Privacy Policy

Done For You Hub ("we," "us," or "our") operates Done For You Hub (the "Service") at https://yourdfyhub.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

2.1 Information You Provide

• Account information: Name, email address, phone number, and password when you register for an account or authorize an MCP client.
• Profile information: Any additional details you add to your profile, including business name and industry.
• Payment information: Collected and processed by Stripe, Inc., our payment processor, on Stripe's hosted checkout page. Stripe receives your card details, billing name, email address, and transaction details. We receive confirmation of payment and your subscription status; we do not receive or store your payment card number.
• Communications: Messages you send us for support or feedback.
• Communications consent records: When you agree to receive calls or text messages from us, we record the phone number you provided, the date and time of your agreement, your IP address, and the exact text of the disclosure you were shown, so that we have an accurate record of what you agreed to.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, and interactions with the Service.
• Device information: Browser type, operating system, IP address, and device identifiers.
• Cookies and tracking: See Section 8 (Cookies).

2.3 Business and CRM Data

If you use our CRM integration features, we may process contact information and customer data from your connected systems (including GoHighLevel). You remain the data controller for any customer data you import. We act as a data processor and handle such data only as directed by you. See our Data Processing Addendum for details.

2.4 Third-Party Platform Data

When you connect external platforms (Jobber, GoHighLevel, Google Analytics, Search Console, WordPress, and others), we receive data from those platforms on your behalf. The specific data depends on which platforms you connect and which OAuth scopes you authorize. We access only the data within the scopes you authorize and you can disconnect any platform at any time.

2.5 AI Secretary

If you subscribe to the AI Secretary, it answers calls and approved text messages to the phone number we provide you. This means we process information about people who are not our customers:

• People who call your Secretary number: the caller's phone number, a transcript of the call, and an AI-generated summary of it (caller name and company if given, reason for calling, action items, and urgency). On the Executive plan we also keep an audio recording of the call. Every call begins with an announcement that it may be recorded and transcribed.
• People who text your Secretary number: messages from numbers you have approved. Messages from other numbers are ignored and their content is not stored.

To provide this feature, call audio and content pass through Telnyx (the phone line and text messages), Vapi (call handling, and storage of call recordings), Deepgram (speech-to-text), PlayHT (the Secretary's voice), and Anthropic (the AI that conducts the call and writes summaries). Each receives only what it needs for its part of the call.

We keep AI Secretary data for as long as your account exists and delete it, including recordings held by Vapi, within 45 days of a verified deletion request, the same as the rest of your account data (see Sections 6 and 11).

If you called or emailed a business that uses our AI Secretary, that business, not Done For You Hub, is your point of contact for questions or requests about your call or message. We will help it respond.

We use your information to:

• Provide, maintain, and improve the Service.
• Process transactions and manage your subscription.
• Send transactional emails and account notifications.
• Contact you by phone call and text message at the number you provide about your account, including service, security, billing, and support messages. These messages may be delivered by automated means.
• With your separate consent, contact you by phone call and text message with marketing and promotional messages, including by automatic telephone dialing system and by prerecorded or artificial voice.
• Respond to your support requests and communications.
• Analyze usage patterns to improve features and user experience.
• Run AI-powered audits and analyses of your business data.
• Generate recommendations, insights, and optimization suggestions.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell your personal information to third parties.

We may share your information with:

• Service providers: Third-party vendors who help us operate the Service (hosting, payment processing, email delivery, analytics). These providers are contractually obligated to use your information only as directed.
• Stripe, Inc.: Our payment processor for subscription and credit billing. Stripe's privacy policy is at https://stripe.com/privacy.
• Telephony and messaging providers: We use Telnyx to place calls and deliver text messages to you on our behalf. We share your phone number with this provider solely to deliver those communications.
• Anthropic, PBC: Our AI provider. Data sent to AI features may be processed by Anthropic in accordance with their privacy policy.
• Langfuse: Our AI monitoring provider. It receives the prompts and outputs of AI features, which may include your business data or AI Secretary caller content, and metadata about each AI request.
• Sentry: Our error-monitoring provider. It receives error reports with request metadata; request bodies, headers and cookies are stripped before they are sent.
• Exact Match Marketing, Inc.: Provides the visitor-identification pixel on our marketing pages (see Section 8). Exact Match uses this data for its own purposes as well as ours and is not our service provider.
• Connected Platforms: When you authorize an action (or enable auto mode), we transmit data to connected platforms via their APIs only as directed by you.
• Legal requirements: We may disclose information when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.

We do not share your phone number, or data from the platforms you connect to the Service, with third parties for their own marketing or for advertising. Apart from the Exact Match visitor pixel described in Section 8, we do not disclose personal information to third parties for their own marketing purposes.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA). We extend these rights to all users whether or not a law requires it.

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: We do not sell personal information. If your browser sends the Global Privacy Control signal, we do not load third-party visitor-identification scripts on our website (see Section 8).
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your rights, contact us at [email protected].

We keep your personal information for as long as your account exists. When you cancel a paid plan, your account continues on the free plan and keeps its data; every connected platform is disconnected and its access revoked when your last paid plan ends, and the AI Secretary's Gmail access is revoked when that plan ends. We delete your account and its data when you ask us to (see Section 11), and we may delete the data of an account we have terminated. Records we must keep to meet legal, tax or dispute obligations are retained for as long as those obligations require.

Records of your communications consent and of any opt-out request you make are retained after account closure where necessary to demonstrate compliance with telephone and messaging laws and to ensure we continue to honor your opt-out.

We implement multiple layers of security to protect your information:

• All OAuth tokens and API credentials are encrypted at rest using AES-256-GCM with per-tenant HKDF-derived keys.
• Row-Level Security (RLS) is enforced on all tenant-scoped database tables.
• Passwords are hashed with bcrypt. Authentication uses JWT tokens.
• All data in transit is encrypted via TLS/HTTPS.
• Webhook endpoints verify HMAC signatures before processing.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We use cookies and similar tracking technologies to:

• Keep you logged in to the Service.
• Remember your preferences.
• Analyze usage patterns to improve the Service.
• Identify visitors to our marketing pages (see the Exact Match visitor pixel below).

Exact Match visitor pixel. On our public marketing pages (such as our home, pricing, features, done-for-you SEO, blog, demo, SEO MCP, and legal pages), we load a visitor-identification script provided by Exact Match Marketing, Inc., a company affiliated with DFY Hub's operator. On those pages the script records each page you view, the referring site, the page title, your time on the page, campaign tags (UTM parameters), your browser and device characteristics, and any advertising click identifiers in the page address. It sets a first-party visitor cookie (_em_vid) that lasts 90 days, plus a 90-day cookie for each advertising click identifier present. It builds a device fingerprint from your browser's technical characteristics (such as screen size, time zone, language, graphics hardware, and installed-font measurements) so that your device can be recognized on later visits, and stores that fingerprint identifier in your browser's local storage. Your IP address is sent to an IP-intelligence provider to check for bot, proxy or hosting use and is used to determine your country; a cached copy of that check is kept for up to 24 hours, and after that your IP address is stored only as a daily-rotating hash and a network prefix. The script also records which buttons and links you click (their visible text and the page address) and the field names, but not the contents, of forms you submit. If you submit a form on one of those pages that includes an email address, the script captures the email address and any name and phone number in the same form. Exact Match combines information collected on our pages with information it collects from other websites that use its service, so a device or person seen on our site can be linked to a record created elsewhere, for its own purposes as well as ours. Exact Match's service can send page-view and conversion information (hashed email or phone number, IP address, browser details, and click identifiers) to advertising platforms; we have not connected any advertising platform, no information about our visitors has been sent to one, and we will update this Policy before enabling that. Exact Match Marketing, Inc. is a data broker registered with the California Privacy Protection Agency; its privacy policy is at https://exactmatch.io/legal/privacy, and its Consumer Privacy Rights Notice, which explains how to request access, deletion, or opt-out, is at https://exactmatch.io/legal/customer-data-policy. If your browser sends the Global Privacy Control signal, we do not load this script; you can also block the domain nfw8xqyn.yourdfyhub.com. Until October 6, 2026 the pixel also loaded on our sign-in and registration pages and may have captured email addresses entered there; the event records from those pages were deleted on October 6, 2026.

Umami: We use Umami, a cookie-less analytics tool that we host ourselves, to count page views and sign-ups across our website and the Service. It records the page, the referring site, and your browser, device type, and country. It does not set cookies or build a profile of you, and its data is not shared with anyone.

Microsoft Clarity: Until July 28, 2026 we used Microsoft Clarity, a behavioral analytics tool that recorded mouse movements, clicks, scrolling, and page navigation. We no longer use it.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Service.

We do not use Google Analytics on the Application itself (we use Google Analytics data only from your connected accounts, for your benefit).

We do not respond to browser Do Not Track signals. If your browser sends the Global Privacy Control signal, we do not load third-party visitor-identification scripts on our website.

The Service integrates with third-party platforms including GoHighLevel, Google (Analytics, Search Console, Ads, Business Profile, YouTube, Contacts, Sheets), WordPress, and Jobber. We comply with each connected platform's developer terms and API usage policies, including Google's Limited Use requirements. We access Google user data only to provide the Service features you have requested and do not use Google data for advertising or transfer it to third parties except as necessary to provide the Service.

Gmail. Connecting Gmail to the AI Secretary is not currently available. If we offer it, we will update this policy first. The connection would be read-only, and we would access your Gmail data solely to identify urgent messages and action items in your inbox for the Secretary's alerts and briefings. That data would be processed by an AI provider (Anthropic) to provide the feature and would not be used to develop, improve, or train generalized AI or machine-learning models. No human would read it except with your consent, for security purposes, or as required by law.

The Service is offered to businesses located in the United States, and we store and process your information in the United States. Logo images you upload to brand your reports are stored with Cloudflare R2 in its Eastern North America region, which may include Canada, and anyone with an image's link can view it.

You may:

• Access and update your account information through your account settings.
• Delete your account by contacting us at [email protected]. We delete your account and its data within 45 days of a verified request, except records we must keep by law.
• Opt out of marketing emails by clicking the unsubscribe link in any marketing email.
• Opt out of marketing calls and text messages at any time. You may reply STOP to any text message, tell any caller that you no longer wish to be contacted, or email us at [email protected]. You may revoke your consent by any reasonable means, and we will honor your request within 10 business days. Opting out of marketing calls and texts does not stop essential service, security, and billing messages about your account.
• Request a copy of your personal data in JSON format by contacting us.
• Disconnect connected platforms at any time through the dashboard, which immediately revokes stored OAuth tokens.

Our Service is designed for business use and is not intended for individuals under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us at [email protected] and we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

For privacy-related questions or to exercise your rights:

Done For You Hub
Email: [email protected]
Website: https://yourdfyhub.com