Privacy Policy

Dunyo — People Operations and Project Management for Growing Teams
Effective Date: October 5, 2026
Last Updated: October 5, 2026

1. Introduction

Dunyo, Inc. ("Dunyo," "we," "us," or "our") is committed to protecting the privacy of individuals who use our platform at dunyo.app (the "Service"). Dunyo is a workspace that brings people operations and project management together, helping growing teams organize their people, plan and track their work, and support career growth. This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it.

This Policy applies to:

• Workspace Administrators and Members who use the Service directly — including managers, people and HR teams, and other employees;
• Individuals whose personal data is entered into the Service by a customer organization (such as employees whose org structure, absence, or career data is managed through Dunyo).

If you are an employee whose data has been entered into Dunyo by your employer, your employer is the data controller for your data. Please contact your employer for questions about how your data is handled within the Service.

2. Data Controller and Contact

For personal data relating to Workspace Administrators and Members who directly use the Service, Dunyo, Inc. is the data controller:

Dunyo, Inc. Email: [email protected] Address: 651 N Broad St, Suite 201, Middletown, DE 19709 Website: https://dunyo.app

For personal data relating to employees or other individuals entered into the Service by a customer organization, that customer organization is the data controller. Dunyo acts as a data processor on their behalf, as governed by our Data Processing Addendum.

EU Representative: Dunyo has not yet designated an EU representative under Article 27 GDPR. If you are an EEA resident with questions or requests regarding your personal data, please contact us directly at [email protected].

3. Information We Collect

In the preceding 12 months, we have collected the following categories of personal information:

3.1 Information You Provide

• Account information: name, username, email address, password (hashed and never stored in plain text), profile photo, and optional profile details you choose to add, such as job title, mobile number, birthdate, bio, social profile links, and location (city, country, and timezone);
• Billing information: billing contact name and email, and payment card brand, last four digits, and expiry date. Full card details are collected and stored by our payment processor, Stripe, and never reach our servers;
• Workspace data: organizational structure, departments and team memberships, roles, reporting lines, vacancies, schedules, absence records, career ladder levels and progression, initiative, project, and issue data, comments and attachments, and other content you or your organization enters into the Service;
• Communications: messages you send to our support team, including through the in-app support chat.

3.2 Information Collected Automatically

• Activity data: actions taken within a Workspace, such as creating, updating, or deleting records, which are recorded in the Workspace audit log, and your online/offline status;
• Device and technical data: IP address, approximate location (city) derived from your IP address, browser type and version, operating system, device identifiers. We use approximate location to alert you to sign-ins from new devices;
• Authentication data: OAuth tokens (for Google sign-in), access token metadata.

3.3 Information from Third Parties

• OAuth providers: if you sign in with Google, we receive your name, email address, and profile picture from Google, subject to Google's privacy policy. We do not receive your Google password.

3.4 Cookies and Similar Technologies

We use strictly necessary cookies to maintain your session, keep you logged in, and protect against cross-site request forgery. These cookies are essential for the Service to function and do not require your consent. Our in-app support chat, provided by Chatwoot, stores a functional cookie so your support conversation continues across pages. We do not use advertising cookies, analytics cookies, or any cookies for tracking or behavioral profiling.

On our website (dunyo.app), we use Cloudflare Web Analytics to count page views. It does not use cookies or local storage, does not track you across sites, and does not build visitor profiles.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service;
• Authenticate users and manage accounts and Workspaces;
• Send transactional emails (account activation, invitations, password reset, billing notifications, and trial expiry reminders);
• Respond to support requests and communicate with you about the Service;
• Detect and prevent fraud, abuse, and security incidents;
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for advertising purposes. We do not use Your Content (including projects, issues, or people data) to train machine learning models or for any purpose outside of providing the Service to you.

5. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

For special category data (such as health information or other sensitive data that may be included in HR records entered by a customer organization), the customer organization as data controller is responsible for establishing the applicable legal basis under Art. 9 GDPR before entering such data into the Service.

6. How We Share Your Information

We share personal data only in the following circumstances:

6.1 Service Providers (Sub-processors)

We engage trusted third-party service providers who process data on our behalf. All sub-processors are bound by data processing agreements and may only process data as instructed by us. Our current sub-processors include:

• Akamai Technologies (Linode) — application and database hosting (United States);
• Cloudflare — web delivery, network security, file storage, and cookie-free website analytics (United States and global edge network);
• Brevo (Sendinblue) — transactional email delivery (European Union);
• Google — Google sign-in and support email (United States);
• Stripe — subscription billing and payment processing (United States);
• Chatwoot — in-app customer support chat (United States).

The full and current list of sub-processors, including the data each one processes, is maintained in Annex III of our Data Processing Addendum.

6.2 Business Transfers

If Dunyo is involved in a merger, acquisition, or sale of all or substantially all of its assets, your data may be transferred as part of that transaction. We will notify you by email and by posting a notice in the Service before your data is transferred and becomes subject to a different privacy policy.

6.3 Legal Requirements

We may disclose your data if required by law, court order, or governmental authority. Where permitted by law, we will notify you of such requests before complying.

6.4 Protection of Rights

We may disclose data where necessary to protect the rights, property, or safety of Dunyo, our users, or others, including to prevent fraud or imminent harm.

7. International Data Transfers

Dunyo, Inc. is based in the United States, and our servers are located in the United States. Our personnel may also access personal data from Uzbekistan to provide support and operate the Service. If you are located in the EEA, UK, or other regions with restrictions on cross-border data transfers, your personal data may be transferred to and processed in these countries.

We rely on the following mechanisms to ensure lawful transfers:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914/EU), incorporated into our Data Processing Addendum;
• UK International Data Transfer Addendum to the SCCs for transfers from the United Kingdom;
• Adequacy decisions where applicable.

You may request a copy of the applicable transfer mechanism by contacting us at [email protected].

8. Data Retention

We retain personal data for as long as necessary to provide the Service and fulfill the purposes described in this Policy, or as required by law.

After the applicable retention period, data is securely deleted.

9. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of data at rest;
• Hashed storage of passwords using industry-standard algorithms (passwords are never stored in plain text);
• Role-based access controls and principle of least privilege for internal staff;
• Redis-backed session management with token expiry;
• Regular security reviews and monitoring.

No system is completely secure. In the event of a personal data breach, we will notify affected users and relevant supervisory authorities as required by applicable law, within the legally required timeframes (72 hours under GDPR where applicable).

10. Your Rights

10.1 Rights for EEA/UK Residents (GDPR/UK GDPR)

You have the following rights with respect to your personal data:

• Access (Art. 15): obtain a copy of the personal data we hold about you, along with information about how it is processed;
• Rectification (Art. 16): request correction of inaccurate or incomplete data;
• Erasure (Art. 17): request deletion of your data ("right to be forgotten"), subject to legal retention obligations;
• Restriction (Art. 18): request that we restrict processing of your data in certain circumstances;
• Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format;
• Objection (Art. 21): object to processing based on legitimate interests;
• Withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at [email protected]. We will acknowledge your request within 5 business days and respond substantively within 30 days (or 60 days for complex requests, with notice to you).

You also have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu.

10.2 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties with whom it is shared;
• Right to Delete: request deletion of your personal information, subject to certain exceptions;
• Right to Correct: request correction of inaccurate personal information;
• Right to Opt Out of Sale or Sharing: Dunyo does not sell or share personal information for cross-context behavioral advertising. You may nonetheless submit an opt-out request at [email protected];
• Right to Non-Discrimination: we will not discriminate against you for exercising your rights.

To exercise your California rights, contact us at [email protected]. We will respond within 45 days, with a possible 45-day extension where reasonably necessary.

10.3 Rights for All Users

Regardless of location, you may:

• Access and update your account information through your account settings at any time;
• Request an export of Your Content by contacting [email protected];
• Delete your account by contacting [email protected] — we will process deletion within 30 days;
• Opt out of non-essential communications through your account notification settings.

11. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us at [email protected] and we will delete it promptly.

12. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by email and by posting a notice in the Service at least 14 days before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision. For minor changes (such as clarifications that do not affect your rights), we may update the Policy without advance notice beyond updating the date.

13. Contact Us

For privacy-related inquiries, to exercise your rights, or to raise a concern:

Dunyo, Inc. Email: [email protected] Address: 651 N Broad St, Suite 201, Middletown, DE 19709 Website: https://dunyo.app