Legal Notice

Privacy Policy

Last updated August 6, 2026

This Privacy Notice for Dossier Inc. (“we,” “us,” or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you visit usedossier.online, use our application or connect your third-party accounts (such as Google services) to our platform, or engage with us in other related ways.

Questions or concerns? Contact us at support@usedossier.online. By creating an account or signing up for our Services, you acknowledge that you have read, understood, and agree to this Privacy Notice, including our use of session recording and analytics as described herein.

Summary of Key Points

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes data collected through session recording and analytics tools.
Do we process any sensitive personal information? No.
Do we collect any information from third parties? No.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
Do we use Google user data? Yes, if you connect your Google account to our Services. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet can be guaranteed to be 100% secure.
How do you exercise your rights? Submit a data subject access request or contact us at support@usedossier.online.

1. What Information Do We Collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us. The personal information we collect may include: names, usernames, phone numbers, email addresses, and contact or authentication data.

We do not process sensitive information. We may provide you with the option to register with us using your existing social media account details, like your Google, Facebook, or other social media account.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes. The information we collect includes:

Log and Usage Data: Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services.
Device Data: Information about your computer, phone, tablet, or other devices you use to access the Services.
Location Data: Information about your device's location, which can be either precise or imprecise.
Client Application Data: Information collected from the specific client application used to interact with the product.
Session Recording Data: We use session recording technology (powered by Mixpanel) to record and analyze how you interact with our Services. This may include mouse movements, clicks, scrolls, keystrokes (excluding sensitive fields like passwords), page navigation, and other interactions with our user interface. Session recordings help us understand user behavior, identify usability issues, and improve our Services.

We use Mixpanel as our analytics and session recording provider. For more information about how Mixpanel handles data, please visit their privacy policy. By creating an account or signing up for our Services, you consent to our use of session recording and analytics as described in this Privacy Notice.

2. Google API Services User Data Disclosure

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.1 Data Access and Justification

Our application integrates with Google services to provide core functionality. We only request access to the narrowest scopes necessary to provide the following prominent, user-facing features:

Google API Scope	Data Accessed & Used	User-Facing Feature
gmail.modify	Read, compose, send, delete, and manage emails	AI-Driven Action and Reply Automation: creating drafts, archiving/labeling emails, analyzing email content to identify follow-up tasks
calendar	View, edit, share, and manage calendars and calendar events	Intelligent Scheduling: creating, updating, and managing calendar events identified through email analysis or user input
documents	Read and manage Google Docs	AI Content Generation: creating, editing, or searching the user's Google Docs based on commands or tasks
spreadsheets	View, edit, create, and delete spreadsheets in Google Sheets	AI Data Management: creating, editing, or searching the user's Google Sheets based on commands or tasks
drive	View, edit, create, and delete files in Google Drive	AI Data Management: accessing and organizing files based on commands or tasks
adwords	Read campaign, ad group, keyword, and performance data, and create or modify campaigns, budgets, and ads within Google Ads accounts	AI Advertising Management: reporting on campaign performance, and making confirmed campaign changes

Google Ads exposes a single OAuth scope (adwords); no narrower scope is available for the reporting and campaign-management features described above. Granting it does not give Dossier access to any advertising account beyond those your own Google account can already reach.

2.2 Limited Use Policy Compliance

If you grant Dossier access to your Google data, our use of that data is subject to these additional, strict requirements mandated by the Google API Services User Data Policy:

No Selling: We will NOT sell Google user data to any third party, under any circumstances.
No Advertising Use: We will NOT use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
No General AI/ML Training: We will NOT use Google user data to create, train, or improve generalized machine learning or artificial intelligence models.
Limited Transfer: We will NOT transfer or share Google user data with any third party, except as necessary to provide prominent, user-facing features, for security, or legal compliance.

2.3 Human Access Restrictions

Human access to Google user data is strictly prohibited, except with your explicit documented consent for a specific support purpose, when necessary for security purposes, or to comply with valid legal processes.

2.4 Google User Data Deletion

Upon your request to delete your account or any Google user data, we will promptly delete all Google user data from our systems and backup archives. You may request deletion by contacting us at support@usedossier.online.

2.5 Data Security for Google Data

We implement appropriate technical and organizational security measures to protect Google user data, including encryption in transit using TLS/SSL, encryption at rest, and strict access controls.

3. How Do We Process Your Information?

We process your personal information for the following reasons:

To facilitate account creation and authentication and otherwise manage user accounts.
To deliver and facilitate delivery of services to the user.
For analytics and product improvement, including session recording via Mixpanel.
To provide user-facing features. We process Google user data solely to provide prominent features.
To save or protect an individual's vital interest.

4. What Legal Bases Do We Rely On to Process Your Information?

We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law (Consent, Performance of a Contract, Legal Obligations, and Vital Interests). GDPR applies to EU and UK residents.

5. When and With Whom Do We Share Your Personal Information?

We only share your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law. We do not sell your personal information.

6. Do We Offer Artificial Intelligence-Based Products? (Zero-Model-Training Guarantee)

As part of our Services, we offer products powered by artificial intelligence and frontier foundation models (including Anthropic and OpenAI via enterprise API agreements). All personal and company information processed using our AI Products is handled under a strict Zero-Model-Training Guarantee:

Zero Model Training: We will NEVER use your customer data, CRM data, Slack communications, email drafts, uploaded documents, or user inputs to train, retrain, fine-tune, or improve generalized machine learning or artificial intelligence models.
Contractual Zero Data Retention (ZDR): Our enterprise agreements with LLM providers strictly mandate zero data retention on API endpoints. Your data is processed in ephemeral memory and discarded immediately upon response generation.
Tenant Isolation: Customer context and research memory are logically isolated at the database level and never commingled or shared across accounts.

7. How Do We Handle Your Social Logins?

Our Services offer you the ability to register and log in using third-party social media accounts (like Google or SAML SSO). Where you choose to do this, we receive profile information such as name, email address, and profile photo, used solely for authentication and service provision.

8. How Long Do We Keep Your Information?

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice. No purpose requires us keeping personal information for longer than three (3) months past the termination of the user's account, after which it is cryptographically erased from all primary systems and backups.

9. How Do We Keep Your Information Safe? (Enterprise Encryption Standards)

We maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of your information:

Encryption in Transit: All data transmitted between your browser, Slack workspace, external APIs, and our servers is encrypted using TLS 1.3 (with fallback to TLS 1.2 minimum) utilizing modern cipher suites with perfect forward secrecy (PFS).
Encryption at Rest: All stored data, including database records, search indices, and backup snapshots, is encrypted using industry-standard AES-256 encryption.
Key Management & Token Vault: Sensitive credentials, OAuth refresh tokens, and third-party integration keys are stored in an isolated, encrypted token vault managed via AWS Key Management Service (KMS) with strict hardware security module (HSM) controls.
Independent Audits: We undergo regular third-party penetration testing and maintain continuous compliance with CASA Tier 2 and SOC 2 Type II controls.

10. Controls for Do-Not-Track Features

We do not currently respond to DNT browser signals as no uniform technology standard has been finalized.

11. GDPR and United States State Privacy Rights (CCPA/CPRA)

Under applicable privacy legislation including the European Union General Data Protection Regulation (GDPR), UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), you are entitled to the following rights:

Right to Access / Know: The right to request disclosure of personal data collected, used, or shared.
Right to Rectification: The right to correct inaccurate personal data.
Right to Erasure (“Right to be Forgotten”): The right to request deletion of your personal data.
Right to Data Portability: The right to obtain a copy of your personal data in a structured, commonly used, machine-readable format.
Right to Opt-Out: We do not sell or share personal data for cross-context behavioral advertising. You maintain the absolute right to restrict processing.
Non-Discrimination: We will never deny services, charge different prices, or provide a different quality of service for exercising your privacy rights.

To exercise any of these rights, please submit a request to our Data Protection Officer at support@usedossier.online. We respond to all verified requests within thirty (30) business days.

12. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Revised” date at the top of this Privacy Notice.

13. How Can You Contact Us About This Notice?

Email: support@usedossier.online
Dossier Inc.
548 Market St PMB 766478
San Francisco, CA 94104
United States

14. How Can You Review, Update, or Delete the Data We Collect From You?

To review, update, or delete your personal information, please contact us at support@usedossier.online. You may disconnect your Google account from our Services at any time through your account settings.