Privacy Policy

Who we are#

dotsy is run by Loving Universe LLC, a Wyoming limited liability company ("dotsy", "we", "us"). This policy covers dotsy.ai, the dotsy dashboard (app.dotsy.ai), the dotsy API, the dotsy AI connector (mcp.dotsy.ai) and the dotsy command-line tool.

For your account, we decide how your information is used. For the people who visit sites hosted on dotsy, we handle information on behalf of each site's owner (see Visitors to sites on dotsy).

What we collect#

• Account details. Your name, your email and your password (stored only as a hash). If you sign in with Google, we get the name, email and profile picture Google shares. We also keep your early-access status and who invited you, if anyone. Each sign-in records the IP address and browser it came from.
• Your sites. The pages, images, files, settings and domains you add, earlier versions of them, and an activity log of who changed what (by email or API key name). When you import a website, we fetch the pages at the address you give us.
• Keys and connections. API keys are stored only as a hash. If you connect a domain provider (such as Cloudflare, Name.com or GoDaddy), we store that access encrypted and use it only for the domain changes you ask for.
• Google Search Console, if you connect it. A workspace owner can connect a Google account to a site. We then receive that account's email and Google ID, and access to Search Console for that site: we prove the site is yours, add it to your Search Console, send its sitemap, and read its search numbers (clicks, how often it was shown, and its average position). We store that access encrypted.
• Bing Webmaster Tools, if you connect it. A workspace owner can connect a Bing Webmaster Tools account to a site. Bing gives us access to that account, not your name or email. We use it to prove the site is yours, add it to your Bing Webmaster Tools, send its sitemap, and read the site list in that account, the site's verification, its search numbers (clicks, how often it was shown, average position, the searches and pages people found it with) and what Bing found when it read your pages. We store that access encrypted.
• Your AI assistant's requests. When an assistant uses the dotsy connector, we receive the requests it sends to our tools. Each one includes a one-line reason (for example "Update the opening hours"). When the assistant publishes a site or sends us feedback, it adds a short feedback note, and the session's list of tool calls with their one-line reasons is stored with it so we can fix problems.
• Messages to us. Emails and feedback you send us.
• Bug reports. When you report a bug from the dashboard or editor, we get what you write, a screenshot of the page you were on and any images you add. Passwords, one-time codes, card numbers and API keys are hidden before the screenshot is taken; everything else on screen is in it, so blur or remove it if you need to. If you leave Technical details ticked (it is by default), we also get recent error and warning messages, failed requests, the last 10 pages you visited, your browser, screen size, language and time zone, the dashboard version and recent errors from your account's jobs. Keys and email addresses in your text and those details are masked. We also note your email, your plan and the site and page the report is about. If you're not signed in, you give us an email address for our reply. When you answer our reply by email, your answer is added to the report.

How we use it#

To run dotsy: create and secure your account, host and publish your sites, send the emails you need (sign-in verification, invitations, site transfers, form notifications, replies to your bug reports), answer your bug reports and fix what they find, prevent abuse and fix problems. We also use feedback to improve dotsy.

To answer bug reports, our support assistant (built on Anthropic's Claude) reads the report, its screenshots and images and the technical details you chose to send, helps us find the cause and drafts a reply. A person on our team checks the draft and decides what we send you.

We don't use your information for advertising, we don't sell or share it for advertising, and we don't use it to train AI models. Anthropic's commercial terms don't allow it to train its models on what we send it.

If you're in the EU or UK, our legal bases are: our contract with you (running your account and sites), our legitimate interests (security, preventing abuse and improving dotsy), and legal obligations where they apply.

Google Search Console and Bing Webmaster Tools data#

• We use it only to show the site's search performance to the people in its workspace and to the AI assistants they connect to dotsy.
• We keep short-lived copies of search numbers for up to 7 days. Google keeps the history, so we don't store it.
• We don't sell it, we don't use it for advertising, and we don't use it to train AI models.
• When you disconnect, we delete our cached data and stop using the access. You can also remove dotsy's access to your Google account, in dotsy or at myaccount.google.com/permissions. Your Google account stays an owner of the site in Search Console; remove it there if you want.
• dotsy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Bing works the same way: we use its data only to show the site's search numbers to its workspace and the AI assistants they connect, keep short-lived copies for up to 7 days, and never sell it, use it for advertising or use it to train AI models. When you disconnect Bing, we delete our cached data and our copy of the access. Bing has no way for us to give the access back, so the site stays in your Bing Webmaster Tools account; remove it there if you want.

Visitors to sites on dotsy#

Sites on dotsy belong to their owners. For people who visit them:

• Analytics set no cookies and don't store IP addresses. We count unique visitors with a code that changes every day and is different for every site. We record the page, the referring website, the country, the browser, operating system and device type (not the full browser string), and any campaign tags in the link.
• Forms send answers to the site's owner by email, to their dotsy inbox, or both. We keep the sender's IP address only in a scrambled (hashed) form, to limit spam. If the owner connects an AI assistant to dotsy, the assistant can read the answers in that inbox when the owner asks it to (for example to sum up new enquiries).
• Cookies. A site sets a cookie only while its owner runs an A/B test, to remember which version you saw (for 30 days). People editing a site get a short-lived sign-in cookie.

Site owners decide what their sites collect, including any scripts they add, and they're responsible for their own privacy notice. If you visited a site and have a request about your data, contact its owner. We'll help them answer. Business customers who need a data processing agreement can email us.

Cookies on our own sites#

The dashboard uses only the cookies that keep you signed in. On dotsy.ai we set a dotsy_ft cookie on your first visit (referrer, landing page and campaign tags in the link, if any; 30 days) so we know how people found us when you sign up; it is sent to other dotsy.ai hosts such as the app and API. We do not use advertising or third-party tracking cookies. We host our own fonts, so loading a page sends nothing to Google.

Who we share it with#

We use these providers to run dotsy. They handle information for us, only as much as each one needs:

We also send information where you ask us to: to a domain provider you connect, and to a website you import. People you invite to a workspace or site can see its content and activity, depending on their role.

We may disclose information if the law requires it, to protect people or the service, or as part of a merger or sale of the business. This policy would keep applying to it.

Our providers may handle information in the United States and other countries.

How long we keep it#

• Account details and sign-in records: while your account is open.
• Sites, their earlier versions and activity log: until you delete the site or close your account.
• Analytics: individual page views, with that day's visitor code, expire after about 3 months. Daily totals are kept for 400 days.
• Form answers: until the site's owner deletes them or the site.
• Feedback: as long as it helps us improve dotsy.
• Bug reports: the report, its screenshots and images and our replies, until you ask us to delete them. Images you upload but don't send are deleted after a day.
• Server logs: up to 7 days.

To close your account, email us and we'll delete your account and your sites.

Your rights#

Wherever you live, you can ask us for a copy of your information, or ask us to correct it, delete it or stop using it for a purpose. Email hello@dotsy.ai and we'll reply within 30 days. You can download your sites' content yourself at any time with the dotsy command-line tool or the API.

If you're in the EU or UK, you can also complain to your local data protection authority.

Security#

Every connection uses HTTPS. Passwords and API keys are stored as hashes, domain-provider access is encrypted, and every request is checked against your access. Connector sign-in tokens expire after an hour. No system is perfectly secure: if a breach affects your information, we'll tell you. Report security issues to hello@dotsy.ai.

Children#

dotsy isn't for children. You must be at least 16 to create an account. If you think a child has given us personal information, email us and we'll delete it.

Changes to this policy#

We'll post changes here and update the date at the top. If a change is significant, we'll tell account holders by email or in the dashboard before it takes effect.

Contact#

hello@dotsy.ai
Loving Universe LLC, a Wyoming limited liability company