Privacy Policy

1. Who We Are

DO.Impact is an integrated operating system for industrial manufacturers. The platform is operated by doimpact.llc and hosted on Lovable Cloud infrastructure. For privacy questions, contact us through /security-contact or email contact@doimpact.app.

2. Data We Collect

We collect the following categories of data:

• Account data: email address, password hash, and authentication details provided when you sign up or are invited.
• Workspace data: company or workspace name, subscription details, add-on entitlements, module permissions, and access settings.
• User-uploaded data: strategy documents, KPIs, employee records, skills matrices, customer contacts, contracts, opportunities, operational data, and any other content you choose to upload.
• Usage data: logins, feature usage, AI exec-room interactions, and audit events for security and billing.
• Technical data: IP address, browser type, device information, and cookies or similar identifiers used for security and analytics. See our Cookie Policy for details.

3. Legal Bases and Purposes of Processing

We process personal data only where we have a valid legal basis: to perform our contract with you, to pursue legitimate interests (such as security, billing, and service improvement), to comply with legal obligations, or with your consent where required.

Purposes include: providing and maintaining the service, authenticating users, enforcing access controls, processing billing, preventing fraud and abuse, supporting users, and complying with legal obligations.

4. Data Sharing and Subprocessors

We do not sell personal data. We share data only with service providers necessary to operate the platform. Current subprocessors include:

• Lovable Cloud — hosting, database, authentication, and storage infrastructure.
• AI providers — used only within the optional Exec Team Room add-on and only when enabled for your workspace.
• Email and notification providers — for account verification, invitations, and critical service notices.
• Payment processor — Stripe for billing and subscription management.
• Google Ads — advertising measurement on public marketing pages, loaded only with your cookie consent.
• LinkedIn (Insight Tag) — advertising measurement and retargeting on public marketing pages, loaded only with your cookie consent.

A more detailed list is available in our Data Processing Agreement.

5. Data Retention

Account and workspace data are retained while the account is active. When you delete your account or workspace, we remove personal data within a reasonable grace period, except where we must retain it for legal compliance, billing, or security purposes. Billing and audit records are typically retained for 7 years unless you request earlier deletion and the law permits it. Sandbox data is session-only and not retained.

6. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export your personal data, and to object to or withdraw consent for certain processing. You can request these actions through your workspace settings or by contacting us. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling certain requests.

7. Security Measures

We use industry-standard security practices, including encryption in transit and at rest, role-based access controls, row-level security in the database, audit logging, and regular security reviews. However, no system is completely secure. You are responsible for maintaining strong credentials and promptly reporting suspected unauthorized access. Details are described on our Security page.

8. Cookies, Analytics, and Advertising

Essential cookies for authentication, security, and session management are always used. On our public marketing pages we also use the Google Ads tag to measure the effectiveness of our advertising, but only if you accept advertising cookies in our cookie banner. We also load the LinkedIn Insight Tag on the same terms. Google Consent Mode keeps advertising and analytics storage denied until you accept, and if you reject, neither the Google tag nor the LinkedIn tag is ever loaded. You can withdraw your consent at any time from the Cookie Policy page. Legal basis for advertising cookies is your consent.

9. International Transfers

DO.Impact serves users globally. Your data may be stored and processed in jurisdictions outside your own, including the United States. We rely on Standard Contractual Clauses or equivalent transfer mechanisms where required by EU, UK, and other applicable data protection laws. Please contact us for details about transfer safeguards.

10. Children

DO.Impact is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the service. The latest version is always available at this URL.

12. Contact Us

For privacy-related requests or questions, contact us through /security-contact or email contact@doimpact.app.