Privacy Policy

This Privacy Policy explains how GATTUNE LABS (CNPJ 36.500.035/0001-37) (“dotby”, “we”, “us”) collects, uses, and shares information when you use dotby at dotby.app and go.dotby.app (the “Service”).

The Service includes the website at dotby.app, the web app at go.dotby.app, and the iOS and Android companion apps. A Free plan is available with published limits; optional Pro plans are billed on the web as described at dotby.app/pricing. This policy describes only features that are live in production. It does not cover in-product AI, in-app purchases on mobile, push notifications, or advertising SDKs.

If you have questions, contact us at privacy@dotby.app.

1. Who is responsible for your data

For the Brazilian Lei Geral de Proteção de Dados (LGPD) and, where applicable, the EU/UK General Data Protection Regulation (GDPR) and US state privacy laws, the controller of your personal data is:

GATTUNE LABS — CNPJ 36.500.035/0001-37
Av. dos Vinhedos, 70, Sala 202 (2º andar) — Karaíba, Uberlândia/MG, CEP 38.411-217, Brazil
Privacy contact / Encarregado:privacy@dotby.app

Where you use dotby as part of a team, your workspace administrator determines how the workspace is configured and who has access. For workspace content, that organization is the controller and dotby acts as a processor (operador) on its behalf.

2. Information we collect

Account information. When you sign up we collect your name and email address. Sign-in is handled by our identity provider, Clerk. On the web you may sign in with Google, Apple, email code, password, or a passkey. In the iOS and Android apps you may sign in with Apple, Google, email code, or password (not passkeys). Clerk manages your credentials, so dotby never sees or stores your password. When you sign in with Google or Apple, Clerk passes us the basic profile that provider shares (name, email, and if provided an avatar); your Google or Apple password is never shared with us.

Workspace content. The information you and your team put into dotby: tasks, sub-tasks, descriptions, comments, attachments, labels, boards, sprints, pages, whiteboards, time entries, rate matrices, and similar. We process this content to provide the Service.

Mobile camera and photos. In the iOS and Android apps, if you attach a photo or file to a task, comment, or page, the app accesses the camera or photo library only for that attachment. The file is stored as a workspace attachment with Cloudflare. We do not use camera or photo-library access for advertising, and the apps do not request microphone, contacts, or location permission.

Usage and technical data. Log data such as IP address, browser or device type, pages or screens viewed, actions taken, timestamps, and presence status (whether you are online). This helps us keep the Service secure and working. The companion apps do not collect advertising identifiers, do not run third-party analytics SDKs, and do not use push-notification tokens.

Payment data. If you subscribe to a Pro plan, checkout happens on the web and payments are processed by Stripe. We receive limited billing details (plan, amount, currency, last four digits of the card, billing country) but we do not store full card numbers. The iOS and Android apps do not sell subscriptions, process cards, or include an in-app purchase.

Communications. If you email us or contact support, we keep those messages. We also send transactional email (invites, security, and billing) through Resend.

3. How we use your information and our legal basis

We send transactional and account emails only. We do not send advertising or third-party marketing emails, and we do not use advertising or analytics SDKs.

4. How we share information

We do not sell or share your personal data for cross-context advertising. We share it only with:

• Service providers (sub-processors) who help us run dotby, under contracts that require them to protect your data. Our current sub-processors include:
  • Convex — database and backend infrastructure
  • Cloudflare — website hosting and content delivery (CDN)
  • Cloudflare — file storage (attachments) and email routing (proxy)
  • Stripe — payment processing for Pro plans on the web
  • Clerk — authentication (Apple, Google, email code, password; passkeys on the web)
  • Resend — transactional and account email delivery
  • Slack — optional web integration only. If a workspace administrator connects Slack, we process the Slack data needed to create tasks or keep connected threads in sync. Slack is not embedded in the iOS or Android apps.
• Your workspace — content you create is visible to other members and guests of that workspace according to their roles and permissions.
• Legal and safety — when required by law, to enforce our Terms, or to protect the rights and safety of users and the public.
• Business transfers — if dotby is involved in a merger, acquisition, or sale of assets, subject to this policy.

5. International data transfers

dotby is operated from Brazil. Convex, Clerk, Stripe, Cloudflare, Resend, and (if you connect it) Slack may store or process data in the United States and other countries. Where we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses and the mechanisms recognized under LGPD Art. 33. We do not transfer content to an in-product AI provider.

6. How long we keep data

We keep account and workspace data for as long as your account is active. If you delete content or close your account, we delete or anonymize the associated personal data within 90 days, except where we must retain it to meet legal, accounting, or security obligations. Backups are purged on a rolling schedule.

Billing records needed for tax and accounting are kept for the period required by law. Security logs are kept only as long as needed to investigate abuse. Workspace content belonging to an organization remains under that organization’s control until its administrators delete it.

7. Security

We use technical and organizational measures to protect your data, including encryption in transit (TLS) and encryption at rest, access controls, and least-privilege practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you have rights over your personal data. We honour the rights that apply to you. To exercise them, use the in-app account controls where they exist, or contact us as described below. We will respond within the time required by applicable law. If you use dotby through a workspace, some requests about workspace content may need to go through your workspace administrator.

Contact privacy@dotby.app.

You can delete your account from Profile in the web app and in the iOS and Android apps. Deletion removes your personal account data as described in “How long we keep data”. It does not by itself erase content your teammates still need in a shared workspace.Learn how to request account deletion.

Brazil (LGPD). You may request: confirmation and access; correction; anonymization, blocking, or deletion of unnecessary or excessive data; portability; information about sharing; and to know the consequences of refusing consent. You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

European Economic Area and United Kingdom (GDPR). You may request access, correction, deletion, restriction, portability, and objection, and you may lodge a complaint with your local supervisory authority. We have not appointed an EU Article 27 representative; EEA residents can contact us at the address and email below.

United States, including California (CCPA/CPRA and similar state laws). We collect the categories described in this policy (identifiers, account and workspace content, commercial/billing information if you subscribe, internet/technical activity). We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a “limit the use” right. You may request to know, access, correct, or delete personal information, and to opt out of sale or sharing (which we do not perform). We will not discriminate against you for exercising these rights. You may use an authorized agent as your state law allows. We aim to respond within 45 days.

9. Cookies and similar technologies

We use only strictly necessary cookies and local or secure storage — the minimum needed to keep you signed in and to remember your preferences (language, density, theme). We do not use advertising, tracking, or third-party analytics cookies. Because these cookies are essential to provide the Service, they do not require your consent. If we ever add non-essential cookies, we will ask for your consent where required and update this section.

10. Children

dotby is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the Service evolves. If we make material changes, we will notify you by email or an in-app notice before they take effect. The “Last updated” date at the top always reflects the current version.

12. Contact

GATTUNE LABS — CNPJ 36.500.035/0001-37
Av. dos Vinhedos, 70, Sala 202 (2º andar) — Karaíba, Uberlândia/MG, CEP 38.411-217, Brazil
Email:privacy@dotby.app
Privacy contact / Encarregado:privacy@dotby.app