Dandy AI
Connect Start free trial

Legal

Privacy Policy

Last updated October 30, 2026

Dandy AI is a service that stores a typed record of what your software is supposed to do, and reads schema metadata from the data sources you register. It works on the shape of your data, not the data itself. This page explains, in plain language, what we store and what we deliberately do not.

What we store

  • The record of your software. Products, projects, their input and output schemas, the edges connecting them, the rules they must follow, and the test and review verdicts recorded against them, along with the names and descriptions you or your AI give them.
  • Schema metadata from your sources. When you register a database, an API or a file store, Dandy AI reads its structure: table and column names and types, API endpoints and their fields, file formats and columns. That is what it keeps.
  • Your account email. Supplied by Google or Microsoft when you sign in, along with your display name and organization membership, so we know who you are and what you have access to.
  • Billing records. Handled by Stripe. We keep the subscription state (plan, seat count, trial and renewal dates) and Stripe's customer identifier.

What we never store

  • Database passwords and API keys. A password or key you supply so Dandy AI can read a source's structure is used for that one connection and then discarded. It is never saved.
  • The contents of your data. We do not copy, cache, or read the rows in your tables, the responses from your APIs, or the contents of your files. Dandy AI records that a column called customer_id exists and is an integer; it never sees the values in it.

Connecting an AI client

When you connect Claude or another AI client to your account, you sign in and approve access, and Dandy AI issues that client an OAuth token for your organization. The token lets the client read and update your Dandy AI record, nothing else.

  • Stored hashed. We keep only a one-way hash of each token, never the token itself, so a copy of our database could not be used to act as your client. Dandy AI API keys are stored the same way.
  • Revocable. A workspace admin can revoke a connected client at any time from the Organization Access page, where your API keys are listed, under Connected apps. A revoked token stops working on its next use.

Signing in

Sign-in is handled through Google or Microsoft OAuth. We never see or store your password for those accounts. We receive only your email address, name, and a stable account identifier from the provider.

Payments

Subscriptions run through Stripe, which processes and stores your card details on its own systems. Card numbers never reach Dandy AI. You can cancel anytime from the billing portal in your account.

Sharing

We do not sell your data, and we do not share it with advertisers. We use a small set of service providers to run the product, including Stripe for payments and our hosting and database providers, and they only receive what they need to do that job.

Your data, your call

You can ask us for a copy of what we hold about you, or ask us to delete your account and its data. Email nicholasfulton@dandylabs.dev and we will take care of it.

Changes

If this policy changes in a way that matters, we will update the date at the top of this page and, for material changes, let account holders know by email.

Contact

Questions about privacy or anything on this page: nicholasfulton@dandylabs.dev.

Back to dandylabs.dev