Privacy Policy — DoifyNow
Read DoifyNow Privacy Policy to understand what data we collect, why we collect it, and your GDPR rights.
1. Scope
This notice covers personal data processed through the DoifyNow public site, account page, and same-origin AuthAPI. Product-domain records remain governed by the relevant product site's privacy notice. Contact: [email protected].
2. Data processed by DoifyNow
- Sign-in credentials submitted to AuthAPI; the browser client does not persist the password
- Account identity fields returned for the session: internal user ID, name, and email address
- An opaque session token and its expiry state used to authenticate and revalidate the browser session
- Read-only billing state returned to the account page: an active flag and entitlement identifiers
- Service-key metadata such as owner, name, scopes, and expiry when AuthAPI service-key features are used
- Language and analytics-consent preferences, optional getting-started progress, consented analytics events, and technical security request data
- Information included when composing a contact email in the user's own mail client
- Administrator overview metrics aggregated from account, session, service-key, subscription, entitlement, and billing-event records
- Administrator audit records containing actor IDs, actions, resource types, results, timestamps, and request IDs, but not credentials or request payloads
The Angular client receives no database or Stripe credentials. A plaintext service key is returned only at creation; AuthAPI retains its hash, and service keys cannot become browser sessions.
3. Purposes
- Authenticate users, maintain and secure sessions, and provide the account page
- Authorize read-only subscription or entitlement access for a user session or correctly scoped service key
- Create and revoke scoped service keys when an authenticated user requests those operations
- Provide and secure site content, remember preferences, and respond to messages
- Understand site use when analytics is enabled and consent is provided
- Provide authorized operational visibility and an append-only audit trail for administrator access
4. Browser storage and requests
The bearer session token is stored in per-tab sessionStorage, not persistent localStorage.
The current session profile is held in application memory. The client sends the bearer token only to the configured
same-origin AuthAPI path and clears it after sign-out or a rejected, invalid, or expired session. See our
Cookie Policy.
5. Retention and rights
Browser session storage normally ends when the tab session ends and can be cleared earlier by signing out. AuthAPI identity, session, hashed service-key, security, and billing-snapshot records are retained only as needed for the service, security, and applicable obligations; this notice does not state a fixed external retention period. You may request access, correction, deletion, restriction, portability, or object to processing where applicable by contacting us.
6. Product handoff
Following a link to any Now product takes you to an independently operated site. That site's privacy notice governs data collected there.
Theme, demo, and optional identity providers
Theme and language preferences stay in browser storage. The interactive demo uses synthetic records and keeps edits in per-tab session storage; Reset restores the sample data and Exit clears it. Do not enter personal data in the demo.
If Google or Apple sign-in is enabled, the requested authorization redirects to that provider. AuthAPI processes the provider identity and permitted account fields needed for sign-in, such as an identifier, name, and email, which may be an Apple relay address. Provider credentials and tokens are not included in the public browser configuration or analytics. Each provider's privacy notice governs its own processing.
Analytics is optional and requires an affirmative choice when enabled. Declining does not block the site or account access. You can change the choice through Analytics settings in the footer; revocation stops future client tracking and does not remove events already received. We do not send credentials, form contents, or demo records to site analytics. The eight Now products have their own operational and privacy boundaries; follow the relevant product's notice after leaving this site.
Development stages describe the portfolio direction. Features, access, and availability vary by product; a listing does not mean every planned feature is live.