Privacy Policy

Donded Pty Ltd ("Donded", "we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered marketing platform at donded.com.au. We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and where applicable, the General Data Protection Regulation (GDPR).

By using Donded, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our platform.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Name and email address
• Business name, description, location, and service area
• Industry or trade type
• Monthly advertising budget and marketing goals
• Website URL
• Password (stored in hashed form via Clerk)

1.2 Meta (Facebook) Platform Data

When you connect your Meta Business account, we collect and store the following data from the Meta Platform via OAuth:

• Meta user access token (encrypted at rest)
• Facebook Ad Account ID and name
• Facebook Page ID and name
• Ad campaign performance data: spend, impressions, clicks, leads
• Ad Account permissions granted via ads_management and ads_read scopes
• Facebook Page engagement data via pages_read_engagement scope

We access this data solely to provide our advertising management services on your behalf. We do not sell or share Meta Platform data with third parties for advertising purposes, profiling, or any use not directly required to operate our service.

1.3 Usage Data

• AI chat messages and conversation history
• Campaigns created through our platform
• Leads and CRM contact data associated with your campaigns
• Login timestamps and session data
• Subscription and billing information (payment processing via Stripe)

1.4 Technical Data

• IP address and browser type
• Pages visited and time spent on the platform
• Error logs and performance data

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Donded platform
• Create and manage Meta ad campaigns on your behalf using the permissions you grant
• Generate AI-powered ad copy, targeting recommendations, and campaign reports
• Process subscription payments and send billing communications
• Send transactional emails (account creation, campaign alerts, billing receipts)
• Improve and personalise the platform based on usage patterns
• Respond to support enquiries
• Comply with legal obligations and enforce our Terms of Service

We do not use your Meta Platform data to target advertisements to you on other platforms, build audience profiles for third-party use, or for any purpose beyond operating the Donded service you have requested.

3. Meta Platform Data — Specific Disclosures

Donded integrates with the Meta Marketing API. Our use of Meta Platform data complies with Meta's Platform Terms and Meta's Developer Policies.

• We only request permissions necessary to manage your advertising campaigns (ads_management, ads_read, pages_read_engagement, pages_show_list).
• Your Meta access token is encrypted and stored securely. It is never exposed to third parties.
• We do not transfer, sell, or license your Meta Platform data to any third party.
• We do not use Meta Platform data for re-targeting, profiling, or cross-platform advertising.
• We retain Meta access tokens only while your account is active. Disconnecting your Meta account or deleting your Donded account revokes our access and triggers deletion of stored tokens.

4. Google Gmail & Microsoft Outlook Integration

Donded offers an optional feature that lets you connect your own Gmail or Microsoft 365/Outlook account, so that emails to your leads are sent from your real address and (for Outlook) replies are tracked automatically. This is entirely opt-in — nothing is accessed unless you choose to connect an account in Settings.

4.1 What we access, and why

• Gmail: permission to send email on your behalf (the "gmail.send" scope) and your Google account email address, so we know which address a sent email came from. We do not request, and cannot obtain, permission to read your Gmail inbox or any existing email.
• Outlook / Microsoft 365: permission to send email on your behalf and to read your inbox ("Mail.Send" and "Mail.Read"), so a lead’s reply can be matched back to their enquiry and shown in your Donded Email inbox automatically.

4.2 How this data is used

• Sending an email you compose in Donded, or an automated follow-up reminder you’ve enabled, through your own connected account.
• For a connected Outlook account only: periodically checking your inbox for a new message from an email address that matches one of your leads, and storing that message (sender, recipient, subject, and a preview of the body) against that lead’s record so you can see the full conversation in one place.
• Your Gmail or Microsoft access and refresh tokens are encrypted at rest and used solely to make the above API calls on your behalf.

We do not use data obtained through Gmail or Microsoft integrations for advertising, do not sell it, and do not share it with any third party except where strictly necessary to provide the Donded service to you (e.g. our database and hosting providers listed in Section 6, who are bound by data processing agreements and have no independent right to use this data).

Donded's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your Gmail or Outlook account at any time from Settings → Connected Accounts. Disconnecting immediately revokes Donded's access and deletes the stored access/refresh tokens; previously sent or received emails already recorded in your Donded Email inbox are retained as part of your lead records unless you request deletion under Section 9.

5. Google Calendar & Microsoft Outlook Calendar Integration

Donded offers an optional feature that lets you connect your own Google Calendar or Microsoft 365/Outlook Calendar, so that your public booking page only ever offers times you are genuinely free, and appointments booked through Donded appear directly on your real calendar. This is entirely opt-in — nothing is accessed unless you choose to connect a calendar in Settings.

5.1 What we access, and why

• Google Calendar: permission to read your existing events ("calendar.readonly") and to create, update, and delete events ("calendar.events"), plus your Google account email address so we know which calendar was connected. We only ever read busy/free time and event details needed to avoid double-booking — we do not use this data for any purpose beyond scheduling.
• Outlook / Microsoft 365 Calendar: permission to read and write your calendar events ("Calendars.ReadWrite") and your basic profile ("User.Read"), used the same way — to check your real availability and create an event when a lead books an appointment through Donded.

5.2 How this data is used

• Computing which time slots to show on your public booking page, based on your existing calendar events and your working-hours/buffer settings.
• Creating a new calendar event on your connected calendar whenever a lead books an appointment through Donded, and removing or updating that event if the appointment is cancelled or rescheduled.
• Your Google or Microsoft access and refresh tokens are encrypted at rest and used solely to make the above calendar API calls on your behalf.

We do not use data obtained through Google or Microsoft Calendar integrations for advertising, do not sell it, and do not share it with any third party except where strictly necessary to provide the Donded service to you (e.g. our database and hosting providers listed in Section 6, who are bound by data processing agreements and have no independent right to use this data).

Donded's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your Google or Outlook calendar at any time from Settings → Connected Accounts. Disconnecting immediately revokes Donded's access and deletes the stored access/refresh tokens; events already created on your calendar are not retroactively removed.

6. Data Sharing and Disclosure

We do not sell your personal information. We share data only in these circumstances:

• Service providers: Clerk (authentication), Stripe (payments), Supabase (database hosting), Vercel (platform hosting), Anthropic (AI processing), Upstash (rate limiting infrastructure), Resend (transactional email). Each is bound by data processing agreements.
• Meta Platforms Inc.: data is sent to Meta solely to execute ad campaigns on your behalf.
• Legal requirements: if required by law, court order, or government authority.
• Business transfers: in the event of a merger or acquisition, your data may transfer subject to equivalent privacy protections.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specifically:

• Account and business profile data: retained while your account is active, deleted within 30 days of account closure.
• Meta access tokens: deleted immediately upon disconnection or account closure.
• Campaign and leads data: retained for 3 years after account closure for legal and billing compliance, then deleted.
• AI conversation history: retained while your account is active, deleted within 30 days of account closure.
• Billing records: retained for 7 years in accordance with Australian tax law.

8. Data Security

We implement industry-standard security measures to protect your information, including:

• TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest (including access tokens)
• Role-based access controls for internal systems
• Regular security reviews and dependency updates

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Your Rights

Under the Australian Privacy Act and, where applicable, the GDPR, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Withdraw consent to data processing at any time
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, email hello@donded.com.au. We will respond within 30 days.

10. Facebook Data Deletion

If you connected your Facebook account to Donded and later wish to delete your data from our platform, you can:

• Delete your Donded account from Settings, which removes all associated Meta data within 30 days.
• Remove the Donded app from your Facebook account at facebook.com/settings?tab=applications. We will receive a deletion request and process it within 30 days.
• Email hello@donded.com.au to request manual data deletion.

You can also check the status of a data deletion request at donded.com.au/data-deletion.

11. Cookies and Tracking

We use essential cookies to maintain your login session. We do not use third-party advertising cookies or tracking pixels on our platform. Our public marketing site (donded.com.au) may use analytics to measure visitor behaviour; no personally identifiable information is collected via analytics.

12. Children's Privacy

Donded is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal data, contact us at hello@donded.com.au.

13. International Transfers

Your data is primarily stored in Australia and the United States. By using Donded, you consent to the transfer of your information to these countries. We ensure appropriate safeguards are in place for any international data transfers.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Continued use of Donded after changes take effect constitutes acceptance of the updated policy.

15. Contact Us

For privacy-related enquiries, requests, or complaints, contact our Privacy Officer: