Privacy Notice

This privacy notice explains how Dunaroo, LLC ("Dunaroo," "we," "us," or "our") collects, uses, and shares personal information when you visit www.dunaroo.com, use the Dunaroo application (the "Service"), fill in a form on a website that uses Dunaroo, receive or reply to an email a business sends through Dunaroo, or view a client review page a business shares with you. Questions? Email contact@dunaroo.com.

Contents: 1. What we collect · 2. Information we process for businesses · 3. Roo and AI · 4. How we use it · 5. Who we share it with · 6. Cookies · 7. How long we keep it · 8. Security · 9. Your rights · 10. Children · 11. Changes · 12. Contact

1. What we collect

Information you give us. Your name, email address, phone number, job title, company, password, profile photo, and contact preferences, and anything you send us when you contact us. We do not process sensitive personal information; please don't submit it through Dunaroo forms or emails.

Payments. Stripe collects your card details directly; we never receive or store full card numbers or security codes. See stripe.com/privacy.

Inquiries sent through Dunaroo forms. Your name, email address, company, phone number, message, and any other answers the form asks for; the page you submitted it from; a one-way hash of your IP address (used to stop abuse, not to identify you); and your browser's user agent.

Emails. When you reply to an email sent through Dunaroo, we receive the reply's text, subject, sender, recipients, and attachments, and the results of the checks that confirm who sent it (SPF, DKIM, and DMARC). For emails we send, we record whether they were delivered, bounced (and why), or marked as spam, and when a link in them is clicked, including the IP address and browser of the click. We do not track email opens.

Files and content that you or a business share through the Service.

Information collected automatically.

• Device and usage information: your IP address, browser, device, operating system, language, referring page, approximate location, the pages and files you view, the features you use, and error reports.
• Sign-in records: the IP address and browser of each sign-in attempt, to protect accounts from password guessing.
• Push notification tokens, if you turn on notifications in our mobile app.
• Session recordings. We may record how people use our website and the Service (such as clicks, scrolling, and pages viewed) to find and fix problems. Recordings hide what you type. If we record use of the Service, recordings also hide the content of your workspace, and we don't record client review pages or lead forms. If you are in the EU, the UK, or Switzerland, we record only after you accept analytics cookies.
• Cookies and similar technologies (see Section 6).

2. Information we process for businesses

When a business uses Dunaroo to work with you (for example, a studio that manages your project in Dunaroo, or whose website form you filled in), that business decides what information about you to collect and how it is used. Dunaroo processes that information on the business's behalf and under its instructions. Requests about it are best sent to that business; we'll help them respond, and you can also contact us. A business can also connect other apps to Dunaroo, for example to import its work from Asana or to send updates to tools like Zapier; information it sends to those apps is handled under their terms.

3. Roo and AI

Businesses that use Dunaroo can use Roo, our AI assistant, to help with their work. When they do, the content the feature needs is sent to our AI providers (currently Anthropic) to produce the result, which is stored with that business's records. Depending on the feature, that can include an inquiry and its email conversation, a project's details, tasks, comments, and files, and the business's settings. Roo searches the public web for information about businesses, not for personal profiles of individuals. Neither we nor our AI providers use this information to train AI models.

4. How we use it

We use personal information for these purposes. If you are in the EU, the UK, or Switzerland, the legal basis for each is in brackets.

• To provide the Service: create and run accounts, deliver features, send service and account messages, and answer support requests [contract].
• To provide the Service to the businesses that use Dunaroo to work with you [legitimate interests].
• To keep the Service secure and free of abuse, fraud, spam, and bots [legitimate interests].
• To understand how the Service is used, fix problems, and improve it [legitimate interests].
• To send product news and offers; you can unsubscribe from any of these emails [legitimate interests or consent].
• To measure whether our ads lead to sign-ups, where you allow it [consent].
• To comply with the law and protect our rights [legal obligation, legitimate interests].

Where we rely on your consent, you can withdraw it at any time; this doesn't affect anything done before.

5. Who we share it with

We do not sell personal information. We share it with these service providers, who work on our behalf:

We may add or change providers as the Service grows and will attempt to keep this list current. Your information is processed in the United States and in other countries where these providers operate. Where the law requires a safeguard for transfers from the EU, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or an equivalent mechanism.

We may also share information if we sell or merge all or part of our business, or when the law requires it.

Other people in the Service. What you post in a workspace (comments, files, your profile) can be seen by that workspace's members. If a business turns on a client review page for a project, the tasks, comments, and files it shares there can be seen by anyone who has the page's private link, unless the business also protects it with a password. The business decides who receives the link.

6. Cookies

We use cookies and similar technologies (like web beacons and pixels) for these purposes:

• To make the Service work: keeping you signed in, protecting forms from forgery and bots, remembering that you've opened a client review page, and storing a copy of your workspace in your browser so it loads quickly (signing out clears it).
• To see whether links in emails sent through Dunaroo are clicked.
• On our website, sign-up pages, and in the Service, to understand how people use them, and on our website and sign-up pages, to see whether our ads work. We and the partners listed in Section 5 set these analytics and advertising cookies. They are not used on client review pages, lead forms, or in emails sent through Dunaroo.

If you are in the EU, the UK, or Switzerland, analytics and advertising cookies are set only after you accept them in our cookie banner, and you can change your choice at any time under "Cookie settings" on our website. You can also block or delete cookies in your browser settings; blocking the cookies the Service needs will stop it from working. We don't currently respond to browser "Do Not Track" signals.

7. How long we keep it

We keep personal information while your account is active and as long as we need it for the purposes above, or longer where the law requires (for example, for tax and accounting). Then we delete or anonymize it; copies in backups are deleted as the backups expire.

Inquiries that a business never turns into a client are deleted after that business's retention period (12 months by default); inquiries marked as junk are deleted after 30 days. Deleting an inquiry also deletes its email conversation, Roo's research about it, and the business's notifications about it. Files are deleted when they are removed from the Service.

8. Security

We use reasonable technical and organizational measures to protect personal information. No system is completely secure, so we can't guarantee that information will never be accessed, lost, or changed without permission.

9. Your rights

Depending on where you live (for example, the EU, the UK, Switzerland, Canada, or California), you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to how we use it, and to withdraw consent. You can update your details on your Account settings page. For anything else, email contact@dunaroo.com; we'll respond as the law requires. If your information was provided to us by a business that uses Dunaroo, you can also make these requests to that business.

You can unsubscribe from our product emails at any time with the link in each one; we'll still send messages you need about your account. If you close your account, we may keep some information where we need it to prevent fraud, resolve disputes, or meet legal requirements.

If you are in the EU or the UK, you can also complain to your local data protection authority; in Switzerland, to the Federal Data Protection and Information Commissioner.

10. Children

The Service is for people 18 and older. We don't knowingly collect information from children; if we learn we have, we'll delete it. If you think a child has given us information, email contact@dunaroo.com.

11. Changes to this notice

We may update this notice. The date at the top shows when it last changed. For significant changes, we will let you know by email or by a notice in the Service.

12. Contact

Dunaroo, LLC · contact@dunaroo.com