Privacy policy

Who we are

Doodali is a trading name of Arc Media Group Ltd, registered in England and Wales (company number 16716587), at Unit 10 Neptune Court, Hallam Way, Blackpool, FY4 5LZ, United Kingdom. We are registered with the Information Commissioner’s Office (ICO), registration number ZC288160. For questions about privacy, contact us.

We are the controller of the data about you as a Doodali customer or website visitor. For the data you put into Doodali about your own customers and contacts, you are the controller and we are your processor: we only use it to provide Doodali to you, as set out in our terms.

What we collect

• Account details, your name, email, phone, job title, photo and password (stored only as a secure hash).
• Business details, your businesses’ names, addresses, VAT numbers, bank details for invoices, and logos.
• What you put in Doodali, customers, contacts, deals, projects, tasks, messages, files, forms, invoices and bookings.
• Connected accounts, if you connect Google, Xero, Facebook or Stripe, the access they grant: for example, emails between you and your Doodali contacts, and your calendar’s free and busy times.
• Billing, your plan and payment history. Card details are handled by Stripe; we never see or store your full card number.
• Technical data, IP address, browser and the times you sign in, kept in server logs to keep the service secure.

How we use it

We don’t sell personal data, and we don’t use the data in your account to advertise to you or anyone else.

Doodali AI

When you ask Doodali something (by typing or talking), your question and the relevant records from your account are sent to our AI provider, Anthropic, to produce the answer. It only uses data you already have access to. Anthropic doesn’t use this data to train its models.

When you speak to Doodali, the recording is sent to OpenAI to turn it into words, and spoken answers are made by OpenAI. Recordings aren’t kept by Doodali, and these providers don’t use them to train their models.

We keep the questions you ask Doodali (not its answers) with your account, to see what people need from it and make it better. We don’t share them, and they’re deleted with your account.

How Doodali’s AI gets better. We look at how Doodali’s AI features do from how they’re used: for example, whether a suggested reply was sent as it was, changed or not used, or whether an answer was marked helpful. Across all the businesses using Doodali, we only use this as anonymised, aggregated patterns (counts and rates, never from small groups) to improve Doodali for everyone. We never share one customer’s content (their messages, customers, files or anything they wrote) with another customer, and never put it into another customer’s AI.

Each business’s own AI also learns from the changes its own team makes (its usual sign off, say, or the categories it prefers), for that business only. The business can see, change or clear what it has learnt in Settings, AI, and can opt out of the anonymised patterns there at any time.

When the AI gets something wrong, our team may keep an example to test a fix. Unless a business has chosen to share examples with us (in Settings, AI, off unless they turn it on), names, contact details and other identifying details are taken out first. Nothing is kept from a business that has opted out.

Signing contracts

A business using Doodali can send its customers contracts to sign online. For the business we hold, on its behalf, what’s needed to show who signed and that nothing changed: each signer’s name and email address, the 6 digit code we email them to check the link reached them (kept only as a scrambled hash, for 10 minutes), the wording of the consent to sign electronically they ticked, their signature, what they typed in the contract, and the time, IP address and device for each step. Each step is chained to the one before it, so the record can’t be changed without it showing.

Signers see the contract as pictures of its pages; the file is checked for viruses and made safe before anyone sees it, and Word files are turned into PDFs on our own servers, in the UK. The signed copy, with a signing certificate, is emailed to everyone who signed and kept for the business for 7 years (or the period the business chooses), then deleted. Contracts that were declined, cancelled or ran out are deleted after a year. Anyone can check a signed copy at Doodali’s Check a document page: the file is checked in their own browser and never uploaded.

WhatsApp

A business using Doodali can connect its own WhatsApp Business account, through Meta’s sign-up. We then receive the data Meta and Twilio provide for that connection, the business’s WhatsApp account and number, its customers’ messages and contact details, message templates and whether messages were delivered, and use it only to run that business’s WhatsApp in Doodali: showing its messages in its inbox, sending its replies and follow-ups, and getting its templates approved. Each business only sees its own WhatsApp data. We don’t sell it, share it with other businesses, or use it for advertising. The business can disconnect WhatsApp at any time, which stops new messages coming in; its messages are kept and deleted like the rest of its account (see How long we keep it).

Google, YouTube and Microsoft accounts

Each person can connect their own Google or Microsoft 365 account, and a business can connect its YouTube channel. We only ask for what the features they switch on need, and use it only for those features:

• Calendar: to show the times you’re free on your booking page, put bookings in your calendar with an invite for the guest, and, if you choose, show your team where you are on the team calendar. Events you’ve marked private only ever show as “Busy”, and you choose whether your team sees details, just “busy”, or nothing.
• Sending email: to send your Inbox replies, invoices and other emails you write in Doodali from your own address. We don’t read your mailbox to do this.
• Reading email (only if you switch on “Log your client emails”): to find emails to and from your Doodali contacts and file them on those contacts’ pages. Other emails are ignored and not stored.
• Your AI PA (only if you take one on, for yourself, in the AI team): to read the last 14 days of your own inbox and sent mail, find emails that need a reply from you and ones you sent that nobody answered, and draft replies and chasers for you to check. It keeps only who, when, the subject and a snippet of up to 500 characters of the emails it finds, its drafts until they’re sent, and short notes on how you write, and deletes them after 30 days (the notes stay until you clear them). It never keeps whole emails, never forwards or attaches anything, and only writes to people already in the email. Only you see it: not your company’s admins, and not Doodali staff, even with support access. It works with Microsoft 365 now, and with Gmail once Google has finished its review. Your company’s admins can switch it off for everyone, which deletes what it kept.
• YouTube: to show your channel’s comments in Doodali and post the replies you or Doodali AI write, as your channel. This uses YouTube’s API Services, so the YouTube Terms of Service and Google Privacy Policy also apply.

Doodali’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we don’t sell this data, use it for advertising, or let people read it except with your permission, for security, or where the law requires. We don’t use it to train AI models. When you ask Doodali AI to help with something (writing a reply to a YouTube comment, say), only what’s needed for that is sent to our AI provider, which doesn’t use it for training either.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

What we keep, and for how long. Your calendar’s events and free and busy times are read when they’re needed (to show your booking page or the team calendar) and held in memory for a couple of minutes at most; we don’t save them. Bookings made through Doodali are kept as part of your account. Emails we send for you through Gmail are kept in Doodali as part of the conversation they belong to. YouTube comments and replies are kept so you can see and answer them. All of it stays until you delete it or close your account; then it’s deleted from the live system straight away and drops out of our backups within about five weeks.

Who it’s shared with. Nobody, except the service providers that run Doodali for us, listed below (our hosting, database and backup storage, and our AI provider for the parts you ask Doodali AI to help with), under contracts that let them use it only to provide Doodali. We never share or sell Google user data to advertisers, data brokers or anyone else, and never use it for advertising.

How it’s protected. Google’s access tokens are encrypted (AES-256) in our database, everything travels over HTTPS, and only Doodali reaches Google, on your behalf, for the features you’ve switched on. Doodali staff don’t look at it, except to help when you ask, as described in Support access below.

You can disconnect at any time in Doodali (Settings → Calendar & booking, or the YouTube page), or remove Doodali’s access from your Google account’s security settings. When you disconnect, we delete the access tokens straight away. Emails already filed on your contacts and replies already posted stay, as part of your account, until you delete them or close your account.

Who helps us

We use these providers to run Doodali. Each only gets what it needs for its job, and most are only used when you switch on the feature that needs them. Our data processing agreement covers how we choose and manage them.

Where data leaves the UK, it’s protected by the UK’s adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses.

Support access

If you ask us for help, someone on the Doodali team may open your account to see what you see and sort it out. This only happens to help you, it lasts two hours at most, and each time is recorded. The account’s owners get an email every time it happens, saying who opened it and when. Even then, some things stay hidden from us: your password vault, your staff’s HR records, documents and forms, what leave anyone is on and why, and your direct messages.

Apart from that, Doodali staff don’t look at the data in your account, except where the law requires it or to keep the service secure.

Demo links from our team

Someone on the Doodali sales team may send you a link to look round a demo of Doodali set up for a business like yours, by email or by WhatsApp from their own phone, because they’re in touch with you. To do that we keep your business’s name, your name, and the email address or mobile number it was sent to, as typed in by the person who sent it. When you open the link we note when, how many times, for how long, and which parts of the demo you looked at, so they can follow up. We don’t record anything about your device. The demo itself is invented: nothing in it is real, you can’t change anything, and nothing in it is sent to anyone.

A demo link email is a one off from the person who sent it. Every one has a link to stop all emails from Doodali. Your details are deleted 90 days after the link runs out (it works for 7 days); what’s left is a count, with nothing that identifies you. If you sign up within 30 days, we note which link you came from so the right person gets the credit.

Cookies

This website asks before using any cookies that aren’t essential. When you first visit, we ask whether we may do two things. First, remember how you found us, the site, ad or campaign that sent you, so that if you get in touch later, we know which of our marketing works; that’s kept on your device for up to 90 days and holds nothing that identifies you. Second, use Meta’s pixel and Conversions API: Meta (Facebook and Instagram) sets cookies (_fbp, and _fbc if you came from one of our ads, for up to 90 days) and we tell Meta which of our pages you visit and when you join the waiting list or contact us, with your email address scrambled (hashed) so it isn’t sent as text, and your IP address and browser. Meta uses it to show our ads to people who’ve visited and to measure them; Meta is then a joint controller with us for that, under its own privacy policy. If you say no, none of this happens, nothing is stored, and a message sent through the contact form only says which page you sent it from. Change your mind any time with “Cookie settings” at the bottom of any page. We remember your choice itself so we don’t ask again. Fonts are loaded from Google Fonts, which means Google sees your IP address.

The chat on this website is answered by AI (Anthropic’s Claude) from information about Doodali. What you type is sent to Anthropic to write the answer; it isn’t used to train their models. If you leave your email, the chat so far comes to our team with it. Nothing about the chat is stored on your device.

Businesses using Doodali can add the same enquiry tracking to their own websites. They decide whether to use it and are responsible for telling their visitors.

The Doodali app uses one essential cookie to keep you signed in. It expires after 12 hours without use. We don’t use tracking cookies in the app. Opening a demo link from our team, or a team member’s sign up link, also remembers for 30 days which link it was (and nothing else), so if you sign up we know who to thank.

How long we keep it

• Your account data is kept while your account is open. If an account is paused for unpaid bills, nothing is deleted until you close it.
• When you delete a business or close your account, its data is deleted from the live system straight away and drops out of our backups within about five weeks.
• Billing records are kept for six years, because the law requires it.
• Demo links from our team: your name, business and the email or mobile it was sent to are deleted 90 days after the link runs out.

Keeping it safe

Data is encrypted in transit (HTTPS), passwords are hashed, connection keys and saved passwords are encrypted in the database, each business’s data is separated, and the servers are locked down, monitored and backed up nightly. Two-step sign-in and passkeys are available to everyone. There’s more on our security page. No system is perfectly secure, but if something ever went wrong that affected your data, we would tell you and the ICO as the law requires.

Your rights

You can ask to see, correct, delete or export the personal data we hold about you, or object to how we use it. Most of it you can change yourself in the app. Otherwise contact us and we’ll reply within a month.

If you’re a customer of a business that uses Doodali, please contact that business first, they control your data, and we’ll help them respond.

You can also complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If we change this policy in a way that matters, we’ll tell you by email or in the app before it takes effect.