Privacy Policy

• Account details — your name, email address and password (stored only as a one-way hash), or your Google profile if you sign in with Google.
• Billing details — your plan, subscription status, invoices, and the billing name, address and tax ID you enter at checkout. Card details are collected and stored by Dodo Payments, which processes our payments as Merchant of Record; we never receive your full card number.
• Content you add — contacts, companies, deals, notes, tasks, files and project boards in your workspace.
• Connected accounts — if you connect Gmail or WhatsApp, the access tokens or session needed to read and send messages on your behalf (stored encrypted). Gmail is covered in detail under Google user data below. If you add your own AI provider keys, those keys (stored encrypted).
• Usage — the lead searches you run (the filters and how many results came back), which we use to count your plan’s allowance, and technical logs such as IP address and browser type, kept for security and troubleshooting.
• Visitors who are not signed in — to count the free searches on the public Lead Finder, we keep a one-way, salted hash of your network address. We do not keep the address itself for this, and these records are deleted after 90 days.
• Cookies — essential cookies that keep you signed in and remember your preferences, and, on our public pages only, Google Analytics cookies that tell us how the site is used. The signed-in app does not load analytics.
• Messages to us — what you send through our contact form or by email.

Our search results contain information that businesses have made publicly available, such as business names, categories, addresses, phone numbers, websites, business email addresses and social media profiles. Most of it concerns businesses rather than individuals, but some entries may name a sole trader or include a contact person’s work details.

If you are listed and want your details removed or corrected, ask us through our data removal form. We act on removal requests within 30 days and exclude the listing from future results.

• to provide the Service, including the features you choose to use;
• to take payments, issue invoices and manage your subscription;
• to count search allowances and prevent abuse;
• to answer your questions and send service messages (receipts, renewal notices, security alerts);
• to keep the Service secure and to meet our legal obligations;
• to understand, in aggregate, how the Service is used so we can improve it.

We do not sell your personal data, and we do not use it to build advertising profiles. We process it on the basis of your consent, to perform our contract with you, and where the law requires or permits it.

Connecting Gmail is optional. You only need it to send email and read replies from inside the Service. Signing in with Google gives us only your name, email address and profile picture, and no access to your mailbox.

What we access

When you connect a Gmail account, you grant the Service the gmail.modify permission and access to your email address. With it, the Service can access:

• the email address of the account you connect;
• your messages and threads: senders, recipients, subjects, dates, message bodies and attachments;
• your labels and each message’s state (read or unread, starred, archived, spam, trash).

How we use it

We use Gmail data only for features you see and use in the Service, when you use them:

• Inbox — to list and open your conversations inside the Service, with their attachments.
• Lead and contact pages — to show the email threads you have had with a contact on that contact’s page.
• Sending — to send new emails and replies from your own address when you press Send.
• Organising — to mark messages read or unread, star them, archive them, or move them to spam or trash when you choose to. The Service never permanently deletes your email.

What we store

Your mailbox is read live from Google each time you open it. We do not copy your messages or attachments into our database. We store only:

• the OAuth access and refresh tokens Google issues, encrypted with AES-256-GCM;
• the connected email address and the permissions you granted;
• when you send an email from a contact’s page, a timeline entry on that contact with the subject, the recipients and the Gmail thread ID.

Sharing

We do not sell, rent or share Gmail data with anyone. It is not transferred to third parties except our hosting provider, which runs the servers the Service operates on, or where the law requires it. Gmail data is never sent to AI providers. The AI email drafting feature works only from a contact’s details and website, not from your mailbox.

What we never do

• use Gmail data for advertising, including targeted, retargeted or interest-based ads;
• sell it, or give it to data brokers or information resellers;
• use it to decide creditworthiness or for lending;
• use it to build databases or profiles beyond your own workspace;
• use it, raw, aggregated, anonymised or derived, to develop, improve or train generalised or non-personalised AI or machine-learning models.

No person reads your Gmail data unless you have given us explicit permission for specific messages (for example, to help with a support request), it is needed for security purposes such as investigating abuse, it is needed to comply with the law, or the data is aggregated and anonymised for internal operations.

Security, retention and deletion

Gmail data travels only over encrypted connections (HTTPS/TLS), and the stored tokens are encrypted at rest. Only your own workspace can use a mailbox you connected. We keep the tokens while the mailbox is connected.

• Disconnect it at any time in Settings → Connections. This deletes the stored tokens immediately and revokes the Service’s access at Google.
• You can also remove access from your Google Account permissions page.
• Deleting your account revokes every Gmail connection and deletes the tokens and contact timeline entries along with the rest of your workspace, normally within 30 days.
• To ask us to delete any Gmail-derived data sooner, use our contact form.

DnHub’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs complies with those Limited Use requirements, and DnHub does not use it to develop, improve or train generalised AI or ML models.

We share personal data only with service providers that help us run the Service:

• Dodo Payments — our Merchant of Record: payment processing, invoices, sales tax and subscription management. It handles your billing details under its own privacy policy as well as this one.
• Google — sign-in with Google, the Gmail connection you choose to make, and Google Analytics on our public pages.
• Our cloud hosting provider — the servers and databases the Service runs on.
• AI providers you connect (such as OpenAI, Anthropic or Google Gemini) — when you ask the AI to draft an email, the contact’s details, the text of their website and your instructions, sent with your own key. Gmail data is never sent to them.

We may also disclose data where the law requires it, or to protect our rights and users. If DnHub is involved in a merger or sale, your data may transfer to the new owner under this policy.

The Service and some of our providers may store data on servers outside India. Where data is transferred abroad, we do so as permitted by Indian law and take steps to protect it as described here.

• Account and workspace data: while your account is open.
• Gmail access tokens: until you disconnect the mailbox or delete your account. Your email itself is not stored (see Google user data).
• After you delete your account: your workspace is deleted, normally within 30 days, apart from backups that expire on their own schedule.
• Invoices and payment records: as long as tax and accounting laws require, even after the account is closed.
• Visitor search counts: 90 days. Security logs: for a limited period.

Data travels over encrypted connections (HTTPS). Passwords are hashed, and connected-account tokens and API keys are encrypted at rest. Access to production systems is restricted. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

Depending on where you live, you can:

• get a summary of the personal data we hold about you and how it is used;
• correct, complete or update it;
• have it erased, unless we must keep it by law;
• withdraw consent you have given, without affecting what happened before;
• nominate someone to exercise these rights for you in case of death or incapacity;
• complain to our Grievance Officer, and then to the Data Protection Board of India.

To use any of these rights, use our contact form. We reply within 30 days.

The Service is for adults running a business. It is not meant for anyone under 18, and we do not knowingly collect their data.

We may update this policy. If a change is significant, we will tell you by email or in the Service before it takes effect. The date at the top shows when it was last changed.

If you have a complaint about the Service, a charge or how we handle your information, contact our Grievance Officer through our contact form. We acknowledge every complaint within 48 hours and aim to resolve it within one month of receiving it.

• Business: DnHub