Privacy & AI disclosure
Written to be read, not to be survived. If anything here is unclear, that's a bug — tell us.
Last updated 26 July 2026
Where we actually are
Doingly is pre-launch. The agent is not yet answering a public phone number, and no customer task has been run. This page describes two things separately: what we collect today, and what will change when the agent goes live. We would rather tell you that than imply an operation that doesn't exist yet.
What we collect today
One thing: the phone number you type into the box on the homepage.
| Field | Why |
|---|---|
| Phone number | To text you when your number is ready. It is the only way we can reach you — we don't ask for email. |
| Timestamp | To contact people in the order they signed up. |
| Source | Which button on the page you used. Tells us what people respond to. |
It is stored in DynamoDB in AWS us-east-1 (United States), encrypted at rest by
default. Three named founders have access. It is not sold, rented, or shared with anyone,
and it is not used to build advertising profiles.
The one third-party tool on this site
We use Microsoft Clarity to record how people move through these pages —
anonymised session replays and heatmaps. We are a three-person company guessing at what is
confusing; watching where someone hesitates is how we stop guessing. It sets cookies
(_clck, _clsk) and the data goes to Microsoft.
What it structurally cannot capture: anything you type into a box.
Clarity masks the contents of input fields in every mode, and per Microsoft's own
documentation that behaviour "can't be customized" — it is not a setting we could
switch off by accident. Your phone number is never recorded. We additionally tag that field
with data-clarity-mask so it is covered twice.
It records mouse movement, clicks, scrolling and which pages you viewed. It does not follow you to other websites, and we do not use it for advertising. This is checkable, not a claim: open your browser's network tab and you will find exactly two third parties — Google Fonts for two typefaces, and Clarity. Nothing else.
What changes when the agent goes live
When Doingly starts running tasks, it will necessarily hold more. Specifically:
- The tasks you ask for, and their outcomes.
- Transcripts of calls it makes for you — so you can read exactly what was said in your name.
- Call recordings, where the law allows it. Several US states require every party to consent. Where that applies, the agent keeps a transcript and no recording.
- Things it learns in passing — your carrier, your dentist, that you can't do mornings. This is what makes the tenth task easier than the first.
It will not ask you to fill in a profile up front, and it will not collect anything a task doesn't need. Card details, where a task requires one, are handled by the payment processor and are not stored by us.
This page will be updated with retention periods before the first task runs, not after.
What the agent says when it calls someone
It identifies itself. Every time, unprompted, in the first sentence. This is the exact opening line:
And when you call it:
It will never claim to be a human, and it will never claim to be you. If someone asks directly whether they're speaking to an AI, it confirms without hedging.
What it will never do without asking you first
Sign anything. Pay anyone. Accept a settlement. Cancel anything that can't be undone. Each of those stops and texts you for a yes.
This is enforced in code that sits outside the AI model, not in the model's instructions — so it isn't something the agent can be talked out of by a persuasive person on the other end of the line. There is no setting to switch it off.
Deleting everything
Today: email doingly.ai@gmail.com from any address, or text us, and your number is removed. There is nothing else of yours to remove.
Once the agent is live: text DELETE to your Doingly number. Profile, memory, transcripts and recordings all go. We'll publish the exact SLA here before that ships.
Where we are, and what we haven't done yet
Doingly is a very early company. Being straight about the gaps is more useful to you than a page implying an enterprise security programme we don't have:
- No SOC 2. Not started. We'll say so here when it is.
- No formal DPA or sub-processor list yet — because we have no processors beyond AWS.
- US only. We are not currently set up for GDPR obligations, so we are not taking non-US users yet.
- No penetration test. Not yet done.
If you are an organisation that needs any of the above before you could use Doingly, tell us — that is genuinely useful information about what to build next.
Talking to a person
doingly.ai@gmail.com reaches one of the three founders. There is no support queue, because there are three of us.