Privacy Policy

1. Information We Collect

From account holders:

• Account information, such as your name and email address;
• Access to your Connected Account(s), which allows us to read the sender and message metadata (such as sender address, subject line, and timestamp) needed to screen incoming mail;
• The content of the mail you receive and send through the Service, which we keep in encrypted form as described under "Message content and storage" below;
• The screening rules and approvals you configure;
• Identity-verification information required to receive funds (such as legal name, date of birth, and government-identifier or tax information), which is collected and verified by our third-party payment processor to comply with financial regulations;
• Payout and banking details held by our payment processor, if you receive priority-fee settlements;
• Usage data and device/log information.

From senders:

• The sender address, subject line, and timestamp of messages you send to an account holder, which we use to screen the message, and the message itself, which is held, stored in encrypted form as part of the account holder's mail unless it is blocked, and — where a fee is required and paid — delivered to the account holder;
• If an account holder requires a priority fee and you choose to pay it: your confirmation that you are at least 18 years old, your acceptance of our Terms of Service and this Policy, and payment information processed by our third-party payment processor to complete the payment.

Scope of access for provider-authorized accounts. For accounts connected through a provider's authorization process (such as Gmail or Outlook), the scope of access is defined by the permissions that provider grants, which may be broader than the metadata-only access used for direct mail screening. We use such access only to operate the screening features you enable.

Message content and storage. How Donna handles message content depends on where the message is in the screening process.

Screening. To decide whether a message reaches the inbox, Donna reads only envelope and header information — the sender's address, subject line, and timestamp. Screening does not read or scan message bodies.

Stored mail. Donna keeps an encrypted copy of your mail — the messages you receive and the messages you send through the Service — so that it is available on each of your devices and remains available after your email provider's own retention period ends. Each account's mail is encrypted at rest (AES-256) under its own key, and those keys can be unlocked only by Donna's mail server, a system separate from the Donna application. Because Donna holds these keys, this storage is not end-to-end encrypted, and we are technically able to access stored content where necessary to operate the Service, respond to your requests, or comply with law.

Search index. To make your mail searchable, Donna also keeps a search index built from the text of your stored mail. The search index is not encrypted in the same way as the stored copy: someone with access to Donna's database could read the words it contains.

Messages held for review. A message held for the account holder's review is stored in the same way while it awaits a decision. If it is released or a priority fee is paid, it becomes part of the account holder's stored mail.

Blocked and deleted messages. Mail that Donna blocks is not stored. If a message that was already stored is later blocked, remains held for review for 30 days without being released or paid for, or is deleted by the account holder, its stored copy is kept for a short recovery period (currently three days) and is then deleted. We do not delete a message's stored copy while a payment related to that message remains open.

Google API Services Limited Use. Donna's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide the user-facing features you enable. We do not use or transfer Google user data to develop, improve, or train generalized, foundational, or non-personalized artificial intelligence or machine learning models, and we do not retain Google user data for any such purpose. We do not use or transfer Google user data for advertising, and we do not permit humans to read it except with your affirmative agreement as to specific messages, or where necessary for security purposes or to comply with applicable law.

2. How We Use Information

We use information to:

• Operate the email screening and priority-fee features of the Service;
• Charge and process payments from senders who choose to pay a priority fee, which settle first to our own account with the payment processor and are then transferred to the account holder, less our administrative fee;
• Communicate with you about your account, transactions, and security;
• Detect and prevent fraud, spam, and abuse of the priority-fee mechanism;
• Improve, modify, and develop the Service, including by analyzing aggregated, statistical metrics about how messages are delivered and engaged with (such as opens and reads); and
• Comply with legal, tax, and financial-regulatory obligations (for example, identity verification and reporting related to payouts).

Engagement information. We do not give senders read receipts, and we do not report back to a sender whether their delivered message was opened, read, or answered. We measure message activity such as deliveries, opens, and reads only on an aggregated, statistical basis, which we use to operate, secure, improve, and modify the Service. We do not track individual message opens or reads except to the extent that activity contributes to these aggregated metrics, and we do not sell this information.

We do not sell your personal information, and we do not use the content of your email to serve you advertising.

3. How We Share Information

• Between senders and account holders. When a sender pays a priority fee, we share the information necessary to deliver their message and identify them to the account holder (such as name and email address).
• Service providers. We share information with vendors who help us operate the Service, including payment processors, cloud hosting providers, and email infrastructure providers, under confidentiality and data protection obligations.
• Your email provider. Donna interacts with your Connected Account(s) through your email provider's mail routing or API. Where access is granted through a provider's authorization process, that provider defines the scope of the permissions involved, as described in Section 1. We do not control, and are not responsible for, that provider's own data practices.
• Legal reasons. We may disclose information if required by law or legal process, or to protect the rights, safety, or property of Donna, our users, or others.
• Business transfers. If Donna is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this Policy or a policy offering equivalent protections.

4. Your Choices and Controls

Account holders can, at any time:

• Adjust or disable screening rules for any Connected Account;
• Review and approve or deny specific senders;
• Revoke Donna's access to any Connected Account, through the Service or your email provider's permissions settings;
• Request deletion of your account and associated data, subject to Section 6.

Senders can request access to, correction of, or deletion of the personal information they submitted when contacting an account holder, subject to our legitimate need to retain transaction and fraud-prevention records.

5. Legal Rights

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have rights under the GDPR, including rights to access, correct, delete, restrict, or object to processing of your personal information, and to lodge a complaint with your local data protection authority.

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, and opt out of certain sharing. We do not sell or share personal information for cross-context behavioral advertising.

To exercise these rights, contact us at Legal@ThanksDonna.com.

6. Data Retention

We retain account and transaction information for as long as needed to operate the Service, resolve disputes, and meet legal, tax, and fraud-prevention obligations. We keep the encrypted copy of your mail, and the search index built from it, until you delete the message or delete your account, subject to the recovery period described in Section 1 and to any retention we are legally required to maintain. Mail that Donna blocks is not stored. When you delete your account, the keys that protect your stored mail are destroyed, so that nothing Donna stored can be read again; encrypted data that remains in our storage systems after that point cannot be read and is removed by our routine cleanup processes. Deleted information may also persist in our backups for a limited period. When you disconnect a Connected Account or delete your account, we delete or anonymize personal information that we are not otherwise required to retain.

If you connect a custom domain, incoming messages are also received and retained by our third-party inbound mail-processing provider as part of routing your mail to Donna, for a period of up to one year. That retention period is set and controlled by the provider, not Donna, and runs independently of the retention periods described above.

7. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit, encryption of stored message content at rest under access-restricted keys (other than the search index described in Section 1), restricted access to Connected Account data, and regular security review. No system is completely secure, and we cannot guarantee absolute protection.

8. International Data Transfers

We may process and store information in countries other than your own. Where we transfer personal information internationally, we use appropriate safeguards, such as standard contractual clauses, consistent with applicable law.

9. Children's Privacy

The Service is intended for adults and is not directed to children. You must be at least 18 years old to use the Service, and we do not knowingly collect personal information from children.

10. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service and understand usage patterns. You can control cookies through your browser settings, though some features may not function properly without them.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy with a new effective date, or through other reasonable means, such as email or an in-Service notice.

12. Contact Us

Questions about this Privacy Policy, or requests to exercise your privacy rights, can be sent to Legal@ThanksDonna.com or: