Privacy policy
Last updated: 15 August 2026
Dolemai is provided by Lapunne Limited, a company registered in England and Wales. This policy explains how we collect, use and protect your personal data when you use Dolemai at app.dolemai.com.
1. Who we are
Lapunne Limited, trading as Dolemai.
We are the controller of your account, billing and usage data — we decide how that data is handled.
We are a processor of the project information you connect to Dolemai — the documents, emails and project records you bring to the service. You remain the controller of that data, and you decide what Dolemai sees. Our obligations as processor are set out in our Data Processing Agreement.
Contact: [email protected]. For data protection matters: [email protected].
Registered with the Information Commissioner's Office. Registration reference: ZB111903.
2. What data we collect
Account data. Your email address, your name if you provide it, and your authentication method (email and password, Microsoft sign-in or Google sign-in).
Project data. The project information you enter — project name, client name, site address, postcode, project type, stage, appointment and contract details, and baseline figures.
Project documents and emails. When you connect a Microsoft 365 folder or a project email channel, Dolemai reads the documents and messages in that location in order to extract project intelligence. What happens to that content is set out in section 5.
Extracted project intelligence. The structured records Dolemai produces from your documents — register entries for risks, actions, information required, decisions, appointment changes and construction contract changes, together with the reports generated from them. These are stored and associated with your project.
Usage records. Records of how you use Dolemai — pages visited, actions taken, reports generated and analyses run. These are our own records held in our own database; we do not use third-party analytics.
Billing data. Payment information is processed by Stripe. We do not store your card details.
Technical data. Standard technical data including IP address, browser type, device type and access logs, used for security monitoring and service maintenance.
3. How we use your data
To provide and maintain Dolemai; to process your project documents and produce project intelligence; to prepare reports for your review; to manage your subscription and payments; to send you notifications about your reports, subscription and account; to respond to support requests; to monitor the security and performance of the service; and to comply with our legal obligations.
We do not sell your data. We do not use your project documents or project data to train AI models. We do not share your data with third parties except as described in this policy.
4. Legal basis for processing
Contract performance — providing the service you have subscribed to, including account management, document processing and report generation.
Legitimate interests — operating and improving Dolemai, including security monitoring, usage records and service maintenance, where these are not overridden by your rights.
Legal obligation — financial record-keeping and tax compliance.
Consent — where we send marketing communications. You may withdraw consent at any time.
5. How your documents are processed
This section describes exactly what happens to your project documents and emails. We have written it in detail because it is the question our customers ask most.
Documents are not stored by Dolemai. When Dolemai analyses a project, it retrieves the documents from the folders you have connected, processes them, and discards them. Document files are never written to disk on our servers and are never saved to our database. Only the structured intelligence extracted from them is retained.
Document content is sent to Anthropic for processing. Dolemai uses Anthropic's Claude API to read and interpret your documents. The content of each relevant document is transmitted to Anthropic as part of that process — for PDFs this is the file itself, and for Word, Excel and programme files it is the extracted text. Email messages that match your filter rule are transmitted in full, including the content of their attachments.
Anthropic's retention. Anthropic retains inputs and outputs for up to 30 days for safety and security purposes, after which they are deleted. Under Anthropic's commercial terms, data submitted through their API cannot be used to train AI models. This is a contractual commitment, not a setting.
Legislation lookup. Dolemai uses OpenAI's API to search a library of public UK legislation, so that reports can be grounded in the relevant regulatory context. Only two pieces of information about your project are used in that search — the RIBA stage and the type of construction contract. No documents, no register content, no names and no other personal data are sent to OpenAI.
Email. Where you connect a project email channel, Dolemai retrieves the subject, sender, date and a short preview of recent messages in the connected mailbox, and applies the subject filter rule you have set. Only messages matching that rule are read in full and processed. Microsoft does not offer folder-level permissions, so the permission Dolemai is granted is read access to the mailbox as a whole; Dolemai reads in full only the messages your filter selects. Email monitoring is optional and is set per project.
You decide what is in scope. You choose which folders and mail channels Dolemai monitors, and you can change or disconnect them at any time. You can also exclude specific folders from monitoring. Exclusions apply to future analysis; information already extracted remains in your registers until you remove it.
6. Where your data is stored, and for how long
Where. Your account and project data is stored in Supabase, hosted in the United Kingdom (London). Payment data is processed and stored by Stripe.
How long.
| Data | Retention |
|---|---|
| Account data | While your account is active |
| Project data, registers and reports | While the project exists in your account |
| Reports you discard | The report content is deleted immediately |
| Ask Dolemai responses | 30 days, then deleted automatically |
| Usage records | 90 days |
| Billing records | Held by Stripe for six years, as required for UK financial record-keeping |
When you delete a project, it is deleted immediately and permanently. All project data, registers and reports are removed from our database at once. There is no retention window and no recovery. We recommend closing a project rather than deleting it if you may want the records later.
Dolemai never deletes anything automatically. If a project has no new documents or emails for 90 days, we generate a closing report and mark the project inactive. After a further 30 days we email you to ask whether you want to delete it. We do not act on that email — deletion is always your decision.
7. Security
We protect your data with:
- Encryption of connection credentials. The tokens that allow Dolemai to read your Microsoft 365 folders are encrypted with AES-256-GCM by our application before being stored, in addition to encryption at rest by our database provider.
- Tenant isolation. Row-level security is enforced on every table, so your data is only reachable by your account.
- Multi-factor authentication. Available on your account using an authenticator app. If you sign in with Microsoft, your organisation's own multi-factor settings apply.
- No tracking. We use no third-party analytics, advertising or tracking services.
- Restricted access. Access to customer data is limited to authorised personnel, only where necessary to provide support, investigate a fault or maintain security.
No system is completely secure. If you believe your account has been compromised, contact us immediately at [email protected].
8. Third parties we use
| Provider | Purpose | What is shared |
|---|---|---|
| Anthropic Ireland Limited | AI processing of documents and generation of reports | Document and email content, project context, register data |
| Supabase | Database and authentication | Account and project data |
| Cloudflare | Hosting, content delivery and security | Request logs, technical data |
| Stripe | Payment processing | Billing and subscription data |
| Resend | Transactional email delivery | Email address, email content |
| OpenAI | Embedding of public UK legislation | RIBA stage and contract type only. No documents, register content or personal data |
| Microsoft | Microsoft 365 sign-in and mailbox hosting for our own support addresses | Sign-in identifiers; support correspondence |
| GoDaddy | Reseller and administrator of our Microsoft 365 tenant | Support correspondence |
| Sign-in only | Email address, name, Google account identifier |
Full details, including locations and transfer safeguards, are at dolemai.com/sub-processors.
When you connect your own Microsoft 365 account, Microsoft is processing your data under your own agreement with Microsoft, not ours. Dolemai reads from it on your instruction.
We will give you at least 30 days' notice by email before adding or changing a sub-processor. If you are not comfortable with a change, you may cancel and receive a pro-rata refund of any prepaid fees.
9. Microsoft 365
When you connect Microsoft 365, Dolemai requests permission to read the SharePoint and OneDrive folders you select and, where you enable it, your mailbox. We use these permissions only to read documents and messages for project analysis as you direct.
Your access tokens are encrypted and used only for the folders and mail channel you have connected. You can disconnect at any time in Project Settings, or revoke Dolemai's access entirely in your Microsoft account settings.
10. Google sign-in
If you sign in with Google, we receive your email address, name and Google account identifier. We use these only to create and manage your Dolemai account. Dolemai does not connect to Google Drive or any other Google service.
11. Your rights
Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict processing, to receive your data in a portable format, to object to processing based on legitimate interests, and to withdraw consent where processing is based on it.
You can export your project registers at any time from your project workspace, download any report as a Word document, and delete your account from Account Settings.
To exercise any other right, contact [email protected]. We will respond within one month.
You may also complain to the Information Commissioner's Office at ico.org.uk.
12. Cookies
Dolemai uses only essential cookies. See our Cookie Policy.
13. Children
Dolemai is a professional service for adults. We do not knowingly collect data from anyone under 18.
14. Changes to this policy
We may update this policy. We will notify you of material changes by email. The current version is always at dolemai.com/privacy.
15. Contact
Lapunne Limited — [email protected] — [email protected] — dolemai.com