Last updated: 28 October 2026 Version: 1.0
This policy explains how personal data is handled when you visit https://delusiongroup.com, use Dwork (https://dwork.delusiongroup.com) or DeluHub (https://deluhub.delusiongroup.com), or contact us. The Services are operated by Delusion Group, a business registered in Vietnam ("Delusion", "we", "us"). Business registration details are available on request from support@delusiongroup.com.
We follow Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, and we apply a baseline consistent with the EU/UK GDPR for users in the European Union, the United Kingdom and the United States.
Privacy contact: support@delusiongroup.com (subject: "Privacy")
1. Our role
- Controller. We decide how and why we process data about our customers and website visitors: account details, billing records, support messages, and service logs.
- Processor. For the content your organisation puts into Dwork or DeluHub (emails, meetings, recordings, documents, workspace data), your organisation is the controller and we process it only on its instructions. Our Data Processing Addendum covers this. If you are a user in a customer's workspace, contact your workspace administrator first about that content.
2. What we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | name, work email, workspace name, role, password hash, language | create and run your account, sign-in, security | contract; consent where required |
| Billing data | plan, seats, order and invoice numbers, billing country, company name and tax ID for invoices | billing, tax and accounting records | contract; legal obligation |
| Payment card data | handled only by Lemon Squeezy; we do not receive full card numbers | payment | contract (by Lemon Squeezy) |
| Meeting media | live audio, video, screen share relayed between participants | deliver live meetings | contract |
| Cloud recordings | recorded audio and video, recording consent log | store recordings you choose to make | contract; participant consent |
| Mail content | emails, attachments, contacts, folders, mail headers | deliver, store and filter your email | contract |
| DeluHub workspace data | notes, memories, threads, files you store | provide DeluHub | contract |
| Support data | messages you send us, attached screenshots | answer requests and complaints | contract; legitimate interest |
| Technical logs | IP address, device and browser type, timestamps, sign-in events, mail delivery logs, error logs | security, abuse prevention, troubleshooting | legitimate interest; legal obligation |
| Founding price requests | name, work email, chosen plan, number of seats (Team only), language of the form | handle your request and email you when payments open | steps taken at your request before a contract |
| Website data | essential cookies; page views and clicks, without cookies or IP addresses (see Analytics below) | run the website and measure usage | necessary; legitimate interest |
We do not sell personal data. We do not use Customer Content for advertising or to train AI models. We do not knowingly collect sensitive personal data, except where it appears in content you choose to store.
Founding price requests. When you request a founding price on the DeluHub website, Delusion Group collects your name, work email, the plan you chose, the number of seats (Team only) and the language of the form, and uses them only to handle that request and to tell you when payments open. We do not send you marketing emails. No payment is taken, and a request does not reserve one of the 50 Founding places: places are counted at first payment. We keep the request until payments open and you pay, or until you tell us you no longer want it, and at most 12 months. To cancel the request or have your details deleted, reply to our confirmation email or write to support@delusiongroup.com.
Analytics. We use PostHog, provided by PostHog Inc., as our processor to count page views and clicks on delusiongroup.com and the DeluHub website. PostHog runs in PostHog Cloud EU. It runs without cookies, and our server does not send your IP address to PostHog. We do not send names, email addresses or the content of your messages or files.
Live meetings. Meeting media is relayed through our servers to the other participants in real time. It is not stored unless someone starts a cloud recording.
Local recording. When a participant records locally in the browser, the file is saved on their own device. We do not receive it. The person recording is responsible for informing participants and obtaining consent.
3. Who can access your data
We share personal data only with:
- Service providers (subprocessors) that host or process data for us under contracts that require confidentiality and security:
| Provider | Service | Data | Location |
|---|---|---|---|
| Amazon Web Services (AWS EC2) | servers for Dwork mail (including support@ mail) and meetings, recordings | account, mail content, meeting media, recordings, logs | Sydney, Australia |
| Cloudflare, Inc. | website hosting, DeluHub hosting and database, CDN, security, object storage (R2) | website data, DeluHub data, files, logs | global network |
| Lemon Squeezy LLC (a Stripe company) | Merchant of Record for online payments | name, email, billing address, payment and order data | United States |
| Resend, Inc. | sending form notifications and request confirmations | name, email address, message content | United States |
| PostHog Inc. (PostHog Cloud EU) | website analytics, without cookies or IP addresses | page views and clicks | European Union |
- Your workspace administrator, who can manage the accounts and content of their workspace.
- Competent authorities, when the law requires it.
- A successor business, if the Services are transferred, under the same protections and with notice to you.
Our staff access personal data only when needed to run, secure or support the Services.
4. Transfers outside Vietnam
Our servers and several providers are located outside Vietnam, including in the United States. We transfer personal data abroad only as needed to provide the Services, under contracts with appropriate safeguards, and we prepare and file the cross-border transfer impact assessment required by Vietnamese law. For EU/UK data, we rely on the safeguards available under the GDPR, such as Standard Contractual Clauses or the provider's certification.
5. How long we keep data
| Data | Retention |
|---|---|
| Account data | while your account is active, then deleted within 30 days after closure and export period |
| Mail content and DeluHub data | until you delete it or your workspace is closed, then deleted as in our Terms (section 8.3) |
| Cloud recordings | 30 days from recording, then deleted automatically |
| Recording consent logs | 12 months |
| Billing and invoice records | as long as tax and accounting law requires (generally up to 10 years in Vietnam) |
| Order and contract data | at least 1 year, as required for e-commerce |
| Technical and security logs | 90 days, longer if needed to investigate an incident |
| Support messages | 24 months after the request is closed |
6. How we protect data
We use encryption in transit (TLS), access controls with least privilege, multi-factor authentication for administrative access, separation between customer workspaces, regular backups and security updates, and logging of administrative actions. No system is perfectly secure, and we keep improving these measures.
7. Your rights
Under Vietnamese law (Law No. 91/2025/QH15), and similar rights under the GDPR, you have the right to:
- be informed about how your data is processed;
- give, refuse or withdraw consent (withdrawal does not affect earlier lawful processing);
- access and receive a copy of your data;
- view, correct or ask us to correct your data;
- ask us to delete your data;
- ask us to restrict processing, or object to processing;
- data portability (EU/UK);
- complain to us or to the competent authority, and seek compensation where the law allows.
How to exercise them.
- You can view and edit most account data yourself in your account settings, and export content from the product.
- For anything else, email support@delusiongroup.com from your account email, stating your request. We may ask you to verify your identity.
- We acknowledge requests within 3 business days and respond within the time limit set by law, and in any case within 30 days.
- If your request concerns content in a customer workspace, we will forward it to that workspace's administrator and help them respond.
- If you are not satisfied with our answer, you can complain to the Vietnamese personal data protection authority (Department of Cybersecurity and High-Tech Crime Prevention, Ministry of Public Security), or to your local data protection authority in the EU/UK.
8. Data breaches
If a personal data breach occurs, we will take steps to contain it, notify the competent authority within the time required by law, and inform affected customers and individuals without undue delay where required, including what happened, the likely impact and what we are doing about it.
9. Cookies
We use essential cookies to keep you signed in, remember your language and protect against abuse. These are necessary for the Services. Our analytics run without cookies. We do not use advertising cookies.
10. Children
The Services are for businesses and professionals and are not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact support@delusiongroup.com and we will delete it.
11. Changes
We may update this policy. We will post the new version here with a new "Last updated" date and notify account owners of material changes by email or in the product before they take effect.
12. Contact
Privacy and support: support@delusiongroup.com Business details are available on request from support@delusiongroup.com.