Privacy Policy

Last updated: 23 October 2026

This policy explains which personal data we process when you visit doodock.com, join the waitlist, sign up for the beta or use DooDock as a customer, why we do so, and what rights you have.

This English version is provided for convenience. The German version is binding.

1. Controller

Björn Juncker
Sole trader, trading as DooDigital
Am Kleesbrock 20
33719 Bielefeld
Germany

Phone: +49 170 9068195
Email: info@doodigital.agency

For any data protection question, or to exercise your rights, an email to info@doodigital.agency is enough. We have not appointed a data protection officer because the law does not require us to.

2. What this policy covers, and what it doesn't

This policy covers:

• the website doodock.com;
• the waitlist and the beta signup;
• our contract with agencies that use DooDock, and contacting us;
• signing in to DooDock workspaces.

Data in agencies' workspaces: Agencies use DooDock to manage their own clients, projects, quotes, invoices, files and messages. Each agency is the controller of that data. We process it only on the agency's behalf and on its instructions, under a data processing agreement (Art. 28 GDPR). If you are a client of an agency or use its client portal, please contact the agency about your data; its privacy policy is linked in the client portal. If such a request reaches us, we forward it to the agency without delay.

3. Hosting

doodock.com and all DooDock workspaces run on a server operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in a data centre in Germany. IONOS processes the data on our behalf under a data processing agreement. The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in secure and reliable operation. Where operation serves the performance of a contract, the legal basis is Art. 6(1)(b) GDPR.

4. Visiting doodock.com

Server logs

For every request, the web server automatically records:

• the IP address of the requesting device;
• the date and time;
• the page or file requested and the response status code;
• the amount of data transferred;
• the previously visited page (referrer), if your browser sends it;
• the browser and operating system (user agent).

We need this data to deliver the website and to detect and fend off attacks and errors. The legal basis is Art. 6(1)(f) GDPR. The logs are deleted after 14 days. The same applies to the server's system logs. A log entry that documents a specific attack is kept for as long as we need it to investigate or pursue the attack.

No cookies, no tracking

doodock.com sets no cookies, uses no analytics or advertising services and loads no content from third-party servers. We serve the fonts from our own server too.

Protecting the forms against abuse

The waitlist and beta signup forms limit the number of attempts per IP address. For this, a checksum of the IP address is held in memory for at most ten minutes and never stored permanently. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against automated mass requests.

5. Waitlist

When you join the waitlist, we store:

• your email address;
• your choice of whether you want to hear about beta places and, if ticked, about product news;
• optional details if you give them: name, agency, role, team size, interests and the tools you use;
• the page you signed up on, the time and the version of the consent text.

We use this data to tell you about beta places and the launch of DooDock, and about product news if you chose that. The optional details help us hand out invitations well. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can withdraw your consent at any time with effect for the future, by emailing info@doodigital.agency or through the unsubscribe link in every email we send you about the waitlist. Withdrawal does not affect the lawfulness of processing before it.

We delete your entry as soon as you withdraw, and at the latest 24 months after you signed up.

We do not send emails to the waitlist yet. Before we start, we will add the mailing service we use for this to this policy.

6. Beta signup

The beta is by invitation only. When you sign up, we store:

• a checksum of your invite code (not the code itself);
• your name, your work email address, your agency's name and the address you want for your workspace (name.doodock.com);
• the times of signup and confirmation;
• your IP address and browser identifier at signup;
• the version of the terms and notices you confirmed.

How it works: You receive an email with a confirmation link that is valid for 48 hours. After you confirm, Björn Juncker reviews the signup personally. Only when he approves it is your workspace set up, and you receive the setup link by email. No automated decision is made.

Purpose and legal basis: We need this data to confirm your email address, decide on your participation and set up your workspace (Art. 6(1)(b) GDPR). We store the IP address and browser identifier to detect abuse and to be able to prove the signup (Art. 6(1)(f) GDPR). Without these details we cannot set up a workspace.

How long we keep it:

• We delete an unconfirmed signup at the latest seven days after signup.
• We delete a confirmed signup 30 days after your workspace has been set up. If no workspace is set up, we delete it 90 days after confirmation.
• What we need for the contract, such as the account holder's name and email address, we keep as contract data (section 7).

7. Customer account and contract

For our contract with an agency we process:

• the names and contact details of the contact persons and the account holder;
• the agency's name and address and its workspace address;
• contract data and, once use is paid, billing data;
• correspondence and support requests;
• technical data we need to run the workspace, such as its status, the version it runs and error reports (section 12).

We use this data to provide DooDock, to inform you about the service (for example about maintenance, security matters or new sub-processors) and to invoice. The legal basis is Art. 6(1)(b) GDPR; for statutory retention, Art. 6(1)(c) GDPR.

We keep this data for the term of the contract. After that we keep what the law requires: invoices and accounting records for eight years, commercial and business letters for six years (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code), each counted from the end of the calendar year. What happens to the workspace when the contract ends is described in section 11.

8. Signing in to DooDock

When you sign in to a DooDock workspace or a client portal, we set strictly necessary cookies:

• a session cookie that keeps you signed in;
• security cookies that protect against forged requests;
• when connecting a Google, Meta, LinkedIn or Canva account, a short-lived cookie that secures this step.

The browser's local storage also remembers a few interface settings, such as the chat channel you opened last. We set no analytics or advertising cookies. The legal basis for storing and reading them is Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because these cookies are strictly necessary for the service you asked for.

Password reset links are valid for one hour, invitation links to a workspace for seven days. What you do in a workspace after signing in, we process on the agency's behalf (section 2).

9. Contacting us by email or phone

When you write to us or call us, we process your details and the content of your request to answer it. The legal basis is Art. 6(1)(b) GDPR if your request concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your request.

Our mailbox info@doodigital.agency is run by Google (Google Workspace; our contracting party is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland). Google processes the emails on our behalf; a transfer to the USA is possible (section 15).

We delete requests once they are dealt with and no retention duty applies. We keep business letters for six years.

10. Emails from DooDock

DooDock sends system emails: the confirmation of your signup, the setup link, invitations to a workspace, password reset links and notices about the service. These emails come from crm@doodock.com and are sent through IONOS's mail server in Germany. We keep no copies of these emails. The legal basis is Art. 6(1)(b) GDPR.

Emails that an agency sends from DooDock to its own clients go through the mail server or Google account the agency set up itself. The agency is responsible for them.

11. Backups and the end of a contract

Every night we make a backup of every workspace and of our own systems. It is encrypted on our server before it leaves it, and stored on Google Drive (Google Cloud EMEA Limited). Only Björn Juncker holds the key; Google cannot read the content. We keep daily backups for seven days and monthly backups for twelve months. Data deleted in the live system is therefore gone from all backups at the latest twelve months later. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR; our legitimate interest is being able to restore data after an error or outage.

When a contract with an agency ends, we give the agency a copy of its data on request within 30 days. We then delete the workspace, with its database and files, from the server. It is gone from the encrypted backups at the latest twelve months later.

12. Error reports and monitoring

Our central management system checks that the workspaces are reachable and running without errors, and collects technical error reports. Before an error report is stored, email addresses, long strings of digits and access tokens are removed. An error that does not recur for 30 days is deleted. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. Error reports from a workspace are processed on the agency's behalf.

13. AI features in DooDock

Two features in DooDock use artificial intelligence from Anthropic: summaries of analytics reports and the knowledge base assistant. Only when someone uses one of these features do we send the content it needs to Anthropic, PBC, San Francisco, USA:

• for a summary, the channel, the period and the aggregated figures, without the name of the client or its accounts;
• for the assistant, the question with the conversation so far, a list of all articles (title and short description) and the full text of the matching articles.

Anthropic processes this content as our sub-processor. Under its commercial terms, Anthropic does not use it to train AI models and generally deletes it within 30 days; it keeps it longer only where needed to enforce its usage policy or for legal reasons. The content belongs to the agency's workspace; we process it on the agency's behalf (section 2).

14. Google accounts in DooDock

People in an agency can connect Google accounts to their workspace. DooDock then uses Google user data only for the features the person or the agency switched on:

• Gmail, only when someone connects their mailbox on the E-Mail page: DooDock shows that person's emails in the workspace, sends emails and creates drafts on their instruction, and links email threads to records in the workspace when they ask it to. Emails are fetched from Google when they are shown; the workspace keeps only those links (the thread's ID and subject).
• Google Calendar: DooDock shows the person's events in the workspace and creates or changes events on their instruction, including appointments booked through the agency's booking page.
• Google Analytics, Search Console and Google Ads, connected by an agency administrator, read-only: DooDock reads which properties, sites and ad accounts the Google account can see, and stores daily figures (such as visits, clicks, search queries and costs) in the agency's workspace to show reports. Instead of signing in with a Google account, an agency can give DooDock access through its own Google service account.
• The email address of the Google account, to show which account is connected.

The sign-in tokens and service account keys are stored encrypted on our server, in the agency's workspace. We use Google data only to provide these features to the agency. We never use it for advertising, never sell it and never use it to train AI models. We pass it on only as described in this policy: when someone asks for an AI summary of an analytics report, its aggregated figures go to Anthropic (section 13). We look at Google data ourselves only with the agency's permission for support, where security requires it, or where the law obliges us to.

DooDock's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A person can disconnect their Google account in the workspace at any time ("Settings → Integrations", or in "E-Mail" and "Calendar"); anyone can also remove DooDock's access at https://myaccount.google.com/permissions. When an account is disconnected, or the person is removed from the workspace, we delete its sign-in tokens. Figures already fetched stay in the workspace until the agency deletes them or the workspace ends (section 11). This data belongs to the agency's workspace; we process it on the agency's behalf (section 2).

15. Recipients and transfers outside the EU

All three process data on our behalf. We pass invoices and accounting records to our tax adviser where bookkeeping requires it. We disclose data to authorities only where we are legally obliged to.

Transfers to the USA: For Google, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified, and in addition on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For Anthropic, we rely on the standard contractual clauses. You can request a copy of the standard contractual clauses from us.

16. Retention at a glance

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). An email to info@doodigital.agency is enough.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you can object to that processing at any time on grounds relating to your particular situation. We then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Complaints: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

18. No automated decision-making

We make no decisions based solely on automated processing (Art. 22 GDPR). A person also decides on participation in the beta.

19. Changes

We update this policy when our service, the providers we use or the law change. The version published here applies.