Donut

Privacy Policy Overview

Version 2.3 — Last updated March 16, 2026

1. Data Collection and Use

Information collected

Donut may collect:

• Identity and contact data: Name, email, postal address, phone number, company information, and similar details.
• Payment-related information: Payments are handled directly by Stripe; Donut states it does not receive or store complete payment-card details.
• Customer-provided data: Information supplied by subscribing organizations or users, such as names and email addresses. For customer-controlled data, Donut generally acts as a data processor.
• Device and usage data: Features used, purchases, pages visited, email interactions, IP address, browser, operating system, referring URLs, network information, and potentially software/product-key information.
• Integration data: For Indigo, information obtained from authorized services such as GitHub, Linear, Jira, Slack, and meeting-transcript providers through OAuth access.
• Meeting content: Indigo may store one-on-one meeting transcripts and AI-generated summaries.
• Cookies and tracking data: Cookies, web beacons, analytics tools, and identifiers may track website activity, email opens, advertising effectiveness, and activity across websites or applications.

Purposes

Donut uses data to:

• Provide, personalize, maintain, secure, and improve its Services.
• Provide technical support and manage accounts and transactions.
• Develop features, conduct research, and create aggregate business analytics.
• Send service-related and marketing communications.
• Administer surveys, promotions, and recruitment.
• Improve advertising relevance and prevent inappropriate targeting.
• Enforce its Terms of Service and investigate fraud or wrongdoing.

Google API data limitation: Data obtained through Google APIs is stated to be used only for core Service features and improvement—not advertising, marketing campaigns, third-party targeting, or unrelated purposes.

2. User Rights and Choices

Users may generally:

• Access, correct, or delete personal data by emailing support@donut.ai.
• Request deletion using the subject line “Please delete my personal data.”
• Request corrections using “Please update my personal data.”
• Opt out of marketing emails through the unsubscribe link.

Donut aims to respond within 14 days and must respond within 30 days. However:

• Deletion may not cover billing or usage metadata that must be retained for legal or regulatory reasons.
• Complete deletion requires removing Donut from the relevant collaboration service and, for Indigo, disconnecting all integrations.
• Mandatory service communications cannot be opted out of.
• The policy does not clearly describe all potentially applicable rights under laws such as the GDPR or state privacy laws, including portability, restriction, objection, or appeal rights.

3. Third-Party Sharing

Donut may share personal data:

• With hosting, backup, support, infrastructure, analytics, and other service providers acting on Donut’s behalf.
• With AI providers and related observability vendors.
• With third parties when legally required or necessary to protect users, Donut, its systems, or others.
• During a merger, sale, reorganization, dissolution, or similar corporate transaction.
• As aggregated, non-personal information for advertising, marketing, or analytics.

Donut says it does not sell or trade personal information. Nevertheless, third-party providers may process data under their own agreements and policies. Linked third-party websites are outside Donut’s responsibility.

4. AI/ML Processing and Training

For Indigo, Donut uses AI to analyze and summarize integrated activity and meeting data. Inputs may be sent to Anthropic and/or OpenAI. Donut may also use Langfuse, LangSmith, or similar platforms that can store AI inputs and outputs for monitoring, debugging, and improvement.

The policy does not expressly state whether Donut or these providers use submitted data to train general-purpose AI models. It says providers are governed by their own privacy policies and data-processing agreements, so users should review those documents or obtain contractual confirmation—particularly before submitting confidential meeting or employee information.

5. Important User and Customer Obligations

• Users must provide information necessary for the Services; refusing may prevent access to certain features.
• Users should authorize only integrations they are entitled to connect and should manage or revoke OAuth permissions when no longer needed.
• Employers using Indigo are responsible for having a lawful basis, notifying employees, and obtaining any legally required approvals.
• Users should not assume meeting transcripts, performance data, or connected-service data will remain confined to Donut; AI and infrastructure providers may process it.

6. Liability and Disputes

This policy contains no detailed dispute-resolution clause, governing-law provision, arbitration requirement, forum selection, or liability limitation. It does state that Donut disclaims responsibility for linked third-party sites and their activities, but broader liability terms likely appear in Donut’s Terms of Service or customer agreement.

Privacy complaints and questions may be sent to support@donut.ai; Donut states it will respond within 30 days.

7. Policy Changes

Donut may update the policy to reflect feedback or Service changes. It will revise the “last updated” date. For material changes, Donut says it will either prominently post notice before the change takes effect or directly notify users. Users are encouraged to review the policy periodically.

Donut Terms: Key User Takeaways

*This overview summarizes the Terms of Service provided, last updated August 22, 2023. Donut’s separate Privacy Policy and Data Protection Addendum (DPA) are incorporated by reference and may contain important additional details.*

1. Data Collection & Usage

Data Donut may access

• Customer Data: Any data or content you or your users upload to Donut or that Donut can access through linked third-party accounts, such as Slack, Microsoft Teams, Figma, or Zoom. This may include messages and other collaboration-service content visible to Donut.
• Usage Data: General information about your configuration and use of the Services, collected to improve Donut’s products.
• Account and billing information: The Terms specifically contemplate linked third-party accounts and credit-card information for paid subscriptions, although the precise data collected is governed by the Privacy Policy.

How Donut may use it

You retain ownership of Customer Data, but grant Donut a worldwide, royalty-free, limited-term license to access, use, process, copy, display, export, and perform it as reasonably necessary to:

• Provide, maintain, and update the Services;
• Address technical, security, support, or service issues;
• Comply with law or the DPA; and
• Perform other activities you expressly authorize in writing.

Donut may also collect and use Usage Data to improve the Services and may use or share aggregated or anonymized information to develop features and promote its products.

Important restriction: You represent that Customer Data will not contain “sensitive” personal data or personal health information unless you have a separate written agreement with Donut.

2. User Rights Regarding Data

The Terms provide that:

• You or your organization own Customer Data.
• You are responsible for having the necessary rights and permissions to provide the data to Donut.
• Donut will maintain administrative, physical, and technical safeguards described in the DPA.
• You are responsible for security, protection, and backups of data under your control.
• After termination, Donut may delete Customer Data unless the DPA or applicable law provides otherwise.

The Terms do not specify direct rights such as access, correction, deletion, portability, or objection rights. Those rights, if available, should be reviewed in the Privacy Policy, DPA, or applicable privacy laws.

3. Third-Party Sharing

Donut may share or provide access to Customer Data with:

• Hosting and technology vendors supplying infrastructure, storage, networking, software, and related services;
• Donut employees, affiliates, and contractors who need access to perform the agreement;
• Third parties where required by law or permitted by the DPA; and
• Recipients of aggregated or anonymized data.

Donut says vendors must maintain reasonable confidentiality and security practices, but generally disclaims responsibility for third-party vendors’ acts or omissions. Donut also disclaims responsibility for how Slack or other integrated services handle data.

4. AI/ML Training

The Terms do not expressly state that Customer Data is used to train artificial-intelligence or machine-learning models. They permit use of Usage Data to improve Services and use of aggregated or anonymized data to develop products and features. Because the Privacy Policy and DPA are not included, users should not assume that identifiable content is excluded from AI-related processing without confirming those documents or obtaining written clarification.

5. Key User Obligations and Restrictions

Users must:

• Comply with the Terms, applicable law, and the terms of linked collaboration services;
• Ensure all users are at least 16;
• Secure accounts and accept responsibility for activity through them;
• Pay fees in advance; fees are generally non-refundable and subscriptions automatically renew unless canceled at least 30 days before renewal;
• Avoid uploading infringing, harmful, sensitive, or health-related data without authorization.

Users may not resell, sublicense, reverse engineer, copy, disrupt, benchmark publicly, or use the Services to build a competing product. Donut may remove content or suspend access for violations, security risks, legal requirements, maintenance, or nonpayment.

6. Liability and Disputes

• Services are provided “as is” and “as available,” without guarantees of uninterrupted, secure, timely, or error-free operation.
• Donut’s total liability is capped at the subscription fees paid during the six months before the claim.
• Donut excludes liability for lost profits, data, revenue, goodwill, business interruption, and other indirect or consequential damages.
• You must indemnify Donut for claims relating to Customer Data, your use of the Services, unpaid taxes, or your breach.
• Disputes generally must be resolved through binding AAA arbitration in New York, in English. Users waive jury trials and class actions. Donut may seek court injunctions.

7. Changes to Terms and Services

Donut may change the Terms or policies by email, notice within the Services, or posting revised terms online and updating the date. Continued use after notice constitutes acceptance. Donut may also modify or discontinue Services without notice or liability.