Privacy policy

1. Controller

The controller of the data described in this policy is Dona Labs LLC, EIN 43-2201094, a limited liability company organized under the laws of the State of Delaware, United States, with its registered address at 1500 NE Miami Pl ("Dona"). Privacy contact: privacy@joindona.com.

This policy covers the data of: (a) visitors of joindona.com and people who contact us; (b) Dona customers and their users of the CRM and apps. We process the data of our Customers' customers (people who message or call a business served by Dona) on behalf of that business, under the Data processing agreement: to exercise your rights over that data, contact the business; you may also write to us.

2. Data we process

Contact data: name, email, phone, company, industry and what you write in the form or through other channels.

Account data: name, email, password (stored only as an irreversible hash), language and security settings of panel, CRM and app users.

Billing data: legal name, tax details, payment history. Card data is processed by Stripe or Mercado Pago; Dona never receives it.

Usage and security data: sign-in records, IP address, sensitive actions performed (audit log) and technical data needed to operate and protect the Service.

Content the Customer uploads: business information, catalog, files, photos and videos.

Data from connected platforms: when the Customer connects a WhatsApp Business account or another channel, we receive the account identifiers and the messages of that channel in order to handle them.

We do not use third-party advertising or analytics tools on the website or the panel.

3. Purposes and legal bases

Provide the Service and support (performance of the contract).

Answer sales inquiries and follow up as you requested (your consent and our legitimate interest in replying).

Invoice, collect payments and comply with legal, accounting and tax obligations (legal obligation).

Protect the security of the Service and prevent fraud and unauthorized access (legitimate interest and our legal duty to keep data secure).

Send you Service updates. You can unsubscribe at any time.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use it to train AI models.

4. Who we share data with

We share data only with providers we need to deliver the Service (processors or sub-processors), under contract and with confidentiality and security obligations: infrastructure and hosting (DigitalOcean), AI models (Anthropic; OpenAI to transcribe audio), messaging (Meta / WhatsApp Business; Twilio for telephony), payments (Stripe, Mercado Pago) and email delivery (Resend). The complete, up-to-date list is in the Data processing agreement.

We may also share data when required by a competent authority under the law, or in the event of a merger or sale of the company, keeping the protections of this policy.

When a public authority asks us for personal data, we first review that the request is legally valid and binding, we challenge it if we consider it unlawful, we disclose only the minimum information the request requires, and we keep a record of the request and of our response. The full procedure is in our Government and law enforcement requests policy.

5. Text messages (SMS)

Dona, and the businesses Dona serves in the United States, may answer by text message (SMS) through a phone number provided by Twilio. These messages are conversational: a person starts the conversation by texting the number, and that first message is their consent to receive replies about their inquiry (for example, answers to questions, appointment confirmations or order updates). We do not send promotional or unsolicited text messages through the Service.

Message frequency varies with the conversation. Message and data rates may apply. You can reply STOP at any time to stop receiving messages from that number (you will get one confirmation and nothing more) and HELP for assistance; you can also write to privacy@joindona.com.

Phone numbers and SMS consent are used only to reply to the person who wrote and to keep that conversation in the CRM of the business they wrote to. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be sold, rented, transferred or shared with any third party; they are disclosed only to the providers that carry the messages (Twilio and the mobile carriers), for delivery.

6. International transfers

Dona is based in the United States and its providers process data mainly there. If you are in the European Union, the United Kingdom or Switzerland, transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or an equivalent mechanism. If you are in Argentina, transfers rely on the model clauses approved by AAIP Disposition 60-E/2016. For other countries we use the safeguards their law requires, and we require adequate security from every provider.

7. Retention

Account and Service data: while the relationship lasts and up to 30 days after it ends (to allow export), unless you ask us to delete it sooner.

Backups: rotated and deleted within 30 days at most.

Audit log: 1 year.

Billing data: as long as accounting and tax rules require (generally 7 to 10 years, depending on the country).

Inquiries that do not become customers: up to 2 years after the last contact.

8. Security

We apply appropriate technical and organizational measures: encryption in transit (HTTPS), encryption of third-party credentials, hashed passwords, two-step verification for Dona staff, audit logging, least-privilege access, encrypted backups and monitoring. More in our Security policy.

If an incident affects your data we will notify you without undue delay, and the authorities where required.

9. Your rights

Wherever you are, you may request access to your data, its correction, update or deletion, object to certain processing, withdraw consent and request portability by writing to privacy@joindona.com. We respond within the deadlines set by the law that applies to you, and in any case within 30 days. We may ask you to verify your identity first. How to request deletion, step by step, is explained in Data deletion.

If you are in the European Union, the United Kingdom or Switzerland, you have the rights of the GDPR and equivalent laws, including lodging a complaint with your local supervisory authority.

If you reside in California, you have the rights of the CCPA/CPRA: to know what personal information we collect and how we use it, to delete it, to correct it, to opt out of its sale or sharing (Dona does not sell or share personal information for advertising) and not to be discriminated against for exercising them. You may use an authorized agent; we will verify the request.

If you are in Argentina, you have the rights of Law 25,326: access, free of charge, at intervals of no less than six months unless a legitimate interest is shown (section 14, subsection 3), and correction, update or deletion within the legal deadlines. The Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the enforcement authority of Law 25,326, handles complaints from anyone whose data protection rights have been affected.

If you are in Brazil, you have the rights of the LGPD, including complaining to the ANPD.

10. Minors

The Service is intended for businesses and not for people under 18. We do not knowingly collect data from children under 13 (or the age set by your country's law) for our own purposes; if you believe we have, write to privacy@joindona.com and we will delete it.

11. Changes

If we materially change this policy we will announce it on the website and email Customers in advance. The date of the last update appears at the bottom.