Operator and privacy contact
Anika Tasmi Rima operates DoneHat from H345, Gaibandha Road, Sundarganj, Gaibandha 5720, Bangladesh. For account, website and support data, the operator determines the purposes of processing. Send privacy questions and rights requests to contact@donehat.com. When an organization provides data on someone else’s behalf, its own responsibilities also apply.
Information and sources
We process account names, email addresses, password hashes and session records; workspace members, brand facts, website URLs, questions, drafts, tasks and saved results; public page content and AI answers collected for an audit; support correspondence; and billing identifiers, plan status and payment events. Payment card details are entered with the checkout provider, not stored as full card numbers by DoneHat.
Requests can produce technical records such as IP address, browser information, timestamps, errors and service usage. With optional analytics enabled, we also record product events and referral information. Public websites and AI answers may include personal information; public availability does not remove a person’s privacy rights.
Purposes and grounds
We use information to provide requested audits and account features, manage subscriptions, answer support requests, maintain security, enforce usage limits and meet legal obligations. Where the GDPR applies, the relevant grounds are performing our contract, legal obligations, and legitimate interests in operating a secure service and resolving problems, balanced against your rights. Optional device analytics uses consent, which you can withdraw in Cookie settings. Where local law requires consent for other processing, that requirement also applies.
AI processing and other providers
AI requests can include your buyer questions, brand and competitor names, supplied business facts, relevant page text and previous answers. The current pilot uses OpenAI for sampled web-grounded answers and DeepSeek for classification and drafting. Other answer providers may be used when enabled for a feature. Provider names and model details are shown with evidence when recorded. Do not supply secrets or sensitive personal information in prompts or pages selected for analysis.
AWS hosts the application, database, backups and transactional email service. Cloudflare provides domain services and incoming email routing when configured, and Turnstile abuse prevention for anonymous audit submissions. Freemius handles purchases and billing records. PostHog and Google Analytics (Google Ireland Limited) are optional analytics, used only when permitted by your choice; Sentry may receive error diagnostics when configured. We share information needed for those functions and do not sell personal information. Each provider also has its own applicable terms and privacy practices.
Public reports and team access
Anyone with a free audit report link can view that report, its sampled answers and submitted business context. Links currently expire after 30 days. Avoid private client data in this flow. Signed-in workspaces have membership-based access; people you authorize may see the work you share there. Contact us with the report URL if it includes information that should be removed.
Locations and international processing
The pilot application and database run in AWS Frankfurt, Germany. This does not mean all processing stays in Germany: the operator is in Bangladesh and AI, billing, email and infrastructure providers may process data elsewhere, including the United States and China. Provider arrangements and applicable transfer requirements must be considered before placing personal client data in DoneHat. Contact us for a data-processing or transfer review; we do not claim an EU-only service or a completed enterprise data-processing agreement.
Retention and deletion
Account and workspace records support the active service and saved history. Public link expiry stops public access through that link; it is not an immediate database erasure schedule. Some usage and billing identifiers survive deletion to prevent duplicate charges or allowance resets and to resolve disputes. Backup copies remain until their storage lifecycle expires. Retention depends on the purpose, account status, legal obligations and unresolved security or billing matters; there is no blanket 90-day deletion promise.
Request deletion in account settings or email us. We may need proportionate identity verification before providing or changing account data. If we must retain information, we will explain the reason and relevant criteria. Deleting your account does not automatically remove a report created through the public audit flow or records independently held by a payment provider.
Your rights and choices
Depending on applicable law, you can request access, correction, deletion or a copy of your information, object to or restrict processing, and withdraw consent without changing the lawfulness of earlier processing. You may complain to the relevant data protection authority. Contact contact@donehat.com with the account email or affected report URL; do not send your password. We respond within the period required by applicable law.
DoneHat is intended for adults using business tools, not children. Our outputs do not decide eligibility for employment, credit, housing or other consequential services. We use access controls and encrypted network connections, but no service can promise absolute security. Material changes to this notice will be dated and communicated where required.
Questions about these policies?
contact@donehat.com