Privacy Policy

Last updated: August 19, 2026

1. Introduction

Doku operates the doku.work platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

By using Doku, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

  • Name (first and last name)
  • Email address
  • Password (stored encrypted)
  • Profile avatar (optional)

2.2 Usage Data

We automatically collect information about how you interact with the platform:

  • Pages visited and features used
  • Tasks, projects, and content you create
  • AI chat conversations and interactions
  • Device information and browser type
  • IP address and approximate location

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain the Doku platform
  • Manage your account and authenticate your identity
  • Process your tasks, projects, and workspace data
  • Power AI-assisted features using third-party AI services (Google Gemini)
  • Send transactional emails (invitations, password resets)
  • Improve and optimize the platform
  • Ensure security and prevent fraud

4. AI Data Processing

Doku uses Google Gemini to provide AI chat and task management assistance. When you use AI features:

  • Your messages and relevant workspace context are sent to Google's API
  • AI conversations are stored in our database for continuity
  • We do not use your data to train AI models
  • Google's data processing is governed by their own privacy policy

5. Data Sharing and Subprocessors

We do not sell your personal information or share it for advertising. We may share data with:

  • Members of your workspace: what you share inside a space is visible to the other members of that space.
  • Subprocessors: Cloudflare (hosting for the app, API and files), Google Cloud (managed database), Google Vertex AI — Gemini (AI features), Resend (transactional email) and PostHog (product analytics). If you connect optional integrations, also Google, GitHub, Figma or Meta/WhatsApp.
  • Legal requirements: where required by law or necessary to protect our rights.

Our compliance page explains how we protect each kind of data and which certifications our infrastructure providers maintain.

6. Legal Bases for Processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 GDPR:

  • Performance of a contract (Art. 6(1)(b)): creating and maintaining your account, providing the service and supporting you.
  • Legitimate interests (Art. 6(1)(f)): keeping the platform secure, preventing abuse, and understanding in aggregate how the product is used so we can improve it. You may object at any time.
  • Consent (Art. 6(1)(a)): optional notifications (email, push, WhatsApp) and third-party integrations you choose to connect. You may withdraw it at any time.
  • Legal obligation (Art. 6(1)(c)): where we must retain or disclose information to comply with the law.

7. International Transfers

Our database is hosted on Google Cloud SQL in the us-east1 region (South Carolina, United States). Files and the application are served from Cloudflare's global network. This involves transferring personal data outside the European Economic Area.

These transfers rely on the Standard Contractual Clauses approved by the European Commission, incorporated into the data processing agreements signed with each provider, and on Google's and Cloudflare's participation in the EU-US Data Privacy Framework. You may request a copy of these safeguards at [email protected].

8. Data Security

We apply technical and organisational measures appropriate to the risk, including:

  • Passwords stored hashed (bcrypt), never in plain text
  • HTTPS/TLS encryption for all data in transit
  • Token-based authentication with revocable sessions
  • Per-workspace isolation: every database query verifies the user's membership
  • Role-based access control and revocable share links

No system is infallible. If we detect a breach that poses a risk to your rights, we will notify you and report it to the supervisory authority within the timeframes set by Article 33 GDPR.

9. Data Retention

We keep your data while your account is active. When you request erasure:

  • Your account data and personal content are deleted within 30 days at most.
  • Content you created inside a shared space may remain if other members need it to keep working, detached from your identity.
  • Backups rotate and expire within 35 days at most.
  • We retain only what is strictly necessary to meet legal obligations or defend against claims.

10. Your Rights

The GDPR grants you the following rights over your personal data:

  • Access (Art. 15): obtain a copy of the data we process about you.
  • Rectification (Art. 16): correct inaccurate or incomplete data.
  • Erasure (Art. 17): ask us to delete your data.
  • Restriction (Art. 18): restrict processing while a complaint is resolved.
  • Portability (Art. 20): receive your data in a structured, commonly used format.
  • Objection (Art. 21): object to processing based on legitimate interests.
  • Automated decisions (Art. 22): we do not make decisions producing legal effects based solely on automated processing.
  • Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise them, email [email protected] from your account address. We respond within the one-month deadline set by Article 12(3) GDPR.

If you believe we have not handled your request properly, you may lodge a complaint with your national supervisory authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es).

11. Children

Doku is not directed at children under 16 and we do not knowingly collect their data. If we identify an account belonging to a minor without parental consent, we will delete it.

12. Cookies

Doku uses essential cookies for session management and authentication. We do not use third-party tracking cookies or advertising cookies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

14. Data Controller and Contact

The controller of the data described in this policy is the entity operating the doku.work platform.

For any privacy question, to exercise your rights, or to request a data processing agreement (DPA), email [email protected].

Details of our subprocessors and the applicable safeguards are on our compliance page.