Donely

GDPR overview

Donely claims GDPR alignment explicitly rather than certification: its enterprise page states the architecture aligns with Zero Trust, NIST, ISO 27001, GDPR, and SOC 2 principles. That claim is backed by a working mechanism — a dedicated deletion page handling GDPR and CCPA requests within 30 days, with a confirmation email — and the privacy policy grants access, correction and deletion rights, exercisable through privacy@donely.ai. Beyond that, the framework is thin. No Data Protection Officer is named, no EU representative under Article 27 is designated, no Data Processing Agreement is published or offered on request, and no subprocessor list exists. Hosting jurisdiction is never declared: the policy only warns that data may be processed in the United States or elsewhere. SOC 2 appears as an Enterprise selling point, never as a completed audit.

Who owns the data?

Under the terms, you remain responsible for Your Content, meaning the data, text and feedback you supply plus the usage data generated as you work. Ownership as such is not transferred, but the licence you grant is unusually wide: worldwide, non-exclusive, perpetual, irrevocable, royalty-free, sublicensable and transferable, extended to Donely and to its third-party partners. It covers using, modifying, reproducing, distributing and performing your content in order to run the service and to improve it, model training included except where your plan or a separate written agreement excludes it. Feedback is treated differently and becomes Donely's sole property outright, with all rights assigned.

Reuse rights

End users may reuse their own content freely: nothing in the terms restricts what you do with the material you supply or with the outputs the agents produce for you. The restriction runs the other way. You must warrant that you hold the rights needed to grant Donely its licence, and the terms limit use of the service itself to personal, non-commercial purposes, forbidding resale, sublicensing, redistribution and the creation of derivative works from the service or its content. Personal, non-commercial sharing on social media is explicitly encouraged. Donely also disclaims any liability for AI outputs, leaving you to evaluate their accuracy, completeness and safety before acting on them.

Data retention & training

Hosting summary

Donely does not declare where customer data is hosted. Neither a country nor a region is stated anywhere on the site; the only relevant clause is a cross-border transfer notice in the privacy policy warning that data may be stored or processed in the United States or in other jurisdictions where the company operates. That is a consent clause, not a hosting disclosure, and it should not be read as one. What is described is the protection applied rather than the location. Data is encrypted in transit with TLS and at rest with AES-256 or an equivalent, access is controlled by role, and security reviews are run regularly. Architecturally, each customer receives a dedicated instance and each agent runs in an isolated container with its own network boundaries, so tenants are separated by design. Higher tiers advertise deployment on the customer's own infrastructure, in a private VPC or on premises, which would keep data off Donely's servers entirely. The public site resolves behind Cloudflare, which tells you nothing about where storage actually sits. Anyone with a data-residency requirement should obtain a written answer before signing.