encryption in transit, role-based access on a least-privilege basis, and continuous monitoring. If a breach ever affects your data we will notify you and the authority as the law requires.

Children

DemandCast is a business service and not intended for anyone under 18.

Changes

We will post any revised policy here with its effective date, and give at least 30 days' notice of material changes by email or in-product notice.