Privacy Policy

Version 2.1
Last update: August 22, 2023

At Donut Technologies, Inc., we provide friendly, purpose-built programs that create human connection.

Donut is committed to protecting and respecting your privacy. This Privacy Policy (this “Policy”) sets out how we collect and process personal information about you when you visit our website at donut.com, when you use our products and services (whether via our third party integrations with various collaboration services (including, among others, Slack), app.donut.ai, or otherwise) (collectively, our “Services”), or when you otherwise do business or make contact with us.

Please read this policy carefully to understand how we handle and treat your personal information.

What information do we collect?

SUMMARY:

Donut collects data to enable it to operate the Services effectively, and to provide you with the best experiences on our website and our Services. You provide some of this data to us directly, such as when you register to use our Services (whether directly through us, or indirectly through a collaboration service or third party service like Slack), subscribe to a newsletter, respond to a survey, make an enquiry through our website, contact us for support, or contact us as a prospective customer, vendor, supplier, or consultant. We get some of your data by recording how you interact with our website and our Services by, for example, using technologies like cookies. We also obtain and process data in the context of providing the Services.

LEARN MORE:

You have choices about the data we collect. When you are asked to provide personal data, you may decline. But if you choose not to provide data that is necessary to enable us to provide the Services, you may not be able to use all or part of those Services.

The data we collect depends on the context of your interactions with Donut, the choices you make (including your privacy settings), and the Services you use. The data we collect can include the following:

Name and contact information. We may collect your first and last name, email address,, postal address, phone number, company information, and other similar contact data.

Payment information. When you make purchases on our website, a secure window will be opened directly to our payment provider (currently, Stripe), and any payment information that you provide is sent directly to the payment provider. We do not have access to complete payment information.

Customer information. When you subscribe to our Services, you will control what data is collected and stored on our systems. For example, you might give us the following types of data during your use of the Services:name and email address. In such cases, we act as a data processor, in accordance with your instructions.

Device and Usage information. We may collect data about your device and how you and your device interact with Donut and our Services. For example, we may collect:

Use data. We may collect data about the features you use, the Services you purchase, and the web pages you visit. This also includes your interactions on our website, and your interactions with us via email.
Device, connectivity and configuration data. We may collect data about your device and the network you use to connect to our Services. This may include data about the operating system and other software installed on your device, including product keys. It may also include IP address, browser type, operating system, and referring URLs.

What do we use your information for?

SUMMARY:

We use the data we collect to operate our business, and to provide the Services to you. This includes using the data to improve our Services, and to personalize your experiences. We may also use the data to communicate with you to, among other things, inform you about your account, provide security updates, and give you information about the Services. We may also use the data to manage your email subscriptions, improve the relevance and security of our website, respond to user enquiries, send you periodic marketing communications about our Services, and improve the relevance of our advertising.

LEARN MORE:

Providing and improving our Services. We use data to provide and improve the Services we offer, and to perform essential business operations. This includes operating the Services, maintaining and improving the performance of the Services, developing new features, conducting research, and providing customer support. Examples of such uses include the following:

Providing the Services. We use data to carry out your transactions with us and to provide the Services to you. In certain cases, the Services include personalized features and recommendations that enhance your productivity and enjoyment, and automatically tailor your experience based on the data we have about you.
Technical support. We use data to diagnose product problems, and to provide other customer care and support services.
Improving the Services. We use data to continually improve our website and our Services, including system administration, system security, and adding new features or capabilities.
Business Operations. We use data to develop aggregate analyses and business intelligence that enable us to operate, protect, make informed decisions, and report on the performance of our business.
Recruitment. If you apply for a job with us, we use your data for recruitment purposes.
Promotions. We may use your data to administer contests, promotions, surveys, or other site features.
Improving Advertising Campaigns. We may use your data to improve our advertising campaigns, primarily in an effort to prevent targeting of impressions via third-party channels when they are not relevant to you.
Sending Periodic Emails. We may use your data to send you periodic emails. We may send you occasional marketing emails about our products and services, which you can unsubscribe from at any time using the link provided in the message.
Generally. We use data to respond to your enquiries and requests relating to our Services, to create and administer your accounts, and to provide us with information and access to resources that you have requested from us. We also use data for general business purposes, including, among other things, to improve customer service, to help us improve the content and functionality of our Services, to better understand our users, to protect against wrongdoing, to enforce our Terms of Service, and to generally manage our business.
Communications. We use data we collect to communicate with you, and to personalize our communications with you. For example, we may contact you to inform you when your subscription is ending, to discuss your account, to let you know when updates are available, to remind you about features of the Services that are available for your use, to update you about a support request, or to invite you to participate in a survey.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our payment gateway providers database only to be accessible by those authorized with special access rights to such systems, and are required to keep the information confidential. Your financial information (e.g. credit cards) is never stored on our servers.

How do we ensure that our processing systems remain confidential, resilient, and available?

SUMMARY:

We implement a variety of measures to ensure that our processing systems remain confidential, resilient, and available. Specifically, we have implemented processes to help ensure high availability and business continuity. We commit to maintaining strong physical and logical access controls, and conduct regular penetration testing to identify and address potential vulnerabilities.

LEARN MORE:

High Availability. Every part of the Services utilize properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in case of failure. We take servers out of operation as part of regular maintenance, without impacting availability.

Business Continuity. We keep encrypted backups of data on Heroku. While never expected, in the case of production data loss (i.e., primary data stores loss), we will restore organizational data from these backups.

Physical Access Controls. Donut is hosted on Heroku and AWS_. Those data centers feature a layered security model, including extensive safeguards such as custom-designed electronic access cards, alarms, vehicle access barriers, perimeter fencing, metal detectors, and biometrics. Donut employees do not have physical access to Heroku and AWS data centers, servers, network equipment, or storage.

Logical Access Controls. Donut is the assigned administrator of its infrastructure on Heroku and AWS, and only designated authorized Donut operations team members have access to configure the infrastructure on an as-needed basis.

Penetration Testing. We engage an independent, third-party agency to perform penetration testing on a regular basis. Information about security vulnerabilities that are successfully exploited through penetration testing is then used to set mitigation and remediation priorities. If you are a customer on one of our “Enterprise” plans, we will provide a summary of penetration test findings to you upon request and signing our NDA.

Do we use cookies?

SUMMARY:

Yes. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognize your browser and capture and remember certain information. You can choose to disable cookies, but if you do, your ability to use or access certain parts of our website may be affected.

LEARN MORE:

We use cookies and other similar identifiers to understand and save your preferences for future visits, to advertise to you on other sites, and to compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

You may refuse to accept cookies by activating the setting on your browser that allows you to refuse the setting of cookies. You can find information on popular browsers and how to adjust your cookie preferences at the following websites:

However, if you choose to disable cookies, you may be unable to access certain parts of our site. Unless you have adjusted your browser setting so that it will refuse cookies and/or you have not accepted our cookies policy, our system will issue cookies when you log on to our site.

Our web pages may contain electronic images known as web beacons (also called single-pixel gifs) that we use to help deliver cookies on our websites, and to count users who have visited those websites. We may also include web beacons in our promotional email messages or newsletters, to determine whether and when you open and act on them.

In addition to placing web beacons on our own websites, we sometimes work with other companies to place our web beacons on their websites or in their advertisements. This helps us to develop statistics on how often clicking on an advertisement on a Donut website results in a purchase or other action on the advertiser’s website.

Finally, our Services may contain web beacons or similar technologies from third-party analytics providers that help us compile aggregated statistics about the effectiveness of our promotional campaigns or other operations. These technologies enable the analytics providers to set or read their own cookies or other identifiers on your device, through which they can collect information about your online activities across applications, websites or other products.

Do we disclose any information to outside parties?

SUMMARY:

We share your personal data with your consent, or as necessary to provide the Services to you. We also share your data with vendors working on our behalf; when required by law or to respond to legal process; to protect our customers; to protect lives; to maintain the security of our Services; and to protect our rights or our property.

LEARN MORE:

We share your personal data with your consent, or as necessary to provide the Services to you. We also share personal data with vendors or agents working on our behalf for the purposes described in this Policy. For example, companies we have hired to provide cloud hosting services, off-site backups, and customer support may need access to personal data to provide those functions. In such cases, these companies are required to abide by our data privacy and security requirements and are not allowed to use personal data they receive from us for any other purpose.

We may disclose your personal data as part of a corporate transaction such as a corporate sale, merger, reorganization, dissolution, or similar event.

Finally, we will access, transfer, disclose, and/or preserve personal data, when we have a good faith belief that doing so is necessary to:

comply with applicable law or respond to valid legal process, judicial orders, or subpoenas;
respond to requests from public or governmental authorities, including for national security or law enforcement purposes;
protect the vital interests of our users, customers, or other third parties (including, for example, to prevent spam or attempts to defraud users of our products, or to help prevent the loss of life or serious injury of anyone);
operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks;
protect the rights, interests or property of Donut or third parties;
prevent or investigate possible wrongdoing in connection with the Services; or
enforce our Terms of Service.

We may use and share aggregated non-personal information with third parties for marketing, advertising, and analytics purposes.

We do not sell or trade your personal information to third parties.

How to Access and Control Your Personal Data

SUMMARY:

You can view, access, edit, or delete of your personal data for many aspects of the Services. How you can access and control your personal data will depend on which Services you use.

You can opt out from receiving marketing communications from us by using the opt-out link on the communication

LEARN MORE:

Data Erasure. You can request that Donut delete your personal data by sending an email to [email protected] with “Please delete my personal data” in the subject line. Donut will verify your ability to access that email, then delete the personal data associated with your email address. We will use reasonable efforts to respond to your request within 14 days, but in all events within 30 days of our receipt of the request. Please note that we retain billing and usage metadata about a company or individual as required for compliance with law and regulation. Removing Donut from your applicable collaboration service and/or other Third Party Account is a prerequisite for complete deletion of your data.

Data Correction. You can modify your personal data by sending an email to [email protected] with “Please update my personal data” in the subject line. Donut will verify your ability to access that email, then update the fields where possible within the Services. We will use reasonable efforts to respond to your request within 14 days, but in all events within 30 days of our receipt of the request.

Your Communications Preferences. You can choose whether you wish to receive marketing communications from us. If you receive marketing communications from us and would like to opt out, you can do so by following the directions in that communication. Please note that these choices do not apply to mandatory communications that are part of the Services, or to surveys or other informational communications that have their own unsubscribe method.

Third Party Links

Occasionally, at our discretion, we may include or offer third party products or services on our website or through our Services. If you access other websites using the links provided, the operators of these websites may collect information from you that will be used by them in accordance with their privacy policies. These third party sites have separate and independent privacy policies. We, therefore, have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

Where we Store and Process Personal Data; International Transfers

Personal data collected by Donut may be stored and processed in the United States or in any other country where Donut or its affiliates, future subsidiaries or service providers maintain facilities. The storage location(s) are chosen in order to operate efficiently, to improve performance, and to create redundancies in order to protect the data in the event of an outage or other problem. We take steps to ensure that the data we collect is processed according to the provisions of this Policy, and the requirements of applicable law wherever the data is located.

We transfer personal data from the European Economic Area, the UK and Switzerland to other countries, some of which have not been determined by the European Commission to have an adequate level of data protection. When we engage in such transfers, we use a variety of legal mechanisms to help ensure your rights and protections travel with your data, including standard contractual clauses that have been approved by the European Commission.

We take our data privacy and security obligations seriously. Please see our Data Protection Addendum for more details.

Data Retention

SUMMARY:

We may retain your personal information as long as you continue to use the Services, have an account with us, have Donut installed on your collaboration service or other Third Party Account, or for as long as is necessary to fulfill the purposes outlined in the policy. You can ask to close your account by contacting us at the details above, and we will delete your personal information on request.

We may, however, retain personal information for an additional period as is permitted or required under applicable laws, for legal, tax, or regulatory reasons, or for legitimate and lawful business purposes.

LEARN MORE:

We will retain your personal data for as long as necessary to provide the Services to you, or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different types of data in the context of the different Services we provide, actual retention periods can vary significantly. The criteria we use to determine the retention periods include:

How long is the personal data needed to provide the Services and/or operate our business? This includes such things such as maintaining and improving the performance of the Services, keeping our systems secure, and maintaining appropriate business and financial records. This is the general rule that establishes the baseline for most data retention periods.
Is Donut subject to a legal, contractual, or similar obligation to retain the data? Examples can include mandatory data retention laws in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or data that must be retained for the purposes of litigation.
Is Donut installed on your collaboration service? Removing Donut from your collaboration service or other Third Party Account is a prerequisite for complete data deletion.

Changes to our Privacy Policy

We will update this privacy statement when necessary to reflect customer feedback and changes in our Services. When we post changes to this statement, we will revise the “last updated” date at the top of the statement. If there are material changes to the statement or in how Donut will use your personal data, we will notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to periodically review this privacy statement to learn how Donut is protecting your information.

How to Contact Us

If you have a technical or support question, please contact us at [email protected].

If you have a privacy concern, complaint, or a question, please contact us by sending us an email at [email protected]. We will respond to questions or concerns within 30 days.

Unless otherwise stated, Donut Technologies, Inc. is a data controller for personal data we collect through the Services subject to this statement. Our address is 228 Park Avenue South PMB 68348, New York, NY 10003-1502.

Contact Us

If you have any questions or concerns about our Privacy Policy, please contact us at:

Email address: [email protected]

Mailing address: 228 Park Avenue South PMB 69348, New York, NY 10003-1502