Privacy Policy

Data about you, like your account details, is ours to look after, and this policy covers how.

Content a company puts into Dora, including what its clients send, belongs to that company. We process it on the company's behalf, to run Dora for it. If you're a client of a company that uses Dora, that company decides how your content is used, so ask them first.

• Account details: your name, email, photo if you add one, and the companies and clients you're part of.
• Company details: its name, website, logo, and setup. When you add a website, Dora reads its public pages and may look up public information about the company to set up your portal.
• Content: requests, comments, files, brand details, library items, and emails sent to Dora's reply addresses.
• Billing: Stripe and Link handle card details. We get a customer ID, your subscription's status, and what you pay for, never your card number.
• Usage and technical data: sign-in sessions, how much of Dora's AI allowance is used, and server logs such as IP addresses and browser details.
• Demo requests: the name, work email, website, client count, and message you send us.

• To run Dora: portals, requests, files, and Dora's AI features.
• To send email: sign-in links, invites, notifications, and summaries.
• To bill you, and to keep Dora secure and stop abuse.
• To answer your questions and demo requests.
• To understand how Dora is used, in aggregate, so we can improve it.

Dora's AI runs on Claude, made by Anthropic. When Dora works on something, the content it needs, like a request, its thread, and related files, is sent to Anthropic to generate her answer.

Under its commercial terms, Anthropic doesn't use that content to train its models. We don't train any models on your content either.

We use a few service providers to run Dora. They only process data to provide their service to us:

• Vercel: hosts the website and app.
• Convex: stores Dora's database and files.
• Anthropic: runs Dora's AI.
• Resend: sends and receives Dora's email.
• Stripe and Link: process payments and handle tax.

We also share data when you ask us to, for example with an AI tool, webhook, or API client you connect; when the law requires it; or as part of a merger or sale of the business, under this policy.

Dora uses a cookie to keep you signed in, and your browser's local storage for preferences like your theme and how pages are laid out. There are no advertising or analytics cookies.

We keep your data while your account is active. When a company or its content is deleted, we remove it from Dora within 30 days and from backups after that.

Demo requests are kept for up to 12 months. Billing records are kept as long as tax law requires.

You can update your details in Dora at any time. To see, export, correct, or delete your data, or to object to how we use it, email [legal@dora.work]. We'll answer within 30 days.

If you're in the EU or UK, you also have the right to complain to your data protection authority. If you're in California, you have the rights the CCPA gives you; we don't sell or share personal information for advertising.

Our service providers mainly process data in the United States. Where data leaves the EU or UK, it's protected with the safeguards the law requires, like standard contractual clauses.

Data is encrypted in transit, and access is limited to what's needed to run Dora. No system is perfectly secure; if you find a vulnerability, tell us at [legal@dora.work].

Dora isn't meant for anyone under 16, and we don't knowingly collect their data.

If we change this policy in a way that matters, we'll tell you by email or in the app before it takes effect.

Questions about privacy: [legal@dora.work].

Raze Growth LLC, 75 East 3rd Street, Sheridan, WY 82801, United States.