Privacy Policy

Who is responsible

The data controller for Do This Next is Simon Berriman, sole trader (freelance), Karl-Rothe-Str. 4, 04105 Leipzig, Germany. Full details are in the Impressum. For anything to do with your data, email hello@dothisnext.lol. It reaches a person, and it is the right address for a request under any of the rights listed below.

Do This Next is operated from Germany and this policy is written to the GDPR and the German implementing rules, wherever in the world you are reading it from.

What we process, and why

Grouped by the thing you did, because that is how you will remember giving it to us.

When you run a Product Check

• The URL you submit, and the domain we derive from it. Stored so we can analyse it, show you the result, and not spend money analysing the same site twice in three days.
• The page we fetch from that URL, and what we infer from it about your product. The problem it solves, who it is for, how it is priced, what people use instead. We keep the fetched page alongside the conclusions, because a recommendation you cannot check is worth nothing.
• Anything you tell us about your product. Corrections to what we got wrong, your goals, your budget, how much time you have. Corrections create a new version rather than overwriting the old one, so it stays possible to see what we believed when we gave a particular piece of advice.
• The recommendations we generate, the reasoning behind them, and anything you later record about what happened when you acted on one.
• A hashed form of your IP address. Salted with a salt that rotates every day, used only to rate-limit the free Product Check. Yesterday’s value stops matching today’s, so it cannot be used to follow you over time, and it cannot be turned back into your IP address at all.
• Basic request context. The domain that referred you (not the full page address), your browser’s user agent string, which position on our site you started from, and any campaign tags in the link you clicked.

Legal basis. Article 6(1)(b) GDPR. You asked us to analyse a product, and we cannot do that without the URL and what we find at it. The hashed IP and the rate limiting are Article 6(1)(f): our legitimate interest in not having an automated script spend our model budget, achieved with the least identifying thing that works.

When you give us your email address

• The address itself, and when you gave it. We use it to send you the result of your Product Check and, if you asked to be told when Founding Access opens, to tell you that.

Legal basis. Article 6(1)(b) for the thing you asked us to send you; Article 6(1)(a). Consent, for being told about Founding Access, which you can withdraw by replying and saying so.

If you ask us to tell you about Founding Access

There is an unticked box next to the email field on a Product Check. Ticking it is the only thing that lets us send you an announcement or anything else that is not strictly about something you did. We store the address, the date, where you ticked it, and the exact wording you were shown, because the law asks us to be able to demonstrate what you agreed to rather than merely that you agreed to something.

Legal basis. Article 6(1)(a) GDPR, consent, and § 7(2) Nr. 2 UWG for the electronic advertising itself. Leaving the box unticked changes nothing about your Product Check.

Every one of those emails carries a one-click unsubscribe link, and your mail app’s own unsubscribe button works too. Withdrawing is recorded against your address and outranks any consent, so it applies even if you tick the box again somewhere else later. It does not stop the emails that come with a membership you are paying for, because those are part of the subscription rather than a mailing list. The way to stop those is to cancel.

The email we send once you have an account

All of it is transactional: each one is a response to something you did, and there is no newsletter, no sequence and nothing you have to opt out of to stop hearing from us. We keep a record of which of these went to you and when. That record is what stops the same notice being sent twice, and it is what we would look at if you ever asked whether you were warned before a payment.

• When you create an account, one message confirming it exists and how to get in.
• When you start a trial, the exact date and amount of your first payment, and how to cancel before it.
• Before that first payment, a reminder three days ahead and another the day before, both naming the date and the amount. We send these because we take a card to start the trial, and being charged without warning is the thing they exist to prevent.
• When a payment succeeds, fails, or you cancel: what happened, what it means for your access, and where your invoices are.
• Once, if we worked out your first action and you never came back to read it — naming the action and where to find it. Once only, and never again for that action. It carries an unsubscribe link even though it is about something you asked us to do.

Legal basis. Article 6(1)(b) GDPR throughout. These are necessary to perform the contract you entered into, which is why they are not consent-based and not something we could reasonably let you switch off while still charging you. If you would rather not receive any of it, the answer is to close the account.

When you subscribe (once billing is live)

• Your email address and subscription status, so you have access to what you paid for.
• Payment records. The amount, the plan, the status. Card details are handled entirely by Stripe and never reach us.

Legal basis. Article 6(1)(b) for the subscription itself; Article 6(1)(c) for keeping the accounting records that German tax and commercial law require us to keep.

When you paste in your customers’ feedback

This one is different from everything else on this page, so it gets said plainly. For this data you are the controller and we are your processor. You are handing us other people’s words to analyse on your instruction, which makes it your decision to make and our job to handle carefully. The processing agreement Article 28 requires is section 7 of the Terms.

• What we receive: whatever you paste. Support messages, cancellation reasons, reviews written by your customers.
• What we strip first. Email addresses, phone numbers and long digit runs that look like account or card numbers are replaced before the text is read by anything or written anywhere. This is not anonymisation. A message can identify someone from its content alone, but it removes the identifiers that arrive by accident when you copy an inbox.
• What we keep. Not the messages. We keep the themes we found, what we think each one means for your marketing, and one verbatim quote per theme as the evidence for it. The batch you pasted is not stored, and there is no copy of it after the request finishes.
• What we do with it. Find recurring themes, and use them when choosing your next recommendation. That is all. It is not used to train models, and it is never folded into the aggregated cross-customer patterns described further down.
• Purpose and basis: performing our contract with you (Art. 6(1)(b)) as regards you. As regards your customers, you are the controller and the basis is yours to establish, which is why the Terms ask you to confirm you have one, and ask you not to paste special category data.
• How long: the themes last as long as your account. Ask and we delete them; close the account and they go with it.

Whenever you use the site

• Server and security logs kept by our hosting provider, which include IP addresses and request details. We do not build a profile from them; they exist so that an outage or an attack can be diagnosed.
• Our own page and event counts. First-party, cookieless and not tied to you: which page, which referring domain, which campaign tag. No identifier is set, nothing is read from your device, and the same visitor on two pages is two rows we cannot join.
• Your privacy choice, stored in your own browser. It never reaches our server. See the Cookie Policy.
• Google Analytics data, only if you consent. Covered in its own section below.

Legal basis. Article 6(1)(f) for the logs and our own cookieless counts. A legitimate interest in a site that works and that we can improve, pursued in a way that does not identify anybody. Article 6(1)(a) for Google Analytics, and for nothing that is genuinely necessary to run the product: we do not dress up required processing as a choice you have already made.

What fetching your page actually involves

One request, to the address you gave us. We do not crawl the rest of your site, follow links, or come back on a schedule. The analysis is a single page fetch, and a repeat request for the same domain within three days is served from what we already have rather than fetched again.

• We identify ourselves honestly. The request arrives as DoThisNextBot/1.0 with a link back to this site, so you can recognise it in your logs.
• We never send credentials, never attempt anything behind a login, and read only what an anonymous visitor to that address would get.
• The request times out after twelve seconds, stops after about 1.5MB, follows at most four redirects, and refuses private, loopback and internal addresses outright.
• We do not currently read your robots.txt before that one fetch, because the fetch is of the address someone asked us to look at rather than a crawl of your site. If you would rather we did not fetch it at all, block that user agent or email us and we will stop.

Public conversations we look at, and the people in them

Once you are a customer we search public discussions. Hacker News, Bluesky, and Reddit through a search engine, for people describing the problem your product solves, so we can suggest a conversation worth joining. That means we process a small amount of personal data about people who have never heard of us, and here we are the controller rather than your processor. So this section is about them, not about you, and it is written to be readable by somebody who arrived here after finding their own post quoted.

• What we look at: posts and comments their authors published publicly, found by searching for words about a problem. We do not log in to anything, we do not see anything private, and we do not follow anybody.
• What we keep: the link, the title, an excerpt of the post, when it was posted, and one sentence on why it matched. That is all.
• What we deliberately do not keep. No author names, no handles, no display names, no follower counts, no posting history. We build no profile of anybody. A link to a post unavoidably contains an identifier. A Hacker News item number, or a Bluesky account identifier, because otherwise the link would not work; that is the minimum required to reach the post and it is where it stops.
• Legal basis: legitimate interests, Art. 6(1)(f), ours in helping a customer find a relevant public conversation, and the customer’s in being pointed at one. We think it is a narrow interest and a proportionate one: the data was published publicly by its author, we keep the minimum needed to link to it, we build no profile, and we never contact anybody. Nothing is posted or sent automatically. Our customer decides whether to reply, in their own words, as themselves.
• How long: a fortnight. A discussion stops being worth joining long before that, and the expiry is set on the record when it is written rather than being a tidy-up we intend to get round to.
• If that post is yours and you would rather we did not hold it, email hello@dothisnext.lol and we will delete it and stop. You do not have to explain why, and you have the right to object under Art. 21 regardless of what we think of our own interest.

We are not going to pretend this is nothing. It is a small amount of data about people who did not ask us to read their posts, and the honest mitigations are the ones above: minimum retention, no profiles, no contact, no automation, and a working way to say no.

AI processing

Analysing a product and writing a recommendation is done with large language models. This matters enough to be explicit about.

• The provider is OpenAI. Model calls go to the OpenAI API from our servers. If we ever add a second provider, it will be named here before it processes anything.
• What is sent. The text of the public pages we fetched from your site, the structured profile we built from them, anything you told us about your product and your goals, and the instructions that ask for a specific piece of analysis. Your email address is not sent. Your IP address is not sent. Nothing about your payment is sent.
• Training. We do not use your business’s data to train models of our own. OpenAI states that data submitted through its API is not used to train its models by default; that is their commitment under the API terms rather than ours to give, so we point at it rather than restate it as a promise.
• Judgement stays yours. The output is a recommendation. Nothing is posted, sent or published on your behalf. You decide what to do, and no decision with a legal effect on you is made by an automated process here.

Who else processes your data

A short list, and we would like to keep it short. Each of these acts as a processor on our instructions under a data processing agreement.

Fonts are served from our own domain rather than fetched from Google, so simply loading a page on dothisnext.lol contacts nobody but us. We do not run any third-party advertising, tag manager, session recorder or heatmap, and we do not sell or rent personal data to anyone, for any purpose, ever.

Where your data is stored, and international transfers

Our database is hosted by Supabase in Amazon Web Services’ London region, so the Product Checks, email addresses and records described above are stored in the United Kingdom. The site itself runs in Frankfurt, Germany.

The United Kingdom

The United Kingdom is not part of the European Union or the European Economic Area, so storing your data there is a transfer to a third country and needs a legal basis. Transfers of personal data from the EEA to the UK currently rely on the European Commission’s adequacy decision for the United Kingdom, which recognises UK data protection law as offering protection essentially equivalent to the GDPR. Where an adequacy decision applies, the transfer is permitted on that basis alone and no further safeguard, no Standard Contractual Clauses, no separate consent from you. Is required, so we are not going to claim one.

That decision is periodically reviewed and renewed by the Commission. If it lapsed or were withdrawn, transfers to the UK would need a different basis; we would put one in place and this page would say what it is.

Everyone else

Several of the other providers above are established in the United States or may process data there. For those, the transfer relies on the mechanism set out in our agreement with that provider. The Commission’s Standard Contractual Clauses, or the provider’s certification under the EU–U.S. Data Privacy Framework where it holds one. We deliberately do not state which of those applies to which provider on this page, because we would rather say less than claim a safeguard we have not checked line by line. Ask us about a specific provider and we will tell you what our agreement with them actually says.

Google Analytics

Google Analytics is optional. It is off until you switch it on, and switching it on is the only thing that causes the Google Analytics library to be requested at all. Before that, no request is made to Google and no Google cookie exists on your device.

• What it is for. Seeing in aggregate which pages people read, which ones they leave, and whether a change we made helped. It is not used to target you and we do not run ads.
• What it receives. Page addresses, referrer, approximate location derived from IP, device and browser characteristics, and a few product events such as “someone started a Product Check”. Google sets cookies to recognise a returning browser. Property G-QYB0Z2WDTZ.
• What it never receives. Your email address, the URL you submitted, anything you told us about your business, anything a model wrote for you, or the link to a private Product Check. That page address is redacted before it is sent. Advertising features, Google Signals and ad personalisation are switched off, and advertising consent is refused at all times whatever else you choose.
• Provider. Google Ireland Limited, with Google LLC in the United States as a sub-processor. Google’s own explanation of what it does with the data is at policies.google.com/privacy.
• Changing your mind. Use Cookie settings in the footer of any page. Turning analytics off stops further collection, clears the Google cookies that were set, and reloads the page so nothing of Google’s is still running on it.

Legal basis. Your consent. Article 6(1)(a) GDPR, and § 25(1) TDDDG for the storage on your device. Withdrawing it is as easy as giving it and has no effect on anything else you can do here.

How long we keep things

An anonymous Product Check is deleted 90 days after it was created. That is enforced by a job that runs every day, not a policy we intend to get round to: the expiry is set on the record when it is created, and the purge deletes the check together with the pages we fetched from your site, the profile we inferred and the verdict we wrote. Nothing is left behind except counts. How many checks ran, what they cost us, which carry no information about you or your business.

The exception is a Product Check that belongs to an account. Once you are a customer, your checks are your records: they stay until you delete them or close the account, rather than disappearing off a timer while you are still using them. The 90-day rule applies to the anonymous ones, meaning a check run by somebody who never signed up.

Conversations we found for you expire after a fortnight, set on the record when it is written. A discussion stops being worth joining well before then, so nothing needs to be kept longer and nothing is.

Customer feedback you pasted in is not kept as you pasted it. The messages are discarded once the analysis finishes; what remains is the themes, what we think they mean and one quote each, and those last as long as your account. They are the reason a later recommendation is better than an earlier one, which is why they are not on a timer, but they are yours, and one email removes them.

• Account and subscription data will be kept while the account exists, and deleted afterwards apart from what tax and commercial law require us to retain, which for invoices and accounting records in Germany is a matter of years, not our discretion.
• Your email address goes when the Product Check it is attached to goes, or when the account it belongs to is closed. If you separately asked to be told when Founding Access opens, that record is kept until you tell us to stop, because it is the thing you asked for.
• A record that you unsubscribed is kept indefinitely, and deliberately. It is the only way to honour the request: deleting it would let a later import or a re-run of a job start emailing you again, which is the opposite of what you asked for. It holds the address, the date and how you did it, and nothing else.
• Our record of which emails we sent you is kept while the account exists. It holds the type of message, the address and the date, never the contents. It is what stops a notice being sent twice, and what we would rely on if you asked whether you were warned before a payment, so it has to outlive the message itself.
• Hashed IP addresses stop being linkable to anything within 24 hours, because the salt rotates daily. Rate-limit counters are keyed to a time window and are meaningless once it has passed.
• Server and security logs are kept as long as they are useful for diagnosing a problem, under our hosting provider’s retention, and are not used for anything else.
• Our own cookieless event counts are aggregate from the moment they are written and are not linked to a person, so there is nothing in them to delete on request.
• Your privacy choice lives in your browser, not with us, and lasts until you clear your browser storage or change it. Clearing it simply means we ask again.

You do not have to wait 90 days. Ask us to delete a check and we delete it.

Your rights

Under the GDPR you have the right to ask us for a copy of the personal data we hold about you (Article 15), to have inaccurate data corrected (Article 16), to have it deleted (Article 17), to have our processing restricted (Article 18), to receive it in a portable form (Article 20), and to object to processing we base on legitimate interests (Article 21). Where we rely on your consent you can withdraw it at any time, without giving a reason and without it affecting anything that happened before.

Email hello@dothisnext.lol. There is no form and no portal. We will respond within a month, and if what you are asking for is deletion, deletion means the Product Check, the fetched pages and the analysis actually go.

You also have the right to complain to a data protection supervisory authority. For this operator that is the Saxon Data Protection and Transparency Officer (Sächsischer Datenschutzbeauftragter, datenschutz.sachsen.de), and you may also complain to the authority where you live or work.

A few things we don’t do

• We don’t sell or rent your data. To anyone. Ever.
• We don’t use your business’s data to train models of our own. If we ever learn across customers, it will be from aggregated, de-identified patterns that could not point back to you.
• We don’t post, send or publish anything anywhere on your behalf. We draft; you decide.
• We don’t run advertising, ad tracking or cross-site tracking of any kind, and there is no advertising consent to give because we are not asking for one.
• We don’t make your Product Check public. It has an unguessable link, it is not indexed and it is not listed anywhere. If we later add a way to publish one, it will be off unless you turn it on.

Children

Do This Next is a business tool and is not intended for anyone under 16. We don’t knowingly process children’s data; if you think we have, tell us and we will delete it.

Changes to this policy

If we add a processor, a purpose or a category of data, this page changes first and the date at the top changes with it. A change that affects what you have consented to means the consent banner asks again rather than quietly inheriting your last answer.