Privacy Policy

Donded Pty Ltd ("Donded", "we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered marketing platform at donded.com.au. We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and where applicable, the General Data Protection Regulation (GDPR).

By using Donded, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our platform.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Name and email address
• Business name, description, location, and service area
• Industry or trade type
• Monthly advertising budget and marketing goals
• Website URL
• Password (stored in hashed form via Clerk)

1.2 Meta (Facebook) Platform Data

When you connect your Meta Business account, we collect and store the following data from the Meta Platform via OAuth:

• Meta user access token (encrypted at rest)
• Facebook Ad Account ID and name
• Facebook Page ID and name
• Ad campaign performance data: spend, impressions, clicks, leads
• Ad Account permissions granted via ads_management and ads_read scopes
• Facebook Page engagement data via pages_read_engagement scope

We access this data solely to provide our advertising management services on your behalf. We do not sell or share Meta Platform data with third parties for advertising purposes, profiling, or any use not directly required to operate our service.

1.3 Usage Data

• AI chat messages and conversation history
• Campaigns created through our platform
• Leads and CRM contact data associated with your campaigns
• Login timestamps and session data
• Subscription and billing information (payment processing via Stripe)

1.4 Technical Data

• IP address and browser type
• Pages visited and time spent on the platform
• Error logs and performance data

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Donded platform
• Create and manage Meta ad campaigns on your behalf using the permissions you grant
• Generate AI-powered ad copy, targeting recommendations, and campaign reports
• Process subscription payments and send billing communications
• Send transactional emails (account creation, campaign alerts, billing receipts)
• Improve and personalise the platform based on usage patterns
• Respond to support enquiries
• Comply with legal obligations and enforce our Terms of Service

We do not use your Meta Platform data to target advertisements to you on other platforms, build audience profiles for third-party use, or for any purpose beyond operating the Donded service you have requested.

3. Meta Platform Data — Specific Disclosures

Donded integrates with the Meta Marketing API. Our use of Meta Platform data complies with Meta's Platform Terms and Meta's Developer Policies.

• We only request permissions necessary to manage your advertising campaigns (ads_management, ads_read, pages_read_engagement, pages_show_list).
• Your Meta access token is encrypted and stored securely. It is never exposed to third parties.
• We do not transfer, sell, or license your Meta Platform data to any third party.
• We do not use Meta Platform data for re-targeting, profiling, or cross-platform advertising.
• We retain Meta access tokens only while your account is active. Disconnecting your Meta account or deleting your Donded account revokes our access and triggers deletion of stored tokens.

4. Data Sharing and Disclosure

We do not sell your personal information. We share data only in these circumstances:

• Service providers: Clerk (authentication), Stripe (payments), Supabase (database hosting), Vercel (platform hosting), OpenAI (AI processing). Each is bound by data processing agreements.
• Meta Platforms Inc.: data is sent to Meta solely to execute ad campaigns on your behalf.
• Legal requirements: if required by law, court order, or government authority.
• Business transfers: in the event of a merger or acquisition, your data may transfer subject to equivalent privacy protections.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specifically:

• Account and business profile data: retained while your account is active, deleted within 30 days of account closure.
• Meta access tokens: deleted immediately upon disconnection or account closure.
• Campaign and leads data: retained for 3 years after account closure for legal and billing compliance, then deleted.
• AI conversation history: retained while your account is active, deleted within 30 days of account closure.
• Billing records: retained for 7 years in accordance with Australian tax law.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest (including access tokens)
• Role-based access controls for internal systems
• Regular security reviews and dependency updates

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

Under the Australian Privacy Act and, where applicable, the GDPR, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Withdraw consent to data processing at any time
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, email hello@donded.com.au. We will respond within 30 days.

8. Facebook Data Deletion

If you connected your Facebook account to Donded and later wish to delete your data from our platform, you can:

• Delete your Donded account from Settings, which removes all associated Meta data within 30 days.
• Remove the Donded app from your Facebook account at facebook.com/settings?tab=applications. We will receive a deletion request and process it within 30 days.
• Email hello@donded.com.au to request manual data deletion.

You can also check the status of a data deletion request at donded.com.au/data-deletion.

9. Cookies and Tracking

We use essential cookies to maintain your login session. We do not use third-party advertising cookies or tracking pixels on our platform. Our public marketing site (donded.com.au) may use analytics to measure visitor behaviour; no personally identifiable information is collected via analytics.

10. Children's Privacy

Donded is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal data, contact us at hello@donded.com.au.

11. International Transfers

Your data is primarily stored in Australia and the United States. By using Donded, you consent to the transfer of your information to these countries. We ensure appropriate safeguards are in place for any international data transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Continued use of Donded after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related enquiries, requests, or complaints, contact our Privacy Officer: