Privacy Notice

This privacy notice explains how Dunaroo, LLC ("Dunaroo," "we," "us," or "our") collects, uses, and shares personal information when you visit www.dunaroo.com, use the Dunaroo application (the "Service"), fill in a form on a website that uses Dunaroo, book a call with a business that connects its scheduling tool to Dunaroo, receive or reply to an email a business sends through Dunaroo, email a business that forwards your email into Dunaroo, or view a client review page or an estimate a business shares with you. Questions? Email contact@dunaroo.com.

Contents: 1. What we collect · 2. Information we process for businesses · 3. Roo and AI · 4. How we use it · 5. Who we share it with · 6. Cookies · 7. How long we keep it · 8. Security · 9. Your rights · 10. Children · 11. Changes · 12. Contact

1. What we collect

Information you give us. Your name, email address, phone number, job title, company, password, profile photo, and contact preferences, and anything you send us when you contact us. We do not process sensitive personal information; please don't submit it through Dunaroo forms or emails.

Payments. Stripe collects your card details directly; we never receive or store full card numbers or security codes. See stripe.com/privacy.

Inquiries sent through Dunaroo forms. Your name, email address, company, phone number, message, and any other answers the form asks for; the page you submitted it from; a one-way hash of your IP address (used to stop abuse, not to identify you); and your browser's user agent.

Calls booked through a business's scheduling tool. When a business connects its scheduling tool (currently Cal.com) to Dunaroo and you book a call with it, we receive the booking: your name, email address, and time zone; your answers to the booking questions; the time, type, and location or meeting link of the call; who is hosting it; and the names and email addresses of any guests you add. We also receive later changes to the booking, such as a new time, a cancellation, or whether someone attended.

People added to an inquiry. A business can add other people to an inquiry, such as colleagues who join a call or reply to the email conversation. For each one we store their name, email address, and, if the business adds it, job title.

Emails. When you reply to an email sent through Dunaroo, we receive the reply's text, subject, sender, recipients, and attachments, and the results of the checks that confirm who sent it (SPF, DKIM, and DMARC). For emails we send, we record whether they were delivered, bounced (and why), or marked as spam, and when a link in them is clicked, including the IP address and browser of the click. We do not track email opens.

Inquiries a business forwards or adds. A business can forward us an email you sent it, or add an inquiry from you itself, for example after a call. We receive what it contains or what the business enters, including any attachments, and the business uses it as an inquiry from you.

Estimates. When a business sends you an estimate through Dunaroo, we record each time it is viewed, with the IP address and browser, and show this to the business. If the business asks for an email check, we email a one-time code to the address the estimate was sent to before showing it. If you approve it, send it back with changes, or ask for a call, we record the choices you made, any comments and note you add, the name and email address you enter, the time, and your IP address and browser. The business keeps this as its record of what you agreed to.

Files and content that you or a business share through the Service.

Information collected automatically.

• Device and usage information: your IP address, browser, device, operating system, language, referring page, approximate location, the pages and files you view, the features you use, and error reports.
• Sign-in records: the IP address and browser of each sign-in attempt, to protect accounts from password guessing.
• Push notification tokens, if you turn on notifications in our mobile app.
• Session recordings. We may record how people use our website and the Service (such as clicks, scrolling, and pages viewed) to find and fix problems. Recordings hide what you type. If we record use of the Service, recordings also hide the content of your workspace, and we don't record client review pages, estimates, or lead forms. If you are in the EU, the UK, or Switzerland, we record only after you accept analytics cookies.
• Cookies and similar technologies (see Section 6).

2. Information we process for businesses

When a business uses Dunaroo to work with you (for example, a studio that manages your project in Dunaroo, or whose website form you filled in), that business decides what information about you to collect and how it is used. Dunaroo processes that information on the business's behalf and under its instructions. Requests about it are best sent to that business; we'll help them respond, and you can also contact us. A business can also connect other apps to Dunaroo, for example to import its work from Asana, to send updates to tools like Zapier, or to receive calls booked through its scheduling tool, such as Cal.com. Information it sends to those apps, or that those apps send to Dunaroo, is handled under their terms. When a business acts on one of those apps from Dunaroo, for example by cancelling or rescheduling a booked call, we send that app what it needs to do so (such as the booking and the business's message), and the app may notify you. If a business gives us a key for one of those apps, we store it encrypted and use it only for actions the business takes in Dunaroo.

3. Roo and AI

Businesses that use Dunaroo can use Roo, our AI assistant, to help with their work. When they do, the content the feature needs is sent to our AI providers (currently Anthropic) to produce the result, which is stored with that business's records. Depending on the feature, that can include an inquiry and its email conversation, notes the business takes during calls with you, the details of a call booked with the business, the names and job titles of the people on the inquiry, the files on an inquiry, a project's details, tasks, comments, and files, estimates and the changes and comments sent back on them, and the business's settings and price list. Roo searches the public web for information about businesses, not for personal profiles of individuals. A business reviews and sends any estimate Roo drafts; Roo does not send estimates itself. When someone at a business asks Roo questions about an inquiry, an estimate, or their work, we save that conversation so they can come back to it. It is private to the person who had it, not shared with the rest of their team, and is deleted when they clear it, when the inquiry or estimate it is about is deleted, or when their account or the business's organization is deleted. Neither we nor our AI providers use this information to train AI models.

4. How we use it

We use personal information for these purposes. If you are in the EU, the UK, or Switzerland, the legal basis for each is in brackets.

• To provide the Service: create and run accounts, deliver features, send service and account messages, and answer support requests [contract].
• To provide the Service to the businesses that use Dunaroo to work with you [legitimate interests].
• To keep the Service secure and free of abuse, fraud, spam, and bots [legitimate interests].
• To understand how the Service is used, fix problems, and improve it [legitimate interests].
• To send product news and offers; you can unsubscribe from any of these emails [legitimate interests or consent].
• To measure whether our ads lead to sign-ups, where you allow it [consent].
• To comply with the law and protect our rights [legal obligation, legitimate interests].

Where we rely on your consent, you can withdraw it at any time; this doesn't affect anything done before.

5. Who we share it with

We do not sell personal information. We share it with these service providers, who work on our behalf:

We may add or change providers as the Service grows and will attempt to keep this list current. Your information is processed in the United States and in other countries where these providers operate. Where the law requires a safeguard for transfers from the EU, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or an equivalent mechanism.

We may also share information if we sell or merge all or part of our business, or when the law requires it.

Other people in the Service. What you post in a workspace (comments, files, your profile) can be seen by that workspace's members. If a business turns on a client review page for a project, the tasks, comments, and files it shares there can be seen by anyone who has the page's private link, unless the business also protects it with a password. Estimates work the same way: anyone who has an estimate's private link can see it, along with any choices, comments, and notes sent back on it. If the business turns on the email check, we first email a one-time code to the address the estimate was sent to. Only the people it was sent to can approve it or send it back. The business decides who receives these links.

6. Cookies

We use cookies and similar technologies (like web beacons and pixels) for these purposes:

• To make the Service work: keeping you signed in, protecting forms from forgery and bots, remembering that you've opened a client review page or an estimate (or confirmed your email for one, for 30 days), and storing a copy of your workspace in your browser so it loads quickly (signing out clears it).
• To see whether links in emails sent through Dunaroo are clicked.
• On our website, sign-up pages, and in the Service, to understand how people use them, and on our website and sign-up pages, to see whether our ads work. We and the partners listed in Section 5 set these analytics and advertising cookies. They are not used on client review pages, estimates, lead forms, or in emails sent through Dunaroo.

If you are in the EU, the UK, or Switzerland, analytics and advertising cookies are set only after you accept them in our cookie banner, and you can change your choice at any time under "Cookie settings" on our website. You can also block or delete cookies in your browser settings; blocking the cookies the Service needs will stop it from working. We don't currently respond to browser "Do Not Track" signals.

7. How long we keep it

We keep personal information while your account is active and as long as we need it for the purposes above, or longer where the law requires (for example, for tax and accounting). Then we delete or anonymize it; copies in backups are deleted as the backups expire.

Inquiries that a business never turns into a client are deleted after that business's retention period (12 months by default); inquiries marked as junk are deleted after 30 days. Deleting an inquiry also deletes its email conversation and files, call notes, estimates (including any approval records), Roo's research about it and conversations with Roo about it, the calls booked on it, the people added to it, and the business's notifications about it. Estimates for clients, and the approval records on them, are kept with the business's records. Calls that a business's existing clients book are kept with that client's records until the business deletes them. Keys for apps a business connects are deleted when it disconnects the app or deletes its organization. Files are deleted when they are removed from the Service.

8. Security

We use reasonable technical and organizational measures to protect personal information. No system is completely secure, so we can't guarantee that information will never be accessed, lost, or changed without permission.

9. Your rights

Depending on where you live (for example, the EU, the UK, Switzerland, Canada, or California), you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to how we use it, and to withdraw consent. You can update your details on your Account settings page. For anything else, email contact@dunaroo.com; we'll respond as the law requires. If your information was provided to us by a business that uses Dunaroo, you can also make these requests to that business.

You can unsubscribe from our product emails at any time with the link in each one; we'll still send messages you need about your account. If you close your account, we may keep some information where we need it to prevent fraud, resolve disputes, or meet legal requirements.

If you are in the EU or the UK, you can also complain to your local data protection authority; in Switzerland, to the Federal Data Protection and Information Commissioner.

10. Children

The Service is for people 18 and older. We don't knowingly collect information from children; if we learn we have, we'll delete it. If you think a child has given us information, email contact@dunaroo.com.

11. Changes to this notice

We may update this notice. The date at the top shows when it last changed. For significant changes, we will let you know by email or by a notice in the Service.

12. Contact

Dunaroo, LLC · contact@dunaroo.com