Privacy Policy

Finding your business on Google

When you search for your business, the name and location you enter are sent to Google Maps to find matching listings. Google handles that search under its Privacy Policy. DoneAsk saves the review destination you select, not a directory of search results.

Who operates DoneAsk

DoneAsk is operated by Maoz Chonowitz, Israel. Contact: support@doneask.com. This policy covers business owners, their customers and website visitors.

Our roles

DoneAsk is responsible for account, billing, security and support data. Each business decides which customers to contact and why. For customer names, phone numbers, job details, messages and feedback, that business is the controller and DoneAsk processes data on its instructions. We do not acquire ownership of customer data.

Information we use

• Account information: your name, email, business details, country, language and settings. Email sign-in uses a password hash. Google sign-in, when configured, uses your Google account identifier, name and verified email; DoneAsk does not receive your Google password.
• Customer information: names, phone numbers, optional job notes, follow-up permission, messages, replies, feedback categories and opt-out records.
• Activity: prepared messages, WhatsApp handoffs, connected-service message events, errors and review-link visits. Opening WhatsApp does not prove sending. A review-link visit does not prove a review was posted.
• Billing information: subscription identifiers, status and payment events received from PayPal when checkout is enabled. PayPal handles payment credentials; DoneAsk does not store full card details.
• Necessary technical information such as session identifiers and server logs.

Why we use it

We use account data to provide the service, authenticate you, administer subscriptions, secure the system, respond to requests and meet legal obligations. On a business’s instructions, we use customer data to prepare or send follow-ups, collect and classify replies, record feedback, prevent duplicate or unwanted contact and provide review links. The business must obtain appropriate permission and give customers the required notice.

AI, WhatsApp and other providers

Railway hosts the application and database. DeepSeek and Google Gemini are the supported AI services; the configured primary or fallback receives relevant message text, names and job notes to understand requests, draft replies and classify feedback. Automatic follow-ups use Meta’s WhatsApp Business Platform. Google provides sign-in and, when available, business search. PayPal processes subscriptions and payment credentials. These providers may process data outside your country.

See the Data Processing Agreement, Google privacy policy, PayPal privacy statement and WhatsApp privacy policy. Contact support@doneask.com for information about processing locations and safeguards applicable to your account.

Retention and deletion

Our retention policy is 12 months for customer records, linked WhatsApp messages and feedback, and 30 days for incoming messages that cannot be linked to a business, unless deleted sooner or a legal obligation requires longer retention. Cleanup of a business’s older customer records runs when its dashboard is opened. Deleting a customer removes linked messages; deleting a business removes its linked message records. Deletion from the active database does not imply immediate removal from backups. Contact support@doneask.com for a deletion request or backup-retention information. Authentication sessions last up to 30 days. Account deletion is available in Settings. Minimal opt-out records may need to remain to prevent unwanted contact; billing records may be retained to meet legal obligations.

Your choices

Customers can reply STOP to a connected Chino conversation or ask the business to stop contact. Manual WhatsApp replies go to the business, which must honor them. Contact the business first for access, correction or deletion of its customer records, or contact support@doneask.com. We assist with requests and applicable privacy rights. You may also contact your local privacy regulator.

Security and cookies

We use account-scoped access, password hashing, HTTPS in production and restricted credentials. No service is perfectly secure. Necessary cookies keep you signed in and secure the Google sign-in flow. DoneAsk does not use advertising cookies or marketing trackers. See the Cookie Notice.