Privacy
The short version: we keep the email address you signed up with, a record of what you spent credits on, and nothing else about you. Files you send to a tool are not retained — processed in memory or a temporary directory and deleted before the request returns.
Who we are
DoAThingPlease.com is the data controller for the personal data described here.. Questions about this policy, or any request under the rights below, go to privacy@doathingplease.com.
What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Your email address | To create your account, confirm it, let you sign in, and reset your password | Performance of a contract |
| A hash of each API key | To authenticate your API calls. We store only a SHA-256 hash — the key itself is shown once when you create it and is never recoverable, including by us | Performance of a contract |
| Your credit balance and its history | To meter usage, show you where your credits went, and evidence a purchase | Performance of a contract; legal obligation for purchase records |
| Which tool you ran, when, whether it succeeded, and how long it took | So the Activity page can explain why your balance changed, and so we can find faults | Performance of a contract; legitimate interests in running a reliable service |
| Server logs, including IP address | Security, abuse prevention and debugging. Handled by AWS on our behalf and not linked to your account by us | Legitimate interests in protecting the service |
Files and text you send to a tool
This is the part most people want to know about. A file you upload is held in memory or in a temporary directory for the life of the single request that processes it, and deleted before the response is returned. There is no object storage in this system: nothing you send is written anywhere durable, and no human can retrieve it afterwards, because it no longer exists.
We do not read, inspect, sample or train anything on your content. We record that you ran a tool — never what you ran it on. Filenames are not logged, and error messages are deliberately written so they cannot echo your content back.
Payments
Card details never reach our systems. Payment is taken on Stripe’s own checkout page; Stripe is the merchant of record for your purchase, which also means Stripe accounts for any VAT due. We receive confirmation that a payment succeeded, the amount, and which credit pack it was for — enough to add the credits and show you the purchase.
How long we keep it
- Tool history: 400 days, then deleted automatically.
- Purchases, refunds and the signup grant of 20 credits: kept for as long as the account exists — these are the record of money moving and of what you are owed.
- Uploaded content: not retained — processed in memory or a temporary directory and deleted before the request returns.
- Server logs: 14 days.
Cookies and browser storage
We set no cookies and load no third-party scripts, so there is no cookie banner to dismiss. Two things are stored by your own browser and never sent anywhere except back to us:
- A session token in
sessionStorage, so you stay signed in within a tab. It is discarded when you close the tab. - A short list of tools you used recently in
localStorage, purely so the site can offer them again. Clearing your browser data removes it.
Stripe’s checkout page is Stripe’s own, and sets its own cookies under its own policy.
Who else sees your data
We do not sell personal data and we do not share it for advertising. These processors are in the path:
| Processor | What for | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, compute, database, email delivery | eu-west-1 (Ireland) |
| Stripe | Payments. Stripe is the merchant of record for purchases and handles card data, which never reaches our systems | EU/US, under their own terms |
| ImprovMX | Inbound email forwarding for our domain | EU/US, under their own terms |
Your rights
Under UK and EU data protection law you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, or ask us to restrict it. Email privacy@doathingplease.com and we will respond within one month.
Deletion is self-serve and immediate. The bottom of your account page deletes your account, your keys, your history and your remaining balance. It is irreversible, which is why it asks you to type the confirmation. You do not need to email anyone to do it.
If you think we have handled your data badly, you can complain to the Information Commissioner’s Office. We would rather you told us first.
Changes
If this policy changes materially we will say so on this page and update the date above. The current version is dated 2026-09-08.