Privacy Policy

We are the controller of the personal data described in this policy. You can reach us at hello@chatdoes.com.

• Account details. Your email address and a password, which we store only as a salted, one-way hash. If you sign in with Google, we receive your email address and Google account identifier — never your Google password.
• Verification codes. One-time codes we email you are stored only as a hash and deleted within 24 hours.
• Conversations. The messages you send, the replies we generate, and the titles we give your conversations.
• Connected tools. Which apps you connect (for example Gmail, Google Calendar, Google Drive, Notion, Linear or Asana) and the data we read from or write to them when you ask us to.
• Billing. Your credit balance, purchase history, usage (such as the number of AI tokens each request consumed) and, if you turn on auto-recharge, your chosen threshold and top-up amount. Card details are collected and held by Stripe; we never see or store your full card number.
• Technical data. Your IP address (used briefly for rate limiting), browser type, and server logs of requests and errors.

Profile fields you fill in on the Account page (such as name, profession or bio) are saved only in your browser and are not sent to our servers.

• To create your account, sign you in and keep your session secure.
• To carry out the requests you make — reading, searching, drafting or updating items in the tools you have connected.
• To meter usage, charge for credits and process payments.
• To send service emails such as verification codes and receipts.
• To prevent abuse, debug problems and keep the service running.

Where data-protection law requires a legal basis, we rely on performing our contract with you (running the service you signed up for), our legitimate interests (security, fraud prevention and improving reliability), your consent (connecting a third-party tool, which you can withdraw at any time) and legal obligations (tax and accounting records).

To answer a request, we send your message, relevant conversation history and any data retrieved from your connected tools to a large-language-model provider. Depending on the model, this may be Anthropic, OpenAI or a model-routing gateway acting on our behalf.

These providers process the data only to generate a response for us. We do not use your conversations or connected-tool data to train AI models, and we do not sell it.

When you connect a Google service, we request only the access needed for the actions you ask for. Data obtained through Google APIs is used solely to provide those features to you.

ChatDoes’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or where required by law.

We share data only with service providers that help us run ChatDoes:

• Composio — manages the connections to your tools and holds the access tokens for them.
• AI model providers — see “AI processing” above.
• Stripe — payment processing.
• Google — if you choose to sign in with Google.
• Hosting, database, email and logging providers — to store data, deliver emails and monitor errors.

We may also disclose data if required by law, or as part of a merger or acquisition, in which case this policy will continue to apply. We never sell your personal data.

We use one essential cookie, auth_token, to keep you signed in; it expires after 30 days or when you sign out. We also use your browser’s local storage for your cached account details and profile preferences. The Google sign-in button loads a script from Google, which may set its own cookies. We do not use advertising or cross-site tracking cookies.

We keep your account and conversations for as long as your account is open. When you ask us to delete your account, we delete your conversations and account data, except for payment records we must keep for tax and accounting purposes. Disconnecting a tool revokes our access to it straight away.

Data is encrypted in transit, passwords and verification codes are hashed, and access tokens for your tools are held by our integration provider rather than in our own database. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email hello@chatdoes.com. You may also complain to your local data-protection authority.

Our providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

ChatDoes is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

We may update this policy from time to time. If a change is significant, we will tell you by email or in the app before it takes effect. The date at the top shows when it was last revised.