Privacy · DoneDealify

DoneDealify handles something private: the quotes you send your customers, and your customers' email addresses. This page says exactly what that means in practice.

It is written to be read. Where something has not been decided yet, it says so rather than filling the gap with reassuring words.

Who we are

The data described here is looked after by George Daniel Vad, an individual based in Spain, trading as DoneDealify. Write to hello@donedealify.com about anything on this page — it reaches a person, not a queue.

DoneDealify is the service described at donedealify.com. It is run from Spain; the database is in the European Union, in Frankfurt.

What we store

Everything held about you falls into six groups, one of which exists only if you connect Gmail. Open any of them to see the actual fields — this list is taken from the database itself, not written from memory.

Who you are and the name your follow-ups are signed with.

You need an account to sign in, and the follow-ups have to be signed with something. The signing name is separate from your legal name on purpose — people write to "Jon", not "Jonathan".

Handled by Supabase

Email addressHow you sign in, and where account email goes.
PasswordStored hashed by Supabase Auth. We never see it and cannot read it.
Your nameOptional. Given during setup.
Signing nameThe name at the bottom of your follow-ups.
Business nameOptional. Used in follow-ups where it reads naturally.
How you writeWarm or blunt, and any example emails you paste in. Used only to set the tone of your follow-ups.
PausedWhether you have paused all sending, and since when.
PlanFree or paid, and — if you pay — Stripe's customer id and when your plan renews. Never your card details: Stripe holds those, not us.
Your BCC addressThe quote-…@donedealify.com address that is yours alone. Treat it as a password: anyone who has it can file a quote on your account.
How you found usOptional: your answer to "How did you hear about DoneDealify?" at setup. Also recorded automatically at signup: any campaign tag in the link you followed (such as utm_source=linkedin) and the other website that linked you to the signup page, if there was one — its address only, nothing from your browser. No cookies are used for this.
DatesWhen the account was created, updated, and finished setup.

Your account

You need an account to sign in, and the follow-ups have to be signed with something. The signing name is separate from your legal name on purpose — people write to "Jon", not "Jonathan".

Handled by Supabase.

Email address — How you sign in, and where account email goes.
Password — Stored hashed by Supabase Auth. We never see it and cannot read it.
Your name — Optional. Given during setup.
Signing name — The name at the bottom of your follow-ups.
Business name — Optional. Used in follow-ups where it reads naturally.
How you write — Warm or blunt, and any example emails you paste in. Used only to set the tone of your follow-ups.
Paused — Whether you have paused all sending, and since when.
Plan — Free or paid, and — if you pay — Stripe's customer id and when your plan renews. Never your card details: Stripe holds those, not us.
Your BCC address — The quote-…@donedealify.com address that is yours alone. Treat it as a password: anyone who has it can file a quote on your account.
How you found us — Optional: your answer to "How did you hear about DoneDealify?" at setup. Also recorded automatically at signup: any campaign tag in the link you followed (such as utm_source=linkedin) and the other website that linked you to the signup page, if there was one — its address only, nothing from your browser. No cookies are used for this.
Dates — When the account was created, updated, and finished setup.

Your quotes

This is the product. We cannot follow up on a quote we have not been sent, and we cannot stop at the right moment without knowing which thread it belongs to.

Handled by Supabase and Resend and Anthropic.

The quote email's text — So the follow-ups can mention the actual job. Sent to Anthropic once, when you put a value on the quote, to write the five emails. Deleted 90 days after the chase ends.
Who it went to — The client addresses on the quote, including anyone copied in.
Who it came from — The address you sent it from.
Subject line — Your own words from your own sent mail.
Email and thread identifiers — The technical ids that let a follow-up land inside the original conversation instead of starting a new one.
Client name, job and amount — Typed by you when you put a value on the quote, or when you add a quote yourself. We never guess an amount.
The follow-ups — Five, or fewer for an older quote you add yourself. Their text, when each is due, and whether it was sent, skipped or stopped. You can read and edit every one before it goes.
Status — Awaiting reply, replied, won, lost, stopped, or closed (the last follow-up sent, no answer).
A per-quote link token — The secret half of the one-tap Won / Lost / Stop link emailed to you. Scoped to that one quote and nothing else.
Dates — When the quote arrived, or the day you say you sent it if you added it yourself, and when its status last changed.

Your clients

Your customer's name and email reach us because they are in an email you sent them. They did not choose this, which is why they get their own section in the policy rather than being quietly folded into yours.

Handled by Supabase and Resend.

Their email address — From the quote's To and Cc lines. The follow-ups go here, and you can change it.
Their name — If you type it in, so the follow-ups can greet them.
Whether they replied — Their reply comes to a reply address of ours, so the chase stops when they answer, and we pass it straight on to you. We record that they replied, not what they said.

Email we send and receive

Sending and receiving email means a mail provider handles the message. Resend keeps delivery records so a bounce or a failure can be explained rather than guessed at.

Handled by Resend.

Delivery records — Sent, delivered, bounced, complained — held by Resend.
The quote email itself — Received by Resend at your BCC address before it reaches us.
Your client's reply — Received by Resend at the reply address in each follow-up, only so we can stop the chase and pass the reply on to you, attachments included. We do not keep a copy in our database.
Emails we send you — About your quotes: a chase has started, a client replied, and one "Did you win it?" reminder a week after an unmarked reply. Besides those: a monthly summary, and two setup tips in your first few days if no quote is being chased yet. Settings → Emails from us turns off the summary and the tips; we record when each was sent so none goes twice. Replies to the setup tips reach our support inbox.

Your Gmail, if you connect it

Connecting Gmail lets the follow-ups come from your own address, lets us notice quotes you send without a BCC, and lets us see when a client replies so the chase stops. Google gives us two permissions for that, and neither lets us read what an email says.

Handled by Google and Supabase.

Permission to send — Google's gmail.send. Used only to send the follow-ups you have seen on the quote's page, from your address, in the quote's own thread.
Email headers — Google's gmail.metadata: who an email is from and to, when, its subject line, and whether something is attached. Never the text of an email and never an attachment — the permission does not allow it.
Which of your sent emails look like quotes — Header details of sent emails that look like quotes, shown on your dashboard for you to confirm or dismiss. Deleted after 14 days if you do neither.
Your recent sent emails, when you add a quote — Opening Add a quote shows the headers of your sent emails from the last 30 days, so you can pick the quote. They are read at that moment and not stored. Only the one you pick is kept, as a quote.
Your Gmail address and a connection key — So we can act for you without your password, which we never see. The key is encrypted before it is stored, and disconnecting revokes it at Google.

Technical records

A site cannot be hosted without its host keeping request logs, and you cannot stay signed in without a cookie. Neither is used to build a picture of you.

Handled by Vercel and Supabase.

Sign-in cookie — Set by Supabase Auth. It keeps you signed in and does nothing else.
Server logs — Kept by Vercel as part of hosting: which pages were requested, and when.
Page-view counts — Vercel Web Analytics counts visits to the public pages: which page, the site you came from, your country, and your device and browser type. No cookies, nothing stored on your device, and visitors cannot be recognised from one day to the next. No advertising and no third-party tracking.

Why we store it

Because the product cannot work otherwise. A follow-up autopilot that does not keep your quote has nothing to follow up, and one that does not know your client replied cannot stop — which is the single most important thing it does.

We do not sell it, we do not share it for advertising, and we do not use it to train anything.

In the language of the EU GDPR: your own data is handled because it is needed to provide the service you signed up for (Article 6(1)(b)). Your clients' details are handled in the legitimate interest of following up a quote they asked you for (Article 6(1)(f)) — which is why we only ever contact them about that quote, and stop when they reply or you say so.

Your clients' details

This deserves saying plainly rather than burying: when you BCC a quote to DoneDealify, or we spot it in a Gmail you connected and you confirm it, your customer's name and email address arrive with it. They never signed up here and may not know we exist.

So we keep the amount of their data to the minimum the job needs, we never contact them about anything other than your quote, we never add them to any list, and they are never contacted again once you mark the quote won, lost or stopped.

Because these are people you already have a business relationship with, the responsibility for that relationship stays yours. The Terms say the same thing from the other direction.

Who else can see it

Only the companies that run the parts of the service we do not run ourselves. Each of them sees only what its job requires.

Supabase — the database and sign-in. Hosted in Central EU (Frankfurt). This is where your account and your quotes live.
Resend — sending and receiving email. Your quote reaches us through Resend, the follow-ups go out through it, and your client's reply comes back through it and is passed on to you, attachments included.
Vercel — hosting. Serves the site, keeps the request logs any host keeps, and counts page views without cookies (Vercel Web Analytics).
Cloudflare — the domain name. It answers "where is donedealify.com" and does not see your data.
Anthropic — writes the follow-ups. When you put a value on a quote, the quote's text, the details you typed and your writing samples are sent to Anthropic's Claude once, to draft the five emails.
Stripe — payments, only if you choose the paid plan. Stripe acts as the seller and holds your card details; we never see them.
Google — two separate things. If you connect your Gmail: your mail already lives there; through Google's Gmail API we send your follow-ups from your account and read the headers described under "If you connect Gmail". And our support inbox runs on Google Groups, so if you reply to one of our setup emails, Google holds that reply.

Nobody else. No data brokers, no advertising networks, no tracking companies.

If you connect Gmail

Connecting Gmail is optional. Without it, everything works through your BCC address and nothing below applies.

If you connect it, Google asks you to give DoneDealify two permissions, and those are the only two we ask for:

Send email on your behalf (gmail.send) — used only for the follow-ups on your quotes, each of which you can read, edit or skip first.
See your email's headers, but not the email itself (gmail.metadata) — who an email is from and to, when, its subject, and whether something is attached. We use it to notice quotes you send, to put each follow-up in the right thread, and to see when a client replies or you have written to them yourself, so the chase stops or waits.

We cannot read the text of your emails or open attachments: the permissions do not allow it. We look only at your sent emails and at replies in the threads of quotes being chased; the rest of your inbox is not looked at. When you open Add a quote, we list your sent emails from the last 30 days for you to pick from; that list is not stored, and only the email you pick is kept. When you put a value on a quote we found in Gmail, its subject line and the details you typed are sent to Anthropic's Claude once to draft the follow-ups, as described under "Where AI comes into it".

DoneDealify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice: Gmail data is used only to provide the features described here, is never sold, never used for advertising, never used to train AI models, and no person reads it unless you ask us to for support, it is needed for security, or the law requires it.

Disconnect any time in Settings, or from your Google Account under Security → Third-party apps. Disconnecting revokes our access at Google straight away; follow-ups already scheduled carry on from DoneDealify's address under your name.

How long we keep it

The text of a quote email is deleted automatically 90 days after its chase ends — when it is won, lost, stopped, replied to, or the last follow-up has gone. It is the most sensitive thing we hold, and writing the follow-ups is the only thing it is needed for.

Everything else — your account, the record of each quote and its follow-ups — is kept while your account exists, so your dashboard stays accurate. It is deleted when your account is.

Deleting your data

Email hello@donedealify.com from the address you signed up with and ask. Your account, your quotes, their follow-ups and your clients' details are deleted together, within 30 days and usually the same week. Anything already sent cannot be unsent.

If one of your clients asks us to delete what we hold about them, we will — and stop any follow-up to them.

Cookies

One cookie, set when you sign in, which keeps you signed in. That is the whole list.

There is no cookie banner on this site because there is nothing to consent to. Page views are counted without cookies and without storing anything on your device, and there is no advertising, no tracking pixels and no third-party script following you between sites.

Where AI comes into it

The follow-ups are drafted by Anthropic's Claude. When you put a value on a quote, the quote's text, the details you typed and any writing samples you gave are sent to it once, and it writes the five emails. Nothing goes out before you can read it on the quote's page, and you can edit or skip any of them.

It is told never to state anything that is not in your quote — no invented dates, prices or promises. If it cannot be reached, plain wording that says nothing specific is used instead, so a chase is never missing and never made up.

Anthropic does not use data sent through its API to train its models, and neither do we. The emails in the homepage demo are written by hand, not generated.

Your rights

Under EU and UK data protection law you can ask to see what we hold about you, correct it, delete it, or take it elsewhere. You can also complain to a regulator — the Agencia Española de Protección de Datos (AEPD) in Spain, or the supervisory authority where you live.

Send any of these requests to hello@donedealify.com. You will get an answer within 30 days, which is the legal limit, and usually much sooner.

Changes to this page

The date at the top is the honest one. If something material changes — a new company handling your data, a new use for it — you will be emailed about it rather than left to notice.