Privacy policy
Contents
This policy explains what DownlineAI does with personal data, and what you can do about it.
1. Who is responsible
DownlineAI, is the controller of the data described in section 2. Contact us about anything on this page at [email protected].
Members also store details of their own prospects in DownlineAI. For that data the member is the controller and we are their processor — see section 6.
2. What we collect and why
Account data
Your name, email address, hashed password, username, plan, referral code and who invited you. We need it to give you an account and to run the service. Lawful basis: performance of our contract with you.
Referral payouts
If you set up cash referral payouts, Stripe (Stripe Connect) collects and verifies your identity, address, bank account and, where required, tax details, as an independent controller under its own terms. We never see your bank or ID details. We store your Stripe account identifier, whether it can receive payouts, the rewards you earned (from which referred member's payment, the amount and rate) and each payout or conversion to AI credit. We keep these records for as long as accounting and tax law requires. Lawful basis: performance of our contract with you, and our legal obligation to keep accounting records.
Payment data
Subscriptions and AI-credit top-ups are handled by Stripe. Card numbers never reach our servers. We store the Stripe customer and subscription identifiers, your plan, your subscription status, renewal dates and invoice references. Lawful basis: contract, and our legal obligation to keep accounting records. Stripe is an independent controller for fraud prevention and payments; see stripe.com/privacy.
Chat transcripts
Conversations with either AI assistant — the public recruiter on member pages and the private assistant inside the application — are stored in our database, together with the account or visitor conversation they belong to. The text of each message is also sent to a large language model backend to generate a reply. Do not type anything into the chat that you would not want processed that way. We use these conversations to provide, maintain and improve our products — for example to review and improve how the AI answers, to develop and train it, to help you when you contact support, and to keep the service safe. The member who owns a page, or a website carrying our chat widget, can read the conversations visitors have with the AI there (their "Leads & chats" page), so they can follow up; your conversations with the in-app assistant are not shown to other members. Lawful basis: contract for members; for a visitor on a member's page, the member's legitimate interest in answering them.
Leads collected by the AI
When a visitor gives an email address to the public AI recruiter and confirms that it may be shared, we store that address, the message it came with, the page it came from and the date and manner of the confirmation, and pass it to the member who owns the page. We do not store an address that has not been confirmed. Lawful basis: consent, recorded with the record. See section 6.
The landing-page tutorial
If you leave your email on one of our landing pages to try the tutorial, we store that email, what you type about the business you promote, the questions you pick, the replies the AI writes for you, which steps you reach and when, and the link tags you arrived with (see below). What you type is sent to the AI model provider to write the replies. We use it to run the tutorial, to fill in your email if you go on to create an account, and to improve the tutorial. We may write to you about DownlineAI at that address; tell us and we stop. Lawful basis: our legitimate interest in showing you the product you asked to see, and in improving it.
Emails we send
When you leave your email for the tutorial, we send you one email with a link to pick it up later, and we may write to you about DownlineAI after that. If you start signing up and don't finish paying, we send you one reminder to finish. Every email except essential account emails (like a password reset) has an unsubscribe link, and unsubscribing stops them. Lawful basis: our legitimate interest in following up with people who asked about DownlineAI; you can object at any time by unsubscribing.
Tutorials started from a member's page
If you leave your email in the form on a member's page, that member receives your email (and your first name, if you gave it) to contact you. If the page then takes you to the tutorial, the member can also see how far you got in it, but not what you typed or the AI's replies.
Follow-up emails from members
If you leave your email for a member (on their page, or by saying yes to their AI assistant), that member can have DownlineAI send you their follow-up emails, from "<member> via DownlineAI", with replies going to the member. We record which emails were sent to you. Every one has an unsubscribe link; unsubscribing stops that member's emails to you. The member writes these emails and is responsible for what they say.
If an email to you bounces because the address doesn't exist, or you mark one as spam, our email provider (Resend) tells us. We then keep your address on a do-not-send list so you get no more follow-up or marketing emails from DownlineAI or any member (essential account emails, like a password reset, still go). A spam report also tells the member that someone marked their email as spam, without saying who. Lawful basis: our legitimate interest in not emailing people who don't want it and in keeping our emails out of spam folders.
Where you came from
If the link that brought you here carried tags saying where it was posted (for example "utm_source=facebook") or which landing page you used, we store those tags with your request and your account, so we know which posts bring people in. We do this through the link itself — no cookie and nothing stored in your browser. Lawful basis: our legitimate interest in knowing which of our own marketing works.
Your team and what your sponsor sees
Your account is linked to the member whose link you joined through (your sponsor); if their team was full, you may have been placed with another member of their team, who then becomes your sponsor. Your sponsor sees your name, when you last used DownlineAI and how far you are with the getting-started steps (for example whether you have published a page), so they can help you. Members above them see your name in their team tree. Lawful basis: contract — this is part of the service you joined.
Team chat
Messages you send in team chat are stored and shown to the people in that chat: a team chat to its leader and their direct recruits, a private chat to the two of you, and an announcement to the writer's whole team below them (each member decides whether announcements from above reach their own team). Members can delete their own messages, and a team leader can delete messages in their own team; a deleted message is hidden from everyone. Like other content on the service, team chat messages may be used to provide, maintain and improve our products and to keep them safe, for example when a message is reported. Lawful basis: contract.
How we use what we collect
We use the information we have — including messages, chat transcripts and conversations with our AI — to provide, personalise and improve our products, to develop and train the AI that powers them, to understand how they are used, and to keep people and the service safe and secure.
Photos you upload
Photos you upload for your pages are stored on our server. Before upload your browser makes them smaller and removes the information a camera or phone adds to a photo, such as where it was taken; our server removes it again. A photo is public once it is on a published page, at its own web address. Deleting your account deletes your photos.
Feedback and guided tours
What you send us through "Send feedback", the page you sent it from, and our reply to you. Which in-app guided tours you have finished or skipped, so they don't start again and so we can see where people get stuck. Lawful basis: our legitimate interest in improving the service.
Technical data
Your IP address, request times and rate-limit counters, used to keep the service up and stop abuse. Server error logs record the path and the error, never message contents or credentials. Lawful basis: our legitimate interest in security and availability.
Usage and billing meters
Token counts, costs and timestamps of metered AI calls, so we can bill them and show you what you spent. Lawful basis: contract.
3. Cookies and local storage
We do not use advertising, analytics or tracking cookies, and there is no cookie banner because there is nothing to consent to. What we do set:
- a session cookie when you sign in, so the site knows it is you. It is strictly necessary for a service you asked for;
- if a member puts our chat widget on their own website, the widget stores an opaque conversation id in that site's local storage so a returning visitor keeps the same conversation. It is not a fingerprint and it identifies nobody across sites;
- an optional access-code cookie in non-public test environments.
Under the ePrivacy rules these are exempt from consent because they are strictly necessary to provide the service requested. We say so here rather than staying silent about it.
4. Who we share data with
- Stripe — payments, invoicing and the customer portal.
- The AI model provider — the text of chat messages and the prompt we build around it, in order to generate a reply. Depending on our configuration this is either a model we run ourselves or a third-party inference provider. Chat content leaves our application to be processed by a model.
- Our hosting provider — which stores the database and serves the site.
- Anyone we are legally required to disclose to, and a buyer if the business is sold.
We do not sell personal data and we do not share it with advertisers.
5. International transfers
Our payment and model providers may process data outside your country. Where that happens we rely on the transfer mechanisms in those providers' own terms, such as the European Commission's standard contractual clauses.
6. Data members collect about other people
Members use DownlineAI to keep details of prospects and team members, and to run an AI assistant that can be given an email address by a visitor. For that data:
- the member decides what to collect and why, and is the controller;
- we act on the member's instructions as their processor;
- the AI recruiter asks the visitor to confirm before an email address is stored or passed to the member, and we record when and how that confirmation was given;
- if the member has switched lead capture off, no address is stored at all;
- a request about data held by a member should go to that member; write to us at [email protected] and we will pass it on and help.
7. How long we keep things
- Account data: while your account exists, then deleted or anonymised within 90 days of closure.
- Invoices and payment records: as long as tax and accounting law requires, which is commonly 7–10 years.
- Chat transcripts and leads: until the member deletes them or the account is closed.
- Team chat messages: while the accounts in that chat exist; deleted messages are hidden at once and removed with the account.
- Tutorial records and link tags: while we use them to improve the tutorial and our marketing, and deleted when you ask or when your account is closed.
- Feedback and tour progress: while your account exists.
- Technical logs and rate-limit data: short-lived; error logs are kept no longer than needed to fix the problem.
8. Your rights
If the GDPR or the UK GDPR applies to you, you have the right to: access your data; have it corrected; have it erased; restrict or object to processing; receive it in a portable format; withdraw consent at any time where processing is based on consent; and not be subject to a decision with legal effect based solely on automated processing. The AI writes text and suggests wording — it does not make decisions about you.
To use any of these, email [email protected]. We answer within one month. You can also complain to the data protection authority in the country you live in, or to the supervisory authority in the country where we are established.
9. Security
Passwords are stored hashed. Sessions are signed tokens. Payments are handled entirely by Stripe. No system is perfectly secure; if a breach affects you and the law requires it, we will tell you.
10. Children
DownlineAI is for people aged 18 and over. We do not knowingly collect data from children.
11. Changes
We post changes here and, where they matter, tell you in the application.