Privacy Policy

Dovito® Business Solutions, Ltd. ("Dovito," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

1. Scope

This Policy applies to personal information we collect through:

1. Our website at dovito.com and its subpages (the "Website").
2. Systematics, our software platform at app.dovito.com, including its web, iOS, and Android apps and its Model Context Protocol (MCP) connection (together, the "Platform").
3. Our consulting, development, coaching, and training engagements, workshops, and events (the "Services").
4. Our affiliate program, recruiting, and other business communications.
5. Our relationships with our own team members, contractors, and job applicants, as described in Section 2.5.

Customer Data is handled differently. When a business uses the Platform or Services, it may upload or connect information about its own employees, contractors, customers, applicants, and contacts ("Customer Data"). For Customer Data we act as a service provider or processor on that business's behalf, and the business decides how the data is used. Our handling of Customer Data is governed by our agreement with that business, including our Data Processing Agreement (dovito.com/legal/dpa). If your information was placed in the Platform by a business you work with, please send privacy requests to that business. We will assist them in responding.

This Policy does not apply to third-party websites, apps, or platforms you connect to or reach from our Website or Platform. Their own privacy policies govern them.

2. Information We Collect

2.1 Information you give us

2.2 Information collected automatically

2.3 Information from other sources

2.4 Customer Data processed in the Platform

Depending on the features a business uses, Customer Data may include CRM contacts and records retrieved from connected platforms; SMS messages and transcripts handled by an automated messaging assistant; voice notes and their transcripts; screen recordings and their transcripts; documents and files; and electronic signature records. For each signer, a signature record includes the signer's name and email address, the signature and initials, the time of each event (sent, viewed, signed, declined), the signer's IP address and browser information, and a cryptographic hash of the document, so the signature can be verified later.

We process Customer Data to provide the Platform to the business that controls it and as our agreements with that business permit, and we do not use it to infer characteristics about anyone or for advertising.

2.5 Dovito team members, contractors, and applicants

If you work with Dovito as an employee or contractor, we collect the information needed to engage and pay you, including contact details, contracts and nondisclosure agreements, tax forms (such as Form W-9 or its equivalent, which contain a taxpayer identification number), identity documents, timecards, pay records, and payout details. We use a payout provider (Payoneer) or a payroll provider to pay you. If you apply for a role, we collect your name, email address, phone number, resume, cover letter, and answers you provide. We use this information to evaluate applications, manage the working relationship, pay you, meet tax and legal obligations, and protect our systems, and we keep it for the periods in Section 10. Taxpayer and government identification numbers are sensitive personal information, and we use them only for tax, payment, and identity verification purposes.

3. How We Use Personal Information

We will not use personal information for a purpose materially different from those above without telling you and, where required, obtaining your consent.

4. Artificial Intelligence Features

The Platform includes AI agents and assistants. When you use them, the content you submit (such as prompts, messages, files, voice notes, and data retrieved from platforms you have connected) is sent to the AI provider that powers that feature to generate a response. Our current AI providers are OpenAI, Anthropic, and Perplexity.

1. No model training for others. We do not use your content or Customer Data to train AI models that are made available to anyone other than the business that owns the data, and we use these providers under commercial API terms that do not permit them to train their models on the data we send. We may create de-identified, aggregated statistics about how the Platform is used, which do not identify any business or individual.
2. Provider retention. An AI provider may keep submitted data for a limited period to monitor for abuse, as described in its terms, and then deletes it.
3. Your control. AI output can be inaccurate or incomplete. Where an agent proposes an action in a connected platform, you choose whether to approve it. Our Terms of Service describe responsibility for actions you authorize.
4. Human review. Dovito staff may review AI conversations only to provide support you request, investigate a security or abuse concern, or comply with law.
5. Automated messaging. Where a business enables an automated SMS assistant, it tells recipients they are communicating with an automated system where required, honors opt-out keywords, and observes quiet hours. The business that sends the messages is responsible for obtaining recipients' consent.

5. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

6. Cookies, Analytics, and Advertising

6.1 Product analytics on the Platform

We record product events in our own database to understand feature use and to support billing and usage reporting. These events contain counts, identifiers, amounts, and outcomes only. They never include the text of messages, AI prompts or answers, tool inputs or results, documents, or your email address, phone number, name, or postal address, and our systems remove fields that appear to contain personal data.

We copy these events to PostHog, a product analytics provider hosted in the United States, through our own domain. PostHog also receives page views and click data from the web app. Click data does not include on-screen text. PostHog discards IP addresses and identifies people by an internal user ID and role only. We have turned off PostHog's AI data processing features.

Session recordings are off unless you turn them on (Settings, then Preferences, then "Allow session recordings"). When enabled, all text and form inputs are masked, and recordings never run on billing, payment, settings, security, messaging, deliverables, library, signing, or sharing pages. We also use PostHog for feature flags, product experiments, and short in-app surveys, which never ask for personal data.

6.2 Advertising and website analytics

We use Google Analytics and the Meta Pixel on the Website and on the Platform's public pages (such as the landing, sign-in, careers, workshop, privacy, and terms pages) to understand traffic and measure our advertising. On the Platform, these tools run only for signed-out visitors and never load inside the signed-in portal or on billing or payment pages. We do not send your Platform user ID to Google.

On the Website, when you submit a form, we may send Meta a one-way hashed version of the email address, name, and phone number you entered so Meta can match the visit to an ad. Hashing hides the underlying value from anyone who does not already have it, but Meta may be able to match it to an existing Meta account.

On the Platform, our servers send Meta two events: sign-up and purchase (with amount and currency). These identify you by a one-way hash of your internal user ID and by Meta's own browser cookies if present. They do not include your email address, phone number, name, or IP address.

6.3 Cookies we use

6.4 Your choices

You can decline or withdraw consent to non-essential cookies through the cookie banner or cookie settings link on our sites. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of targeted advertising and the related sharing described in Section 8.2, for that browser and, if you are signed in, for your account. You can also block or delete cookies in your browser settings, install the Google Analytics Opt-out Browser Add-on, and manage ad preferences in your Meta account. Blocking strictly necessary cookies may prevent sign-in.

7. How We Disclose Personal Information

7.1 Service providers

We disclose personal information to vendors that process it on our behalf under contracts that limit their use of it to providing services to us.

The current list of sub-processors for Customer Data is published at dovito.com/legal/subprocessors and in our Data Processing Agreement, and we notify business customers of changes as that agreement provides.

7.2 Other disclosures

1. At your direction. When you connect a third-party platform or ask an agent to act in one, we send that platform the data needed to carry out your instruction.
2. Within your business account. Administrators of your business's account can see information about users and activity in that account.
3. Dovito personnel. Authorized Dovito staff may access an account, including by viewing the Platform as a particular user for up to one hour at a time, to provide support you request, investigate security or abuse, maintain the Platform, or comply with law. This access is logged.
4. Legal and safety. When we believe in good faith that disclosure is required by law, subpoena, or court order, or is needed to protect the rights, property, or safety of Dovito, our users, or others.
5. Advertising partners. Google and Meta receive the information described in Section 6.2. This is disclosed in Section 8.2 as sharing for advertising.
6. Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy's commitments.
7. With your consent.

8. Sale and Sharing of Personal Information

8.1 No sale for money

We do not sell personal information for money, and we do not sell or share Customer Data or sensitive personal information.

8.2 Targeted advertising

Our use of the Google and Meta tools described in Section 6.2 may be considered "sharing" for cross-context behavioral advertising, "targeted advertising," or a "sale" under some U.S. state privacy laws. You can opt out at any time through the "Your Privacy Choices" link in our site footer, by sending a GPC signal, or by emailing legal@dovito.com. In the past 12 months, the categories of personal information disclosed in this way were identifiers (such as cookie IDs and hashed contact details or user IDs), internet or network activity, and commercial information (sign-up and purchase events), disclosed to Google and Meta. We do not knowingly sell or share the personal information of anyone under 18.

9. SMS Messaging

If you give us your mobile number and agree to receive texts, we or our messaging provider may send you account, service, and, with your separate consent, marketing messages. Message frequency varies and message and data rates may apply. Reply STOP to opt out and HELP for help. Consent to receive texts is not a condition of purchase. We do not share mobile numbers or SMS opt-in data with third parties or affiliates for their marketing purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except service providers that send messages on our behalf.

10. Data Retention

We keep personal information only as long as needed for the purposes in this Policy, then delete or de-identify it.

We may keep information longer where needed to resolve disputes, enforce agreements, or comply with a legal hold.

11. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including encryption in transit (TLS), encryption of sensitive data at rest, multi-factor authentication for system access, role-based access controls, logging and monitoring, and incident response procedures. No system is completely secure. If we learn of a breach affecting your personal information, we will notify you and the authorities as required by law.

12. International Transfers

We are based in the United States and store data primarily in the United States. If you access our services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism.

13. Your Rights and Choices

13.1 Rights available to everyone

Regardless of where you live, you may ask us to:

1. Confirm whether we process your personal information and give you access to it.
2. Correct inaccurate information.
3. Delete your information.
4. Provide your information in a portable, machine-readable format.
5. Opt out of targeted advertising, sale, or sharing (see Section 8.2).
6. Stop sending you marketing emails (use the unsubscribe link) or texts (reply STOP).

Where the GDPR or UK GDPR applies, you may also object to or ask us to restrict processing based on legitimate interests, withdraw consent at any time without affecting earlier processing, and lodge a complaint with your local data protection authority.

13.2 How to make a request

Email legal@dovito.com with the subject "Privacy Request," or write to the address in Section 17. You can delete your Platform account from its settings. We will verify your identity by confirming information we already hold, such as access to the email address on your account, before acting on a request, and we will ask only for what verification requires.

You may use an authorized agent. We may ask the agent for signed permission from you and may ask you to verify your identity directly.

We respond within 45 days. If we need more time, we will tell you why and may extend by up to 45 more days where the law allows. Requests are free unless they are manifestly unfounded or excessive.

We may decline part of a request where the law permits, for example when we must keep records for tax purposes. If we do, we will explain why.

13.3 Appeals

If we decline your request, you may appeal by replying to our decision or emailing legal@dovito.com with the subject "Privacy Appeal." We will respond in writing within the period the law requires, generally 45 to 60 days, and explain the outcome. If you are not satisfied, you may contact your state attorney general. Colorado residents may contact the Colorado Attorney General at coag.gov.

13.4 No discrimination

We will not deny you service, charge a different price, or provide a different quality of service because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.

14. Additional Disclosures for U.S. State Residents

State privacy laws, including those of California, Colorado, Connecticut, Virginia, Texas, and others, require specific disclosures. In the past 12 months we have collected the following categories of personal information:

We use sensitive personal information only for purposes permitted without an opt-out right under applicable law, and we do not use it to infer characteristics about you. Retention periods are in Section 10.

14A. Required and Optional Information

Providing account, contact, and payment information is necessary to enter into and perform our contract with you. If you do not provide it, we cannot create an account or provide the Platform or Services. Other information is optional unless we say otherwise when we collect it.

15. Children

Our Website, Platform, and Services are intended for business use by adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.

15A. Do Not Track

Some browsers send a "Do Not Track" signal. Because there is no common standard for it, we do not respond to Do Not Track signals. We do honor Global Privacy Control signals as described in Section 6.4.

16. Changes to This Policy

We will post any update on this page and change the "Last Updated" date. If we make a material change, we will notify account holders by email or in the Platform at least 30 days before it takes effect. We will not apply a material change to personal information collected earlier without your consent where the law requires it.

17. Contact Us

Dovito® Business Solutions, Ltd. 508 Main Street Windsor, Colorado 80550 Email: legal@dovito.com