Privacy Policy

1. What We Collect

When you use Do Later List ("DLL"), we collect the following information:

• Phone number — required to send and receive SMS messages
• Email address — optional, used for transactional emails (welcome, billing receipts, summaries)
• Tasks and reminders — the content you send us via SMS, voice, or the portal
• Objects and memory — structured information DLL learns about your life (cars, homes, subscriptions, etc.)
• Monitoring rules — alerts and tracking rules you configure
• Usage data — anonymized analytics about how you interact with DLL (page views, feature usage)
• Voice recordings — temporarily processed for transcription, not stored after processing
• Billing information — processed by Stripe; we do not store card numbers

2. How We Use Your Data

• To provide the DLL service: managing tasks, sending reminders, generating summaries
• To personalize your experience based on your life context and memory
• To send transactional communications (reminders, confirmations, billing receipts)
• To improve the service through anonymized, aggregated analytics
• To process payments through our billing provider (Stripe)

We do not sell your personal data. We do not use your task content or personal information for advertising.

3. Third-Party Services

DLL uses the following third-party services to operate:

• Twilio — SMS and voice message delivery
• Supabase — database and authentication
• Stripe — payment processing
• OpenRouter — AI model access for task interpretation
• Deepgram — voice transcription
• Resend — email delivery
• PostHog — anonymized product analytics
• Sentry — error monitoring (no PII in error reports)
• Vercel — application hosting

Each service processes only the minimum data required for its function. We do not share your task content, memory, or personal context with analytics or advertising services.

4. Data Retention

• Active account data (tasks, objects, memory) — retained while your account is active
• Completed/archived tasks — retained for your historical reference
• Audit logs — retained for 2 years
• AI processing logs — retained for 90 days for cost tracking
• Temporary processing data (idempotency records) — pruned after 24 hours
• Voice recordings — processed for transcription and not retained

5. Your Rights

You have the right to:

• Export your data — download all your data as JSON from the portal Settings page
• Delete your account — request full account deletion from the portal Settings page. Deletion is soft (immediate, 30-day grace period for reversal) then permanent.
• Opt out of SMS — reply STOP to any DLL message to immediately unsubscribe
• Opt out of emails — use the unsubscribe link in any DLL email

Account deletion removes all tasks, objects, memory, monitoring rules, reminders, and audit events permanently after the 30-day grace period.

6. SMS and Voice

By providing your phone number and sending your first message, you consent to receive SMS messages from DLL related to the service (task confirmations, reminders, summaries). See our SMS/Messaging Terms for details.

Voice calls are transcribed using automated speech recognition. Voice capture is available on paid plans only.

7. Security

We protect your data with:

• Encryption in transit (TLS) and at rest
• Row-level security on all user-data tables
• Application-level encryption (AES-256-GCM) for sensitive credentials
• Webhook signature verification for all inbound provider communications
• Rate limiting to prevent abuse

8. Children

DLL is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete that information promptly.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Categories of personal information we collect:

• Identifiers — phone number, email address, account ID
• Commercial information — subscription tier, payment history
• Internet or electronic network activity — usage analytics, feature interactions
• Other personal information — task content, objects, memory, monitoring rules you create

Your rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected
• Right to delete — request deletion of your personal information
• Right to opt out of sale — we do not sell your personal information to third parties
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA rights

To exercise these rights, contact us at privacy@dolaterlist.com or use the data export and account deletion features in your portal Settings.

10. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional terms apply:

Data Controller: Do Later List, Inc. is the data controller for your personal data.

Lawful Basis for Processing:

• Contract performance — processing necessary to provide the DLL service you requested (task management, reminders, summaries)
• Legitimate interests — anonymized analytics to improve service quality, fraud prevention, security
• Consent — SMS and email marketing communications (you may withdraw consent at any time)

Your rights under GDPR:

• Right of access — obtain a copy of your personal data
• Right to rectification — correct inaccurate personal data
• Right to erasure — request deletion of your personal data
• Right to restrict processing — limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format (JSON export)
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent

Data Processing Locations: Your data is processed and stored in the United States using infrastructure provided by our third-party service providers (see Section 3). By using DLL, you acknowledge that your data may be transferred to and processed in the United States.

To exercise your GDPR rights, contact us at privacy@dolaterlist.com. You also have the right to lodge a complaint with your local data protection authority.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via SMS or email to active users. Continued use of the service after changes constitutes acceptance.

12. Contact

Questions about your privacy? Contact us at privacy@dolaterlist.com.