Privacy
Policy

Effective date: 9 June 2026  ·  Last updated: 22 July 2026  ·  Version 1.1
Data controller: Cooke-Yarborough Ltd  ·  Company number 17272745  ·  Registered in England and Wales
ICO registration: ZC171876
Contact: privacy@donae.co

01  ·  Who We Are

Donae is a gift concierge service — an AI that remembers the people who matter to you and proposes personalised gifts ahead of each occasion. Donae is a product of OPIMA, a suite of AI-powered life management tools.

The data controller for this service is Cooke-Yarborough Ltd, a company incorporated in England and Wales under company number 17272745.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

02  ·  What Data We Collect and Why

Waitlist sign-up

• Your email address
• The date and time you signed up

We collect this to notify you when early access opens and to send you relevant updates about Donae. Legal basis: legitimate interests (keeping you informed about a product you have expressed interest in), with the right to withdraw at any time.

When you use Donae (service, not yet live)
Once the service launches, we will collect additional data to run the gift concierge. This policy will be updated before launch to cover each category. The categories we anticipate are:

• Your profile (name, voice preferences, default budgets)
• Your people graph (names and relationships of the people you want to remember)
• Occasion data (dates, budgets, categories)
• Gift history (past gifts given, reactions, outcomes)
• Voice recordings and transcriptions (if you use the voice intake feature — separate consent required)
• Google Calendar and Gmail data (if you connect your Google account — separate consent required for each scope)

We will always ask for separate, explicit consent before collecting voice recordings or connecting to your Google account. These are optional features — Donae works without them.

03  ·  Special-Category Data

Some information you add to the people graph — for example, dietary restrictions that are medically or religiously motivated, or notes that reveal someone's sexual orientation — is "special-category data" under UK GDPR (Article 9). We treat this category with additional care:

• We collect it only when you explicitly provide it for the purpose of gift personalisation
• We store it separately from your main profile
• We include it in AI processing only when it is directly relevant to a specific gift decision
• We will ask for separate explicit consent before collecting any Article 9 data

04  ·  How We Use Your Data

• To notify you when early access opens (waitlist only, at this stage)
• To run the gift concierge service once launched
• To improve the product based on aggregate, anonymised patterns
• We do not use your data for advertising. We do not sell it. We do not share it with third parties for their own marketing purposes.

05  ·  Who We Share Data With

We share data only with service providers who help us operate Donae, under strict data processing agreements:

• AI providers — to generate gift proposals and card text (e.g. Anthropic). Your profile and recipient data is sent to the AI only at the moment a proposal is generated. We do not permit AI providers to use your data for training.
• Email service provider — to send you proposal emails and notifications (e.g. Resend or Postmark). They receive your email address and the content of emails sent to you.
• Payment processor — when you make a purchase, payment is handled by Stripe. We do not store payment card details.
• Google — if you choose to connect your Google Calendar or Gmail, data is accessed via Google's OAuth 2.0 APIs. We request only the minimum scopes needed. You can revoke access at any time in your Google Account settings.

All service providers are listed in full in our Sub-processor Register, available on request.

06  ·  Google API Services & Limited Use

If you choose to connect your Google account, Donae accesses Google user data through Google's OAuth 2.0 APIs. This section explains exactly what we access and how we handle it. Connecting Google is optional: you may use Donae without connecting a Google account, although Google-powered features will not be available. Consent is requested separately for each scope.

• What we access — with your consent, read-only access to your Google Calendar events (event titles, dates, and times, to identify upcoming occasions from calendar events) and read-only access to your Gmail messages (to identify and surface messages that may help identify gift opportunities, such as delivery confirmations and occasion reminders). We request no write, send, or delete permissions of any kind.
• How we use it — solely to provide the user-facing features described above and to improve those same features for you: detecting upcoming occasions from your calendar and surfacing messages that may help identify gift opportunities. We do not use Google user data for advertising, profiling unrelated to providing those features, market research, or creditworthiness or lending decisions.
• Who we share it with — Google user data is never sold, and never transferred to data brokers, advertisers, or any other third party, except to sub-processors acting on our instructions where strictly necessary to provide the features above, in a transfer of business assets as permitted by Google's policy, or where required by law.
• AI processing — we do not use Google user data to develop, improve, or train generalised artificial-intelligence or machine-learning models. Where Google user data is processed by our AI provider to generate an output you have requested (for example, a gift proposal), that processing happens under contractual terms that prohibit the provider from using your data to train its models.
• How we protect it — Google user data is transmitted over encrypted connections (TLS), stored with strict, least-privilege access controls, and accessed only by systems that need it to provide the features above.
• Retention and deletion — Google user data obtained through your connected account is retained only for as long as necessary to provide the features described above. You can revoke Donae's access at any time from your Google Account permissions page. If you disconnect your Google account or revoke access, we delete the Google user data we hold within 30 days. Account deletion follows the service-data retention rules in Section 07.

Limited Use disclosure: Donae's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

07  ·  Data Retention

• Waitlist emails — kept until you unsubscribe, or for 24 months from sign-up if you never convert to a paying customer, whichever comes first.
• Service data — kept while your account is active and for 30 days after deletion, to allow recovery. After 30 days, personal data is permanently deleted from our systems. Anonymised, aggregate data (e.g. that a gift in category X was approved) may be retained to improve the product.
• Voice recordings — transcribed and deleted within 24 hours. The transcription is reviewed by you before being saved to your profile; the raw audio is never stored longer than needed to produce it.

08  ·  Your Rights Under UK GDPR

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — at any time, for any consent-based processing (including Google OAuth)

To exercise any of these rights, email privacy@donae.co. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the ICO: ico.org.uk.

09  ·  Cookies and Tracking

The waitlist page does not use cookies or tracking pixels. If you join the waitlist, your email address is stored locally in your browser (via localStorage) as a fallback — this data stays on your device and is not sent anywhere until a backend endpoint is wired up. We will update this section when analytics or a backend are added.

10  ·  International Transfers

Some of our service providers (including AI providers and email infrastructure) are based outside the UK. Where we transfer data internationally, we do so under the UK's International Data Transfer Agreement (IDTA) or equivalent safeguards. Details are available on request.

11  ·  Changes to This Policy

We will update this policy before the service launches to cover service-specific data processing. We will notify you of material changes by email. The date at the top of this page reflects the most recent update.

12  ·  Contact

For any privacy question, request, or concern, email us at privacy@donae.co. We will respond within 30 days.