Privacy Policy

Doris - bookwithdoris.com

Last updated: 18 October 2026

This Privacy Policy explains how ItsMeFil Ltd (“we”, “us”, “our”) collects, uses, and protects personal data when you use Doris at bookwithdoris.com.

We are registered in England and Wales. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Data controller: ItsMeFil Ltd (Company No. 17218858), registered in England and Wales. Registered office: 66 Paul Street, London EC2A 4NA.

We are registered with the Information Commissioner’s Office (ICO) as a data controller, registration reference ZC163160. Our entry can be found on the ICO’s public register at ico.org.uk.

Contact: hello@bookwithdoris.com

For the personal data of members invited by an organisation administrator, and for the details of guests entered by an administrator when booking a room on their behalf, the organisation acts as data controller and we act as data processor on their behalf. In both cases the organisation decides what is collected, why, and how long it is kept; we store and process it on their instructions. The terms on which we do that are set out in section 12 of our Terms and Conditions.

2. What Data We Collect

Organisation administrators

Name and email address (used for account creation via Clerk)
A profile picture, if you have added one to your sign-in account, and a display name, initials and booking colour for the calendar
Organisation name, contact telephone number, address, country, time zone and settings. We ask for the contact number when you start setting up and for the address before setup is finished, because we need to be able to reach the organisations we provide a service to. The contact number is also shown to your organisation’s own members in their welcome email, so that they have a way to check the email is genuine
Whether you have said that one of our team may telephone you to help you get set up, and the date you said it. This is optional. You can give it or withdraw it at any time in Settings, under Organisation
Subscription and billing information (held by Paddle - we do not store payment card data)
When you last signed in, and which devices are signed in (used to enforce the device limit on the Free plan, described in our Terms)
Copies of the emails we send you about your trial and your account, kept so we can see what you have already been told
Our own notes of conversations with you - a call, a meeting, an email you sent us, or a follow-up we intend to make. These are the ordinary records of a small business looking after its customers. They are written by us, about the organisation and its administrators, and you can ask to see them at any time (Section 11)
If you send us feedback from inside the app: your message and, if you attach one, a screenshot of what you were looking at. Both are emailed to us and are not stored in Doris

Organisation members (invited users)

Name and email address
A profile picture, if you have added one to your sign-in account, and a display name, initials and booking colour for the calendar
Booking records - which rooms were booked, when, and by whom, including bookings an administrator or team booker made on your behalf
Custom field responses on bookings (as configured by the organisation administrator)
Push notification subscription data (if opted in)
Contact and emergency details, where the organisation chooses to keep a member record: full name, address, phone number, and an emergency contact’s name, phone number and relationship. An administrator can enter these when adding a member; once the member has signed in, only the member themselves can change them, on their Account page. The emergency contact’s details exist for one purpose - reaching someone if something happens to the member at the venue.
Payment bookkeeping, kept by the organisation’s administrators: how the member usually pays (for example bank transfer or card), a company to bill if there is one, and administrators’ own notes. These are visible to the member and the organisation’s administrators only - never to other members. The notes are not shown to the member in the app, but they remain the member’s personal data and are covered by the rights in Section 11.
Where the organisation prices its rooms: what you have been charged, statements issued to you, and payments recorded against them

Who sees a member record is deliberately narrow: the member themselves and the organisation’s administrators. Other members never see any of it, and none of it is included in the organisation-directed integrations described in Section 5. Section 7 explains who can see what inside Doris.

Guests (people who hire a room without becoming members)

Some organisations hire rooms to people who are not members and never will be - a birthday party, a community meeting, a wake. An administrator enters the guest’s details on their behalf; the guest never uses Doris, never creates an account, and never visits our website.

Name (required) and phone number (required)
Email address (optional - used only to send booking confirmations and payment links)
Any additional fields the organisation chooses to capture (for example an address for invoicing, or access requirements)
The booking record itself - which room, when, and any payment recorded against it

The organisation chooses which of these fields to collect and how long to keep them (see Section 9). We hold them on that organisation’s behalf as its data processor.

Referrals (if a Doris user refers your organisation to us)

Any Doris user can refer another organisation to Doris. When they do, they give us:

The email address they are referring (required)
The organisation’s name, if they choose to give it (optional)
A short personal note to include in the invitation, if they write one (optional)

We use that email address once, to send a single invitation on the referrer’s behalf, and we keep the record so the referrer can see what became of it and so we can pay their reward if the organisation subscribes. We do not add referred addresses to any mailing list, and we do not send follow-ups or reminders. If you receive an invitation and do nothing, you will not hear from us again.

The invitation identifies the person who sent it: it gives their name, and it carries their email address as the reply address, so that a reply reaches them rather than us. The referrer is told this before they send. If you were referred and want to reply, you are replying to that person directly.

Here, ItsMeFil Ltd is the data controller (not the referrer’s organisation) - the referral is a personal act by an individual, and the reward is paid to them personally. Our legal basis is legitimate interest: telling an organisation about a service a peer recommends, balanced against the single, low-volume, clearly-attributed nature of the message. You can object at any time using the contact details in Section 15, and we will delete the record.

What we do NOT collect

Passwords - authentication is handled entirely by Clerk (clerk.com)
Payment card data - we never see or store card details, in either of the two money flows Doris touches. An organisation’s subscription is billed by Paddle (paddle.com), who take the card details themselves. Card payments made to an organisation by its members or guests are taken by Stripe (stripe.com) on that organisation’s own Stripe account, and the card details are entered with Stripe. Both are described in Section 5.
Client, patient, or service-user data of any kind - see the note below on the difference between a guest who hires a room and the people an organisation serves
Special category data (health, clinical, religious, political data etc.)
Your organisation’s data sent to an AI service by us. Doris has one built-in AI feature, Ask Doris, on the Help page for an organisation’s owner and admins. It sends the question typed into it, together with the public Doris manual, to Anthropic’s Claude model, which answers from the manual. It never sends bookings, members, guests, money, names or anything else about your organisation; before the question leaves Doris we remove anything in it that looks like an email address, a phone number or a postcode. Questions and answers are kept for 180 days and deleted with the organisation. Anthropic and this feature are described in Sections 5 and 6. Beyond that, your data reaches an AI service only if your own organisation deliberately connects one, which is described under “Organisation-directed integrations” in Section 5.

Doris is a room booking tool. The personal data it holds is the data of the people who book and use rooms - staff, volunteers, members, and guests who hire a room from the organisation.

A guest is the person hiring the room, not the people an organisation serves. If you are a counsellor or therapist, your clients’ details should never enter Doris. The same applies to a charity’s beneficiaries, a school’s pupils, or any other service user. Booking a room for a client is fine; recording who that client is, is not.

3. How We Use Your Data

We use your data to:

Operate the room booking service
Manage your account and subscription
Send push notifications you have opted into
Send service-related communications (trial status, account notifications, billing statements)
Telephone an organisation’s administrator to help them get set up, where they have said that we may. We use the organisation’s contact number for this. We do not telephone members, and we do not use the number for marketing
Record what members and guests owe an organisation, and, where that organisation has connected its own Stripe account, send them a link to pay it
Send a single referral invitation when an existing user refers an organisation, and pay that user’s reward if it subscribes
Look after our customer relationship with your organisation: keeping notes of our conversations, following up when we have said we would, and occasionally emailing an organisation’s administrators about their account
Comply with our legal obligations

Emails about your trial and your account. During a trial we send a short series of emails: notices about where the trial stands (which everyone receives, because they describe a change to your account) and occasional tips on getting set up. The tips carry an unsubscribe link and stop the moment you use it. We do not run newsletters or marketing campaigns to members, and members receive only the notifications the organisation’s use of Doris generates.

What we record about administrators, to improve Doris. If you are an owner or an admin of an organisation, Doris keeps a short note of how you use the admin side of the service: which screens you open, which setup steps you reach, when you open Help, and when Doris refuses something you tried (for example, a room that could not be added, or a booking that clashed). Each note is the name of a screen, a step or a refusal, with the date and time. We never record what you type, the names of your rooms or members, or anything from a booking. Members are not included at all: nothing of this kind is kept about them. We keep these notes for 180 days and then delete them, nobody outside ItsMeFil Ltd sees them, and we use them for one purpose only: to see where setting up an organisation gets hard, so we can make it easier. We rely on our legitimate interest in improving the service (Section 4). You can object at any time by switching off “Help improve Doris” on your Account page: collection stops at once and every note already kept about you is deleted in the same moment (Section 11).

Questions to Ask Doris. If you are an owner or an admin and you ask Ask Doris a question, we keep the question (with email addresses, phone numbers and postcodes removed first), the answer, whether Doris was able to answer and whether you said the answer was helpful, for 180 days. We read them for one purpose: to find what the manual does not yet explain and write it. We rely on our legitimate interest in improving the service (Section 4). A conversation you choose to send to the team becomes a help request (above) and is handled as one.

Searches of the manual on our website. When you search the manual on bookwithdoris.com, we record the words you searched for and whether anything was found, so we can see what the manual is missing and write it. Before the search is recorded we remove anything that looks like an email address, a postcode or a long number, and we keep no more than the first 80 characters. The recording is part of our website measurement (Sections 5 and 12), runs without cookies, and is not linked to a Doris account.

We never use your account or booking data for advertising, and we do not sell your data to third parties. The only advertising-related measurement we do happens on our public marketing pages, uses no Doris account data, and only runs if you consent to it (see Sections 5 and 12). We do not share your data with any third party except as described in Section 5.

4. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

Contract - to provide the service you have signed up for
Legitimate interests - to operate, maintain, and improve the service; to keep the notes about how administrators use the admin side of Doris described in Section 3 (we have carried out and keep a legitimate interests assessment for this, and you can object by switching it off); to keep the ordinary records of our relationship with the organisations that use Doris; and to send an organisation’s administrators emails about their own trial and account. Where an administrator is a sole trader or otherwise an individual subscriber, we rely on the soft opt-in for those emails, which is why every tip carries an unsubscribe link
Legal obligation - where required by law
Consent - for optional processing such as push notifications, a telephone call to help you get set up, and the optional marketing cookie on our public pages (each can be withdrawn at any time)

We do not make decisions about you by automated means that have a legal or similarly significant effect. Doris refuses a double booking automatically, but that is the service working as described, not a decision about you.

5. Third-Party Services

We use the following third-party services to operate Doris:

Clerk (clerk.com) - user authentication. Clerk processes names, email addresses and profile pictures, and manages passwords. We never see your password. Clerk is based in the United States; see Section 6 for how that transfer is covered.

Paddle (paddle.com) - subscription billing. Paddle acts as Merchant of Record and processes all payment data. We do not store card numbers or payment details.

Cloudflare (cloudflare.com) - hosting, database, and infrastructure. Our database is held in Cloudflare’s Western Europe region. We also use Cloudflare Web Analytics to understand aggregate site usage (page views, approximate visitor counts, and country-level location). This is privacy-first and cookieless: it sets no cookies, does not store IP addresses, does not build a profile of you, and does not track you across other websites.

Sentry (sentry.io) - error monitoring. When Doris encounters a technical error, Sentry records diagnostic information (the error, the page or screen involved, and browser/device type) so we can find and fix bugs. We configure Sentry to minimise personal data: IP-address collection is disabled and identifying details are stripped before a report is sent. Error data is processed in Sentry’s EU (Germany) region.

Stripe (stripe.com) - card payments made to an organisation by its members or guests, where that organisation has chosen to accept them. This is a separate flow from the Doris subscription above, and the difference matters. Paddle handles what an organisation pays us. Stripe handles what a member or guest pays that organisation: the organisation connects its own Stripe account, the money goes directly to that account, and we take no fee or share of it. When you follow a payment link, your card details are entered with Stripe on that organisation’s account, never with us. Stripe receives the payer’s name, email address, card details and the amount being paid, and is independently responsible for that data under its own privacy policy at stripe.com/privacy.

Meta (facebook.com) - optional advertising measurement on our public marketing pages only (every page of bookwithdoris.com, including the manual, but never the Doris app). If - and only if - you accept the cookie banner shown on those pages, the Meta Pixel sets its cookies (_fbp, and _fbc when you arrive by clicking one of our adverts; see Section 12) and tells Meta which of our public pages you visited, so we can measure whether our advertising works and reach people who showed interest in Doris. It never runs inside the Doris app itself, and no account, member, or booking data is ever shared with Meta. If you decline, nothing is loaded and no data is sent. If you accept and later switch advertising measurement off in “Cookie preferences”, the Pixel stops and both cookies are deleted. We and Meta are joint controllers for collecting this data on our pages and sending it to Meta: we decide to place the Pixel on our pages and ask for your consent, and Meta provides the Pixel and receives the data. Our arrangement with Meta for that joint control is set out in Meta’s Controller Addendum (facebook.com/legal/controller_addendum). What Meta does with the data once it has received it is decided by Meta alone and explained in Meta’s own privacy policy at facebook.com/privacy/policy.

PostHog (posthog.com) - site statistics on our public marketing pages only. PostHog counts how visitors use those pages (e.g., page views, button clicks, signup flows, and how far down a page is read and for how long) so that we can improve them. It runs without cookies for every visitor, whether or not you accept the cookie banner: it sends anonymised event data calculated using a privacy-preserving server-side hash, but stores absolutely nothing on your device (no cookies, local storage, or personal identifiers). It records statistics only: no session recordings, no visitor profiles, and nothing is passed on to advertisers or anyone else. PostHog acts only on our behalf, and its data is hosted entirely in the European Union (EU Cloud). You can switch site statistics off at any time (see Section 12). No account, member, or booking data from the Doris application is ever sent to PostHog.

Resend (resend.com) - transactional email delivery. Resend sends the emails Doris generates: welcome and sign-in emails, billing statements, guest booking confirmations and payment links, trial and account emails, and referral invitations. It receives the recipient’s email address and the content of that message, and nothing else. Resend is based in the United States; see Section 6 for how that transfer is covered.

Anthropic (anthropic.com) - the AI model behind Ask Doris, the help assistant on the Help page for an organisation’s owner and admins. When you ask it a question, we send Anthropic the question (after removing anything that looks like an email address, a phone number or a postcode), the public Doris manual, and four plain facts about your organisation so it can pick the right page: which plan it is on, its booking style, which setup step it is at, and which spelling to use. Nothing else: no bookings, members, guests, money, names or the organisation’s name. Anthropic acts as our processor under its Data Processing Addendum; it does not use what we send to train its models, and it deletes the inputs and outputs within 30 days (Anthropic’s privacy centre, 1 July 2026). Anthropic is based in the United States and processes in the United States; see Section 6 for how that transfer is covered. Ask Doris is used only when you choose to ask it something.

Tremendous (tremendous.com) - referral reward vouchers. If you earn a referral reward, we send your name and email address to Tremendous so it can deliver your voucher and let you choose which reward you want. Tremendous receives nothing else - no booking data, no organisation data, and no details of who you referred. It is used only for people who have earned a reward. Tremendous is based in the United States and transfers are made under the UK International Data Transfer Addendum.

Your browser’s push service - if you opt in to push notifications, each notification is delivered through the push service built into your browser or phone (run by Apple, Google or Mozilla, depending on your device). That service receives the notification text, which is the list of your bookings for the day, and nothing else about you.

Each of these providers has their own privacy policy and, except where this section says otherwise, is independently responsible for their data handling.

Organisation-directed integrations (optional, off by default)

An organisation owner or admin can choose to connect outside services to their organisation’s Doris data:

Connected AI assistants - a read-only connection that lets an AI assistant the organisation already uses (for example Anthropic’s Claude or OpenAI’s ChatGPT) read that organisation’s rooms, bookings, availability, analytics, and billing statements on the admin’s behalf.
Outbound webhooks - signed notifications about booking and billing events, sent to a URL the organisation controls.
Calendar feeds - a subscription link that shows the organisation’s bookings in a calendar application such as Google Calendar or Outlook. An organisation-wide feed includes members’ names. Any member can also create a personal feed of their own bookings.

These connections exist only if an admin (or, for a personal calendar feed, the member) deliberately sets them up, and they can be revoked at any time in Settings. When one is active, we send the organisation’s data to the service the admin chose, acting on the organisation’s instructions as data processor. Member email addresses are excluded unless the organisation explicitly switches them on. Guest contact details - name, phone number, email address and any additional fields the organisation captures - are never included in these connections. Once delivered, that data is handled by the receiving service under its own privacy policy, under the organisation’s own arrangement with that service.

6. Where Your Data Is Stored and International Transfers

Doris itself runs on Cloudflare, and the database holding your organisation’s data is in Cloudflare’s Western Europe region. Error reports (Sentry) are processed in Germany and website analytics (PostHog) in the European Union.

Four of the services in Section 5 are based in the United States and receive personal data there:

Clerk - names, email addresses, profile pictures and sign-in credentials
Resend - the email address and content of every email Doris sends
Tremendous - the name and email address of anyone who has earned a referral reward
Anthropic - the questions an owner or admin asks Ask Doris, with email addresses, phone numbers and postcodes removed first

Clerk and Resend are both certified under the UK Extension to the EU-US Data Privacy Framework, which the UK government has recognised as providing adequate protection, and each of our agreements with them also incorporates the UK Addendum to the Standard Contractual Clauses as a fallback. Our transfers to Tremendous are made under the UK International Data Transfer Addendum. Our transfers to Anthropic are made under its Data Processing Addendum, which incorporates the UK Addendum to the Standard Contractual Clauses; Anthropic offers no UK or EU processing region, so a question is answered in the United States. Where your organisation connects an outside service itself (Section 5, “Organisation-directed integrations”), or accepts card payments through its own Stripe account, any transfer that involves is under the organisation’s own arrangement with that service.

Doris does not otherwise transfer personal data outside the United Kingdom.

7. Who Can See Your Data Inside Doris

Owners and administrators of your organisation see every booking in the organisation in full: who booked it, when, any custom field responses and notes, and the member record and payment bookkeeping described in Section 2. That is the nature of running a venue, and it is unaffected by anything below.

Other members do not see your name on your bookings unless two things are both true: your organisation has turned name sharing on, and you have chosen, on your own Account page, to share your name. When both are true, other members see your name, your booking colour and your profile picture on your bookings, including on the floor map’s “who’s in” view. Either of you can turn it off again at any time, and the change applies to every booking, past and future, straight away. Other members never see your email address or your member record.

Team bookers. An organisation can name a member as a team booker for a team of its members. A team booker can see the bookings of the members of their own team, and make or cancel bookings for them. When someone else makes a booking for you, you are notified.

Guests never sign in and see nothing.

Us. We look at an organisation’s data only when we need to: to answer a support request, to investigate a fault, or to run the service (for example applying a change to how billing works). We do that through an internal administration tool that only ItsMeFil Ltd’s operator can use, protected by multi-factor authentication and passkeys, and every account change made through it is recorded. We do not browse organisations’ bookings out of curiosity, and we never use what we see for any purpose other than looking after the service.

8. Links That Carry Access

Some of what Doris sends contains a link that works on its own, without signing in, because the person using it may never have a Doris account:

Payment links sent to members and guests, which show what is owed and let them pay
Calendar feed links created by a member or an organisation
Sign-in links in welcome emails

Anyone who has one of these links can use it. Treat them as you would a password: do not forward them, and if you think one has reached the wrong person, regenerate it. Members and administrators can regenerate calendar feed links in Settings; administrators can regenerate a member’s payment link; and a welcome link expires and can be reissued by an administrator. Payment links never show card details, which are entered with Stripe.

9. Data Retention

We retain your data for as long as your organisation’s account is active.

When a trial ends without a subscription, the organisation moves to the Free plan and carries on. Its data is preserved and it remains fully usable within the Free plan’s limits (see our Terms and Conditions). If a paid subscription lapses or is cancelled, the organisation also returns to the Free plan.

An organisation on the Free plan is archived only when it has gone dormant: no booking made or taking place in the last 180 days. Archiving switches the organisation off: nobody can sign in to it and it is no longer used. The data is retained on our systems at that point, not erased.

We would rather be plain than reassuring here. There is no automatic job that permanently erases an organisation’s data after a set period. Permanent deletion happens when someone asks us for it, or when we decide we no longer need to hold the data. If you want your data permanently deleted, ask us and we will do it and tell you when it is done. See Section 11.

Guest details are the exception, and they are deleted automatically. An organisation sets how long it keeps a guest’s contact details after the date of the booking, between 1 and 24 months, and 12 months unless it changes that. Once the period passes, the name, phone number, email address and any additional fields are permanently deleted, automatically and without anyone having to ask. The booking record itself remains - the room was still booked - but it no longer identifies anyone.

This deletion is not optional and is not something the organisation has to remember to do. It also keeps running if the organisation stops subscribing or turns guest bookings off, because lapsing is not a reason to hold someone’s details for longer than promised.

Member contact, emergency and payment details are also deleted automatically. Thirty days after a member leaves an organisation, their member record - address, phone number, emergency contact, payment bookkeeping and administrator notes - is permanently deleted, automatically. Their name and email address are kept, because the organisation’s booking history still refers to them and because a returning member should be recognised. The thirty-day pause exists so an accidental removal can be undone without the member retyping everything. The emergency contact is someone else’s personal data - a person who never used Doris - which is exactly why it does not outlive the membership. As with guest details, this deletion keeps running whether or not the organisation still subscribes.

Booking history and audit records - who made, moved, approved or cancelled a booking, and when - are kept for as long as the organisation exists, because they are the organisation’s record of what happened in its rooms. The delivery log for an organisation’s outbound webhooks is pruned after 30 days.

Referral records. We keep a referral record for as long as it may still result in a reward, and afterwards as part of our financial records where a reward was paid. If you were referred and did not sign up, you may ask us to delete the record at any time - see Section 11.

Our records about your organisation - copies of the trial and account emails we sent, and our notes of conversations - are kept for as long as the organisation exists on our systems, and deleted with it.

The notes about how administrators use Doris (Section 3) are deleted automatically 180 days after they were made, deleted with the organisation if it is removed sooner, and deleted at once for any administrator who switches “Help improve Doris” off.

Questions to Ask Doris and their answers (Section 3) are deleted automatically 180 days after they were asked, and with the organisation if it is removed sooner. Anthropic’s own copy is deleted within 30 days (Section 5).

You may request deletion of your data at any time by contacting us. See Section 11 for your rights.

10. Data Security

We take appropriate technical and organisational measures to protect your data, including:

Encryption in transit (HTTPS, enforced by Cloudflare)
Database access restricted to the application layer
Secrets and API keys never stored in code or version control
Clerk, Paddle and Stripe handle the most sensitive data (credentials and card payments) under their own security programmes
Our own access to the service’s data goes through an internal tool protected by multi-factor authentication and passkeys, as described in Section 7
Signed webhooks, tokenised links that can be regenerated, and rate limits on the public parts of the service

No system is completely secure. In the event of a data breach affecting your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay. Where the breach affects data we hold for an organisation as its processor, we will tell that organisation without undue delay so it can meet its own obligations.

11. Your Rights

Under UK GDPR, you have the right to:

Access - request a copy of the personal data we hold about you
Rectification - ask us to correct inaccurate data
Erasure - ask us to delete your data (subject to legal obligations)
Restriction - ask us to restrict processing in certain circumstances
Portability - receive your data in a machine-readable format
Object - object to processing based on legitimate interests
Withdraw consent - for consent-based processing (e.g. push notifications), withdraw at any time

Your right to object to the notes we keep about administrators. Separately from the rights above, and without having to give a reason: if you are an owner or admin you can stop us recording how you use the admin side of Doris (Section 3) at any time, by switching off “Help improve Doris” on your Account page. Collection stops the moment you do, and everything already kept about you is deleted in the same request. You can switch it back on later if you wish. ItsMeFil Ltd is the data controller for these notes, which are kept for our own purpose and not on behalf of your organisation.

If you are a member of an organisation: the organisation you belong to is the data controller for your membership, your bookings and your member record, and we hold them on its behalf. Much of it you can see and change yourself on your Account page. For anything else, please contact your organisation’s administrator first - they can see and correct your details, and remove you if you leave. If you cannot reach them, or the request is about something only we hold (your sign-in account, for example), contact us at hello@bookwithdoris.com and we will help.

If you were referred to Doris by someone: ItsMeFil Ltd is the data controller for that referral record. You can ask us to delete it, or object to the processing entirely, by emailing hello@bookwithdoris.com - we will act on it and you will receive nothing further. We will tell you who referred you if you ask.

If you are a guest who hired a room: the organisation you booked with is the data controller for your details, and we hold them only on its behalf. Please contact that organisation directly to ask about, correct, or delete your details - its name is on the confirmation email you received. If you cannot reach them, contact us at hello@bookwithdoris.com and we will help the organisation respond. Your details are in any case deleted automatically after the period that organisation has set.

To exercise any of these rights, contact us at: hello@bookwithdoris.com. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

12. Cookies

Inside the Doris app, we use only essential cookies and session tokens necessary to operate the service - no advertising or tracking cookies, ever. Those are the sign-in cookies set by Clerk, which keep you signed in, and a small amount of browser storage that remembers things like which organisation you last looked at, which floor of the map you had open and which view you prefer. None of it leaves your device or is used to track you. For usage analytics we use Cloudflare Web Analytics, which is cookieless - it sets no cookies and does not track you across other websites (see Section 5).

Our public marketing pages measure two things, and you can switch each of them on or off at any time with the “Cookie preferences” button in the footer of every page.

Advertising measurement (Meta): off unless you accept. If you accept the cookie banner, the Meta Pixel loads and sets the cookies below (see Section 5). If you decline, it never loads and nothing is set. If you later switch it off in Cookie preferences, the Pixel stops and both of its cookies are deleted.

Cookie: _fbp (Meta) - identifies your browser to Meta, so that a visit can be linked to our advertising. Expires after 90 days.
Cookie: _fbc (Meta) - set only when you arrive by clicking one of our adverts, and records that click. Expires after 90 days.
Session storage: doris.landing - kept only if you accept: the advert details of the page you arrived on, so that a signup can be credited to the advert that brought you. Deleted when you close the tab.

Site statistics (PostHog, no cookies): on unless you switch them off. PostHog counts how our pages are used, as described in Section 5, so that we can improve them. It sets no cookies and stores nothing on your device, it records statistics only, and what it records is never shared with advertisers. We rely on the exception for statistical purposes in regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended by the Data (Use and Access) Act 2025, which allows this without your consent provided we tell you about it and give you a simple way to object, free of charge. Our legal basis under UK GDPR is legitimate interests (see Section 4). To object, switch “Site statistics” off in Cookie preferences: PostHog then stops entirely on that browser and is not loaded again unless you switch it back on. If you accepted our cookie banner on an earlier version of these pages, the PostHog cookie and storage set then (named ph_phc_n2mPKAXBiM5aejGcTo8N6M33jCyuPCPkMqm5qToxrPJg_posthog) are deleted the next time you visit.

Your two choices are remembered in your browser’s local storage, and nothing else is stored to remember them:

doris.cookieConsent - whether you accepted or declined advertising measurement.
doris.siteStatistics - present only if you have switched site statistics off.

13. Children

Doris is intended for use by adults within organisations. We do not knowingly collect data from anyone under the age of 16, and organisations agree in our Terms not to invite anyone under 16 as a member. If you believe a minor has registered without appropriate authority, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via the Doris admin dashboard. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

15. Contact

Privacy queries and data subject requests: hello@bookwithdoris.com

ItsMeFil Ltd (Company No. 17218858), registered in England and Wales. Registered office: 66 Paul Street, London EC2A 4NA.