Privacy Policy

This Privacy Policy explains what information Dossio (“Dossio,” “we,” “us”) collects, how we use it, and the choices you have. It applies to the Dossio desktop application and this website.

1. How Dossio is built

Dossio is a desktop application that turns your existing email into a CRM. It connects directly to your mailbox and runs a private AI model on your own device to identify contacts, summarize conversations, and detect events. Understanding this split is the key to understanding how your data is handled:

• Your device. Your mail syncs to a local store on your computer, the same way any email client works. All AI analysis of message content — reading email bodies, writing summaries, extracting details — happens here, on-device. This content does not leave your machine.
• Dossio's servers. A small set of derived records — the contacts, notes, and activity summaries that make up your CRM — sync to your Dossio account so they're available across the app and backed up. What those records contain is described in Section 4.

2. Information you connect

To build your CRM, Dossio asks you to connect one or more mailboxes. When you connect a Google account, Dossio requests access to:

• Gmail — full mailbox access (the https://mail.google.com/ scope). Dossio is a full email client: it syncs your mail to your device over IMAP, sends the replies you write over SMTP, and marks messages read as you read them. Google grants IMAP and SMTP access through this single broad scope, so the permission you approve is wider than what Dossio does with it — it reads your mail to build contacts and timelines, writes only the mail you compose, and never deletes your email.
• Google Calendar — to read and create calendar events detected from your email, and to respond to invitations when you ask it to.
• Basic profile and email address — to identify the account you connected.

Dossio does not request access to Google Contacts. Your contact list is built from the people you actually correspond with, not imported from your Google address book.

Dossio also supports Microsoft/Outlook and standard IMAP accounts, which grant comparable access to mail and calendar — and, for Microsoft accounts, contacts. You can disconnect any account at any time.

3. How your email content is used

Message content — subjects, bodies, attachments, and headers — is processed by the AI model that runs locally on your device. Dossio uses it to:

• Detect the people and companies you correspond with and create contact records.
• Write short titles and summaries of email activity for your timeline.
• Suggest profile details about a contact, along with the short quote it came from.
• Detect calendar events and meeting requests.

The full text of your emails is never sent to Dossio's servers or to any third-party AI service. The AI model and its processing live entirely on your computer.

4. What Dossio stores on its servers

So your CRM works across sessions and is backed up, the following derived records sync to your Dossio account:

• Contacts and companies — names, email addresses, and profile fields (for example role, company, or lifecycle stage).
• Activity records — the AI-generated title and short summary of an email interaction, its timestamp, and the message and thread identifiers used to link back to it. These summaries are generated on your device; only the result is stored.
• Profile evidence — where a suggested detail came from, which may include a short quoted excerpt from an email.
• Notes you write about a contact.
• Account information — your Dossio login and the addresses of the mailboxes you've connected.

Separately from the records above, Dossio collects anonymous diagnostics — which features were used, whether a sync or an on-device AI task succeeded or failed, and technical details of errors (app version, operating system, error type, and code location). These are tied to a random identifier for your installation, not to your name or email address. They deliberately contain no message content, contact or company names, email addresses, calendar titles, AI prompts, or CRM field values; error text is stripped of anything matching those before it is sent. See section 6 for who processes it, and section 9 for how to turn it off.

Calendar events are not stored on Dossio's servers. When Dossio detects an event or you create one, it is read from and written directly to your connected calendar provider (for example, Google Calendar) — Dossio doesn't keep its own copy.

We store this data only to provide the service to you. We do not sell it, share it for advertising, or use it to train machine-learning models.

5. Google API Services — Limited Use

Dossio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide and improve the features you see in Dossio.
• We do not transfer Google user data to third parties except as needed to provide the service, for security, or to comply with law.
• We do not use Google user data for advertising.
• We do not allow humans to read your Google user data unless you give explicit consent, it is necessary for security or to comply with law, or the data has been aggregated and anonymized.
• We do not use Gmail message content to develop, improve, or train generalized AI or machine-learning models.

6. Service providers

We rely on a small number of infrastructure providers to run Dossio's backend (for example, cloud hosting and database services). They process data only on our instructions and only to keep the service running.

We use PostHog to process the anonymous product analytics and error reports described in section 4, and to count visits to this website. We do not use advertising trackers, we do not sell or share this data, and no CRM data, message content, or personal identifier is ever included in it. Website analytics are limited to page visits: there is no session recording, no click tracking, and no cross-site profile. If your browser sends a Do Not Track signal, this website records nothing at all.

7. Data retention and deletion

We keep your CRM data for as long as your account exists. In the app you can edit your contact and company records and delete individual notes. Removing a contact archives it: the record is hidden from the app but is still stored on our servers until the account is deleted.

There is currently no way to delete your account or your data from inside Dossio, and no deletion happens automatically. To have your account and the CRM records associated with it deleted, email us at contact@dossio.co and we will do it manually. We are working on self-serve account deletion and will update this policy when it ships.

The local mail store on your device is separate from all of this: it is removed when you remove the account from the app or uninstall it, without needing to contact us.

8. Security

Data in transit is encrypted using TLS, and access to your account is protected by authentication. No system is perfectly secure, but we work to protect your information using industry-standard measures.

9. Your rights and choices

• Disconnect a mailbox or revoke Dossio's access at any time from your account settings, or from your Google Account's security settings.
• Access and correct your CRM data, and delete individual notes, from within the app.
• Request deletion of your account and the data associated with it by emailing contact@dossio.co. This is handled manually today — see section 7.
• Turn off anonymous diagnostics — see the steps below.

Turning off anonymous diagnostics

There is no setting for this in the app yet, so it takes a small edit to a configuration file. Quit Dossio first, then open config.json in your Dossio data folder:

• macOS — ~/Library/Application Support/Dossio/config.json
• Windows — %APPDATA%\Dossio\config.json
• Linux — ~/.config/Dossio/config.json

The file is JSON, and every setting lives under a top-level "*" key. Find the "dossio" section and add "optOut": true inside its "telemetry" object, so that part of the file reads:

{
  "*": {
    "dossio": {
      "telemetry": {
        "optOut": true
      }
    }
  }
}

Keep any other keys that are already there — add "optOut" alongside them rather than replacing the file. Save it and start Dossio again; nothing is sent from that point on. If you would rather not edit the file yourself, email us at contact@dossio.co and we will walk you through it.

10. Children

Dossio is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their information.

11. Changes to this policy

We may update this policy from time to time. When we do, we'll revise the “Last updated” date above, and for material changes we'll provide a more prominent notice.