Privacy Policy

Who is responsible for your data

Dotto is run by Łukasz Czarnacki, who is the controller of your personal data. For any question or request about your data, write to czarnackigrafika@gmail.com.

What we collect

• Account: your email address, and the name and profile picture you add in your profile.
• Workspaces and teams: workspace names and icons, who belongs to which workspace and with what role, and the email addresses of people you invite.
• Projects: the website addresses you add, project names, statuses and a preview screenshot of each website.
• Comments and replies: their text, any image or video you attach, and a screenshot of the page taken when a comment is left, together with the page address, device and position of the comment. Screenshots show whatever was on the reviewed page, which may include personal data displayed there.
• Guests: if you comment without an account, the name and email you choose to give (both optional). A random code kept only in your open browser tab lets you manage your own comments until you reload the page.
• Sharing and emails: the email addresses a project is shared with, and the addresses that unsubscribed from a project's emails.
• Technical data: our hosting providers keep standard server logs, such as IP addresses and request times, for security and troubleshooting.

Why we use it

• To provide Dotto: sign-in, projects, comments, sharing and showing who is viewing a project right now (necessary to provide the service you asked for).
• To send emails you'd expect: sign-in links, invitations, shared projects and notifications about new comments, replies and resolved comments. Every notification can be switched off with its unsubscribe link.
• To keep Dotto secure and working, prevent abuse and fix problems (our legitimate interest).
• To answer your messages, help requests and feedback.

We don't sell your data, show ads or use analytics or tracking tools.

Who helps us process it

These providers process data on our behalf, only to run Dotto:

• Supabase — database, file storage and sign-in. Data is stored in the EU (Ireland).
• Vercel — hosts the Dotto app (servers in the EU, Ireland).
• Railway — runs the server that loads the websites you review inside Dotto (EU). It doesn't store your comments or account data.
• Resend — sends Dotto's emails (EU region).
• Sentry — error monitoring: when something breaks or loads slowly, it records technical details such as the page address, browser and error message, without names, emails or comment content (EU, Germany).

Some of these companies are based in the United States. Where data may be accessed from outside the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Cookies and browser storage

Dotto only uses what it needs to work: cookies that keep you signed in, remember the workspace you picked and whether the sidebar is collapsed, and browser storage for your light or dark theme. There are no analytics or advertising cookies.

How long we keep it

• Your account data is kept until you delete your account (Profile → Delete your account). Workspaces you own are handed to another Owner, or deleted with their projects if there is none. Comments and replies you left in other people's workspaces stay with their team, but show “Deleted user” instead of your name, and your email is removed from them.
• Projects, comments, replies and files are kept until someone with access deletes them, or their project or workspace is deleted. Deleting a comment erases its text, author, screenshot, attachments and replies.
• Unsubscribe choices are kept so we keep respecting them.
• Backups made during the test phase are kept for up to 30 days.

Your rights

Under the GDPR you can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Write to czarnackigrafika@gmail.com and we'll answer within a month. You can also complain to your data protection authority — in Poland, the President of the Personal Data Protection Office (UODO).

Children

Dotto isn't meant for anyone under 16.

Changes

If this policy changes, we'll update the date above and, for important changes, let account holders know by email. See also the Terms.