Privacy policy

Effective October 15, 2026. Doorman (“we”, “us”).

1. Who is responsible for what

Account data. When you sign up, we decide how your account information is used, so we are the controller of it.

Form submissions. When a visitor submits a form on a customer's website that uses Doorman, the customer decides why that data is collected. The customer is the controller; we are their processor (service provider) and handle submissions only to provide the service. If you submitted a form on someone else's website, please contact that website's owner about your data; we will help them respond.

2. What we collect

From customers

• Account: email address, a hashed password, your plan, and billing identifiers from Stripe (we never see or store full card numbers).
• Configuration: your forms' names, business descriptions, destinations (emails, Slack and webhook URLs), thresholds and allow/block lists.
• API keys and sessions: stored only as hashes.
• Usage and events: monthly check counts and product events such as sign-ups, logins, plan changes and labels, used to run and improve the service.

From form submissions (on behalf of customers)

• The fields the form sent (for example name, email, message and other fields), clipped to fixed lengths. File uploads are ignored and not stored.
• The sender's IP address and, where our network provider supplies it, their country.
• Signals such as time on page, whether JavaScript ran and whether a hidden honeypot field was filled; for checkout forms, the order and payment signals the customer chooses to send.
• Doorman's decision (route, probability, reason and evidence sentence), any label a person gives it, and the delivery log.

From HubSpot (Doorman for HubSpot)

• The free scan (HubSpot's forms permission only): the list of your forms and up to 500 submissions from the last 90 days, read once and judged. The access HubSpot grants is used for the scan and never stored. The report keeps totals and up to nine example submissions (name, email, message excerpt and verdict) so you can share it; it is deleted after 14 days.
• Protection (adds permission to read and update contacts, add contact properties and manage lists): each new form submission is read and stored like any other Doorman submission, and Doorman writes its verdict onto the matching contact (Doorman verdict, reason, the deciding line, score, time and a link) and adds spam contacts to a “Doorman: spam” list. Doorman never deletes contacts or reads other CRM records. The HubSpot refresh token is stored encrypted and used only to keep reading your forms; disconnecting revokes it, and uninstalling the app in HubSpot stops it.
• The HubSpot user's email and account domain, to create or sign in to your Doorman account and to learn what the business sells from its website.

From visitors to this website

• Standard server logs (IP address, pages requested, browser) kept for security and debugging for up to 30 days.
• Anonymous page counts: which of our public pages were viewed and which main buttons were clicked (for example “Copy prompt”), kept only as daily totals per page, with no cookie, IP address or identifier. Not sent if your browser has Do Not Track or Global Privacy Control switched on.
• Support requests and feedback: your email, what you write, and, when you write from the dashboard or through the API, your plan, forms, this month’s check count, recent failed deliveries and errors, the page you were on and your browser. Never API keys or passwords. Kept until you delete your account; requests sent without an account are deleted after a year. A request that Doorman screens as spam is kept but nobody is notified.
• Text you type into the “try it” box on the home page is sent to Jev to be judged and is not stored.

3. How we use it

• To provide the service: judge submissions, forward them to the destinations you set, show them in your dashboard and let you rescue or label them.
• To send service emails: welcome and “set a password” links, password resets, usage warnings and forwarded submissions.
• To bill you through Stripe and handle plan changes.
• To keep the service secure and working: rate limiting, abuse prevention, debugging and alerting.

Legal bases (where GDPR/UK GDPR applies): performance of our contract with you for account data; our legitimate interests in securing and improving the service; and, for submissions, the customer's instructions under our data processing terms.

No training, no selling. Submissions are sent to Jev only to be judged. We don't use them to train or fine-tune models, and we don't sell or rent personal data. Submissions are never used for advertising.

Automated decisions. Doorman makes automated recommendations about whether a submission is genuine. Customers can review every held and dropped submission and deliver it with one click. These are recommendations to the customer, not decisions about you: the customer who runs the form decides what happens to each submission and can deliver any held or dropped one. If you think a message of yours was wrongly kept out, contact the website's owner.

4. Who we share it with

We use a small number of subprocessors to run Doorman. Each receives only what it needs.

Submissions also go wherever the customer points them (their email, Slack workspace or webhook). We may disclose data if required by law, or to protect the rights and safety of users and the service. If Doorman is acquired or merged, data may transfer to the new owner under this policy. We will give customers 30 days' notice of new subprocessors by email and on this page.

5. How long we keep it

Submissions older than the plan's period are deleted automatically. Moving to a plan with a shorter period deletes older submissions. Deleting your account removes its forms, keys and all submissions immediately (backups roll off within 14 days).

6. Cookies and local storage

• dm_session: an HttpOnly cookie that keeps you logged in to the dashboard (30 days). Strictly necessary.
• doorman-theme: your light/dark preference, kept in your browser's local storage. Never sent to us.
• dm_ref: if you arrive from a referral link (?ref=), we keep that tag in a first-party cookie called dm_ref for 30 days so the referrer can be credited when you sign up. It contains nothing else.
• dm_gclid: if you arrive by clicking one of our Google ads, Google adds a click id to the link. We keep it in a first-party cookie called dm_gclid for 90 days; if you sign up, we store it with your account and tell Google Ads that the click led to a sign-up (and later, whether you started using Doorman or subscribed). No Google script runs on our pages and nothing else is shared.
• Doorman for Webflow: the panel in the Webflow Designer keeps your “Webflow app” API key and your account email in its own local storage, on Webflow's app domain, so you stay connected. It sends them only to withdoorman.com. That key can only list, create and rename forms; revoke it under Settings, or press Disconnect to remove it from the panel.

dm_gclid is our only advertising-related cookie: it's first-party, set only when you arrive from one of our Google ads, and used only to tell Google Ads which of those clicks led to a sign-up. We don't use third-party advertising cookies, ad-tracking scripts or third-party analytics cookies. The optional form script (d.js) sets no cookies; it adds a page-load timestamp and a hidden honeypot field to the form.

7. Security

Passwords are hashed with scrypt; API keys and session tokens are stored only as hashes. Traffic is encrypted in transit with HTTPS. Webhooks are signed so you can verify they came from us. Access to production data is limited to the people who run Doorman. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay and within 72 hours where required.

8. International transfers

We and our subprocessors process data in the United States. Where data leaves the EEA or UK, we rely on the European Commission's Standard Contractual Clauses and, for the UK, the UK Addendum.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, and to object to some uses. Customers can export everything we hold about their account as JSON, and delete the account, from Settings in the dashboard. For anything else, email hello@withdoorman.com. You can also complain to your local data protection authority.

If you submitted a form on a website that uses Doorman, contact that website's owner first: they control that data. We will forward requests we receive to them.

10. Children

Doorman is a business tool and isn't directed at children under 16. We don't knowingly collect their data as a controller.

11. Changes

We will post changes here and update the effective date. For material changes we will email account holders at least 30 days in advance.

12. Contact

Doorman. Email: hello@withdoorman.com.