Privacy Policy

The short version

• We collect what we need to run Dustav.com for your business — including the email it reads for you — and you can see most of it in the app.
• We don’t sell your data, show you ads, or train AI models on it.
• The AI itself is run by Anthropic (the makers of Claude) on our behalf, with OpenAI for pictures and voice; they don’t train on it either, and they normally delete it within 30 days.
• We do store the emails Dustav.com reads, encrypted, so it can work your inbox over time — and you can delete it all, for real, whenever you like.

What we collect

• Account info — your email address and your preferences (such as theme and notification settings).
• Connected Google account — when you connect Google (Gmail, and optionally Google Calendar), we store an encrypted access credential and your connected email address so Dustav.com can work your inbox and show your schedule. See “Connecting your Google account” below for exactly what we access and keep.
• The email Dustav.com reads — to draft replies that remember the last exchange, fill the workflow tables you set up, and find a receipt months later, Dustav.com keeps the emails it reads: the message text, attachments, thread history, and the replies it drafts for you. This is stored encrypted at rest and is yours to read, export, and delete.
• What Dustav.com builds — your contacts, the workflow tables you set up (rows collected from your mail — orders, sign-ups, whatever you’ve defined), the durable facts it keeps about your business, your filed documents and files, calendar entries and proposals, drafted replies, and your chat with it.
• Your bank and card statements (Books) — if you import a bank or card statement into Books, we store each line of it (its date, description and amount) along with the accounts you add (the bank’s name, the name you give the account, its currency) and the categories, tags and notes you or Dustav.com put on them. We don’t keep the file itself, and we don’t store your card or account numbers on purpose (a description your bank wrote may include part of one). Dustav.com never connects to your bank: it only sees the files you give it.
• Your Instagram posts (the Studio) — if you use the Studio, the posts you make there: their slides, captions and styling, and the notes you leave on them. When you export a video, its MP4 file too, kept in our private storage until you export it again or delete the video or your account. When you give a video your voice, each recording you keep (a whole read of the script, or a scene on its own) and the words heard in it: they’re kept with the video until you record it again, take the voice off, or delete the video or your account. A whole read is kept in our private storage in Canada (Google Cloud, Montréal). (A voice note you leave Dustav.com isn’t kept as a recording; see below.) When you ask for music for a video, the tracks Dustav.com makes for it (see below) go into your music in the Studio, kept in the same private storage and used only for your videos, until you delete them there or delete your account. Dustav.com never posts to Instagram; you do.
• Your shop (the Shop) — if you use the Shop, the pieces you list (their words, prices, sizes and photos, including the photo you took and the studio shot made from it), your shop’s name and address, your storefront’s design, your pickup and shipping settings, and your orders. While a shopper fills their cart we keep what’s in it (no name or email, only the pieces) for up to 30 days, or until they buy. An order includes what your shoppers give at checkout: their name, email, phone number and, for a piece you ship, their address. We keep those so you can fill the order, and we email the shopper about it (a confirmation, and the tracking when you ship). Shoppers pay Dustav.com through Stripe, and the money is passed to your payouts account and paid out to your bank; we never see a shopper’s card.
• Calendar data — if you connect Google Calendar, a copy of the events on the calendars you choose to show, so your schedule renders beside your mail. See “Connecting your Google account” below.
• Operational data — basic logs and counters needed to run and protect the service (security and error logs, and usage/cost accounting).
• Billing info — your prepaid balance and a customer reference from our payment processor. We do not store your card number — the payment processor handles that.

We don’t intentionally collect sensitive categories of personal data; please don’t connect an inbox or put information into Dustav.com that you don’t have the right to process.

How we use it

We use your data to run Dustav.com for you — read your inbox, draft your replies, fill your workflow tables, file your mail, remind you of dates, sort your books, make your posts, keep the service secure, and account for cost. That’s it. We don’t use it to train AI models, and we don’t sell or rent your personal data to anyone.

Connecting your Google account (Gmail and Calendar)

Connecting your Gmail is how Dustav.com works your inbox. When you connect it, you grant Dustav.com access to: read your mail and its attachments; file messages into your labels and archive them; send a reply — but only the one you review and hit send on; and read the display name on your account so replies go out as you. You can disconnect at any time from the app, which revokes our access.

What we read: the messages Dustav.com works — both incoming mail and the replies you send — and their attachments (a PDF invoice, an order sheet, a schedule). What we keep: we store that email content, encrypted — including a plain-text extraction of readable document attachments (a spreadsheet’s rows, a Word document’s text) — so Dustav.com can do its job over time (draft a reply that remembers the thread, fill a workflow table from it, show you what it read). What happens when you disconnect: revoking access stops Dustav.com from reading your inbox and removes the stored access token; the email content it already read stays with your account (so you can reconnect without starting over). To remove that content, delete your account — which erases everything — or ask us and we'll delete it.

Google Calendar (optional). If you also grant calendar access, Dustav.com lists your calendars so you can choose which to show, and keeps a copy of the events on the calendars you tick so your schedule renders inside the app and stays current with your real calendar. Writing works like sending: when Dustav.com finds a date in your mail it proposes the event, and it lands on your calendar only when you explicitly confirm it — an event is created, moved, or removed by your own action, never by Dustav.com on its own. When a meeting is agreed in your email, Dustav.com can prepare a calendar invitation — the event with that person on it — but the same rule applies: your explicit confirmation is what creates the event and sends the invitation, and Dustav.com never invites anyone on its own. It will only ever propose inviting an address that appears in that email thread or that you gave it yourself. Unticking a calendar removes its events from the app; disconnecting works the same way as Gmail above.

You’re the one who acts. Dustav.com drafts, files, and proposes, but nothing is sent — and nothing lands on your calendar — without you reviewing it and choosing to commit it, and filing is your reversible action.

Limited Use. Dustav.com’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use your Gmail data for advertising, we do not sell it, and we do not use it to train AI models. Humans do not read your mail except: where you ask us to or agree to it (for example, the hands-on onboarding and support described in “Human access” below); where necessary to investigate abuse or keep the service secure; where required by law; or in aggregated/anonymized form.

The AI providers (Anthropic, OpenAI and Google)

Dustav.com runs on Claude, made by Anthropic. There’s no AI key for you to supply — we run the AI for you on our own account — so to generate a reply, read an email, read the layout of a bank file you import and sort its lines, or make a post, the relevant content is sent to Anthropic to process on our behalf, under Anthropic’s commercial terms. Anthropic does not train its models on this content. We attach an opaque account identifier (never your name or email) to these requests so Anthropic can act on a specific tenant in the rare case of abuse. You don’t manage or pay Anthropic directly — that’s handled through your metered Dustav.com balance.

A few jobs go to OpenAI instead, because it makes tools Anthropic doesn’t. The first: when Dustav.com draws a picture (an illustration for a Studio post, like an animal, a cake or a scene, or a design you ask for in chat, like a hoodie graphic or a logo idea), the drawing is made by OpenAI’s image model. OpenAI receives the short description of the picture Dustav.com writes, including any words you want shown on it (your business’s name on a design, say), plus the same kind of opaque account identifier. Never your email, your contact details, anything from your mail, or anything else from your account. When you ask for a picture made from your own photos (say, your face painted into a famous painting), OpenAI also receives those photos, and only those. A photo can go if you uploaded it to the Studio, shared it in chat yourself, or had Dustav.com bring it in from a web page you pointed it to (your own website, or a link you pasted) — never one that came from an email — and a photo with people in it goes only after you’ve told Dustav.com they’re fine to use. The finished picture is stored with your Studio photos, marked as AI-made. The same goes for a studio shot for your Shop: OpenAI receives your photo of the piece (the same photos can go) and a fixed instruction to photograph it cleanly, and nothing else.

The second: when you talk to Dustav.com instead of typing (the microphone beside the message box), OpenAI’s speech-to-text model turns your recording into text. OpenAI receives the recording and your business’s name, so it spells it right, and nothing else. The words come back into your message box for you to read, change and send yourself. Dustav.com doesn’t keep the recording: it’s turned into text and thrown away.

And a Studio video’s voice, which is always yours: a whole read of its script, or one scene at a time. When you keep a whole read, it goes to OpenAI’s speech-to-text model twice (once as it is, once asked to write down every stumble and repeat), which sends back each word and when it was said; the recording and those words are kept, as described above, and nothing about your business goes with it. When you leave Dustav.com a voice note about a scene, it’s turned into text exactly like the chat microphone (the same model, your business’s name and nothing else alongside it), and the recording is thrown away; the words go to Dustav.com in your chat when you send your notes. When you keep a scene as the video’s voice, it goes to OpenAI’s speech-to-text model, which sends back each word and when it was said so the video can follow you (even after the script is edited); that recording and those words are kept, as described above. Those words and the scene’s line then go to Claude (Anthropic), which rewrites the line to what you said; nothing else goes with them.

A Studio video’s music is made by Google’s music model (Lyria), on our paid Google account. Google receives the short description of the music Dustav.com writes from your video’s story (its mood, its instruments, how long it runs and where it changes) and nothing else: never your name, your business’s name, anything from your mail, or anything else from your account. On a paid account Google doesn’t use these descriptions or the music it makes to improve its products, and keeps them only for a limited time to catch abuse. The track is stored with the video, as described above.

What they keep. None of them trains its models on what we send. Anthropic deletes what it processes for us within 30 days. OpenAI keeps the picture descriptions and photos it works from for up to 30 days, and doesn’t keep your voice recordings at all. Both keep it only to check for abuse, and longer only if something is flagged as abuse or the law requires it. Google’s limit for the music descriptions is above.

Human access

As part of onboarding, support, and keeping the service working correctly, a member of our team may access your account and the data Dustav.com holds (your email, and your books and posts if you use them) — for example, to confirm it’s reading your inbox correctly, to diagnose a problem, or to improve how it handles your mail. By connecting your inbox you consent to this access for those purposes. We keep it to what’s needed, and we never sell it, use it for advertising, or train AI on it.

Service providers we share with

To run Dustav.com we rely on a few service providers, and share only what each needs:

• Anthropic — runs the AI (Claude) that reads your mail and drafts your replies, on our platform account and under Anthropic’s terms, as described above.
• OpenAI — draws the illustrations and designs you ask for, from a short description of the picture and, when you ask for one made from them, the photos you chose; turns your voice into text when you talk instead of typing or leave a voice note on a video scene; and times a Studio video to the recordings of your voice you keep (a whole read is heard twice, to catch every word). All as described above.
• Google — when you connect your Google account, Google serves your messages and calendar events to us and applies the labels, sends, and calendar changes you authorize, through the Gmail and Google Calendar APIs under Google’s own terms. Separately, your Studio pieces (posts, decks, posters, a video’s scenes) are drawn into pictures and PDFs on computers we rent from Google Cloud in Montréal: the piece’s page, with its words, photos and fonts, goes in, the picture comes back to Dustav.com, and nothing is kept there. When you export a Studio video, it’s turned into an MP4 on those same computers, and the file is stored there, in our own private storage that only Dustav.com can read. A whole read of a video’s script is stored there too, and so is a video’s music. The video’s words, pictures, voice and music are processed there for that and nothing else. And Google’s music model (Lyria) makes a video’s music from a short description of it, as described above.
• Payments — our payment processor (Stripe) handles your top-ups and card details to fund your balance, under its own terms. We don’t see or store your full card number. If you sell through the Shop, Stripe sets up a payouts account for you that Dustav.com manages: Stripe asks you directly who you are and which bank to pay (we never see your ID or bank details), your shoppers pay on Stripe’s checkout, and Stripe pays each sale out to your bank. We tell Stripe your shop’s name and your email to set the account up, and each order’s items and price.
• Email delivery — when Dustav.com emails you (a reminder, a heads-up), or emails a shopper about their order from your shop, our email provider processes the message and the address to deliver it.
• Discord — when you open an account and pay your first deposit (or use a code we gave you), your email address, the amount and the code are posted to a private Discord channel only we can see, so we know you’ve joined.
• Hosting and database — the application runs on DigitalOcean and the database is MongoDB Atlas; they store the data described above on our behalf, under their own terms.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights and safety of our users and the public.

Cookies

We use a small number of first-party cookies necessary to run the service — chiefly a session cookie to keep you logged in, a token that protects forms from cross-site request forgery, and a few preference cookies that remember small choices on your device (your theme, a sort order, which tab you had open). A shop on Dustav.com sets one cookie on a shopper’s browser, and only once they add something to their cart: it holds the cart’s random id, for that one shop, so the cart is still there when they come back. We don’t use third-party advertising or tracking cookies.

Counting visits. On our public pages (not inside your account) we count visits ourselves, without cookies and without any outside analytics service. For each page view we keep the page, the site or link that sent you, your device type, your browser’s time zone and language, how long the page was on screen, and how far down the home page you scrolled. To count a visitor once a day we keep a one-way scrambled code made from your IP address and browser, mixed with a secret that changes every day and is deleted soon after, so it can’t be turned back into your IP address or linked across days. We never keep the IP address itself. If you open an account the same day, we note which link brought you (for example, our Instagram). Visit records are deleted after about 13 months.

How we protect it

We build for security: a strict content-security policy, protection against cross-site request forgery, and encryption at rest of your most sensitive data — your Gmail access credential and the email content Dustav.com stores. No system is perfectly secure, but we build to reduce risk and keep our attack surface small.

Your choices and rights

• See it — the app shows you what Dustav.com did (your inbox, tables, and drafts) and what it knows (the facts it keeps), any time.
• Change it — ask Dustav.com in chat to update or remove things it remembers, and it will.
• Disconnect — disconnect Gmail any time; this revokes our access and stops Dustav.com from reading your inbox (your data stays, so you can reconnect later).
• Delete it — delete your account from settings; this removes your data, including everything Dustav.com read and built. You can also email us to request deletion.
• Notifications — turn Dustav.com’s emails off any time from settings or the unsubscribe link in any notification email. (Sign-in codes are the one thing we’ll always email — they’re how you log in.)

Depending on where you live, you may have additional rights to access, correct, export, or delete your personal data. To make a request, email hello@dustav.com and we’ll respond as required by applicable law.

Data retention

We keep your data for as long as your account is active or as needed to provide the service. Disconnecting Gmail stops the reading and drops the access token, but leaves the content in place so you can reconnect; when you delete your account — or ask us to delete your data — we remove your associated content, including the email content Dustav.com read. Some limited records may persist briefly in backups or where retention is required by law, after which they are deleted. What the AI providers keep, and for how long, is under “The AI providers” above.

Children

Dustav.com is a business tool and is not directed to children under 13; we don’t knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us at hello@dustav.com and we’ll delete it.

Changes to this policy

We may update this policy as the service evolves. We’ll change the effective date above and, for material changes, give notice where appropriate.

Contact

Questions about your privacy? Email us at hello@dustav.com.