Privacy policy

Who we are

Doodali is a trading name of Arc Media Group Ltd, registered in England and Wales (company number 16716587), at Unit 10 Neptune Court, Hallam Way, Blackpool, FY4 5LZ, United Kingdom. For questions about privacy, contact us.

We are the controller of the data about you as a Doodali customer or website visitor. For the data you put into Doodali about your own customers and contacts, you are the controller and we are your processor: we only use it to provide Doodali to you, as set out in our terms.

What we collect

• Account details, your name, email, phone, job title, photo and password (stored only as a secure hash).
• Business details, your businesses’ names, addresses, VAT numbers, bank details for invoices, and logos.
• What you put in Doodali, customers, contacts, deals, projects, tasks, messages, files, forms, invoices and bookings.
• Connected accounts, if you connect Google, Xero, Facebook or Stripe, the access they grant: for example, emails between you and your Doodali contacts, and your calendar’s free and busy times.
• Billing, your plan and payment history. Card details are handled by Stripe; we never see or store your full card number.
• Technical data, IP address, browser and the times you sign in, kept in server logs to keep the service secure.

How we use it

We don’t sell personal data, and we don’t use the data in your account to advertise to you or anyone else.

Doodali AI

When you ask Doodali something (by typing or talking), your question and the relevant records from your account are sent to our AI provider, Anthropic, to produce the answer. It only uses data you already have access to. Anthropic doesn’t use this data to train its models.

When you speak to Doodali, the recording is sent to OpenAI to turn it into words, and spoken answers are made by OpenAI. Recordings aren’t kept by Doodali, and these providers don’t use them to train their models.

We keep the questions you ask Doodali (not its answers) with your account, to see what people need from it and make it better. We don’t share them, and they’re deleted with your account.

WhatsApp

A business using Doodali can connect its own WhatsApp Business account, through Meta’s sign-up. We then receive the data Meta and Twilio provide for that connection, the business’s WhatsApp account and number, its customers’ messages and contact details, message templates and whether messages were delivered, and use it only to run that business’s WhatsApp in Doodali: showing its messages in its inbox, sending its replies and follow-ups, and getting its templates approved. Each business only sees its own WhatsApp data. We don’t sell it, share it with other businesses, or use it for advertising. The business can disconnect WhatsApp at any time, which stops new messages coming in; its messages are kept and deleted like the rest of its account (see How long we keep it).

Google, YouTube and Microsoft accounts

Each person can connect their own Google or Microsoft 365 account, and a business can connect its YouTube channel. We only ask for what the features they switch on need, and use it only for those features:

• Calendar: to show the times you’re free on your booking page, put bookings in your calendar with an invite for the guest, and, if you choose, show your team where you are on the team calendar. Events you’ve marked private only ever show as “Busy”, and you choose whether your team sees details, just “busy”, or nothing.
• Sending email: to send your Inbox replies, invoices and other emails you write in Doodali from your own address. We don’t read your mailbox to do this.
• Reading email (only if you switch on “Log your client emails”): to find emails to and from your Doodali contacts and file them on those contacts’ pages. Other emails are ignored and not stored.
• YouTube: to show your channel’s comments in Doodali and post the replies you or Doodali AI write, as your channel. This uses YouTube’s API Services, so the YouTube Terms of Service and Google Privacy Policy also apply.

Doodali’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we don’t sell this data, use it for advertising, or let people read it except with your permission, for security, or where the law requires. We don’t use it to train AI models. When you ask Doodali AI to help with something (writing a reply to a YouTube comment, say), only what’s needed for that is sent to our AI provider, which doesn’t use it for training either.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

What we keep, and for how long. Your calendar’s events and free and busy times are read when they’re needed (to show your booking page or the team calendar) and held in memory for a couple of minutes at most; we don’t save them. Bookings made through Doodali are kept as part of your account. Emails we send for you through Gmail are kept in Doodali as part of the conversation they belong to. YouTube comments and replies are kept so you can see and answer them. All of it stays until you delete it or close your account; then it’s deleted from the live system straight away and drops out of our backups within about eight weeks.

Who it’s shared with. Nobody, except the service providers that run Doodali for us, listed below (our hosting, database and backup storage, and our AI provider for the parts you ask Doodali AI to help with), under contracts that let them use it only to provide Doodali. We never share or sell Google user data to advertisers, data brokers or anyone else, and never use it for advertising.

How it’s protected. Google’s access tokens are encrypted (AES-256) in our database, everything travels over HTTPS, and only Doodali reaches Google, on your behalf, for the features you’ve switched on. Doodali staff don’t look at it, except to help when you ask, as described in Support access below.

You can disconnect at any time in Doodali (Settings → Calendar & booking, or the YouTube page), or remove Doodali’s access from your Google account’s security settings. When you disconnect, we delete the access tokens straight away. Emails already filed on your contacts and replies already posted stay, as part of your account, until you delete them or close your account.

Who helps us

We use these providers to run Doodali. Each only gets what it needs for its job, and most are only used when you switch on the feature that needs them. Our data processing agreement covers how we choose and manage them.

Where data leaves the UK, it’s protected by the UK’s adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses.

Support access

If you ask us for help, someone on the Doodali team may open your account to see what you see and sort it out. This only happens to help you, it lasts two hours at most, and each time is recorded. The account’s owners get an email every time it happens, saying who opened it and when. Even then, some things stay hidden from us: your password vault, your staff’s HR records, documents and forms, what leave anyone is on and why, and your direct messages.

Apart from that, Doodali staff don’t look at the data in your account, except where the law requires it or to keep the service secure.

Cookies

This website asks before using any cookies that aren’t essential. When you first visit, we ask whether we may do two things. First, remember how you found us, the site, ad or campaign that sent you, so that if you get in touch later, we know which of our marketing works; that’s kept on your device for up to 90 days and holds nothing that identifies you. Second, use Meta’s pixel and Conversions API: Meta (Facebook and Instagram) sets cookies (_fbp, and _fbc if you came from one of our ads, for up to 90 days) and we tell Meta which of our pages you visit and when you join the waiting list or contact us, with your email address scrambled (hashed) so it isn’t sent as text, and your IP address and browser. Meta uses it to show our ads to people who’ve visited and to measure them; Meta is then a joint controller with us for that, under its own privacy policy. If you say no, none of this happens, nothing is stored, and a message sent through the contact form only says which page you sent it from. Change your mind any time with “Cookie settings” at the bottom of any page. We remember your choice itself so we don’t ask again. Fonts are loaded from Google Fonts, which means Google sees your IP address.

The chat on this website is answered by AI (Anthropic’s Claude) from information about Doodali. What you type is sent to Anthropic to write the answer; it isn’t used to train their models. If you leave your email, the chat so far comes to our team with it. Nothing about the chat is stored on your device.

Businesses using Doodali can add the same enquiry tracking to their own websites. They decide whether to use it and are responsible for telling their visitors.

The Doodali app uses one essential cookie to keep you signed in. It expires after 12 hours without use. We don’t use tracking cookies in the app.

How long we keep it

• Your account data is kept while your account is open. If an account is paused for unpaid bills, nothing is deleted until you close it.
• When you delete a business or close your account, its data is deleted from the live system straight away and drops out of our backups within about eight weeks.
• Billing records are kept for six years, because the law requires it.

Keeping it safe

Data is encrypted in transit (HTTPS), passwords are hashed, connection keys and saved passwords are encrypted in the database, each business’s data is separated, and the servers are locked down, monitored and backed up nightly. Two-step sign-in and passkeys are available to everyone. There’s more on our security page. No system is perfectly secure, but if something ever went wrong that affected your data, we would tell you and the ICO as the law requires.

Your rights

You can ask to see, correct, delete or export the personal data we hold about you, or object to how we use it. Most of it you can change yourself in the app. Otherwise contact us and we’ll reply within a month.

If you’re a customer of a business that uses Doodali, please contact that business first, they control your data, and we’ll help them respond.

You can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If we change this policy in a way that matters, we’ll tell you by email or in the app before it takes effect.