Privacy Policy

This Privacy Policy explains how Dinabite Limited, a company registered in England and Wales (company number 09788163) whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Dinabite", "we", "us") handles personal data. You can contact us about privacy at will@dinabite.ai.

• As a controller: We decide how data is used for our own website, our customer accounts and billing, support, security, and our own marketing and sales. Sections 3 and 4 cover this.
• As a processor: Businesses that use Dinabite (our "customers") store and process data about their own contacts, prospects, customers and website visitors in the Service. For that data, the customer is the controller and we process it on their instructions. Sections 5 to 9 describe what that involves.

If you received an email or message from a business that uses Dinabite, visited its website, or appear in its CRM, that business is responsible for your data. Please contact it first. If you contact us, we will pass your request to the business where we can identify it.

• Account and profile: name, email address, phone number, organisation, role, profile photo and preferences. If you sign in with Google or Microsoft we receive your name and email address from them.
• Security: sign-in times, IP addresses, devices, multi-factor and passkey settings (secrets are stored encrypted), and audit logs of administrative and support actions.
• Billing: billing contact, company and VAT details, plan and payment history. Card details are handled by Stripe; we do not see or store full card numbers.
• Usage: which features you use, AI usage and costs, errors and diagnostic logs, used to run, secure and improve the Service.
• Communications: messages you send us, support conversations, survey answers and your email preferences.
• Our website: pages visited, referrer, campaign tags, device and browser information, form submissions and sign-ups. See section 4.
• Affiliates and referrals: if you join our affiliate programme or arrive through a referral link: your referral code, referred sign-ups and commission records.
• Our own sales and marketing: business contact details of people we think may be interested in Dinabite, from LinkedIn, company websites and business data providers, and records of our emails and messages to them. We use the same tools we offer customers, including email verification. Every email includes a way to opt out.

On dinabite.ai we use our own analytics and Hotjar (heatmaps and session recordings), only after you allow analytics in the cookie banner where the law requires consent. See the cookie policy for details and to change your choice.

If you allow marketing in the cookie banner (or, where consent isn't required, unless you turn it off), our server tells Meta (Facebook and Instagram) when you view a page on our marketing site, sign up, or buy a plan, so we can measure our ads. The record includes the page address, your IP address and browser user agent, Meta's own cookie identifiers if your browser already has them, and, for sign-ups and purchases, your email address in hashed form. Meta uses this to report how our ads perform and to show our ads to similar people. You can change your choice at any time in Cookie settings.

What we hold depends on the features each customer uses. It can include the following, about the customer's team and about people the customer deals with:

• CRM: contacts, companies, deals, tasks, notes, custom fields, tags, documents and files, and records imported from HubSpot, GoHighLevel, Smartlead, Aimfox, CSV files or other tools.
• Email: campaign recipients, sends, opens, clicks, bounces, unsubscribes and replies; shared inbox conversations; and cold email sequences, mailboxes and replies.
• Connected mailboxes and calendars: if a team member connects Outlook, we read their mail (senders, recipients, subjects and message bodies), contacts and calendar events, read-only, to link them to CRM records. If they connect Google or Microsoft calendars for scheduling, we read availability and create, update and cancel the events they book.
• Meetings: bookings made on booking pages (name, email, answers to booking questions); and, if Fathom is connected, call summaries, action items and transcripts of the team member's recorded meetings, which can contain what other participants said.
• Documents and signatures: proposals and files attached to deals; and, if DocuSign is connected, the envelopes sent and their signing status.
• Social media: connected social profiles and pages, scheduled and published posts, comments, direct messages, reviews and post analytics, including the names and public profile details of people who interact.
• Advertising: connected ad accounts, campaigns and results, lead form submissions from Meta, and conversion events the customer chooses to send to ad platforms (with email addresses and phone numbers hashed).
• Websites, forms and live chat: submissions to forms and lead magnets, live chat conversations (including replies written by AI, if the customer turns that on), orders and tickets.
• Messaging: SMS and WhatsApp messages sent and received for the customer.
• Accounting: if a customer connects Stripe and Xero, invoices, payments and customer names synced between them.
• Development tools: if a customer connects GitHub or Slack, commit messages, repository details and messages the integration is set up to read or send.

Customers can put Dinabite analytics on their websites. Depending on the settings they choose, it records:

• pages viewed, visit duration, referrer, campaign tags, device and browser type, approximate location, and form and booking events. IP addresses are stored as a one-way hash, not in readable form;
• if the customer turns them on, session recordings (a replay of page activity such as clicks, scrolling and page changes) and heatmaps;
• if the customer turns it on, company identification: we look up the visitor's IP address with IPinfo to find the organisation that owns the network, so the customer can see which companies visited. This does not identify individuals;
• once a visitor submits a form or clicks a tracked email link, the visit history can be linked to that person in the customer's CRM.

Analytics events are kept for 90 days by default; the customer can change this. Each customer must tell its visitors about this tracking and get consent where the law requires it. The tracking can wait for consent before it starts.

Customers can use Dinabite to find and contact new business prospects. To do this we:

• search LinkedIn and view LinkedIn profiles through the customer's own connected LinkedIn account, using Unipile, and save names, job titles, companies, profile photos and profile text;
• look for business email addresses with Hunter, check that they can receive email with MillionVerifier, and read public company websites with Firecrawl to research the company;
• use AI to summarise this research and suggest a personal opening line;
• send the emails and LinkedIn messages the customer sets up, track opens, clicks and replies, and keep a suppression list so people who opt out or bounce are not contacted again.

The customer decides who to contact and must have a lawful basis to do so. If you have been contacted and want it to stop, reply to the message or use its opt-out link. You can also email us and we will pass your request to the customer and stop the outreach.

AI features run on models from Anthropic (Claude), OpenAI, Google (Gemini) and Moonshot AI (Kimi), some reached through the Vercel AI Gateway. When you use an AI feature, we send the provider the information it needs, which can include CRM records, messages, documents, call transcripts, website content and research results. We do not use your data to train AI models. Anthropic, OpenAI and Google do not use data sent through their business APIs to train their models.

The in-app chat assistant currently runs on Kimi from Moonshot AI Pte. Ltd. in Singapore. Moonshot's privacy policy allows it to use content sent to its service to improve and train its models, and it stores data in Singapore.

The assistant can remember facts and preferences you ask it to keep, which are stored in your workspace and can be deleted. AI is used to draft, summarise, classify (for example, sorting replies into interested or not interested) and suggest. It does not make decisions that have legal or similarly significant effects on people.

Dinabite's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We request access to Google Calendar (to show availability and manage bookings), Google Business Profile (to manage reviews and posts), Google Ads (to manage campaigns and report results) and Search Console (to report search performance), only when you connect them. We use this data only to provide those features to you. We do not sell it, use it for advertising, or use it to train AI models, and people at Dinabite do not read it except with your permission, for security, or where the law requires.

The same applies to data from Microsoft accounts (Outlook mail, contacts and calendars). OAuth tokens for connected accounts are encrypted at rest, and you can disconnect an account at any time in Settings.

Our optional Chrome extension (listed as "Workspace Assistant") only works after you sign in to your workspace. Depending on the features you use, it handles the following:

• LinkedIn session: when you connect or link a LinkedIn sender, the extension reads your LinkedIn session cookies (li_at, and li_a if you have Sales Navigator) and your browser's user agent, and sends them over an encrypted connection to the provider that runs LinkedIn messaging for your workspace, so it can connect or reconnect your account. We do not store these cookies on our servers, and the extension does not keep them.
• LinkedIn profiles you open: the extension reads the profile address to show whether that person is already in your workspace. When you ask it to save the person or draft a note, it sends the profile address and the visible profile text to the Service. It does not click, type, or send anything on LinkedIn for you.
• Gmail: in Gmail, the extension reads the email addresses and names on the conversation you open to show matching contacts, deals and tasks from your workspace. When you use a feature, it sends what that feature needs: the email text you choose to log, the conversation and draft you ask the AI to help with, or the recipients, subject and body of an email you send with tracking or logging on. It uses the Gmail page in your browser and does not connect to your Gmail account through Google's APIs.
• Email tracking: when tracking is on for an email you send, the extension adds a small invisible image and replaces links with redirect links, so the Service can record when the email is opened or a link is clicked (time, link, and the opening software's user agent). You can switch tracking off for any email before sending.
• Pages you choose to include: only when you tick "Include this page", the extension sends the current page's address, title, selected text and visible text with your chat message, so the AI assistant (and the AI model providers we use) can answer.
• Stored in your browser: sign-in tokens, your chosen workspace, and which LinkedIn sender the browser keeps connected.

We use this data only to provide the features you use. We do not sell it, use it for advertising, or use it to decide creditworthiness. Data from the extension is handled in line with the Chrome Web Store User Data Policy, including its Limited Use requirements. To stop all access, uninstall the extension or revoke it under Settings → API → Connected assistants.

You can connect an AI assistant, such as Claude, ChatGPT or Cursor, to your workspace through our MCP server (mcp.dinabite.ai). Connections are optional, and only you or another workspace member can set one up.

• What you choose: when you connect, you sign in, pick the workspace (or, for agencies, all client workspaces) and choose an access level: read only, or read and write. You can also allow approving Autopilot actions. A sign-in connection can only do what your own role in the workspace allows. Connection keys created in Settings → API have read and write access to one workspace.
• What the assistant can access: the workspace data its tools return when you ask, for example contacts and deals (names, email addresses, notes), social posts and comments, inbox messages, campaigns, outreach sequences and prospects, bookings, analytics, documents and brand settings. With read and write access it can also create and change data and act for you, including scheduling and publishing posts, sending email campaigns, replying to comments and reviews, starting outreach sequences and booking meetings.
• Sharing with the assistant's provider: data the assistant reads is sent to the AI provider you connected (for example Anthropic for Claude) and is handled under that provider's terms and privacy policy. We do not control how they process it.
• What we store: the connection (which assistant, workspace, access level, and when it was created and last used), hashed access and refresh tokens (never in plain text), and the changes the assistant makes, like any other change in your workspace. Access tokens expire after an hour; refresh tokens after 30 days.
• Disconnecting: revoke a connection at any time under Settings → API → Connected assistants, or delete its key under API keys. Access stops immediately. You can also disconnect from within the assistant.

• To provide the Service and manage your account: performance of our contract with you.
• To process customer data: on our customers' instructions, as their processor.
• Billing, tax and accounting records: legal obligation.
• Security, fraud and abuse prevention, including spam and deliverability monitoring: legitimate interests in keeping the Service and its users safe.
• Improving the Service, mostly using aggregated usage data: legitimate interests.
• Website analytics and session recordings: consent, where the law requires it.
• Ad measurement with Meta, our own B2B sales outreach, and product emails: legitimate interests in promoting Dinabite. You can object or opt out at any time.
• Legal claims and requests from authorities: legal obligation or legitimate interests.

We share personal data only with the service providers (sub-processors) that help us run the Service, with the third-party services you choose to connect, with workspace administrators for workspaces you belong to, with a buyer if our business is sold, and with authorities where the law requires. We do not sell personal data.

Our current sub-processors are:

• Hosting and infrastructure: Vercel (application hosting), Neon (database, London), Cloudflare (file storage in the EU, DNS and custom domains), Railway (background workers), Sentry (error monitoring).
• Email: Resend and Amazon Web Services (SES, US) for sending; Microsoft, InboxKit and Mailpool for cold email mailboxes; MillionVerifier (email verification); Hunter (email finding).
• Messaging and social: Unipile (LinkedIn), Twilio (SMS), Meta (WhatsApp, Facebook, Instagram), Zernio (social publishing), SocialAPI (social publishing).
• AI: Anthropic, OpenAI, Google, Moonshot AI, Vercel (AI Gateway).
• Research and analytics: IPinfo (company identification), Firecrawl (website research), Hotjar (analytics on our own website).
• Payments and accounting: Stripe (payments and billing), Xero (our accounting).

Services you connect yourself, such as Google, Microsoft, LinkedIn, TikTok, Fathom, DocuSign, HubSpot, GoHighLevel, Smartlead, Aimfox, Slack, GitHub and your own Xero or Stripe account, receive and return data under their own terms.

Our main database is in London and stored files are kept in the EU. Some providers, including our AI, email and hosting providers, process data in the United States and other countries. Where personal data leaves the UK or EEA, we rely on an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.

• Account and workspace data: kept until you or the customer delete it, or ask us to. Contacts, campaigns and workspaces that are deleted in the app are marked as deleted and hidden, but kept so they can be restored and so opted-out people stay suppressed. Closed workspaces are archived. Email us to have any of this erased permanently; we will do it within one month.
• Website analytics, session recordings and company identification: deleted automatically after 90 days by default; each customer can change this.
• Cookie consent records: deleted automatically after 24 months by default.
• Billing and tax records: at least six years, as UK tax law requires.
• Suppression lists: as long as needed to make sure people who opted out are not contacted again.
• Our sales prospect records: until you ask us to stop contacting you or to delete them.
• Backups: database backups are kept for a short rolling period by our database provider, then overwritten.

We protect data with encryption in transit, encryption at rest for connection tokens, mailbox passwords and multi-factor secrets, hashed IP addresses in analytics, role-based permissions, multi-factor sign-in and passkeys, and logging of staff support access. No system is completely secure, so please tell us at once if you think your account has been compromised.

Under the UK GDPR and similar laws, you can ask to access, correct or delete your personal data, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent where we rely on it. You can object to direct marketing at any time. Email us to make a request; we may need to confirm your identity and will reply within one month.

If your data is held by one of our customers, we will pass your request to them and help them respond. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority, though we would appreciate the chance to deal with your concern first.

If you live in a US state with a consumer privacy law, you have similar rights to know, correct and delete your data, and to opt out of targeted advertising. We do not sell personal information. To opt out of our Meta ad measurement, turn off marketing in Cookie settings. We also honour Global Privacy Control signals.

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children.

We will post any changes on this page and update the "Last updated" date. If a change materially affects how we use your data, we will tell account holders by email or in the app before it takes effect.

For privacy questions or requests, contact Dinabite Limited at:

will@dinabite.ai