Privacy Policy

1. Data we collect

• Account data: your email address, the workspaces you belong to and your role in each.
• Sign-in data: one-time sign-in codes, which expire within 10 minutes, and your browser sessions.
• Workspace content: your sources, rules and destinations, including destination addresses and credentials (credentials are stored encrypted); the events you send, including their titles, bodies, labels and data; and the deliveries, attempts and inbox items produced from them.
• Audit records: a log of changes made in each workspace, showing who did what and when.
• Usage data: the counts behind plan limits, such as events accepted and notifications delivered.
• Billing data: when a workspace subscribes, Stripe collects the payment details. We store the Stripe customer and subscription identifiers, the plan, the billing period and the subscription status. Card numbers never reach Doqet.
• Technical logs: our servers and hosting providers record requests, which can include IP addresses, to keep the Service secure and to fix problems.
• Messages you send to support.

2. How we use it

• to sign you in, keep sessions secure and control who can access each workspace;
• to receive, route and deliver your events as your rules direct, and to show you what happened to them;
• to apply plan limits and to manage subscriptions and billing;
• to send sign-in codes, and to contact you about your account or these policies when we need to;
• to prevent abuse, for example by limiting repeated sign-in attempts;
• to answer support requests and meet our legal obligations.

We don’t sell personal data, and we don’t use it for advertising.

3. Data in your events

Doqet handles whatever your systems put in an event. If that includes personal data about your customers or other people, you decide why and how it is processed, and we process it on your behalf to provide the Service. Send only the data your notifications need.

When a rule sends a notification to a destination, its content goes to that destination. Chat tools and other third-party services you connect handle it under their own terms.

4. Service providers

We share personal data only with the providers that help us run Doqet, under agreements that limit how they may use it:

• Tencent Cloud hosts the Service and its database in its Singapore region.
• Cloudflare provides DNS and network services for our domain, and may handle traffic and email that pass through them. When you request a sign-in code, Cloudflare Turnstile loads from Cloudflare and uses your browser and network details to check that the request comes from a person.
• Mailgun delivers our emails, such as sign-in codes.
• Stripe processes payments and manages subscriptions.

We may also disclose data where the law requires it, or to protect the rights and safety of our users or others.

5. Where data is processed

Doqet is hosted on Tencent Cloud in its Singapore region. Some providers, such as Cloudflare, Stripe and Mailgun, may process data in other countries; where they do, we rely on their contractual commitments to protect it. The destinations you configure can be anywhere.

6. How long we keep data

Events, deliveries, attempts and inbox items are deleted automatically after the workspace’s retention period. That period is 30 days by default, and the workspace owner can change it. Audit records are kept for 400 days by default.

We keep account and workspace settings for as long as the account or workspace exists. Sign-in codes expire within 10 minutes, and browser sessions end after 12 hours or when you sign out. Usage totals are kept after the events they count are deleted, because billing relies on them. Billing records are kept for as long as tax and accounting law requires.

You can delete a workspace you own, or your own account, at any time under Settings → General → Danger zone in the console. A workspace with an active subscription can be deleted once the subscription is set to end, and you can't delete your account while you own a workspace that has other members.

Deleting a workspace takes effect at once: its members lose access, its source tokens stop working and pending deliveries are cancelled. Its sources, rules, destinations, events, deliveries, inbox items, usage history, audit records and memberships are then erased from our database. Deleting your account signs you out everywhere, deletes the workspaces you own alone and removes you from every other workspace, and then erases your account. Changes you made in workspaces that still exist stay in their audit records, shown as “Deleted user” instead of your email address.

You can also ask us to delete an account or a workspace by emailing support@doqet.app. We complete every deletion within 30 days: from the moment you confirm it in the console, or after we have verified a request made by email. We keep a record that the deletion was requested and completed. It holds identifiers, dates and counts of what was erased, and no names, email addresses or content.

Backups are encrypted, and copies in backups are removed as those backups expire, within 40 days. Stripe keeps its customer, subscription and invoice records as tax and accounting law requires.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to withdraw consent. To use these rights, email support@doqet.app; we may need to confirm your identity first.

If your data reached us because a Doqet customer sent it through the Service, we may refer your request to that customer, who decides how that data is used.

If you are unhappy with how we handle your data, tell us, or complain to your local data protection authority. In Hong Kong, that is the Office of the Privacy Commissioner for Personal Data.

8. Security

We use encrypted connections, one-time sign-in codes instead of passwords, role-based access for every workspace and encrypted storage for destination credentials. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

9. Cookies and local storage

Doqet sets up to four cookies. All of them are our own, and none is used for advertising or analytics:

• notify_hub_session keeps you signed in. It ends when you sign out, or after 12 hours.
• notify_hub_email_login links a sign-in code to your browser while you enter it, for up to 10 minutes.
• doqet_locale remembers the language you choose, for one year. It is set only when you choose a language, whether or not you are signed in.
• doqet_device recognises a browser you have signed in from, so sign-in limits shared with other people don't lock you out. It lasts 90 days from your last sign-in in that browser, and Settings → Trusted browsers ends it for all your browsers.

Your browser also keeps some choices on your device: your language and theme, the workspace open in each tab and whether you hid a workspace’s setup guide. Right after you delete a workspace or your account, the tab also keeps a one-time note, with at most the workspace’s name, so the next page can confirm the deletion. Stripe’s checkout and billing pages set their own cookies under Stripe’s privacy policy.

10. Children

Doqet is a tool for work and isn’t meant for children. We don’t knowingly collect their data.

11. Changes to this policy

We will publish updates on this page with a new effective date. We will publish a material change at least 30 days before it takes effect.

12. Contact