DonNe AI, Inc. Privacy Policy

Last Updated: June 25, 2026

DonNe AI, Inc. (“DonNe,” “we,” “us,” or “our”) provides an AI‑powered SaaS platform for business and individual users (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:

visit our websites (including https://www.donneai.com),
create an account or use the Service, or
communicate with us (for example, by email or support requests).

This Privacy Policy is separate from our Data Processing Addendum (“DPA”), which governs how we process certain data on behalf of our B2B customers as their “processor” or “service provider.”

If you do not agree with this Privacy Policy, please do not use the Service.

1. Who We Are and How to Contact Us

Controller / Business: DonNe AI, Inc.

c/o Universal Registered Agents, Inc.

300 Creek View Road, Suite 209

Newark, Delaware 19711

United States

Contact: legal@donneai.com

If we are required to appoint a data protection officer or representative in another jurisdiction in the future, we will update this Policy.

2. Scope

This Privacy Policy applies to:

visitors to our websites,
individual users (B2C) of the Service,
users of business accounts (B2B Authorized Users), and
prospects and contacts we interact with for sales, marketing, or support.

For B2B customers, our DPA governs our processing of Customer Personal Data on their behalf. If there is a conflict between this Privacy Policy and the DPA regarding Customer Personal Data, the DPA will control.

This Privacy Policy also applies to participants in our beta, pre-release, or experimental programs (“Beta Services”), unless a more specific beta privacy notice is presented at the time of enrollment. In case of any conflict between this Privacy Policy and a specific beta notice, the beta notice will control for the Beta Services.

3. Information We Collect

3.1 Information You Provide

Account and profile information – name, email address, password, organization, job title, role.
Billing information – billing contact details and transaction information (payment card data is typically handled by our payment processor, such as Stripe).
Content you submit – data you upload or connect to the Service (e.g., CSV files with professional contacts, candidate lists, or other Customer Data).
Communications – messages you send to us (support requests, feedback, surveys).

3.2 Information from Email/Workspace Connections and Uploads

If you or your organization connect an email account or workspace via OAuth (e.g., Google Workspace/Gmail, Microsoft 365/Outlook), we may process:

Email Metadata (as defined in our Terms of Service): sender, recipient, timestamps, subject lines, message IDs, and related routing fields.
We do not access or process email body content or attachments unless explicitly enabled and agreed in writing (for example, in an Order Form). For Google accounts, we do not request access to Gmail message bodies at all (see Section 4).

If you upload CSV files or similar data, we process the information contained in those files (such as names, emails, job titles, employers, and other professional information).

You are responsible for ensuring you have the necessary rights and permissions to connect these accounts and upload this data.

3.3 Information Collected Automatically

When you visit our websites or use the Service, we automatically collect:

Usage and log information – IP address, browser type, device identifiers, pages viewed, date and time of access, referring URL, and other log data.
Device and technical information – operating system, browser version, language settings, and approximate location (city/region level).
Cookies and similar technologies – used for authentication, security, preferences, and analytics. You can control cookies through your browser settings; some cookies are essential for the Service to function.

3.4 Information from Third Parties

We may receive information about you from third-party sources to enhance the Service’s predictive capabilities:

Connected Services (OAuth): If you connect your email or calendar (e.g., via Google Workspace or Microsoft 365), we collect Network Graph Data (metadata including sender/recipient, timestamps, and frequency of interaction). We do not collect or store the body content of emails or meeting attachments. Data obtained through Google APIs is additionally governed by Section 4.
Professional Networking Platforms: We may collect publicly available professional profile information (e.g., job titles, tenure, skills) from platforms where you have an account, to the extent permitted by those platforms' terms and applicable law.
Business Partners: We may receive contact information or lead data from partners with whom we offer co-branded services or engage in joint marketing.

4. Google User Data and Limited Use

This Section governs personal information that DonNe accesses through Google APIs (“Google User Data”) when you connect a Google account (Gmail / Google Workspace) to the Service. In the event of any conflict between this Section and any other provision of this Privacy Policy, this Section controls with respect to Google User Data.

4.1 Limited Use commitment. DonNe’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google User Data only to provide and improve the user-facing features of the Service that you have enabled.

4.2 Scopes we request (minimum necessary). We request the narrowest OAuth scopes needed for the feature you choose, and only at the time you enable it:

Sign-in (`openid`, `email`, `profile`) — to authenticate you and identify your account.
Send email (`gmail.send`) — to send the outreach messages you compose, from your mailbox and at your explicit direction. This permission allows sending only; it does not allow us to read, list, or modify your mailbox.
Contacts import (`contacts.readonly`, `contacts.other.readonly`) — requested only if you turn on contact import, to add your contacts to your network. This is granted separately from sign-in and send; you may decline it and still use the rest of the Service.

We do not request access to read the content or bodies of your Gmail messages, and we do not request broad mailbox-read scopes for Google accounts. You can review and revoke DonNe’s access at any time at your Google Account permissions page and in Settings → Connected Accounts within the Service.

4.3 How we use Google User Data. We use Google User Data strictly to deliver the features you enable:

to send the outreach emails you compose, from the account you select; and
to import the contacts you choose and link them to companies, so the Service can show your warm paths and relationship strength.

4.4 What we do NOT do with Google User Data. Notwithstanding anything else in this Policy, we do not:

use Google User Data for advertising of any kind (including personalized, targeted, or retargeting ads);
sell, rent, or license Google User Data, or provide it to data brokers;
transfer Google User Data to third parties except as necessary to (a) provide or improve the user-facing features you enabled (for example, our cloud infrastructure provider acting on our behalf under confidentiality and equivalent data-protection obligations), (b) comply with applicable law, (c) as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent, or (d) detect, prevent, or address security threats, abuse, fraud, or technical problems;
use Google User Data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. Where this Policy elsewhere describes model training, Service improvement, or analytics (including Sections 5 and 6), those activities exclude Google User Data;
use Google User Data to send marketing communications to you or anyone else; or
allow humans to read Google User Data, except: (i) with your affirmative consent to view specific messages or data; (ii) where necessary for security purposes (such as investigating abuse) or to comply with applicable law; (iii) where the data has been aggregated and anonymized and is used for internal operations; or (iv) as required by applicable law.

4.5 Retention and deletion of Google User Data. When you disconnect a Google account, or upon your request to legal@donneai.com, we delete the Google User Data obtained for that account and the associated OAuth tokens, except where short-term retention is required to complete a pending operation or by applicable law. OAuth tokens are stored encrypted.

This Section reflects our commitments for Google User Data specifically. Comparable protections for data from other connected providers (such as Microsoft 365/Outlook) are described elsewhere in this Policy and in our DPA.

5. How We Use Information

Subject to Section 4 (which controls for Google User Data), we use personal information for the following purposes:

To provide and operate the Service
creating and managing accounts, authenticating users, providing features, and processing transactions;
To power AI‑driven features and generate Outputs
using Email Metadata, uploaded data, and other inputs to generate predictions, insights, recommendations, and draft communications;
To maintain, secure, and improve the Service (including model training)
monitoring performance, troubleshooting, and fixing issues;
detecting, preventing, and responding to security incidents, abuse, and fraud;
improving model performance, quality, and safety (see Section 6). This does not include Google User Data, which is excluded from model training and improvement under Section 4;
To communicate with you
sending service‑related emails (account notices, security alerts, billing updates);
responding to support requests and feedback;
To send marketing communications
where permitted by law, sending product updates, newsletters, and offers (you can opt out at any time). We do not use Google User Data for marketing (Section 4);
To comply with law and enforce our rights
complying with legal obligations and responding to lawful requests;
enforcing our Terms of Service, Acceptable Use Policy, and other agreements.

If you participate in beta or pre-release programs, we may collect additional usage and feedback data to test and improve experimental features, as described in our Terms of Service (including the “Beta Services” section).

Where required by law (for example, for certain marketing or cookies), we rely on your consent. Otherwise, we rely on contract, legitimate interests, or legal obligations as appropriate.

6. AI, Model Training, and Outputs

6.1 Outputs

The Service generates “Outputs” (as defined in our Terms of Service), such as predictions, insights, recommendations, and draft communications.

Outputs are probabilistic and may be inaccurate or incomplete.
You are responsible for reviewing Outputs and deciding how to use them, especially for recruiting or employment decisions.

As between you and us, and subject to our Terms of Service and applicable law, you/your organization generally own the Outputs generated from your authorized use of the Service. Your use of Outputs remains subject to our Terms of Service, including restrictions on resale, redistribution, and bulk extraction. We may use Outputs in aggregated and/or de‑identified form as described in this Privacy Policy.

6.2 Model Training and Service Improvement

We may use Customer Personal Data and other data to provide, maintain, secure, support, and improve the Service, including improving model performance, quality, and safety.

Google User Data is excluded. Consistent with Section 4 and the Google API Services User Data Policy (Limited Use), we do not use Google User Data to develop, train, or improve any AI/ML models.

Third-Party Licensed Data. Where the Service accesses data from third-party providers (e.g., via integrations or APIs), we will not use such third-party licensed content to train, fine-tune, or improve our models where the applicable third-party terms prohibit such use (for example, Crunchbase Content). In those cases, we use the data only at “point of need” to provide the requested feature and/or we store only derived, non-reversible signals where appropriate.

6.3 Automated Decision-Making Technology (ADMT) and Profiling

Purpose of ADMT: We use ADMT to provide the Service's core forecasting and recommendation features. This includes analyzing professional data and relationship metadata to predict leadership vacancies and suggest outreach targets.
Logic and Significance: Our AI utilizes probabilistic models to generate these Outputs. While these insights assist in identifying professional opportunities, they are not intended to be the sole basis for hiring, termination, or other significant employment decisions.
Your Rights (ADMT): Depending on your jurisdiction, you may have the right to:
Receive information about the logic and data points used in these automated processes.
Opt-out of being subject to significant decisions based solely on automated processing.
Request a human review of the results of such processes.
To Exercise Rights: You may exercise these rights by contacting us at legal@donneai.com or, where available, through your account settings.

B2B Opt‑Out. For B2B customers, we provide an option to opt out of using Customer Personal Data for model training and improvement upon written request to legal@donneai.com, subject to reasonable technical limitations and potential impact on certain features. Even if you opt out, we may still process data to provide the Service and for security, abuse prevention, and legal compliance.

We do not sell Customer Personal Data and do not use it in a way that allows other customers to access your identifiable data.

7. How We Share Information

We do not sell personal information. Subject to Section 4 (which controls for Google User Data), we may share it with:

Service providers and subprocessors
cloud hosting providers, infrastructure providers, analytics tools, email service providers, payment processors, and similar vendors that help us operate the Service;
these providers are contractually required to protect personal information and use it only for our specified purposes.
Your organization (B2B)
if you use the Service under a business account, certain information (such as your name, email, and usage information) may be visible to your organization’s administrators.
Professional advisors
lawyers, auditors, and other professional advisors under confidentiality obligations.
Legal and safety purposes
to comply with laws, regulations, legal processes, or governmental requests;
to protect the rights, property, or safety of DonNe, our users, or others.
Business transfers
in connection with a merger, acquisition, financing, or sale of all or part of our business, personal information may be transferred as part of that transaction, subject to appropriate safeguards (and, for Google User Data, subject to Section 4).

8. Data Transfers and US‑Focused Processing

DonNe is based in the United States, and personal information is stored and processed in the U.S. and in other countries where our service providers operate.

For B2B customers with users or data subjects outside the U.S., our DPA describes the mechanisms we use (such as Standard Contractual Clauses) to support international transfers where required by law.

9. Data Retention

We retain personal information for as long as reasonably necessary to:

provide the Service and fulfill the purposes described in this Policy,
comply with legal, accounting, or reporting obligations, and
resolve disputes and enforce our agreements.

For Google User Data, see the deletion commitments in Section 4.5.

For Customer Data under a B2B subscription:

After termination or expiration of all subscriptions, Customer’s access to the Service will cease.
Upon Customer’s written request made within 30 days after termination/expiration, we will make available a one‑time export of Customer Data in a commercially reasonable format, consistent with our Terms of Service and DPA.
After that period, we may delete or anonymize Customer Data in accordance with our backup and retention policies, except where retention is required for legal or legitimate business purposes (such as audit, billing, or dispute resolution).

10. Your Rights and Choices

Depending on where you live and applicable law, you may have certain rights regarding your personal information, such as:

Access – request a copy of your personal information we hold.
Correction – request correction of inaccurate or incomplete information.
Deletion – request deletion of your personal information, subject to legal exceptions.
Restriction or objection – in some cases, request that we limit or stop certain processing.
Opt‑out of marketing – opt out of marketing emails by using the unsubscribe link in those emails or contacting us.

To exercise these rights, contact us at legal@donneai.com. We may need to verify your identity before responding.

If we process your information on behalf of a B2B customer, we may direct you to contact that customer (the “controller” or “business”), and we will assist them as required by our DPA and applicable law.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include, for example:

encryption in transit (TLS) and, where supported, at rest,
access controls and least‑privilege principles,
logging and monitoring of access to production systems,
vulnerability management and incident response procedures.

OAuth tokens for connected accounts (including Google accounts) are stored encrypted.

No system is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident involving personal information, we will notify affected customers and/or individuals as required by law and our DPA.

12. Children’s Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at legal@donneai.com, and we will take appropriate steps to delete such information.

13. Third‑Party Services and Links

The Service may link to or integrate with third‑party websites, services, or platforms (for example, email providers, identity providers, or professional networking platforms). This Privacy Policy does not apply to those third parties. Their own terms and privacy policies govern their handling of your information.

You are responsible for ensuring you have the necessary rights and permissions to connect and share data from third‑party services with DonNe.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

we will update the “Last Updated” date at the top; and
for material changes, we will provide additional notice (for example, via email, in‑app notice, or a banner on our website) and, where required, seek your consent.

Your continued use of the Service after the effective date of an updated Privacy Policy constitutes your acceptance of the changes.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Email: legal@donneai.com

Mail: DonNe AI, Inc.

c/o Universal Registered Agents, Inc.

300 Creek View Road, Suite 209

Newark, Delaware 19711

United States