How Donut handles information.

1. Information we collect

We collect information you submit, information created while providing the service, and limited technical information from your browser. Depending on how you use Donut, this can include:

• Contact information: name, email address, and phone number.
• Vehicle and claim information: VIN, mileage, vehicle details, insurer, claim number, dates, repair total, market area, eligibility answers, and notes.
• Documents and case content: repair records, photographs, correspondence, filenames, and other materials you choose to upload.
• Service and transaction records: case status, reviewer notes, report research, delivery records, Stripe checkout references, amount, currency, and payment or refund status.
• Website and campaign data: device and browser information, pages and interactions, referring site, landing page, consent choice, campaign parameters, and advertising click identifiers, subject to the choices described below.

We may also obtain information from payment providers and from public or commercial vehicle-listing and history sources used to research a report.

When you enter a valid VIN and start a free case check, we may store the VIN and time of that check even if you do not finish the intake or pay. If you later submit a case, we may link that lead record to the case.

2. How we use information

We may use information to evaluate eligibility; review and research a case; request missing information; prepare and deliver a purchased report; provide service and payment support; process transactions and refunds; attribute campaigns; improve Donut; secure the service; detect misuse or fraud; maintain tax, accounting, and operational records; resolve disputes; and comply with law.

Eligibility results are based on the answers provided and can be reviewed as part of the eligibility process. Donut does not make an insurance-coverage, legal-liability, or claims-payment decision on behalf of an insurer.

3. When information may be disclosed

We may disclose information to vendors that provide hosting, private file storage, security, payments, analytics, communications, and other operational services; to professional advisers; when reasonably necessary to comply with law, protect rights or safety, investigate misuse, or respond to a valid legal process; in connection with a financing, reorganization, sale, or transfer of the business; or at your direction. Providers may process information in the United States or other locations where they operate.

Donut does not knowingly sell case files, uploaded documents, or contact information for money. Some laws may define optional advertising measurement as a “sale,” “sharing,” or targeted advertising even when no money changes hands. That measurement is off unless you choose Allow all, and you can turn it off at any time.

4. Analytics, cookies, and campaign measurement

Donut uses Vercel Web Analytics for anonymous page and referrer measures, Google Tag Manager to manage Google Analytics and Google Ads measurement, and Microsoft Clarity for masked heatmaps and session diagnostics. These tools do not send an analytics event until you allow analytics. Vercel receives only approved public page paths without query parameters. Clarity does not run on reviewer or payment pages and uses strict masking.

Donut's analytics events are designed not to include names, email addresses, phone numbers, VINs, claim numbers, filenames, uploaded documents, or intake text. Masking and access controls reduce risk but do not make any internet service risk-free. Vercel, Google, Microsoft, and their technologies also operate under their own terms and privacy notices.

If you allow analytics, Donut may retain the landing page, referring site, campaign parameters, and advertising click identifiers with a submitted case so the case and a later purchase can be attributed to a campaign. If you decline, Donut does not store those attribution details with the case. A later change applies going forward and may not erase information already processed.

5. Payments

Stripe hosts checkout and processes payment-card information under its own privacy notice. Donut does not receive or store the full card number. We retain transaction references, amount, currency, and payment or refund status as needed to reconcile the case and maintain business records.

6. Retention

We retain information for as long as reasonably necessary for the purposes described here, including to complete and support a case, maintain business and transaction records, secure the service, enforce agreements, resolve disputes, and meet legal obligations. Retention can vary based on the type and sensitivity of information, case status, legal requirements, and operational need. Deletion from backups and provider systems may not be immediate, and some records may be retained when permitted or required by law.

7. Security

Donut uses safeguards intended to protect information, including private file storage and restricted reviewer access. No storage, transmission, or security measure is guaranteed to be completely secure. You are responsible for using an email account and device you control and for avoiding unnecessary sensitive information in your submission.

8. Your choices and privacy requests

Use the Privacy choices control on any Donut page to allow all optional measurement, allow analytics without advertising storage, or decline optional tracking. Donut does not currently respond to the legacy browser “Do Not Track” signal, which does not have a uniform standard.

Depending on where you live and whether a law applies to Donut, you may have rights to request access, correction, deletion, or a copy of certain information; to learn about its sources, purposes, and recipients; or to opt out of certain uses. We may need to verify your identity, authority, and request details. Legal exceptions can apply, and we may retain information needed for transactions, security, disputes, or legal compliance. Donut will not unlawfully discriminate against you for exercising an applicable privacy right.

Deleting an open case may prevent Donut from reviewing, completing, or delivering it. Payment and refund rights remain governed by the service terms and applicable law.

9. Children

Donut is intended for adults and is not directed to children under 18. Do not submit information about a minor unless you have the legal authority and a legitimate case-related reason to do so.

10. Third-party services and links

Donut may link to Stripe, vehicle listings, government resources, or other third-party services. Their privacy and security practices are governed by their own notices, not this one.

11. Changes to this notice

We may update this notice as Donut, its providers, or applicable requirements change. The effective date above identifies the current version. Material changes apply prospectively unless law requires otherwise.

12. How to contact Donut about privacy

For a case-specific privacy request, reply to the Donut message associated with your case and include only your Donut reference number. If you paid through Stripe, you may also use the contact path shown in your Stripe receipt. Do not send additional identity documents or case files unless Donut asks for them through a verified channel.