Privacy Policy

We collect the following, and nothing else:

• If you fill in the brief form — your name, company, email address, and the answers you give about the calendar you want (business type, package, deadline and any notes).
• If you buy a calendar — your email address and company name, plus the tier you bought. Card details are entered on Stripe’s systems and are never sent to us or stored by us.
• If you play a calendar — the first name or nickname you type when you arrive, which doors you have opened, and any accusation you submit. This is how the calendar knows where you are and stops two colleagues overwriting each other.
• If you enter your email to try a preview — that email address.
• If you sign in to a dashboard — your email address, handled by our authentication provider. You may sign in with Google, in which case we receive your email address and name from Google. We do not receive your Google password and we do not access anything else in your Google account.
• Whenever anyone visits the site — standard analytics data about pages viewed and how the site is used, as described below.

• To provide what you asked for — delivering a calendar you bought, replying to a brief, keeping you signed in. Lawful basis: performance of a contract.
• To send transactional emails — your calendar link, your dashboard link, sign-in links. Lawful basis: performance of a contract.
• To understand how the site and calendars are used so we can improve them. Lawful basis: legitimate interests.
• To keep records we are required to keep, such as records of sales. Lawful basis: legal obligation.

We do not sell your data, and we do not use it to build advertising profiles.

We use a small number of third-party services to run Doorly. Each one only receives what it needs to do its job:

• Supabase — our database and sign-in system. Stores the data described above.
• Vercel — hosts the website and provides basic traffic analytics.
• Stripe — takes payments. Stripe handles card details directly under its own privacy policy.
• Resend — sends our emails.
• Google Analytics — tells us which pages people visit.
• Microsoft Clarity — records anonymised sessions and heatmaps so we can see where a page is confusing.

Some of these providers are based outside the UK. Where data is transferred abroad, it is done under the safeguards those providers have in place, such as the UK International Data Transfer Agreement or equivalent standard contractual clauses.

We will also disclose data if we are legally required to, for example by a court order.

If your employer bought a Doorly calendar and you are playing it, the name you enter and your progress are visible to whoever administers that calendar at your organisation. Only a first name or nickname is needed to play — please do not enter anything you would rather your colleagues did not see. In this situation your employer decides what happens with that information and we handle it on their behalf.

We do not load any analytics until you agree to them. The first time you visit, we ask. If you say no, Google Analytics and Microsoft Clarity are never loaded and set no cookies. You can change your mind at any time using the “Cookies” link in the footer.

If you do agree, Google Analytics tells us which pages people visit, and Microsoft Clarity records anonymised sessions and heatmaps so we can see where a page is confusing. Both set cookies to tell one visit from another.

Two things run regardless, because neither identifies you: Vercel Analytics, which counts page views without cookies, and our own calendars, which use your browser’s local storage to remember which doors you have opened so you do not start again each time you return.

You can also block or delete cookies in your browser settings. Doing so will not stop a calendar working, though it may forget your progress.

We keep purchase records for six years, because tax law requires it. Briefs, preview sign-ups and calendar play data are kept while they are useful to us and deleted when they are not. You can ask us to delete your data sooner at any time.

Under UK GDPR you can ask us to show you the data we hold about you, correct it, delete it, or stop using it in a particular way. You can also object to us relying on legitimate interests, and ask for your data in a portable format.

Email hello@doorlyhq.com and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.

Doorly is sold to businesses and is not aimed at children. We do not knowingly collect data from anyone under 13. If you believe we hold data about a child, email us and we will delete it promptly.

Email us and we will delete what we hold about you. Where a calendar you bought is still running, deleting your account details will end your access to it, so we will check with you first. We may keep the minimum records that tax law requires us to keep, and nothing else.

Data is stored with Supabase over encrypted connections, and the site is served over HTTPS. Access to the database is limited to us. No system is perfectly secure, but we take reasonable technical and organisational measures to keep your data safe, and we will tell you and the ICO promptly if a breach affects you.

If we change this policy we will update the date at the top of the page. If the change is significant, we will tell customers by email.

Sophie Aitchison trading as Doorly
hello@doorlyhq.com

We will provide our postal address on request — just email us.