Privacy Policy
Last updated: 2 July 2026
This Privacy Policy explains how GATTUNE LABS (CNPJ 36.500.035/0001-37) (“dotby”, “we”, “us”) collects, uses, and shares information when you use dotby at dotby.app and go.dotby.app (the “Service”).
dotby is currently offered as early access. Features, data handling, and this policy may change as the product evolves. We will flag material changes as described in “Changes to this policy” below.
If you have questions, contact us at privacy@dotby.app.
1. Who is responsible for your data
For the purposes of the Brazilian Lei Geral de Proteção de Dados (LGPD) and, where applicable, the EU/UK General Data Protection Regulation (GDPR), the controller of your personal data is:
GATTUNE LABS — CNPJ 36.500.035/0001-37
Av. dos Vinhedos, 70, Sala 202 (2º andar) — Karaíba, Uberlândia/MG, CEP 38.411-217, Brazil
Encarregado (DPO):privacy@dotby.app
Where you use dotby as part of a team, your workspace administrator determines how the workspace is configured and who has access. For workspace content, that organization is the controller and dotby acts as a processor (operador) on its behalf.
2. Information we collect
Account information. When you sign up we collect your name and email address. Sign-in is handled by our identity provider, Clerk, which supports Google, email code, password, and passkey. Clerk manages your credentials on our behalf, so dotby never sees or stores your password. When you sign in with Google, Clerk passes us the basic profile Google shares (name, email, avatar); your Google password is never shared with us.
Workspace content. The information you and your team put into dotby: tasks, sub-tasks, descriptions, comments, chat messages, attachments, labels, boards, sprints, time entries, rate matrices, and similar. We process this content to provide the Service; we do not use it to train machine-learning models.
Usage and technical data. Log data such as IP address, browser and device type, pages viewed, actions taken, timestamps, and presence status (whether you are online). This helps us keep the Service secure and working.
Payment data. If you subscribe to a paid plan, payments are processed by Stripe. We receive limited billing details (plan, amount, currency, last four digits of the card, billing country) but we do not store full card numbers — those go directly to the payment processor.
Communications. If you email us or contact support, we keep those messages.
3. How we use your information and our legal basis
| Purpose | LGPD basis (Art. 7) | GDPR basis (Art. 6) |
|---|---|---|
| Provide and operate the Service | Execution of contract | Contract (6(1)(b)) |
| Authenticate and secure accounts | Legitimate interest / security | Legitimate interests (6(1)(f)) |
| Process payments | Execution of contract | Contract (6(1)(b)) |
| Improve and troubleshoot the Service | Legitimate interest | Legitimate interests (6(1)(f)) |
| Send service and account emails | Execution of contract | Contract (6(1)(b)) |
| Send product updates / marketing | Consent | Consent (6(1)(a)) |
| Comply with legal obligations | Legal obligation | Legal obligation (6(1)(c)) |
You can withdraw marketing consent at any time via the unsubscribe link or by contacting us.
4. How we share information
We do not sell your personal data. We share it only with:
- Service providers (sub-processors) who help us run dotby, under contracts that require them to protect your data. Our current sub-processors include:
- Convex — database and backend infrastructure
- Cloudflare — website hosting and content delivery (CDN)
- Cloudflare — file storage (attachments) and email routing (proxy)
- Stripe — payment processing
- Clerk — authentication (Google, email code, password & passkey sign-in)
- Resend — transactional and account email delivery
- Your workspace — content you create is visible to other members and guests of that workspace according to their roles and permissions.
- Legal and safety — when required by law, to enforce our Terms, or to protect the rights and safety of users and the public.
- Business transfers — if dotby is involved in a merger, acquisition, or sale of assets, subject to this policy.
5. International data transfers
dotby is operated from Brazil and uses providers that may store or process data outside your country, including in the United States and the European Union. Where we transfer personal data internationally, we rely on appropriate safeguards — such as adequacy decisions, Standard Contractual Clauses, or the mechanisms recognized under LGPD Art. 33 — to protect it.
6. How long we keep data
We keep account and workspace data for as long as your account is active. If you delete content or close your account, we delete or anonymize the associated personal data within 90 days, except where we must retain it to meet legal, accounting, or security obligations. Backups are purged on a rolling schedule.
7. Security
We use technical and organizational measures to protect your data, including encryption in transit (TLS), access controls, and least-privilege practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
8. Your rights
Depending on where you live, you have rights over your personal data. Under LGPD you may request: confirmation and access; correction; anonymization, blocking, or deletion of unnecessary or excessive data; portability; information about sharing; and to know the consequences of refusing consent. Under GDPR you additionally have rights to restriction, objection, and to lodge a complaint with a supervisory authority.
To exercise any of these, contact privacy@dotby.app. We will respond within the time required by applicable law. If you use dotby through a workspace, some requests may need to go through your workspace administrator.
9. Cookies and similar technologies
We use only strictly necessary cookies and local storage — the minimum needed to keep you signed in and to remember your preferences (language, density, theme). We do not use advertising, tracking, or third-party analytics cookies. Because these cookies are essential to provide the Service, they do not require your consent. If we ever add non-essential cookies, we will ask for your consent where required and update this section.
10. Children
dotby is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy as dotby evolves. If we make material changes, we will notify you by email or an in-app notice before they take effect. The “Last updated” date at the top always reflects the current version.
12. Contact
GATTUNE LABS — CNPJ 36.500.035/0001-37
Av. dos Vinhedos, 70, Sala 202 (2º andar) — Karaíba, Uberlândia/MG, CEP 38.411-217, Brazil
Email:privacy@dotby.app
Encarregado (DPO):privacy@dotby.app