1. Who we are
Sequence Theory, a sole proprietorship registered in Amsterdam, Netherlands, builds and operates Donezo. For the personal data described in this policy, Sequence Theory is the controller. When this policy says "we," "us," or "Donezo," it means Sequence Theory.
This policy covers the website at donezo.space and socials.donezo.space, the Donezo apps (Control Lab, Can, Docs, Grid, Make and Net), the help panel inside them, the Connected and Connected+ memberships, the setup service, and Donezo's own channels on social media.
2. How Donezo is built
Donezo runs in your browser, on your device. Your work is written to places you own: your browser's storage, the folder you connect on your device, your own Google Drive and, with Connected+, your own Cloudflare storage. Your work never reaches our servers.
That leaves a short list of what we do process, set out in Section 4, and a longer list of what we never receive, set out in Section 3.
3. What we never receive
- Your work: your files, documents, sheets, pages, tools, projects and workspaces
- Your vault and its content
- Your AI keys, your prompts, and what you or your agents send to your AI provider or receive back
- The passphrases of your sealed files, your Donezo card's key, and the sealed files themselves
- With Connected+: what your storage holds, your timed access keys, what your workers handle, and the work you keep in Ghost mode
- What people send through forms on pages you publish, and anything about the visitors of those pages
- Your photos and videos in Donezo Photos, which are sealed in your own Drive
- Your card details, which go to Stripe
4. What we process, and why
Your membership
When you buy Connected, Connected+ or a paid app such as Donezo Photos, we keep what runs your membership: your email, your plan and membership record, your device records, your payment reference and your referral credit. Your work is not part of it, and we keep no key to it.
- Email. To identify your membership, to send the link that validates a device when needed, to tell you when a new device is added, and to tell you about material changes to the Terms.
- Plan and membership record. Which plan you hold, when you bought it, and whether you hold an early access seat.
- Device records. A device identifier and a device proof for each device you validate, so your membership works on two devices and you can sign out all devices from Control Lab.
- Payment reference. The reference Stripe gives the payment, the amount, and the details your invoice needs.
- Referral credit. The credit you earned, and which purchases it came from.
No key to your work. We keep no key to your work. Validating your plan never opens it, and neither Donezo nor your plan holds anything of your work. If you keep your work in your own Cloudflare storage, it opens on demand with a key you set in your Cloudflare account and in Control Lab, and you can rotate that key whenever you want.
We process these to perform our contract with you. We keep payment and invoice records because Dutch fiscal law requires it.
The setup service
If you book the setup service, we use your email to arrange the session. During the session you work in your own Cloudflare account. We do not ask for your password, and we keep no key or credential after the session.
Messages you send us
If you write to us, or send feedback through the help panel, we receive what you write and any contact details you include, and use them to answer you and to improve Donezo.
Anonymous counters
The apps count a few events, such as an app being opened. These counters store no name, no email, no IP address and no cookie, so they cannot be linked to you.
The website
donezo.space runs no analytics, no advertising and no tracking cookies. When you choose a language or a look (theme, colour, motion, sound) on the website, in an app or on a template, two small cookies remember it for donezo.space and its subdomains, so every Donezo page looks and speaks the way you chose: dz_lang holds the language and dz_look the look, each with the time you chose it, nothing else, for up to a year. The site is delivered through Cloudflare, which processes technical data such as your IP address for each request in order to deliver pages and protect the site. We do not use that data to identify you.
Videos on the landing page load from YouTube's privacy-enhanced mode only when you press play. From that moment YouTube receives your IP address, and Google's privacy policy applies.
socials.donezo.space keeps the posts we publish on our social media channels. It works the same way: no analytics, no advertising, no tracking cookies, and every picture and clip is served from the site itself. A link to a platform takes you there only when you click it.
Our channels on social media
Donezo has its own channels on Facebook, LinkedIn, Instagram, YouTube, TikTok and Reddit. When you follow, comment on or message one of them, the platform processes your data under its own privacy policy. We see what the platform shows the holder of an account: your public profile, and what you post to us or send us. We use a message you send us only to answer it. Where a platform gives us statistics about our channel, such as page insights, they come to us as totals, and the platform and Sequence Theory are jointly responsible for that processing under the platform's own terms.
5. What stays on your device
Donezo uses your browser's storage to work: your appearance and language choices, the record that your plan is validated on that device, your vault, and your work in the free apps. This data stays on your device and is not sent to us. It is needed for the apps to do what you ask, so it does not require consent. You can remove it at any time by clearing your browser's site data.
6. Services you connect yourself
Some services connect directly to your own accounts. Data goes from your browser, or from your own worker, to the provider you chose. We are not part of that exchange, and the provider's own privacy policy applies.
- Google Drive. When you set up a backup in Control Lab, Google's sign-in script asks for your permission first and shows you the access Donezo requests. It is the one script from another company the Donezo apps load, and it loads only in Control Lab. Donezo uses that access only to save and read your Donezo files in your Drive. Donezo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Your AI provider. Your key, your account, your bill. What you ask goes from your browser to your provider.
- Cloudflare (Connected+). Your storage, your workers and your published pages run in your own Cloudflare account, under your agreement with Cloudflare.
- Your domain and your forms (Connected+). For the data that forms on your pages collect, you are the controller. You inform the people who send it and answer their requests (see the Terms, Section 10).
7. Who processes data for us
- Cloudflare runs the service that validates your plan and devices and stores your membership record, and delivers donezo.space and socials.donezo.space.
- Stripe processes payments. Stripe also acts under its own privacy policy for card data and fraud prevention.
- Resend sends the emails described in Section 4.
Where these providers process data outside the European Economic Area, the transfer relies on the safeguards the GDPR provides, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.
We do not sell personal data, and we do not share it for advertising.
8. How long we keep it
- Membership record: for as long as your membership exists
- Device records: until you remove the device or sign out all devices
- Payment and invoice records: 7 years, under Dutch fiscal law (AWR Art. 52)
- Messages and feedback: for as long as we need them to answer and follow up
9. Your rights
Under the GDPR you can ask us for access to your personal data, correction, erasure, restriction, a copy in a portable format, and you can object to processing. Write to us at . We answer within one month.
Some data we must keep by law, such as invoice records, even when you ask us to erase it. We tell you when that applies.
You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the authority in your own EU country.
10. Security
We keep what we hold to the short list in Section 4. Devices need a valid device proof before they can reach your membership record, and you can sign out all devices from Control Lab at any time. Your work never reaches us, so there is no store of it on our side to protect or lose.
Every copy of your work that leaves your device is sealed in your browser first. Validating your plan never opens it: neither Donezo nor your plan holds anything of your work or a key to it. Your Cloudflare storage opens on demand with a key you set in your Cloudflare account and in Control Lab, and you can rotate it whenever you want. Keep your email account and your Cloudflare account secure, with two-factor sign-in on both.
11. Children
Donezo is not directed at children under 16, and we do not knowingly process their personal data.
12. Changes to this policy
When this policy changes materially, we tell members by email and update the date at donezo.space/privacy.
13. Contact
Sequence Theory
Commelinstraat 198, 1093 VD Amsterdam, Netherlands
KvK 72222204