Privacy Policy
Last updated: 7 November 2026
This policy explains how Donevoy ("Donevoy", "we", "us") handles personal data when you visit donevoy.com or use the Donevoy app at app.donevoy.com to manage projects and tasks.
1. Who We Are
Donevoy is a product of Atdrive Infotech Private Limited ("AtDrive"), a company registered in India (CIN U72300UP2013PTC057069) with its registered office at Plot No. 431, GF, Niti Khand-2, Indirapuram, Ghaziabad 201010, Uttar Pradesh, India, and its office at A-1802, Sector 77, Noida 201301, Uttar Pradesh, India. AtDrive operates Donevoy and is responsible for it.
- Controller for account data. We decide how and why we process the data we need to run your Donevoy account: your name, email address, sign-in details, and how you use the app.
- Processor for workspace content. When a company or team (our customer) uses a Donevoy workspace, we process the projects, tasks, comments, files and other content in it on the customer's behalf and on its instructions. The customer is the controller of that content. If your personal data appears in someone else's workspace, for example your name in a task, please contact that company first. We will help them answer you.
2. What We Collect
2.1 Account Data
- Name, email address and password (stored only as a one-way Argon2id hash).
- Profile details and preferences, such as your time zone and notification settings.
- Workspace and project memberships, roles, invitations you send or receive, and workspace settings.
- Security records: sign-ins, sign-outs, password resets and similar events, with the time, IP address and browser type.
- Messages you send us, for example support requests.
2.2 Workspace Content
Everything you and your team create in Donevoy: workspaces, projects, sections, tasks and subtasks, descriptions, assignees, due dates, priorities, labels, comments and mentions, and the activity history and notifications that record changes to them.
2.3 Uploaded Files
- Files you attach to tasks and comments.
- Asana JSON or CSV export files you upload to import a project.
- Export files Donevoy prepares for you when you export a project to JSON or CSV.
Files are stored privately in Amazon Web Services (AWS) S3 in the Mumbai region (ap-south-1), encrypted at rest, and downloaded only through short-lived signed links given to signed-in members who are allowed to see them.
2.4 Technical Data
Our servers and network provider keep standard request logs (IP address, time, requested page, browser type) for security and troubleshooting. We configure our logs not to record passwords, access tokens or cookies.
2.5 This Website
donevoy.com is a static website. It sets no cookies, runs no scripts, analytics or advertising, and loads nothing from third parties.
3. How We Use It
- To provide Donevoy: sign you in, show your workspaces and projects, store and share your files, run imports and exports, and keep activity history.
- To send service emails: verification, password resets, workspace invitations, notifications you have turned on, and important notices about the service.
- To keep Donevoy secure: prevent abuse, detect suspicious sign-ins, investigate incidents and keep security records.
- To fix problems, support you, and improve the service.
- To meet legal obligations and respond to lawful requests.
We do not sell personal data. We do not use it for advertising, we do not share it for cross-context behavioural advertising, and we do not use your workspace content to train AI models.
4. Legal Bases
Where laws such as India's Digital Personal Data Protection Act, 2023 or the EU/UK GDPR apply, we rely on:
- Contract: to provide the service you or your organisation signed up for.
- Consent: where you give it, for example for optional notifications. You can withdraw it at any time in your settings or by contacting us.
- Legitimate interests and other legitimate uses the law allows: security, preventing abuse and improving the service, balanced against your rights.
- Legal obligation: where the law requires us to keep or disclose data.
For workspace content we process on a customer's behalf, the customer is responsible for having a legal basis for its own use of that content.
5. Sharing and Sub-Processors
We share personal data only with service providers that help us run Donevoy, under contracts that limit their use of it, and when the law requires it. Our current providers:
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Storage of uploaded files, import files and export files in S3, and sending service emails such as verification, password resets, invitations and notifications through Amazon SES, both in the Mumbai region (ap-south-1). |
| Cloudflare | DNS, secure network tunnel and protection for donevoy.com and its subdomains. Traffic to our servers passes through Cloudflare. |
| Dropbox | Storage for off-site backups. Backups are encrypted before they leave our servers. |
Inside a workspace, other members can see its content according to their role and the projects they belong to. If we are involved in a merger or acquisition, data may pass to the new owner, who must keep protecting it as this policy describes; we will tell you before that happens.
We will update this list before adding a new sub-processor.
6. Where Data Is Stored
The Donevoy app and its database run on our own servers in India. Uploaded files are stored in AWS's Mumbai region in India. Some of the providers listed above, such as Cloudflare and Dropbox, may process data in other countries, such as the United States. Where data protection law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.
7. Retention
- Account data: kept while your account is open, and deleted within 30 days after it is closed.
- Workspace content and attachments: kept while the workspace exists, and deleted within 30 days after the workspace is deleted. Content you delete earlier is removed from the app straight away.
- Import and export files: deleted automatically, usually within 7 days. Export downloads are available for 24 hours.
- Backups: daily encrypted database backups are kept for up to 45 days, and earlier versions of deleted or replaced files are kept for up to 90 days so we can recover from mistakes. Deleted data disappears from all backups within those periods.
- Server logs: rotated automatically and usually overwritten within a few weeks.
- Security records (sign-ins and similar events, without passwords or tokens): kept for up to 1 year to protect the service, or longer where the law requires.
8. Security
- All connections use HTTPS.
- Each workspace's data is kept separate, and every request is checked against the workspace and project permissions of the person making it.
- Uploaded files are encrypted at rest (AES-256) in private storage and served only through short-lived signed links.
- Passwords are hashed with Argon2id. Sign-in sessions use short-lived access tokens and a secure, HttpOnly cookie, and suspicious reuse of a session ends it.
- Daily backups are encrypted and copied off-site, and we regularly test that we can restore them.
- Access to our systems is limited to staff who need it.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
9. Your Rights
Depending on where you live, including under India's Digital Personal Data Protection Act, 2023, the EU/UK GDPR and California privacy law (CCPA/CPRA), you may have the right to:
- know what personal data we hold about you and get a copy of it;
- correct or update it;
- delete it;
- withdraw consent or object to some processing;
- receive your data in a portable format;
- nominate someone to exercise your rights if you die or become unable to (India);
- not be discriminated against for using your rights.
To use any of these rights, email privacy@donevoy.com. We may need to confirm your identity first, and we will reply within the time the law requires. If your data is in a customer's workspace, we may pass your request to that customer. You can also complain to your data protection authority, such as the Data Protection Board of India or your local supervisory authority in the EU or UK.
10. Exporting and Deleting
- Export your work at any time: export a project to JSON or CSV from the app.
- Delete content such as tasks, comments and attachments in the app, as your role allows.
- Delete a workspace by emailing support@donevoy.com from the workspace owner's address.
- Close your account by emailing privacy@donevoy.com from the address you signed up with.
Deleted data is then removed as described in section 7.
11. Cookies
The Donevoy app uses only strictly necessary storage: a secure, HttpOnly cookie that keeps you signed in, and settings your browser keeps for the app to work. They are not used for tracking or advertising. This website sets no cookies.
12. Children
Donevoy is a business tool. It is not meant for anyone under 18, and we do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to This Policy
We will post any changes on this page and update the date above. If a change is significant, we will also tell account holders by email or in the app before it takes effect.
14. Contact
For privacy questions or requests, email privacy@donevoy.com. For anything else, email support@donevoy.com.
Grievance officer (Digital Personal Data Protection Act, 2023): Emmanual Reddy, Atdrive Infotech Private Limited, at the addresses below, email privacy@donevoy.com. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
Atdrive Infotech Private Limited (CIN U72300UP2013PTC057069)
Registered office: Plot No. 431, GF,
Niti Khand-2, Indirapuram, Ghaziabad 201010, Uttar Pradesh, India
Office: A-1802, Sector 77,
Noida 201301, Uttar Pradesh, India