Privacy Policy

Dossier ("Dossier," "we," "us," or "our") is an AI knowledge-work service operated by Ullmanac. You email a task or your data to us, and an AI analyst returns finished work — spreadsheets, dashboards, decks, documents, or research briefs — by email. This Privacy Policy describes how we collect, use, share, retain, and protect personal information and the files you send us in the course of providing that service.

This policy applies to our website at joindossier.com, to communications you have with us at hello@joindossier.com, and to the deliverables we produce for you. By sending us data or a task, you acknowledge the practices described here.

We're an early-stage, working product and are still maturing our formal privacy and security controls. We'll always aim to be straight with you about where things stand — if anything here is unclear, just ask.

We collect only what we need to do your work and run the service:

• The files & data you send. Spreadsheets, documents, datasets, links, instructions, and any other content you email us so we can produce your deliverable. This is the heart of the service — and it may, depending on what you choose to send, include personal or confidential information about you or third parties.
• Account & contact information. Your name, email address, and any company or billing details you provide so we can correspond with you, deliver finished work, and process payment.
• Basic usage data. Limited technical and operational information — such as email metadata, job history, and standard server logs — that helps us deliver your jobs, provide support, prevent abuse, and keep the service running.

Please send only the data a job actually needs, and redact anything you don't want us to process. You are responsible for ensuring you have the right to share any third-party personal data you include.

We use the information we collect strictly for legitimate, limited purposes:

• To produce your deliverables. The primary and overwhelming use of your data is to generate the finished work you asked for, including the free watermarked preview and the clean, editable file you unlock on payment.
• To provide support. To respond to your questions, handle reruns and revisions, and communicate with you about your jobs.
• To handle billing. To process payments, issue receipts, manage one-time purchases or subscriptions, and prevent fraud.
• To operate and improve the service. To maintain reliability, troubleshoot issues, prevent abuse, and meet legal or accounting obligations.

We do not use your files to train our own foundation models, and we do not use your data for advertising. See the next section for how third-party providers may handle data on our behalf.

To deliver the service, we rely on a small set of trusted third-party providers ("subprocessors"). They process data only to perform services for us, under their own terms and security practices. The categories are:

• AI model providers. We use third-party large-language-model and AI providers to generate the analysis and deliverables you request. The relevant portions of your task and data are sent to these providers solely to produce your work. We choose providers that offer business / API terms intended to keep submitted content private and out of model training, but their handling of data is governed by their own agreements.
• Payment processing. We use Stripe to process payments. When you pay, your card and billing details are handled directly by Stripe under its own privacy policy; we do not store full card numbers ourselves.
• Operational infrastructure. Standard email, hosting, and storage providers that we use to receive your tasks, run the work, and deliver finished files.

We aim to share with each provider only the data needed for its specific function, and to engage providers that maintain appropriate safeguards. We may update the specific providers we use as the service evolves.

We keep your data only as long as we reasonably need it to deliver your work, support you, and meet our legal and accounting obligations. In practice that means we retain the files and deliverables associated with a job so we can re-send, revise, or rerun it, and we retain billing records for as long as the law requires.

We don't keep your content indefinitely for its own sake. When data is no longer needed for the purposes above, we work to delete or anonymize it.

Requesting deletion

You can ask us to delete the data and files associated with you or a specific job at any time. Just email hello@joindossier.com with your request and we'll honor it, subject to any records we're legally required to keep (for example, transaction records for tax purposes). Note that data already processed by a third-party provider is subject to that provider's own retention and deletion practices, which we'll help you navigate where we can.

We take reasonable, good-faith measures to protect your information, including:

• Encryption in transit. Our website and the providers we rely on use industry-standard encryption (such as HTTPS/TLS) for data moving across networks.
• Access limits. We restrict access to your files and data to what is needed to deliver your work and run the service.
• Trusted providers. We use established infrastructure and payment partners (such as Stripe) that maintain their own security programs.
• Data minimization. We ask you to send only what a job needs, and we aim to share only the necessary portions with our subprocessors.

No method of transmission or storage is ever completely secure, and as an early-stage product our controls are still maturing. We cannot guarantee absolute security, but we will continue to strengthen our practices and will tell you honestly where we stand if you ask.

We do not sell your data. We do not rent, trade, or sell your files, personal information, or the deliverables we create for you.

We share data only in these limited situations:

• With subprocessors who help us deliver the service, as described in Processing & third parties above, and only to perform work for us.
• For legal reasons — if required by law, regulation, legal process, or a valid government request, or to protect the rights, safety, and property of Dossier, our users, or others.
• In a business transfer — if Ullmanac is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.
• With your direction — when you ask us to share something or otherwise consent.

You have meaningful control over your information. Depending on where you live, your rights may include:

• Access — to ask what personal information we hold about you.
• Correction — to ask us to fix inaccurate or incomplete information.
• Deletion — to ask us to delete your data, subject to records we must legally keep.

GDPR & CCPA note

If you are in the European Economic Area or the UK, the GDPR may give you additional rights, including the right to object to or restrict certain processing, the right to data portability, and the right to lodge a complaint with a supervisory authority. Where we rely on your consent, you may withdraw it at any time.

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how it is used, the right to request deletion, and the right not to be discriminated against for exercising your rights. As stated above, we do not sell your personal information.

To exercise any of these rights, email hello@joindossier.com. We may need to verify your identity before acting on a request.

Our website is largely static and is built to avoid external scripts, fonts, and trackers. As a result, we use few or no cookies for ordinary browsing of the site.

Where cookies or similar technologies are used — for example, by our payment processor during checkout, or by basic infrastructure needed to operate the site securely — they serve essential functions rather than advertising or cross-site tracking. If we introduce additional cookies in the future, we'll update this policy accordingly.

Dossier is a business service intended for adults. It is not directed to or intended for use by anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us at hello@joindossier.com and we will take appropriate steps to delete it.

We operate from the United States, and the providers we rely on may process and store data in the United States and other countries. If you access Dossier from outside the United States, your information may be transferred to, stored in, and processed in countries whose data-protection laws may differ from those of your own country.

Where required, we seek to rely on appropriate safeguards for such transfers. By using the service, you understand that your information may be processed in these locations as described in this policy.

We may update this Privacy Policy from time to time as our service, providers, or legal obligations change. When we do, we'll revise the "Last updated" date at the top of this page. For material changes, we'll aim to give you reasonable notice — for example, by email or a prominent notice on the site.

Your continued use of Dossier after an update takes effect means you accept the revised policy.