How DoHQ handles your data

Effective 20 October 2026

This policy covers the DoHQ application at app.dohq.it, its API, its command-line tool and its Telegram connection (together, "DoHQ" or "the app"). It explains what data the app collects, how it is used, who it is shared with, how long it is kept and how you can delete it. It is written in plain English on purpose. If anything is unclear, ask us.

1. Who we are

DoHQ is built and operated by DoHQ, Melbourne, Australia. We are the data controller for the personal information described in this policy. Our website is dohq.it and the app is at app.dohq.it. You can reach us at [email protected] or through the contact page.

2. What we collect

DoHQ is a work operations app. It holds the information you put in, and the information it reads from the business tools you choose to connect. In practice that is:

• Your account.Your name, email address and sign-in method (an email address and password, with optional two-factor authentication and passkeys, or sign-in with Google or GitHub). When you sign in with Google or GitHub we never see that account's password.
• What you type into the app. Cards, notes, briefs, chat messages to the AI desks, rulings on what the app proposes, and links or files you drop in to be remembered.
• Data from connected services. When you connect a service, the app reads from it on a schedule and stores what it needs to do its job. The services available are Google Workspace (Calendar, Contacts, Drive, Gmail), Xero, Freshdesk, Asana, Teamwork, Slack, GitHub, Telegram, IMAP mailboxes, and the meeting recorders Fathom, Otter, Granola and Wispr Flow. Each connection is your choice, each is made separately, and each can be disconnected separately.
• Records of what the app did. Every act the app or one of its AI desks takes is written to a log you can read: what was sent, filed, booked, moved or proposed, and on whose instruction.
• Technical data. Server logs with IP address, browser type and the pages requested, kept for security and debugging. The marketing site at dohq.it uses Google Tag Manager for analytics; the app itself does not run advertising or third-party analytics trackers.

3. Google user data

If you connect a Google account, Google shows you the specific permissions the app requests and you can decline any of them. This section explains each one: what is accessed, what is stored, and what the app does with it.

• Sign in with Google (openid, email). Used only to identify you when you sign in. We store your Google account identifier and email address.
• Google Calendar (calendar). The app reads events from the calendars you tick so it can show your diary, link meetings to the people and client work they belong to, and tell you when something is due. It stores event titles, times, attendees and descriptions. It creates, moves, cancels or responds to an event only when you ask it to in that conversation.
• Google Contacts (contacts). The app looks people up so that mail, meetings and tickets land against the right person, and stores names, email addresses, phone numbers and organisations. It creates or changes a contact only when you ask it to.
• Google Drive (drive.readonly). The app searches Google's own index of the folders you tick; it does not copy your Drive or build an index of its own. It reads the content of a file only when you ask about that file, or when you have ticked its folder to be used as context, in which case that content is held while the tick is on and removed when you untick it. The app never creates, changes or deletes anything in Drive.
• Gmail (gmail.modify). The app reads messages from the mailbox you connect so it can find what is waiting on you, raise signals about unanswered mail and let its mail desk work on your instruction. It stores message headers, addresses, labels, a short snippet and the message text (capped at 64,000 characters per message). On your instruction it labels, files or moves a message to Trash, and sends replies you have asked for. The app deliberately does not request the permission that would allow permanent deletion of mail, so it cannot bypass your Trash.

Google data is used only to provide and improve the features described on this page and on the app page, which are visible in the app's own interface. It is not used for advertising, it is not sold, and it is not used to build profiles for anyone other than you. No person at DoHQ reads your Google data unless you have asked us to (for example to help with a support request), it is needed for security or to comply with the law, or it has been aggregated so that it no longer identifies anyone.

DoHQ's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use data

The app uses the data it holds to:

• Show you your work, your diary, your mail and your money in one place.
• Link people, companies, mail, meetings, documents, tickets and cards to each other, so a question about a client can be answered from everything you hold about them.
• Raise signals: an invoice past due, a reply nobody has sent, a ticket unanswered, a piece of work approved but not started.
• Let the AI desks draft, propose and, on your instruction, act: send a reply, file mail, book a meeting, create an invoice, update a ticket.
• Keep a record of what the app did, so it can be checked.
• Secure the service and meet our legal obligations.

Content from your connected services is sent to AI model providers to produce drafts, summaries, classifications and search embeddings. Those providers act as our service providers under terms that limit their use of the content to providing the service to us. We do not use your data to train AI models, and we do not permit our providers to do so.

5. Who we share it with

We do not sell personal information. We share data only with:

• Infrastructure providers that host and deliver the app: Amazon Web Services (Sydney, Australia) and Cloudflare.
• AI model providersthat process content to deliver the app's features: Anthropic, OpenAI, Google (Gemini) and ElevenLabs, each as a service provider as described above.
• The services you connect, when you instruct the app to act in them: for example sending a reply through Gmail, creating an invoice in Xero or updating a ticket in Freshdesk. Data flows to those services only as needed to carry out that instruction.
• Authorities, where the law requires it.

If DoHQ is ever part of a merger, acquisition or asset sale, Google user data will be transferred only with your explicit prior consent, as the Google API Services User Data Policy requires.

6. Where it is stored and how it is protected

The app and its database run on Amazon Web Services in the Sydney region (ap-southeast-2). Data is encrypted in transit (TLS) and at rest. Access tokens for connected services are stored encrypted and are used only by the app's own sync and action code. Access to production systems is limited to the people who operate the service and is logged.

7. How long we keep it and how to delete it

• Disconnecting a service in Settings removes the connection and the data the app had staged from that service. For Google, you can also revoke the app's access at any time from your Google Account under Security, Third-party apps and services; the app then stops reading and removes what it had staged on its next sync.
• Unticking a Drive folder removes any content the app held from that folder.
• Mail and signalsolder than 90 days drop out of the app's search index.
• Your account. Ask us at [email protected] and we will delete your account and the personal information held against it within 30 days, except where we must keep a record to meet a legal obligation.
• Backups of the database are kept for 14 days and then expire.

8. Your rights and choices

You can see what the app holds about your connected services in the app itself, change what it reads by ticking and unticking calendars, folders and mailboxes, and disconnect any service at any time. You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you are in another jurisdiction with its own privacy law, you have the rights that law gives you and we will honour them. If you believe we have mishandled your information, contact us first; you may also complain to the Office of the Australian Information Commissioner.

9. Changes to this policy

When we change this policy we will update the effective date at the top of this page. If a change affects how we handle Google user data or materially changes what we collect, we will tell you in the app before it takes effect.

10. Contact

DoHQ, Melbourne, Australia. [email protected] or the contact page.