Privacy Policy

DonePages (“DonePages,” “we,” “us,” or “our”) provides software that turns completed-job photos and details into public pages, PDFs, videos, social posts, lead forms, lead alerts, and review requests. This policy applies to donepages.com, the DonePages application, the affiliate program, and related support and communications (the “Service”).

DonePages is the controller of account, website, billing, security, and affiliate-program information. When a business customer uploads its own customer or prospect data, that business decides why and how the data is used; DonePages processes it on the business's behalf as a service provider or processor. Business customers are responsible for providing required notices and obtaining required permissions.

• Account and sign-in data. Name, email address, avatar, authentication identifiers, and security events. Password authentication is handled by Supabase Auth; DonePages does not store readable passwords. If you use Google sign-in, we receive profile details Google makes available, such as your name, email, avatar, and provider identifier.
• Business and workspace data. Business name, industry, logo, contact details, website, service areas, team memberships, domains, brand settings, and onboarding or acquisition information.
• Content and customer data. Photos, notes, voice notes, project details, generated or edited copy, videos, approvals, leads, and review-request recipient details such as a name, email, phone number, message, and delivery or engagement status.
• Quote requests from homeowners. When someone uses a business's quote form: their name, email, phone number, message, service, approximate job size, and any photos they attach. We remove hidden location and camera metadata from uploaded photos, and delete photos that are never attached to a submitted request.
• Lead and sales records. The status a business gives each lead (for example contacted, quoted, won, or lost), quote amounts, job values, follow-up dates, and notes.
• Photos and messages sent to intake addresses. If you email (or, once available, text) job photos to your DonePages address: the sender address or number, message text, attachments, and delivery details. Messages from people who are not members of the workspace are ignored.
• Imported website content. If you ask us to import from your website, the publicly available text, logo, and images on the pages we read.
• Connected accounts. If you connect Google Business Profile, Facebook, or Instagram, the account names and identifiers needed to post on your behalf, and the status of each post. We do not receive or store your passwords for those services.
• Notification and text-message data. Web push subscription details (a device-specific address and keys) for lead alerts, a mobile number for text alerts, and the time and way you agreed to receive texts.
• Account feedback and preferences. Reasons given when pausing, downgrading, or cancelling, and your email preferences, including whether you unsubscribed from tips and product emails.
• Billing data. Plan, subscription status, invoice and Stripe customer identifiers, and limited transaction information. Stripe processes card and bank details; DonePages does not store full payment-card numbers.
• Affiliate data. Application details, country, website, promotion methods, accepted terms, referral code, Stripe payout-account status, commission and payout records, and fraud or risk review information.
• Usage and device data. Page views, clicks, downloads, referrals, support interactions, browser or device details, referrer, approximate location inferred from network data, and pseudonymous or hashed IP and visitor identifiers. On our own website and in the application this includes product analytics and session replays that record how pages are used, with form entries masked and, in the signed-in application, on-screen text and photos hidden.
• Cookies and local storage. Authentication, workspace and signup preferences, interface state, product analytics, and a first-party 60-day referral-attribution cookie after a visitor follows an affiliate link. See our Cookie Policy.

We receive this information from you, people who use forms or links you publish, your team or referring affiliate, your browser or device, and providers such as Google, Meta, Stripe, Supabase, Resend, Twilio, bundle.social, and PostHog.

• Provide, secure, personalize, and support the Service; authenticate users; and maintain workspaces and permissions.
• Create, publish, deliver, and measure DonePages, PDFs, videos, social posts, lead forms, approvals, and review requests.
• Notify a business the moment a quote request arrives (by push notification, email, or text where enabled) and send the homeowner an automatic confirmation on the business's behalf.
• Post finished work to connected Google Business Profile, Facebook, and Instagram accounts when you turn on automatic posting or post a job yourself.
• Process subscriptions, prevent duplicate or fraudulent transactions, administer affiliates, attribute referrals, calculate commissions, and facilitate payouts.
• Send transactional, security, billing, and support communications, plus onboarding tips and product emails you can unsubscribe from at any time using the link in each email.
• Analyze performance, troubleshoot errors, improve features, enforce our terms, and protect users and the public.
• Comply with tax, accounting, sanctions, fraud-prevention, law-enforcement, and other legal obligations.

Where applicable law requires a legal basis, we rely on performance of our contract, compliance with legal obligations, consent, and our legitimate interests in operating, improving, securing, and promoting the Service. You may withdraw consent where processing depends on it; withdrawal does not affect earlier lawful processing.

To build and improve pages, we send relevant content to OpenAI: project notes and business details to draft text; job photos to sort before and after, detect tilt, and find details to blur such as house numbers and license plates; voice notes to transcribe them; photos homeowners attach to a quote request to summarize the job for the business; and imported website content to prefill your profile. OpenAI states that API inputs and outputs are not used to train its models by default. Limited data may be retained by the provider for safety and abuse monitoring under its applicable terms. Do not submit unnecessary sensitive information. AI output is a draft: you must review its accuracy, rights, and suitability before publishing or sending it.

Content you publish to a public DonePage, portfolio, collection, service-area page, embed, or custom domain can be viewed, copied, shared, cached, and indexed by search engines and AI search services. Removing it from DonePages may not immediately remove copies held by third parties. Do not publish personal information, photos, reviews, or property details unless you have the right and any required consent to do so.

• Infrastructure and operations. Supabase for database, authentication, and storage; Cloudflare (R2) for photo, video, and file storage and delivery; Vercel for hosting and delivery; Resend for sending and receiving email; Twilio for text messages; OpenAI for AI processing; PostHog (United States) for product analytics and session replay on our own website and application, never on public DonePages or customer domains; and monitoring or support providers used to operate the Service.
• Social posting. When you connect accounts or post a job, bundle.social publishes your photos and captions to Google Business Profile, Facebook, and Instagram on your behalf. Once posted, that content is also governed by Google's and Meta's terms and privacy policies.
• Notification delivery. Push notifications are delivered through your browser or device maker's push service (for example Apple, Google, or Mozilla), which receives the encrypted message and your device's push address.
• Payments and payouts. Stripe processes subscriptions, fraud signals, invoices, affiliate identity verification, and payouts under its own privacy terms.
• Your directions. Information is shared when you publish a page, invite a team member, send a review request, reply to a lead, connect a service, or otherwise direct us to disclose it. Automatic replies to homeowners are sent in the business's name and reach the business when the homeowner replies.
• Affiliates. Approved partners receive referral and commission status needed to operate their dashboard, but not a referred customer's private account or payment details.
• Legal and business events. We may disclose information to advisers, authorities, or other parties when required by law, to protect rights and safety, or as part of a merger, financing, acquisition, or sale, subject to appropriate protections.

We do not sell personal information or use it for cross-context behavioral advertising. If our practices change, we will provide any notice and opt-out method required by law before the change applies.

We keep account and workspace data while your account is active and for a reasonable period afterward to support restoration, security, disputes, and legal obligations. Public content remains until you unpublish or delete it, subject to backups and third-party caches. Billing, tax, affiliate, payout, fraud, audit, and transaction records may be kept longer where needed for accounting, enforcement, or law. Support records are kept as needed to resolve and improve support. Photos uploaded to a quote form but never submitted are deleted within about a day, and push subscriptions are removed when a device stops accepting notifications. We delete or de-identify information when it is no longer reasonably needed for these purposes.

We use measures designed to protect information, including encrypted transport, access controls, row-level database security, restricted administrative access, multifactor authentication for privileged administration, signed webhooks, removal of hidden location metadata from uploaded photos, and audit records. No system can be guaranteed completely secure. Protect your credentials, use a unique password, and contact us promptly if you suspect unauthorized access.

Where text messaging is available, we only text a business's alert number after the business opts in, and only text a homeowner or customer when the business confirms that person agreed to receive texts. Message and data rates may apply. Reply STOP to stop messages or HELP for help. We do not share mobile numbers or text-messaging consent with third parties for their marketing.

Our providers may process information in the United States, Europe, and other countries. Where required, transfers are supported by contractual protections or another legally recognized transfer mechanism. Local privacy laws may differ from those where you live.

Depending on your location, you may request access, correction, deletion, portability, or restriction; object to certain processing; withdraw consent; or opt out of sale or sharing. We do not discriminate against anyone for exercising a privacy right. California residents may also request the categories and specific pieces of personal information collected and disclosed, where the CCPA applies. EEA and UK residents may complain to their local data-protection authority.

Submit a request to [email protected]. We may verify your identity and authority before acting. If data was submitted by a DonePages business customer about you, contact that business first; we will assist it as required.

The Service is designed for businesses and is not directed to anyone under 18. We do not knowingly collect children's personal information.

We may update this policy as the Service or law changes. We will update the date above and provide additional notice when a material change requires it.

Privacy questions and requests: [email protected]. General questions: [email protected].