Last updated: 2026-09-08
1. Introduction
Doana ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI customs agent services.
This policy applies to information we collect through our website, platform, email integrations, messaging integrations, and any other services we provide (collectively, the "Service").
2. Information We Collect
Account Information: When you register for an account, we collect your name, email address, company name, and payment information. For team accounts, we may also collect information about team members you invite.
Document Data: When you use our Service to process customs documents, we temporarily access and process the content of those documents to extract relevant data. This may include commercial invoices, airway bills, certificates, and other customs-related documentation.
Usage Data: We automatically collect information about how you interact with our Service, including access times, pages viewed, features used, and technical data such as your IP address, browser type, and device information.
3. How We Use Your Information
We use the information we collect to provide, maintain, and improve our Service, including processing your customs documents, extracting relevant data, and generating exports in your preferred formats.
We use your contact information to communicate with you about your account, provide customer support, send service updates, and (with your consent) send marketing communications.
We use aggregated and anonymized usage statistics (for example, which features are used and how often) to analyze usage patterns and enhance the overall quality of our Service. We do not use the content of your documents or extraction results to train or improve AI models.
4. Information Sharing
We do not sell your personal information. We may share your information with service providers who assist us in operating our Service (such as cloud hosting, payment processing, and analytics), subject to confidentiality obligations.
We may disclose your information if required by law, to protect our rights or safety, or in connection with a merger, acquisition, or sale of assets. We will notify you of any such disclosure to the extent permitted by law.
5. Data Security
We implement industry-standard security measures to protect your information, including encryption in transit and at rest, access controls, and regular security assessments. Our infrastructure is hosted on secure cloud platforms with SOC 2 compliance.
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.
6. Data Retention
We retain your account information for as long as your account is active. Document data processed through our Service is retained for a limited period necessary to provide the Service and comply with legal obligations.
You may request deletion of your account and associated data at any time. We will delete or anonymize your information within 30 days of such request, except where retention is required by law.
Documents sent through an AI assistant (ChatGPT, Claude, or another MCP client connected to Doana): the original file is stored in a Google Cloud Storage bucket controlled by Doana for up to 7 days and then deleted. The structured extraction result (the fields read from an EASA Form 1 and their confidence scores) is kept for up to 90 days after the extraction and then deleted.
To read the document, the file is processed by Google Cloud Vertex AI (Gemini) acting as a processor on Doana's instructions. Doana does not use your documents to train models. The AI assistant you use receives the extracted fields inside your conversation and handles them under its own privacy policy.
You can delete an extraction earlier at any time from the Agentic connector page of your Doana dashboard. The deletion covers the file, the structured result, and the job record, and is carried out automatically after your request.
7. Your Rights
Under GDPR and other applicable data protection laws, you have the right to access, correct, delete, or export your personal data. You also have the right to object to or restrict certain processing activities.
To exercise these rights, please contact us at privacy@doana.ai. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection authority.
8. International Data Transfers
Your information may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws through appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.
9. Children's Privacy
Our Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.
11. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@doana.ai or through our contact page.