Doji Business Privacy Notice
Effective September 30, 2026 · Version business-privacy-20260930-v1. Gavin Fahey, operating Doji from Eagle Mountain, Utah, United States. Contact: support@dojipro.com.
Scope
This notice explains personal information used for business accounts, applications, review and workspace access at business.dojipro.com. Business contact information can still be personal information, including a sole proprietor's name or address. Personal use of the Doji member app is covered by its separate privacy notice. Business registration does not create a member profile or make application details public.
We receive information directly from you, generate account and review records while providing the service, and receive authentication, security and email-delivery results from service providers. Acknowledging this notice does not waive your rights or authorize unrelated uses of your information.
Information and purposes
- Account information: email, display name, authentication records, accepted terms and acknowledged privacy-notice versions and timestamps, password credentials handled by our authentication provider, and enrolled multi-factor authentication information. Used to establish and secure access, document the account agreement, verify email and support recovery.
- Application information: legal and brand names, business website, country, representative name and role, industry and intended use of Doji. The initial application does not ask for a street address; an address included in an earlier submitted record may remain in that historical record until reviewed under the retention or privacy-request process. Used to identify the business, assess an application and administer an approved relationship.
- Review records: submitted versions, submission times, accepted terms and acknowledged privacy versions, status, reviewer decisions, responses and internal review notes. Used to review consistently, explain decisions and investigate mistakes or misuse. Internal notes are restricted to authorized staff.
- Service and security information: request and authentication events, device/browser and network information processed by our infrastructure providers, email delivery records, and rate-limit counters. Used to operate the service, prevent automated abuse and investigate failures. Doji's dedicated signup limiter uses shared hashed address buckets rather than storing raw email addresses in its limiter records; account and email systems still process your email.
- Support correspondence: information you choose to send when asking for help. Used to address the request and verify authority where necessary.
Required form fields are needed to process the application. You can choose not to provide them, but we may then be unable to review it or provide access. Do not include identity documents, payment data, customer records or sensitive personal information in free-text fields. We will not ask you to send passwords or authenticator codes to support.
Who receives information
Authorized Doji staff review applications and handle support. We use Supabase for authentication and database services, Cloudflare for hosting and bot protection, and Resend for verification and recovery emails. These providers process the information needed for those functions. Support email is routed through Cloudflare to the operator’s Google mailbox, so these providers also process support correspondence. We do not make business applications publicly searchable.
Cloudflare Turnstile evaluates signals such as IP address, browser characteristics and the site being accessed to distinguish legitimate visitors from automated abuse. Cloudflare also describes its own processing to improve bot detection. See its Turnstile Privacy Addendum for those practices and rights contacts. Doji's security check does not send application details or passwords to Turnstile.
We may disclose information when legally required, to respond to valid legal process or when reasonably necessary to address fraud, threats or unauthorized access, subject to applicable law.
Browser storage and messages
The business account client keeps access tokens in page memory. Reloading can require signing in again. The site stores a theme preference locally. Infrastructure and security services may also process browser information as described above. Browser storage and security processing are not permission to subscribe you to marketing.
The onboarding site does not use advertising or cross-site behavioral tracking integrations. Do Not Track browser signals do not change the necessary account and security processing described here. You may contact support about privacy preferences or rights. Verification and recovery emails are service messages, not marketing subscriptions. Creating an account or submitting an application does not subscribe you to a marketing list. The onboarding implementation does not enable campaign billing or paid realtime features.
Retention and closure
We retain information for the time needed to operate the account, review applications, maintain necessary security and decision records, resolve disputes and meet applicable legal obligations. We consider the information's sensitivity, the reason for keeping it, applicable duties and whether a less identifying record will suffice.
Submitted application versions and review history are separate from your sign-in account. Editing a draft, withdrawing an application or closing a sign-in account does not itself erase those records. A correction may be recorded alongside an earlier submission to preserve an accurate history. This does not remove any deletion or correction rights you have under applicable law.
To request closure, withdrawal, access, correction or deletion, contact support@dojipro.com. Identify the account and explain your request; do not send a password, verification code or identity document in ordinary email. We may need proportionate verification of your identity and, for requests affecting the business account, your authority. We will explain any additional information needed. Deletion may be limited where applicable law permits or requires retention, and retained information will be restricted to the justified purpose.
Location and privacy rights
The operator is located in Eagle Mountain, Utah, United States. Business onboarding is currently offered to United States businesses. Our primary application database is in Oregon, United States. Our providers may process service, security and support information in other locations; this notice does not promise United States-only processing.
Depending on applicable law, you may have rights to access, correct or delete information, restrict or object to some processing, obtain a portable copy, withdraw consent where consent is the basis, or complain to a privacy regulator. Contact support@dojipro.com to exercise applicable rights or request review of a denied request, using “Business privacy appeal” as the subject for an appeal. We do not require you to give up applicable rights to use the service. We will explain when a request cannot be fulfilled and why.
Security and updates
The service uses access restrictions, multi-factor authentication for approved workspaces and staff review, and bounded abuse controls. No system can guarantee complete security. We will handle security incidents and required notifications under applicable law.
We will update this notice when practices change and identify the effective version. Where additional notice or consent is required, we will provide it. Contact Gavin Fahey, Doji, Eagle Mountain, Utah, United States; support@dojipro.com.