Privacy Policy

1. Who is responsible for your data

Brooklyn Social House LLC, Brooklyn, New York, United States, is the controller of the personal data described here. For privacy questions, requests, or complaints, write to daryl@makedovey.com and we will respond within thirty days, or sooner where the law requires it.

2. What we collect

Account information. For the ads product, your email address, which is your account and how you sign in, and your basic Google profile if you sign in with Google, never your Google password. For the poster product, your phone number. During signup we may also ask for your name, your role, your industry, and how you heard about us.

The waitlist. If you join it, the email address, website and note you give us, and the search, remix or plan you were looking at when you joined, so we know what you came for.

Content you provide. The searches and questions you ask, the conversations you have with the research agent, your bookmarks and collections, the creators you save and your lists, the text messages you send us, your instructions, product photos, logos, brand imagery, style references you upload, your brand details, and your website address.

Content we create for you. Generated images, exported files, and the creative documents behind them.

Information from your website. If you give us your website address, we fetch that page to read your business description, marketing language, colours, and logo. We fetch only the address you give us.

Usage and generation records. To keep the product improving we record each generation and what shaped it: the brief, the model used, the prompt, a snapshot of the brand details at that moment, cost, and how long it took. We also record product events such as when text on a creative is edited, when a creative is exported, and when one is discarded. These corrections are the most useful signal we have for making output better.

Payment information. Stripe processes your payments and holds your card details. We receive and store your Stripe customer and subscription identifiers, your plan, its status, and renewal dates. We never receive your full card number.

Advertising attribution. If you arrive from one of our ads, we store the campaign parameters from that link on your workspace record, so we can tell which advertising actually works.

What we do not collect. We do not ask for or want your card number, government identifiers, health information, or precise location, and nothing in the product requests them. If you text us something like that anyway, we will delete it on request.

Technical information. IP address, browser and device information, and log data created when you use the service.

3. Information about advertisers and creators

Dovey also holds information about people and businesses who are not our customers, because that is what the product searches. Ads and advertisers come from the Meta Ad Library, which Meta publishes: the advertiser's page name and identifiers, the ad copy, the creative, the platforms it ran on and its start date. Creators come from public TikTok and Instagram profiles and posts: the handle, the display name, the bio, the follower count, the public posts with their view, like and comment counts, and a business email or link where the creator has put one on their profile. We collect both through ScrapeCreators, a data provider, and keep our own copy so that searches are fast and dated.

We add what our models read from that material (the angle and offer of an ad, the topics a creator posts about, a transcript of a video) and numbers we compute (how long an ad has run, a creator's median views and engagement rate). We do not add anything private, we do not guess contact details, and we show a creator's public contact details only to paying customers.

Our basis for this is our legitimate interest in providing a research tool over material the people concerned have made public for the purpose of being seen, and our customers' legitimate interest in studying their market and finding people to work with. If you are an advertiser or a creator and you would rather not appear in Dovey, or you want to see or correct what we hold, write to us and we will act within thirty days. Where the law gives you the right to object, that right applies here.

4. Text messages

Dovey is used mainly by texting it. When you message the number we assign you, the message reaches us through Photon, our messaging provider, which connects to Apple's iMessage service and to the SMS network. Photon processes your phone number and the contents of your messages on our behalf in order to deliver them. When you message us on WhatsApp, the message reaches us through Bird, our WhatsApp provider, and through Meta's WhatsApp service; Bird processes your phone number and message contents on our behalf in the same way.

We store the conversation state needed to run the service: your phone number, which workspace it belongs to, which design is currently on the table, where you are in signup, and whether you have opted out. Message text is sent to our AI providers to work out what you are asking for and to produce the design, and it is recorded with the design so you can see what produced it.

Replying STOP stops all messages to that number and is recorded so that it keeps being honoured. It does not delete your account or your designs; write to us if that is what you want.

Text messaging is not encrypted end to end between you and us, and message content passes through Apple or your carrier and through Photon, or through Meta and Bird on WhatsApp. Please do not send anything sensitive by text.

We keep a log of the messages you send us and the replies we send, so that we can find and fix problems and improve how Dovey understands requests. The log is tied to your phone number and workspace, is stored with our other data, and is deleted with your account on request.

5. Why we use it, and our legal basis

To provide the service you asked for: creating your account, generating and storing creatives, and letting you export them. Basis: performance of our contract with you.

To take payment and manage subscriptions. Basis: performance of our contract, and compliance with tax and accounting law.

To keep the service secure, prevent abuse, and debug failures. Basis: our legitimate interest in a service that works and is not abused.

To improve generation quality using the generation and correction records described above. Basis: our legitimate interest in improving the product. This uses your workspace's own material and the patterns we learn from it, and we do not sell it.

To improve search and the research agent using the searches you run, the questions you ask, and what you do with the results (which ads you open, bookmark, remix or skip). Basis: our legitimate interest in a search that ranks well. These signals are tied to your workspace while it is open and severed from it when it closes.

To send you service messages such as sign in links and billing notices. Basis: performance of our contract.

To measure and improve our own advertising. Basis: consent where required, and otherwise our legitimate interest in knowing which ads work.

6. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising beyond the advertising measurement described below. We use the following processors, each for the purpose named:

• Supabase: database, file storage, and authentication (United States)
• Railway: hosting for our API and background workers (United States)
• Vercel: hosting and analytics for the website (United States)
• Cloudflare: DNS, network security, and content delivery
• Photon: delivery of iMessage and SMS conversations, including your phone number and message contents (United States)
• Bird: delivery of WhatsApp conversations, including your phone number and message contents (United States and European Union)
• Meta (WhatsApp): the WhatsApp messaging service, when you choose to message us there
• ScrapeCreators: the data provider through which we collect public ads from the Meta Ad Library and public creator profiles and posts from TikTok and Instagram
• Anthropic: the research agent that answers your questions over the ads, understanding your requests, and writing the design documents behind posters and menus
• Google (Gemini): reading each ad's creative and video, and reading what a creator posts about
• OpenAI: the search index (embeddings of ads and creators, and of your searches), and image generation from your product photos and prompts
• fal.ai: image generation and editing in flows
• Quiver AI: drawing the vector illustrations used inside designs, from a short subject such as "a coffee cup"
• PostHog: product analytics inside the application (United States)
• Stripe: payment processing and subscription management
• Resend: transactional email such as sign in links
• Meta: measurement of our own advertising, described below
• Google: sign in, if you choose to sign in with Google

We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer in connection with a merger or sale of assets, in which case we will tell you before your data becomes subject to a different policy.

7. How AI providers handle your content

A search sends your query to OpenAI to be turned into the vector we search with. A question to the research agent sends the question, the conversation so far, and the ads or creators it reads to Anthropic, which writes the answer. Reading an ad's creative or a creator's posts sends that public material, never your account details, to Google. Making a design sends your request, your brand details, and any photos or references involved to our AI providers. For text conversations that means the message you sent goes to Anthropic so the system can work out what you want and compose the design. Illustration requests send only a short subject, such as "a coffee cup", to Quiver AI, never your message or your brand details. Analysis passes send generated images and your product photos for comparison, which is how we check that your product was not altered.

We use these providers under business terms that do not permit them to train their models on our customers' content. Their own policies govern retention on their side, and those policies can change. If you have strict confidentiality obligations about a product that is not yet public, take that into account before uploading it.

8. Cookies, analytics, and advertising measurement

We use cookies and similar technologies that are necessary to sign you in and keep your session working. These cannot be turned off without breaking the service.

We use Vercel Analytics to understand page traffic. It is designed to measure without tracking individuals across sites.

We use PostHog inside the signed in application to understand which features are used and where things break. It records product events tied to your workspace, not your browsing on other sites.

We use the Meta pixel on our public pages, and we send Meta server-side events when someone signs up or subscribes, so we can measure our own advertising. These events identify you to Meta only through irreversibly hashed values such as a hashed email address, never your email in readable form. Meta processes this under its own terms and may combine it with data it already holds. If you would rather not be measured this way, browser tracking protection and Meta's own ad settings both limit it.

We do not use advertising cookies inside the product itself. The signed in application is excluded from search engines and is not an advertising surface.

9. International transfers

We are based in the United States and our processors are largely in the United States, so using Dovey means your information is transferred there. If you are in the United Kingdom or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where relevant, as the transfer mechanism with our processors.

10. How long we keep it

Account information and your content: for as long as your account is open. When you ask us to delete your account, we delete your workspace, email address, phone number, brand details, uploads, searches, conversations, bookmarks, lists, and generated designs within thirty days, except where we must keep something longer by law.

Waitlist entries: until you have an account, or until you ask us to remove you.

Ads and creator data: this is public material we keep as a research index, independent of any customer account, refreshed as the sources change and removed on request as described above.

Opt-out records: if you reply STOP, we keep a record of that number's opt-out after deletion, because the only way to reliably not message someone is to remember not to.

Payment and transaction records: kept as long as tax and accounting law requires, typically seven years, even after an account closes.

Generation and product event records: retained while they remain useful for improving quality. On account deletion these are severed from your identity, so what remains describes what worked and what did not, not who you are.

Backups: deleted data can persist in encrypted backups for a short period before those backups roll over.

11. Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or stop a particular use, and we will not treat you worse for asking. Write to daryl@makedovey.com.

If you are in the United Kingdom or the European Economic Area, you also have the rights to access, rectification, erasure, restriction, portability, and objection under the UK GDPR and the GDPR, including the right to object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time. You may complain to your data protection authority, and in the UK to the Information Commissioner's Office.

If you are in California, you have the rights under the CCPA as amended to know, delete, correct, and opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising beyond the advertising measurement described above, which you can limit as explained there.

If you are in Canada, you have rights of access and correction under PIPEDA and may complain to the Office of the Privacy Commissioner. If you are in Australia, you have rights of access and correction under the Privacy Act and may complain to the Office of the Australian Information Commissioner.

12. Security

Data is encrypted in transit and at rest with our infrastructure providers. Workspaces are separated at the database level so one customer cannot read another's data. Access to production systems is limited to people who need it. API keys are stored only as hashes, which is why a key is shown once and never again.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.

13. Children

Dovey is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We will update this page when our practices change, and we will change the date at the top. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect.

15. Contact

Brooklyn Social House LLC, 141 Engert Ave, Brooklyn, New York 11222, United States. Privacy questions and requests go to daryl@makedovey.com.