Privacy policy

This translation is provided for convenience; the French version prevails. The data Doonza processes, why, with whom, and for how long.

1. Controller and scope

Data controller: STM GROUP LLC, a New Mexico company (United States), 4405 Jager Dr NE, Rio Rancho, NM 87144, United States, which operates the service under the name Doonza. Contact for any question about data, including for people located in the European Union and Switzerland: hello@doonza.com. This notice responds to the General Data Protection Regulation (GDPR) and to the Swiss Federal Act on Data Protection (nFADP). It covers the public website doonza.com, which creates no account and counts its visits only in aggregate form and without cookies, and the signed-in space app.doonza.com, where accounts and jobs live. It describes what the service actually does.

2. Data of the signed-in space

The following are stored: the account’s email address and password, managed by Supabase Auth, the password never being readable by Doonza; the first name, last name, country and region; the display language chosen, French or English; requests, with title, description, category, region, desired date and status; offers, with message, rate and availability; the messages exchanged; reports, with reason and detail; the service address and the access details, when the customer chooses to provide them after a booking; reviews and replies, and providers’ reviews of customers; payments, refunds and payouts, and the corresponding receipts, credit notes and statements; tips left or received, with their amount, their payment and payout dates and the corresponding payment costs; emails prepared and sent, and the state of the unsubscription from reminders; the appointments returned by a calendar subscription, when the account requests one; and, for a provider, their declaration of activity, years of experience, service areas, presentation, verification status, availability and absences, hourly rate, prices per service and photos of past work, as well as, if they provide them, their business number, tax residence and nationality (see “Business number, tax residence and nationality”). Also stored are the “before” and “after” photos that a provider takes of a booked job, once arrived: each one is decoded again, reduced and saved again on receipt, without the device’s metadata, GPS position included, under a randomly drawn file name; they open only through a short-lived signed link and are visible only to the customer, the provider of the job and Doonza. They serve as proof of the work, notably in the event of a claim under the Doonza Guarantee. Finally, for a provider, the one-off position, rounded to about 100 metres, that their device sends on arrival, at the end of the job or when they report an absent customer, is stored when they allow it (see “Provider’s position on arrival”). The “Use my location” button reads the device’s position with the person’s consent, solely to choose the nearest region in the form: this position is neither transmitted to Doonza nor kept; only the chosen region is stored. Also logged, without any link to an account where possible, are the anti-abuse counters for sign-up and sign-in and the application’s technical errors. The same account can be used both as a customer and as a provider. Each role’s data is processed separately, and a provider cannot accept a job they booked themselves.

3. Purposes and legal bases

Keeping the account, publishing requests and offers, running the messaging, collecting, holding and paying out payments, issuing documents and sending the service’s emails: performance of the contract (art. 6.1.b GDPR). Keeping accounting records: legal obligation (art. 6.1.c). Limiting sign-up and sign-in attempts, logging errors, handling reports, moderating content and publishing reviews: legitimate interest of Doonza and its users in a safe service and reliable information (art. 6.1.f). Sending optional reminders: legitimate interest, with one-click unsubscription. Measuring traffic without cookies or identifiers: legitimate interest, on aggregated data. Displaying the right language straight away, based on the country deduced from the IP address by the host at the time of the request, without keeping that country or the address, unless the browser asks for French first or the person has already chosen a language, that choice always prevailing, and never for a search-engine crawler: legitimate interest (art. 6.1.f).

4. Sign-in with Google or Apple

A person can sign in with their Google account. Google then transmits their email address, their name and an account identifier, received by Supabase Auth; Doonza obtains no access to their other Google data. Google acts as controller of its own processing, according to its privacy policy. Where this provider is enabled, a person can also sign in with their Apple account (“Continue with Apple”). Apple then transmits to Supabase Auth an account identifier and, depending on the choice the person makes at Apple, their real email address or an Apple relay address, and their name; Doonza obtains no access to their other Apple data. Apple acts as controller of its own processing, according to its privacy policy.

5. Audience measurement

Traffic to the website and the signed-in space is measured in two ways. First by Vercel Web Analytics, without cookies and without reading or writing anything on the device: a visit is counted from a technical fingerprint calculated from the IP address and the browser, irreversible and renewed every day; the IP address is not kept. Second, ONLY with your consent, by Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and of Google LLC (United States), to know the traffic to the pages and the movement from one domain to the other (doonza.com and app.doonza.com); the legal basis is your consent, which you give or refuse in the “Cookies and audience measurement” window, and which you withdraw at any time with the “Manage cookies” link in the footer. Without consent, nothing is loaded from Google and no Google cookie is set. With consent, Google receives the template of the page viewed (for example “/espace/demandes/[id]”), never its real address: no parameter, no identifier, no token, no invitation or referral code; the title sent is that same template and the referring page is not transmitted; Google also receives technical information about the browser and the device, and a random identifier kept in the “_ga” cookies; Google states that Google Analytics 4 does not log or store the IP address. In the signed-in space, three successful steps are also reported to Google, with no data attached (no amount, no region, no identifier): account created, request published, payment confirmed; and five are reported to Vercel Web Analytics in the same way: request published, provider journey started and finished, offer sent, return from payment. No account data (name, email address, identifier) is sent to Google. Google signals, advertising personalisation and any advertising use are disabled: the advertising permissions of Google’s consent mode remain refused. Google Analytics is only put into service once Doonza’s Google Analytics account is configured as follows, the configuration chosen by Doonza: enhanced measurement disabled (it would transmit the real address of the pages), data sharing with Google disabled with the sole exception of technical support, Google’s data processing terms accepted with their addendum for the GDPR and for Switzerland; until this is done, neither the window nor Google Analytics is displayed or loaded. No profile is built. None of this exists in the mobile application installed from an app store.

6. Journey statistics

To find out where people drop out of their journey, Doonza’s administration looks at figures aggregated by week, by region and by category: how many customers signed up, published a first request, received then accepted an offer, paid, saw their job completed and left a review; how many providers signed up, submitted their profile, opened their payout account, made a first offer and received a first payout. These steps are deduced, at the time of the consultation, from the data already described in this policy (profiles, requests, offers, payments, jobs, reviews): nothing new is recorded about a person, and the screen shows no name, no email address and no identifier. A rate calculated on fewer than 5 people is not displayed. Only one extra fact is counted: each time a visitor who is not signed in displays the home screen of the application, Doonza adds 1 to a counter kept per day and per country (the country is read from the geographic indication supplied by the host; the IP address is neither read nor kept). This counter contains no IP address, no cookie, no identifier and no fingerprint, and writes nothing on the device; it counts displays, not people, and does not count robots. Legal basis: Doonza’s legitimate interest in measuring and improving its service, on aggregated data (Art. 6(1)(f) GDPR). The counter is kept for 365 days, then deleted automatically. So that it remains a reliable order of magnitude, a daily cap (per country) and an hourly cap limit the number of displays counted: beyond them, further displays are no longer counted. No third-party tool, no advertising identifier and no processor is involved in these statistics.

7. Regions waiting list

On the Regions page of the website, a person without an account can leave their email address to be told when a region or a municipality opens. Purpose: to write to them, once, when Doonza opens that area. Data: the email address, the region or municipality chosen, the language of the website and the sign-up date; no name, no cookie. The address is kept in clear, because we must be able to write to a person who has no account; it is shown on no screen, including those of the administration, and the email is sent through our sending provider (Resend). Legal basis: the person’s consent, given by sending the form (Art. 6(1)(a) GDPR). Period: the sign-up is deleted automatically at the latest twelve months after sign-up, whether or not the area has opened; if it opens earlier, the sign-up is erased as soon as the opening email is sent. Unsubscribing: at any time, through the link in the email or by writing to hello@doonza.com; the sign-up is then erased.

8. “Near me” search on the website

On the service pages of doonza.com, the “Use my location” button reads the device’s position only after permission is given in the browser, to indicate the nearest open region. The calculation is done in the page: the position is neither transmitted to Doonza nor kept, and a refusal prevents nothing, the list of regions remaining displayed. If the person enters an address or a locality instead, that text is sent, from their browser, to ONE SINGLE public address-search service, that of the address’s country: geo.admin.ch (Swiss Confederation) for a Swiss address, the Base Adresse Nationale for a French address. The country is chosen by the person, between Switzerland and France, with a choice preselected according to the page’s region or, failing that, the browser’s language — and the other service receives nothing. The service queried returns coordinates; Doonza receives neither the text nor the result. In the signed-in space, the distance between a provider and a request is calculated from an area of about 500 metres, never from the exact address.

9. Identity and banking data: at Stripe

Doonza neither collects nor keeps any identity document. A provider’s identity is verified by Stripe when they open their payout account, and their bank details are held by Stripe alone. No card data is requested or kept by Doonza: card entry takes place at Stripe. A Stripe customer identifier is kept on the profile of a customer who has paid at least once, so that they find at Stripe the card they left there; this identifier contains no card data. Stripe acts here as a controller for its own obligations and applies its privacy policy.

10. Business number, tax residence and nationality

A provider can declare, from their profile, a business number (IDE/UID number in Switzerland, SIREN or SIRET in France); without a number, they work as an individual, which is allowed. They can also state their tax residence and their nationality, each as a two-letter country code. The business number is displayed to signed-in customers on the provider’s profile, to show whether they act in a professional capacity; it also serves to determine the right of withdrawal (a professional provider, that is, one with a business number, has none on any paid services bought from Doonza); it does not appear in the public extract of the directory. The tax residence and the nationality are shown to no customer or visitor: only the provider and Doonza’s administration read them. They are kept so that, where applicable, the reporting obligations that bind a platform can be met; Doonza only transmits the information required by law, in particular under the DAC7 directive, described in the next section. Legal basis: performance of the contract for the business number (Art. 6(1), letter b, GDPR), legal obligation (DAC7 directive) for the tax residence and the nationality (Art. 6(1), letter c), Doonza’s legitimate interest solely for checking the business number against the public register (Art. 6(1), letter f). Duration: as long as the account exists; these three items are erased when the account is deleted. Check against a public register: at the request of a person in Doonza’s administration — never of the provider or of a customer —, the declared number can be checked by sending it, alone (no name, no address, no other data), to the country’s official register: the IDE/UID business register of the Federal Statistical Office, in Switzerland (uid-wse.admin.ch), or the public “business search” API fed by the Insee Sirene database, in France (recherche-entreprises.api.gouv.fr). These registers reply with public data, including the name of the business; Doonza stores the name returned, the result of the check and its date. Each register is responsible for its own processing.

11. Tax reporting of providers’ income (DAC7)

Where the law requires it, Doonza reports to the tax authorities the income received by providers through the platform. This obligation stems from Directive 2011/16/EU on administrative cooperation in the field of taxation, as amended by Council Directive (EU) 2021/514 of 22 March 2021 (known as “DAC7”), which covers in particular personal services: time- or task-based work, provided at the request of a user after being facilitated through a platform. At the date of this version, Doonza submits no report on this basis. With these obligations in view, it asks the provider, on an optional basis, for their tax residence and nationality (see the previous section). Among the other information provided for by the directive, Doonza already holds, for the performance of the service: the provider’s first and last name; the base address they entered (street, postcode, town, country), where applicable; their business number and, after a check against the public register, the business name returned by that register, where applicable; their VAT number, where applicable; the amount of each payment, the commissions and fees withheld by Doonza, and hence the number of paid services. It does not hold their tax identification number, their place or date of birth, the identifier of the financial account to which they are paid (bank details are entrusted to Stripe), or any information on possible permanent establishments. If this obligation applies to Doonza, Doonza will have to collect and then transmit to the competent tax authority, for each provider concerned, the information provided for by Annex V to Directive 2011/16/EU (Section II, paragraph B, and Section III, paragraph B, 2): the provider’s identification details (for an individual: first and last name, primary address, tax identification number and the State that issued it or, failing that, place of birth, VAT number where applicable, date of birth; for a business: legal name, primary address, tax identification number and the State that issued it, VAT number where applicable, business registration number, permanent establishments in the Union); the identifier of the financial account to which they are paid, insofar as it is available to Doonza and the authority of the Member State of residence has not published that it does not intend to use it, and, where the holder of that account is not the provider, the name of that holder to the extent available to Doonza, as well as any other financial identification information available to Doonza with respect to that holder; each Member State in which they are resident; the total consideration paid and the number of corresponding services, per quarter; the fees, commissions or taxes withheld or charged by Doonza, per quarter. In that case, Doonza will inform each provider concerned that information relating to them will be collected and transmitted, before any transmission, and will provide them with the information reported about them (Article 25, paragraph 4, of Directive 2011/16/EU; Annex V, Section III, paragraph A, 5). Legal basis: legal obligation (Art. 6(1), letter c, GDPR).

12. Publication of a provider’s profile

The profile of a verified provider — first name, last name, presentation, activity, service areas, reviews received, photos of past work and hourly rate if they publish one — appears by default in the directory, visible to any signed-in customer. Purpose: to let a customer find a provider and contact them. Legal basis: performance of the contract concluded with the provider, who signs up to receive jobs — and not consent. The provider can remove themselves from the directory at any time, in one step, from “My profile” in their space: the removal is immediate and erases nothing. Outside the directory, their photos remain visible only to customers to whom they have made an offer. Without an account, only a public extract is visible: first name and initial of the last name, activity, services offered with their price and unit, service regions, “from” price, month of registration, number of jobs completed (rounded down to the nearest ten above ten), declared languages, average response time (rounded to the hour), average rating, published reviews and days of availability. The presentation, the full name and the photos remain reserved for signed-in accounts, with one exception chosen by the provider: the photos of past work that they PUBLISH themselves, one by one, on their public profile are visible to everyone, with or without an account. Nothing is published by default, and only the provider publishes. Purpose: to show their work to customers discovering them. Legal basis: performance of the contract, at the provider’s request, who can withdraw each photo at any time. Before going online, each photo has been reduced and saved again, without the device’s metadata, GPS location included; it is copied under a random name that does not identify the account, without its caption. The provider undertakes to show no customer’s face, no address and no number plate. Doonza may hide a published photo, with a reason that is kept and visible to the provider. Withdrawal, hiding, deletion of the photo or of the account delete the public copy, which stops being served (a copy already cached by an intermediary may remain for a few moments). No address, phone number or email address is ever published.

13. Reviews and replies

Purpose: to inform later customers about jobs carried out. Legal basis: the legitimate interest of the platform and its users in reliable information. A review is tied to a job. It appears under the first name and the initial of the last name of its author, never under their full name; once published, it is readable by any visitor, with or without an account, on the provider’s public profile: rating, date, text and, if there is one, the provider’s published reply. A hidden review, or one still held back, never appears there. The author can correct it for forty-eight hours from the moment it is posted, after which it is frozen; the provider can reply to it once. Doonza can hide a review or a reply, separately, with a reason kept internally; it never rewrites them. A hidden review drops out of the average and remains readable by its author. Since 1 October 2026, customers are also rated: after a job, the selected provider can rate the customer (punctuality, access to the place, respect, from 1 to 5, and an optional comment). Purpose: to let providers prepare a job with full knowledge. Legal basis: the legitimate interest of providers and the platform in a safe service. On a job paid for on Doonza, each review — the customer’s as well as the provider’s — stays hidden until the other party has rated, or at the latest fourteen days after it was posted. The detail of a review of a customer is readable only by the customer concerned, the provider who wrote it and Doonza; other providers see only the customer’s average rating, and none of this is published in the directory. Doonza can hide such a review, without ever rewriting it. Deleting a customer’s account erases the reviews that concern them. Deleting a provider’s account, for its part, keeps the reviews they wrote about customers, attached to an account that has become anonymous: they are part of the job file and of the customer’s average rating. The export of the account’s data includes them.

14. Service address and calendar

The service address and the access details are optional; the address can be given as soon as the request is posted. Purposes: to offer the customer the nearest providers, and to allow the selected provider to get to the place. To locate it, the text entered is sent, from the browser, to the country’s public address-search service (geo.admin.ch of the Swiss Confederation, or the French Base Adresse Nationale), which returns suggestions and their coordinates. The “Locate me” button reads the device’s position only after permission is given in the browser; a refusal prevents nothing. The exact address and its coordinates are readable only by the customer and the selected provider — never by those who had merely replied to the request: before that choice, a provider sees only a distance rounded to the kilometre and an area of about 500 metres. A provider gives a starting address and a service radius; this address is shown to no one and serves only to calculate distances. In the directory, the “Nearest first” sort calculates on the server an approximate distance between two areas of about 500 metres: the customer’s (the address of their most recent request, or their position when they choose “Locate me”, rounded to 500 metres in their browser before anything is sent and never kept) and that of the provider’s starting point. It is displayed rounded to the kilometre, without any exact address or position, and only providers whose service radius covers the customer’s area appear in it. An account can request a subscription address for its calendar: this address carries a secret token, returns only the appointments of the account that requested it, and can be revoked at any time from the settings, which immediately invalidates the link already shared. As long as the subscription exists, the calendar software used receives these appointments.

15. Provider’s position on arrival

On the day of a booked and paid job, a provider enters the presence code on arrival, then finishes the job; they can also report an absent customer. At each of these three actions, and only at those, the provider’s device may ask them for permission to send their position, once. It is optional: a refusal, a device without a position or an exceeded delay prevent nothing, the job continues normally, without any message. No position is requested before arrival, when a screen loads or in the background, and it is never tracked continuously. Purpose: to have proof of presence in the event of a dispute, a claim under the Doonza Guarantee or a report of an absent customer. Legal basis: the consent given on the device, and the legitimate interest in preventing disputes. The position is rounded to about 100 metres before it is sent, then again when it is stored: Doonza neither receives nor keeps the exact position. No screen displays its coordinates, neither to the customer nor to the provider: the provider only sees that a position has been recorded, the customer sees nothing of it. Doonza’s administration does not see the coordinates either: when examining a dispute, a claim or an absent customer, it only reads the distance, rounded to the nearest hundred metres, between this position and the address of the job, without a map. The provider finds their positions in the export of their data. Retention: twelve months after the end of the job, the decision on the claim or the closing of the dispute (whichever is latest; never while a claim or a dispute is open), like the job photos, after which the coordinates are erased automatically. Deleting the account does not erase them before that term, but the account has then become anonymous. They are passed on to no third party and feed no mapping service.

16. Regular bookings

A regular series keeps the customer, the provider, the service, the frequency, the dates and amounts of the visits, the rate of the service fee that applies to it, as well as the date of the consent to automatic charging and the amounts displayed at that time, for as long as the bookings it produces (accounting obligations and proof of consent). The payment method saved for the series is held by Stripe, a payment processor: Doonza only keeps an opaque identifier, erased when the series is stopped and when the account is deleted, and never sees the card number. Notifications about a failed charge, a pause or a replacement are generic: they carry no name, amount or address. The export of the account’s data returns the series and their visits.

17. Referral

Purpose: to grant the referral credits provided for in the terms of sale. Doonza records who invited whom, the date of validation and the corresponding credits; the referred person and their referrer never see each other’s name in the referral space. To refuse that someone refers themselves with the same card, Doonza keeps the card fingerprint supplied by Stripe — a technical identifier that allows neither the card number to be reconstructed nor the card to be charged. Legal basis: performance of the contract. This data follows the retention period of payments.

18. Emails and unsubscription

Doonza sends emails linked to the service: sign-up confirmation, verification decision, payment, payout, and reminders — before a job, and a single follow-up when a request remains without an offer for one day, when an offer has been waiting for a reply for two days or when a review remains to be left after a job. They are prepared in the database by designating the recipient by their identifier; the address is resolved only at the moment of sending. Sending is carried out by Resend, a processor, which receives the address, the subject and the content of the message and informs Doonza of delivery failures and complaints. The emails needed to carry out a job cannot be turned off; only the reminders are optional and carry an unsubscribe link, also accessible from the account settings. No address is used for advertising purposes or passed on to a third party for that purpose.

19. Push notifications and SMS

Where these channels are open and the person turns them on themselves in their settings, Doonza also sends push notifications and SMS. For a provider, a verified mobile number is mandatory: it is used only for job alerts (booking to confirm, confirmed or declined, offer accepted, refund) and is never shown to the customer; a customer, for their part, never has to provide one. Push: Doonza records the subscription identifier of each registered device (the browser’s notification address with its encryption keys, or the app’s token); the content is encrypted end to end for the web and remains general — no name, no amount, no address. It is delivered by the notification service of the browser’s or phone’s publisher (Google Firebase Cloud Messaging for Android, Apple Push Notification service for iOS, the push service of the browser used). SMS: Doonza records the mobile number, verified by a six-digit code valid for ten minutes (the code is never kept, only its fingerprint is, and it is erased after verification); the SMS, reserved for the essentials — booking to confirm, confirmed or declined, offer accepted, refund —, are sent by Twilio Inc., a processor, which receives the number and the text. The number is never shown to the other party. Each channel can be turned off at any time in the settings; the number can be removed in one step, and deleting the account erases the number and the devices.

20. Backup of accounting documents

The database backups do not contain files. So that the accounting documents Doonza issues are not lost, each one is copied once, by a daily task, to a storage space operated by Cloudflare, Inc. (headquartered in the United States), our backup-hosting processor, in the European Union jurisdiction of its R2 service (the objects are stored in the European Union). Two kinds of documents are copied. (1) Payment receipts, credit notes and payout statements: number, date, amounts, payment and payout references, the person’s abbreviated name (first name and initial), service category, region and request title. (2) “Pro” and “Boost” invoices and credit notes addressed to providers: number, date, amounts, and the provider’s full name, address (street, postal code, city, country) and VAT or business identification number (IDE) when provided; for a Pro subscription, the plan and the billed period; for a Boost, the placement (region and category), the number of days and the purchase date; for a credit note, its reason. Doonza encrypts these documents before sending (AES-256-GCM): Cloudflare does not hold the key and cannot read them; it only sees opaque objects whose size roughly matches the document. The purpose is to recover our records after a technical incident, on the basis of Doonza’s legitimate interest in not losing its accounts and of the legal obligation to keep them. The copy is kept for ten years, the statutory retention period of accounting records, and a storage lock rule prevents it from being modified or deleted during that period. Cloudflare, Inc. is listed under the EU–U.S. Data Privacy Framework and its Swiss extension (the Swiss–U.S. Data Privacy Framework), which cover this transfer (public list: https://www.dataprivacyframework.gov/list).

21. Recipients and transfers

A published request is readable by the providers of its region; an offer, by the customer of the request and the provider who submitted it; a message, by its sender and its recipient. The service address is readable only by the customer and the selected provider. No screen of the application displays another person’s email address. Doonza’s administrator accounts, designated manually in the database and never from the application, have read access to accounts, requests, offers, messages, declarations, reviews, replies, reports and payments, to carry out checks, handle reports and follow the accounting. Processors: Supabase Inc. (database, authentication and files, hosted in Frankfurt, Germany), Vercel Inc. (hosting of the website and the application, functions executed in Frankfurt, and audience measurement), Google Ireland Limited and Google LLC (Google Analytics audience measurement, only with your consent), Resend (sending of emails, United States), Cloudflare, Inc. (encrypted backup of accounting documents, headquartered in the United States, data stored in the European Union jurisdiction of its R2 service), and, where these channels are open, Twilio Inc. (sending of SMS, United States) as well as the push notification services of Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), and, where the help assistant is open, Anthropic PBC (generation of the assistant’s answers, United States), which receives the question asked and a summary of the person’s own account only — role, first name, region, language, titles and states of their recent requests or offers, the history of the current conversation and, when the question calls for it, the results of the assistant’s read-only tools (their requests, bookings, payments or payouts). The questions put to the assistant, the answers it served and the replies of the Doonza team are deleted automatically once the retention period set by Doonza has passed, today ninety days (and at the latest with the account). Stripe (payment, identification of providers and payouts), Google and Apple (sign-in) act as controllers of their own processing. The official business registers of Switzerland and France receive, at the request of the administration, a business number declared by a provider (see “Business number, tax residence and nationality”). As the operator is established in the United States, the GDPR and the nFADP apply directly to its processing. Transfers to the United States are covered by the European Commission’s adequacy decision on the EU–US data protection framework and by its Swiss extension for recipients who have joined it, and, failing that, by the European Commission’s standard contractual clauses, recognised by the Swiss Federal Data Protection and Information Commissioner. No data is sold or passed on for advertising purposes.

22. Retention periods

The data of an account — profile, requests, offers, messages, reviews — is kept as long as the account exists; the person can delete it at any time, with the effects described below. Accounting and tax records — payments, refunds, payouts, receipts, credit notes and statements — are kept for ten years, a period imposed by accounting obligations; an encrypted copy of these records is kept on external storage for the same period, locked: it can be neither modified nor deleted before it ends. Contact and help tickets, with their messages, are kept for twenty-four months after they are closed, then deleted automatically. When an account is deleted, its help tickets are erased with it, except those that the help assistant has classed as “money” (a contested amount, an expected payment or refund): those are kept, detached from their author — the account no longer appears in them, the content remains, as evidence of the transaction — and deleted automatically twenty-four months after they are closed or, if they were never closed, twenty-four months after the account is deleted. The before/after photos of a job and the photos attached to a Guarantee claim are kept for twelve months after the end of the job, the decision on the claim or the closing of the dispute (whichever date is latest; never while a claim or a dispute is open), then erased automatically; deleting the account does not erase them before that term, but the account has become anonymous in them. Providers’ arrival positions follow the same period and the same rules: their coordinates are erased automatically, the rows of the presence history remaining without coordinates. Automatic purges, every night: the anti-abuse counters for sign-up and sign-in after forty-eight hours, technical errors after thirty days, the home-screen display counter after 365 days, read notifications after ninety days, the administration’s internal log after one hundred and eighty days. The questions put to the help assistant, the answers it served (kept signed, with the model used, the number of tokens and the 👍 or 👎 rating given by the person) and the replies of the team are deleted automatically once the retention period set by Doonza has passed, today ninety days. A password reset link expires after one hour, an address change link after two hours; the fingerprint of the corresponding token (and, for an address change, the new address requested) is deleted automatically at the latest two hours after the link’s validity ends, whether it was used or not, and immediately when the address change is confirmed. A provider’s identity data and bank details are not kept by Doonza: they are kept by Stripe, according to its own retention periods.

23. Account deletion

An account is deleted from the settings of the signed-in space. Deletion erases what identifies a person: first name and last name, profile photo and its thumbnail (also erased from the stored files, along with photos of past work), service addresses, photos of past work, availability and absences, service areas, calendar subscriptions, notifications, emails not yet sent, the link to the Stripe customer account; the provider declaration loses everything that describes the person and leaves the directory. The email address is replaced by a non-routable address, and signing in becomes impossible. What is kept, on the other hand, are the payments, refunds, payouts and the corresponding accounting records, because they prove an operation and fall under the ten-year period, as well as the requests, offers, messages and, for twelve months only, before/after photos of jobs, arrival positions and photos attached to a Guarantee claim already exchanged, attached to an account that has become anonymous: erasing them would amputate the other party’s file, who has the same rights. A deleted account cannot be reopened.

24. Security

Access to data is restricted row by row by the database policies, and not by the screen alone. Files live in private storage spaces and are served only through short-lived signed links. Sign-up and sign-in are rate-limited, based on the IP address of the request and the email address entered; these counters are kept for a few hours then purged. Technical errors are logged so they can be fixed. None of this data is used to profile a person. No security certification is claimed.

25. Automation and sensitive data

No automated decision producing legal effects is taken: decisions on verification, moderation, disputes and refunds are taken by a person. The signed-in space can offer, when it is turned on, an optional help assistant, based on an artificial intelligence model; it answers questions about the service, decides nothing and touches no payment. The question asked and a context limited to the person’s own account (role, first name, region, language, five recent requests or offers, the conversation history and, when the question calls for it, the results of the read-only tools: their requests, bookings, payments or payouts) are transmitted to Anthropic PBC, the processor described above. Kept are the questions asked, the answers served by the model (signed, with the model used, the number of tokens and any 👍 or 👎 rating) and the Doonza team’s replies, up to the retention period set by Doonza (today ninety days); they are erased with the account and included in the export of its data. When a question concerns money, a dispute or safety, or the person asks for a human, it is passed to the team under a rule applied by the server, and not decided by the model. No health, opinion, membership or private-life data is requested, and nothing of the kind should be written in a request, a message, a review or a photo caption. The service is reserved for people aged eighteen and over.

26. Your rights

Everyone can request access to their data, its rectification, its erasure, the restriction of or objection to a processing, and portability. Two rights are exercised directly, without asking anyone: the export of all of one’s data, in JSON format, from the account settings (“Export my data”), and the deletion of the account, from Settings. Any other request is addressed to hello@doonza.com, from the email address of the account concerned, and receives a reply within one month. Everyone can also refer the matter to the supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch); in France, the Commission nationale de l’informatique et des libertés (CNIL, 3 place de Fontenoy, 75007 Paris, www.cnil.fr). This notice has been in force since 26 September 2026; any substantial change is announced in the signed-in space.

27. Doonza Pro+ subscription

For a provider who subscribes to Doonza Pro+, Doonza processes: the chosen plan (monthly or yearly), its status (trial, active, payment pending, ended, awaiting payment), its amount and currency, the start, due and cancellation dates, and the subscription identifier at our payment partner; for each charge, its identifier and number at that partner, its amount, its currency, the period covered, its status and its payment date. Card data is collected and kept by our payment partner, never by Doonza. Doonza also records, at subscription, whether the right of withdrawal applies to the person (depending on whether or not they have declared a business number) and, where relevant, the moment of their request for immediate performance; in the event of withdrawal, the date, the amount refunded and the status of the refund. Legal basis: performance of the subscription contract. This data is used for nothing other than the subscription, its benefits and Doonza’s accounting; it is visible to the provider and to the administration, never to a customer. The provider’s VAT or UID number, which is optional, is kept with their profile and reproduced on their invoices. Retention: this data is kept as long as the account exists. When the account is deleted, the current subscription is cancelled with our payment partner before the deletion; the charges already made, the invoices and the credit notes (with the provider’s name, base address and any VAT or UID number on the day of issue) are kept for ten years as accounting records, including after the account is deleted.

28. Doonza Plus subscription

For a customer who subscribes to Doonza Plus, Doonza processes: the chosen plan (monthly or yearly), its status (trial, active, payment pending, ended, awaiting payment), its amount and currency, the start, due and cancellation dates, and the subscription identifier at our payment partner; for each charge, its identifier and number at that partner, its amount, its currency, the period covered, its status and its payment date; for each job payment, the amount of service fees waived; at subscription, the date and time of the request for immediate performance and the applicable right of withdrawal; in the event of withdrawal, its date, the amount refunded and the status of the refund; the history of its subscription periods (start and end dates), needed to know whether the subscription was active on the day of a job; for the Doonza Regular benefit, the occurrences paid out and counted towards a credit and the credits earned (amount, currency, status, dates earned and expiry); for the Guarantee, late claims and, where a refund is granted, the amount returned to the card and its status. Card data is collected and kept by our payment partner, never by Doonza. Legal basis: performance of the subscription contract. This data is used for nothing other than the subscription, its benefits and Doonza’s accounting; it is visible to the customer and to the administration, never to a provider. Retention: this data is kept as long as the account exists. When the account is deleted, the current subscription is cancelled immediately, and the charges already made are kept as proof of the transaction, in the same way as payments, attached to an account that has become anonymous.

29. Boost

For a Boost purchase, Doonza records the provider, the slot (region and category), the duration, the amount and currency, the start and end dates, the state of the purchase and, where relevant, the refund and its reason. This data is visible to the provider and to the administration, never to a customer; the customer only sees the “Sponsored” label on the listing. Payment is processed by our payment provider, which receives the card data on our behalf. Boost purchases, and the invoices and credit notes that result (with the provider’s name, base address and optional VAT or UID number on the day of issue), are accounting records kept for ten years, like the other transaction records, including after the account is deleted. For an individual, Doonza also keeps the date on which they requested immediate performance of the Boost and the date of any withdrawal.