Privacy Policy

Updated: 2026-06-12

DoneRight (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how personal information is collected, used, and disclosed when you use our website, applications, and related services (collectively, the “Service”). The Service currently includes DoneRight Proof (a reputation management and marketing workflow application) and DoneRight BeReady (an evidence-management workspace for certification readiness preparation).

By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Definitions

Company refers to DoneRight Technologies Inc.
Personal Data means any information that identifies or can reasonably be used to identify an individual.
Service refers to the DoneRight website, applications (Proof and BeReady), and related services.
Customer or Account Holder means a business or individual that registers to use the Service.
End User means a person whose information may be processed through a Customer’s use of the Service (for example, a customer of a Proof subscriber, or a workspace member in BeReady).
Workspace means a tenant-isolated environment within BeReady associated with a subscribing organization.
You means the individual or entity using the Service.

2. Information We Collect

The specific data we collect depends on which product(s) you or your organization uses.

Account and Identity Data (all products)

• Name, email address, and password credential hash
• Phone number (where provided for SMS features or verification)
• User agent, IP address, and session data captured during authentication
• Email verification and password reset records
   

Organization and Workspace Data (all products)

• Business name, account name, location name, and contact details
• Team member roles, membership status, and invitation records
• Subscription plan, billing references, and Stripe customer or subscription identifiers
• Timezone, branding settings, and operational preferences
   

Job, Proof, and Media Content (Proof)

• Before and after photos of service work, including thumbnails and generated composite images
• Job notes, completion notes, and associated timestamps
• Customer name, email address, phone number, and job details entered by business users
• Review request records, delivery status, public token hashes, and review link associations
• Customer feedback and private issue submissions including sentiment, comment text, and optional image uploads
• Inbound and outbound issue-remediation email content through connected mailboxes
• Social publishing data including captions, hashtags, scheduled times, and posting status
• Public showcase publication settings and generated showcase content
   

Business Artifact and Evidence Data (BeReady)

• Uploaded business documents (PDF, DOCX, plain text, Markdown, CSV) including filename, MIME type, byte size, and SHA-256 hash
• Parsed document text and content snippets used to generate evidence candidates
• CSV import rows and ingestion run metadata
• Evidence review decisions, reviewer identity, review notes, and timestamps
• Evidence mapping records, criteria coverage data, action suggestions, and export manifest metadata
• AI classification suggestion data including safe input fingerprints, model metadata, classification payloads, confidence labels, and feedback states — when AI features are enabled
• Auth audit logs, platform events, and operational log records
   

Integration and Technical Data (all products)

• Mail integration connection state, connected email address, encrypted token references, and SMTP/IMAP configuration where applicable
• Social connection status, scopes, page identifiers, and encrypted token metadata
• Stripe webhook payloads and provider event identifiers
• SMS delivery status and provider message identifiers where SMS is configured
• Operational logs, audit records, rate limit records, and webhook idempotency records

We do not store full credit card numbers. Payment processing is handled by Stripe.

3. Legal Basis for Processing

• To provide and operate the Service under our agreement with you
• To perform a contract with you or your organization
• To comply with legal obligations applicable to us
• For legitimate business interests such as improving, securing, and operating the Service
• With your consent, where required by applicable law
   

4. How We Use Information

• Provide, maintain, and improve the Service and its features
• Operate workspace-scoped evidence management, review workflows, and reporting (BeReady)
• Operate job capture, review request delivery, social publishing, showcase publication, and issue remediation workflows (Proof)
• Process transactions, manage subscriptions, and communicate billing information
• Deliver transactional and operational email and SMS communications
• Provide customer support and respond to inquiries
• Prevent fraud, abuse, and security incidents
• Comply with legal obligations
   

We do not sell, rent, or trade personal information to third parties.

AI features: Where AI-assisted suggestion features are enabled within BeReady, AI suggestions are non-authoritative review aids. AI output does not automatically create evidence items, accept or reject candidates, satisfy certification criteria, or determine readiness or compliance. Partner and customer data is not approved for use with external AI providers unless a specific opt-in, privacy review, and enablement process has been completed for your workspace.

5. Sharing of Information

Service Providers: We share information with trusted third-party providers who assist in operating the Service, including infrastructure hosting, authentication, email delivery, billing, social platform integrations, mailbox sync, and SMS delivery. Current providers include or may include Convex (backend data and functions), Stripe (billing), Resend (email delivery), Google (Business Profile, Gmail), Microsoft (Outlook), Meta/Facebook, Instagram, SMS providers (Bandwidth, Twilio), and PostgreSQL-compatible database infrastructure.

Public Surfaces (Proof): When a business user publishes proof content to a public showcase or sends a customer review link, selected proof images, job context, and business branding may be visible to third parties. Business users control what is published. Token-based review links are time-limited; the Service stores token hashes, not raw tokens.

Business Transfers: Information may be transferred in connection with a merger, acquisition, or asset sale, subject to confidentiality obligations.

Legal Requirements: We disclose personal information only where required by law and in accordance with our Public Authority Data Request Policy.

No Sale of Data: We do not sell, rent, or trade personal information.

6. Data Retention

We retain personal information and workspace content only as long as necessary to provide the Service, honour contractual obligations, and comply with applicable legal requirements. Operational backend logs are subject to automated retention and pruning processes. Uploaded documents and evidence artifacts are retained within your workspace until deleted or your account is terminated. Specific retention periods depend on the deployed environment and applicable law.

7. Security

We implement reasonable technical and organizational safeguards to protect personal information, including credential hashing, session management, workspace-scoped access controls, token-based public link management, encrypted secret storage for integrations, and audit logging. However, no method of transmission or storage is 100% secure. We encourage you to use strong credentials and to report suspected security concerns to legal@doneright.cloud.

8. International Transfers

Your information may be processed in countries other than your own, including Canada and the United States, depending on the infrastructure and service providers we use. Where required by applicable law, we apply appropriate safeguards to cross-border data transfers.

9. Your Privacy Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise these rights, contact us at legal@doneright.cloud. We will respond in accordance with applicable law.

Where the Service processes personal information on behalf of a Customer (for example, end-user data entered by a Proof subscriber), the Customer is typically the data controller responsible for that information. Please contact the relevant business if you have questions about how your information was submitted to the Service.

10. Cookies and Session Management

We use cookies and session tokens to authenticate users, maintain secure sessions, and operate the Service. We do not use third-party advertising cookies. You may disable cookies in your browser settings, but doing so may affect your ability to log in or use the Service.

11. Automated Processing

The Service includes scheduled background processes that operate without a manual trigger at the moment of execution. These include review request delivery, social post scheduling, SMS reminder delivery, mailbox sync for issue replies, and operational log pruning. These automated processes act on configurations and schedules set by you or your account administrator.

12. Children’s Privacy

Our Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in the Service, applicable law, or our practices. Material changes will be communicated through the Service. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related inquiries, data requests, or concerns:
legal@doneright.cloud
DoneRight Technologies Inc., 777 Fort St., Victoria, BC, V8W 1G9, Canada

15. Our Commitment

We believe technology should empower people and business should support life. We treat personal information with great seriousness and respect, and we are committed to building products that protect the data of the businesses and individuals who trust us.