Privacy Policy

Who we are

We provide Donna, an independent third-party app that drafts and sends replies inside a support inbox you already run. We are the data controller for your account and billing information. For the customer conversations Donna handles, you are the controller and we act as your processor, on your instructions.

What we collect

• Account and workspace data: your name, work email, the workspace you belong to, your teammates' names and emails, and the help desk account you authorise.
• What you tell her: the few lines describing your business, your tone and language settings, your handoff rules, and the API endpoints you switch on, including any credentials you save for them.
• Conversation data: the messages in the threads she is asked to handle, the replies she drafts or sends, and what your own endpoints return when she calls them. That text belongs to you and to the customers who wrote it.
• Usage and metering: which model was used for which conversation, token counts and cost, handoff counts, and the ordinary operational logs and error reports a service keeps.
• Billing data: your plan, invoices and payment status. Card details go straight to our payment provider — we never see or store them.

What we do with it

We use it to run the service you asked for: to reply in your inbox, to apply your handoff rules, to show your team the transcripts and the month's spend, to support you when you write in, to keep the service secure and working, and to bill you. We also use aggregated, non-identifying figures — volumes, error rates, latency — to make the product better.

We do not sell personal data, we do not share it for advertising, and we do not train models on your conversations. Nothing about your business is crawled; Donna knows only what you tell her and what your own endpoints return.

Our legal bases, where the GDPR or UK GDPR applies, are the performance of our contract with you (running the service and billing it), our legitimate interests (security, diagnosis, and improving the product), and consent where we ask for it, such as for marketing email you can withdraw from at any time.

Where conversation text goes

The text of a conversation is sent to the model provider whose key you configured — Anthropic, OpenAI, Google, Mistral or Groq — so that a reply can be generated, and nowhere else. That provider handles it under your account with them and their terms; where you use a key we supply to get started, it is handled under ours. We select providers that do not train on data submitted through their APIs.

Your own endpoints are called only when you switch them on, one at a time. Every call is a GET over HTTPS, redirects are not followed, and private and internal addresses are blocked. There is no code path that writes to your systems.

Who else processes data for us

• Model providers, as above, chosen by you.
• The help desk you connect — Crisp today, others as they are added — which is where the conversations already live.
• Paddle.com Market Ltd, our payment provider and merchant of record, which handles checkout, invoicing, tax and card data.
• Cloud hosting, database, email and error-monitoring providers used to run the service.

Each is bound by a contract to process data only on our instructions. We will also disclose data where the law requires it, and to a successor if the business is sold — in which case this policy travels with it. A current list of sub-processors is available on request at hello@donna.do.

International transfers

Our providers operate in the United States and the European Economic Area, so data may be transferred outside your country. Where personal data leaves the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses and the UK Addendum, together with the additional safeguards those require.

How long we keep it

Conversations and their transcripts are kept while your workspace exists, so your team can read them in the shared inbox. Delete the workspace and they go with it, along with your instructions, rules and stored keys, within 30 days across backups. Account and billing records are kept for as long as tax and accounting law requires, usually six or seven years. Operational logs are kept for a short period, normally under 90 days.

Security

Data is encrypted in transit and at rest. Provider keys and endpoint credentials are stored encrypted and are never shown back to you in full. Access inside our team is limited to the people who need it to run and support the service. No system is perfect; if a breach affects your data we will tell you and the relevant regulator without undue delay.

Your rights

Depending on where you live, you can ask for a copy of your data, correct it, delete it, restrict or object to a use of it, take it elsewhere in a portable form, or withdraw a consent you gave. Californian residents have the rights to know, delete, correct and opt out of sale or sharing — we do not sell or share personal data, and we will never treat you differently for exercising a right.

Write to hello@donna.do and we will answer within 30 days. If a request concerns a conversation held on behalf of one of our customers, we will pass it to that customer, who is the controller of it. You may also complain to your local data protection authority.

Cookies

This site uses only what is needed to make it work and to keep you signed in — session and preference cookies. We do not run advertising or cross-site tracking cookies. Any analytics we use is privacy-preserving and aggregated.

Children

Donna is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children; if you believe we have, tell us and we will delete it.

Changes

We will update this policy as the product changes, and the date at the top will say when. For a material change affecting how we handle your data, we will tell you by email or in the app before it takes effect. Your use of the service is also governed by our Terms and Conditions.