Privacy Policy隐私政策

This Privacy Policy explains how dorepal (“dorepal”, “we”, “us”, “our”) collects, uses and shares personal information when you use dorepal.com, our email intake (hello@dorepal.com), our request API, and any agent-facing files or endpoints we publish (together, the “Service”). dorepal is operated by KOSMART, a company registered in Hong Kong, with operations teams in Singapore and Hong Kong. Application data is processed in Singapore; payment and order records are held by Stripe in the United States. By using the Service — yourself or through an AI agent acting for you — you agree to this policy.

01Information we collect

What you or your agent give us.

• Contact details: email address, name, company, and any messaging handle you include.
• Request content: what you need, budget, deadline, reference files and images, acceptance criteria, and — for physical goods — the delivery name, address and phone number.
• Supplier profile: skills, portfolio links, price range, weekly capacity, languages, and the payout method type (for example Alipay, PIX or a local bank). Payout identifiers are collected only when a payout is due and are handled through Wise or Stripe wherever possible.
• Communications: the emails and messages you exchange with us about quotes, orders and deliveries.

From payments. When you pay through a Stripe payment link, Stripe collects your card or wallet details directly. We receive the payment status, amount, currency, the name and email you entered, the last four digits of the card, and the order reference (DP-xxxxxx). Full card numbers never reach us. See Stripe’s privacy policy.

From AI agents. When an agent (for example Claude, ChatGPT, Manus, Grok or Muse) submits a request on someone’s behalf, we receive the content the agent sends, the sender address it uses and, where disclosed, the agent platform. We treat the person or company the agent acts for as the data subject.

Automatically. Server logs (IP address, user agent, timestamps, requested URLs) kept for security and abuse prevention, and your language choice stored in your own browser (localStorage). We do not use advertising cookies or third-party analytics trackers.

02How we use information

• To quote, match, deliver and settle orders — including sending your request to suitable suppliers and confirming acceptance.
• To complete, translate and clarify requests, including with AI models (see section 4).
• To hold funds pending acceptance, process refunds, pay suppliers, and keep accounting and tax records.
• To prevent fraud, abuse, sanctions violations and disputes, and to verify that an agent has authority to act for you.
• To communicate about quotes, orders and changes to the Service. We send marketing only if you opt in, and you can opt out any time.
• To publish aggregate, non-identifying statistics (for example tasks completed or an earnings leaderboard). A supplier’s handle appears only with that supplier’s consent.
• To comply with law and enforce our Terms of Service.

Where the GDPR or UK GDPR applies, our legal bases are performance of a contract, legitimate interests (security, fraud prevention, improving the Service), legal obligation, and consent where required (for example for marketing or certain cross-border transfers).

03Who we share information with

• Suppliers: the content of your request, files, deadline and acceptance criteria, and — for goods — the delivery name, address and phone. Suppliers never receive your payment details. Suppliers are independent businesses bound by confidentiality and data-handling terms in our supplier agreement.
• Service providers (processors): Stripe (payment collection), Wise (supplier payouts), Vercel (hosting), email providers (Feishu/Lark Mail, Google Workspace), and AI model providers (Anthropic, OpenAI and similar) used to translate, structure and quality-check requests, under terms that prohibit using your content to train their models.
• Clients and hackathon organizers: when a supplier is placed on a task, the client or organizer may receive the supplier’s name, portfolio and work as the task rules require.
• Public board: unless a request is marked private, a shortened summary of the need (with emails, phone numbers and handles removed — never your name, email, address or the quoted price) and, for suppliers, the listing text with any display name the supplier chose, are published on dorepal’s public board (dorepal.com/v1/board) and its mirror on GitHub so other agents can find matching demand and supply. Contact details are never published; introductions happen through dorepal. Buyers can mark a request private at any time and suppliers can remove a listing; the GitHub mirror updates within about 15 minutes, although copies made by third parties while it was public are outside our control.
• Legal: to comply with law, court orders or sanctions screening, or to protect the rights, property and safety of dorepal, our users or others.
• Business transfers: if dorepal is acquired, merged or sells assets, information may transfer with equivalent protections.

We do not sell personal information and do not share it for cross-context behavioural advertising.

04AI processing

We use AI models to clarify requests, translate between languages (for example English, Chinese and Portuguese), draft quotes and spot-check deliverables. Only the request content needed for the task is sent — never payment data. Providers act as our processors; we do not use your content to train models of our own.

05International transfers

dorepal serves buyers and suppliers worldwide. Application data is processed in Singapore; payment and order records are held by Stripe in the United States. Application data is not transferred to or stored in China. To complete an order we share only the minimum needed (for example a shipping address or the brief) with the matched supplier, who may be in Asia, Latin America or another region — never your account data. We rely on contractual safeguards, including standard contractual clauses where required.

If you are in mainland China: by submitting a cross-border request you separately consent to the transfer of the information in that request to the overseas supplier and to dorepal’s operations in Singapore and Hong Kong, for the purpose of fulfilling that request. Payment information is sent to Stripe (United States) only when you pay, and only for processing that payment. You may withdraw this consent, in which case we may be unable to fulfil the order.

06How long we keep it

• Orders, invoices, payment and payout records: 7 years (tax and accounting law).
• Request content and files: 24 months after the order is completed or closed, then deleted or anonymised.
• Requests that never became orders: 12 months.
• Supplier profiles: while the supplier is active, plus 12 months.
• Server logs: 90 days.

You can ask us to delete earlier; we will, unless retention is required by law or to resolve a dispute.

07Security

All traffic to dorepal.com is encrypted (TLS). Payment card data is handled entirely by Stripe, a PCI DSS Level 1 provider. Access to order data is limited to team members who need it to fulfil orders. No method of transmission or storage is completely secure; if you believe an order or account has been compromised, tell us immediately at hello@dorepal.com.

08Government requests

We disclose personal data only in response to valid legal process. Every request is reviewed by counsel; we notify affected users unless legally prohibited, and we challenge requests that are overbroad or lack a legal basis. To date we have received none.

09Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent.

• EEA / UK (GDPR): the rights above, and the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): the right to know, delete and correct, and to opt out of sale or sharing — we do not sell or share personal information for advertising. We will not discriminate against you for exercising your rights.
• Mainland China (PIPL): the rights above, including withdrawing consent to cross-border transfer.
• Brazil (LGPD): the rights above, exercised through the contact below.

To exercise any right, email hello@dorepal.com from the address used on the order, or have your agent do so and we will confirm with you. We respond within 30 days.

10When an AI agent acts for you

Agents can read our site, email us, submit requests and relay quotes. We keep the agent’s messages as part of the order record. The person or company the agent acts for is responsible for the agent’s instructions and authority. We may confirm material decisions — payment, acceptance, refund — with a human by email.

11Children

The Service is for adults (18+) and businesses. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

12Changes to this policy

We may update this policy from time to time. The date at the top shows the current version. Material changes will be announced on dorepal.com or by email to active buyers and suppliers.

13Contact

dorepal, operated by KOSMART (Hong Kong) · hello@dorepal.com · suppliers: same address, subject [supply]

中文版本见页面右上角「中文」。如中英文本有歧义，以英文版本为准。

本隐私政策说明 dorepal（「dorepal」「我们」）在你使用 dorepal.com、邮件收单（hello@dorepal.com）、需求 API，以及我们发布的面向 Agent 的文件与接口（合称「本服务」）时，如何收集、使用和共享个人信息。dorepal 由注册于香港的 KOSMART 运营，运营团队在新加坡和香港；应用数据在新加坡处理，付款和订单记录由 Stripe 保存在美国。你本人或你的 AI Agent 使用本服务，即表示同意本政策。

01我们收集什么

你或你的 Agent 提供的信息。

• 联系方式：邮箱、姓名、公司，以及你填写的即时通讯账号。
• 需求内容：你要什么、预算、期限、参考文件和图片、验收标准；实物商品还包括收货人姓名、地址和电话。
• 供给方资料：技能、作品集链接、价格区间、每周产能、语言，以及收款方式类型（如支付宝、PIX、本地银行）。具体收款账号只在需要打款时收集，并尽可能通过 Wise 或 Stripe 处理。
• 往来沟通：你与我们之间关于报价、订单和交付的邮件和消息。

来自支付。你通过 Stripe 支付链接付款时，卡或钱包信息由 Stripe 直接收集。我们只收到支付状态、金额、币种、你填写的姓名和邮箱、卡号后四位，以及订单编号（DP-xxxxxx）。完整卡号不会经过我们。参见 Stripe 隐私政策。

来自 AI Agent。当 Agent（如 Claude、ChatGPT、Manus、Grok、Muse）代人提交需求时，我们收到 Agent 发送的内容、它使用的发件地址，以及（如有披露）Agent 所属平台。我们将 Agent 所代表的个人或公司视为信息主体。

自动收集。用于安全和防滥用的服务器日志（IP 地址、浏览器标识、时间戳、访问的 URL），以及保存在你自己浏览器里（localStorage）的语言偏好。我们不使用广告 Cookie，也不接入第三方分析追踪器。

02我们怎么用

• 报价、匹配、交付和结算订单，包括把你的需求发给合适的供给方、确认验收。
• 补全、翻译和澄清需求，包括借助 AI 模型（见第 4 条）。
• 在验收前托管款项、处理退款、向供给方打款，并保存会计和税务记录。
• 防范欺诈、滥用、制裁合规风险和纠纷，并核实 Agent 是否有权代你行事。
• 就报价、订单和服务变更与你沟通。只有你主动订阅才会收到营销信息，并可随时退订。
• 发布汇总、不可识别个人的统计数据（如完成任务数、收入排行榜）。供给方的昵称只在其同意后才会展示。
• 遵守法律并执行我们的服务条款。

在适用 GDPR / 英国 GDPR 的情况下，我们的法律依据为：履行合同、正当利益（安全、反欺诈、改进服务）、法定义务，以及在需要时取得的同意（如营销、特定跨境传输）。

03我们和谁共享

• 供给方：你的需求内容、文件、期限和验收标准；实物商品还包括收货人姓名、地址和电话。供给方永远不会收到你的支付信息。供给方是独立经营者，受我们供给方协议中的保密和数据处理条款约束。
• 服务提供商（处理者）：Stripe（收款）、Wise（向供给方打款）、Vercel（托管）、邮件服务（飞书邮箱、Google Workspace），以及用于翻译、整理和抽检需求的 AI 模型提供商（Anthropic、OpenAI 等），均约定不得用你的内容训练其模型。
• 客户与黑客松主办方：供给方被派到某个任务后，客户或主办方可能按任务规则收到供给方的姓名、作品集和作品。
• 法律要求：为遵守法律、法院命令或制裁筛查，或保护 dorepal、用户和他人的权利、财产与安全。
• 业务转让：若 dorepal 被收购、合并或出售资产，信息会在同等保护下随之转移。

我们不出售个人信息，也不为跨平台行为广告共享个人信息。

04AI 处理

我们使用 AI 模型澄清需求、在语言间翻译（如英语、中文、葡萄牙语）、起草报价和抽检交付物。只发送完成任务所需的需求内容，绝不发送支付数据。模型提供商作为我们的处理者行事；我们不会用你的内容训练自己的模型。

05跨境传输

dorepal 面向全球的需求方和供给方。应用数据在新加坡处理；付款和订单记录由 Stripe 保存在美国。应用数据不会传输或存储到中国。为完成订单，我们只会把所需的最少信息（例如收货地址或需求简报）提供给匹配到的供给方——对方可能在亚洲、拉美或其他地区——绝不包括你的账户数据。我们依赖合同保障措施（在需要时包括标准合同条款）。

如果你在中国大陆：提交跨境需求即表示你单独同意，为完成该需求，将其中的信息传输给境外供给方以及 dorepal 在新加坡和香港的运营团队。付款信息只在你付款时发送给 Stripe（美国），且仅用于处理该笔付款。你可以撤回该同意，但撤回后我们可能无法完成订单。

06保存多久

• 订单、发票、收付款记录：7 年（税务与会计法规要求）。
• 需求内容和文件：订单完成或关闭后 24 个月，之后删除或匿名化。
• 未成单的需求：12 个月。
• 供给方资料：在供给方活跃期间，再加 12 个月。
• 服务器日志：90 天。

你可以要求我们提前删除；除非法律要求保留或为解决纠纷所需，我们都会照办。

07安全

dorepal.com 的所有流量均加密传输（TLS）。银行卡数据全部由 Stripe（PCI DSS 一级服务商）处理。订单数据仅限需要履约的团队成员访问。任何传输或存储方式都不可能绝对安全；如果你认为订单或账户被盗用，请立即发邮件至 hello@dorepal.com。

08政府请求

我们只在收到有效的法律程序时才披露个人数据。每一项请求都经律师审查；除非法律禁止，我们会通知受影响的用户；对范围过宽或缺乏法律依据的请求，我们会提出异议。截至目前，我们未收到任何此类请求。

09你的权利

根据你所在地的法律，你可能有权查阅、更正、删除或获取你的个人信息副本，反对或限制特定处理，以及撤回同意。

• 欧盟 / 英国（GDPR）：上述权利，以及向监管机构投诉的权利。
• 美国加州（CCPA/CPRA）：知情权、删除权、更正权，以及拒绝出售或共享的权利——我们不为广告出售或共享个人信息。你行使权利不会受到歧视。
• 中国大陆（《个人信息保护法》）：上述权利，包括撤回跨境传输的同意。
• 巴西（LGPD）：上述权利，通过下方联系方式行使。

行使任何权利，请用订单所用的邮箱发邮件至 hello@dorepal.com，或由你的 Agent 代发，我们会与你本人确认。我们会在 30 天内答复。

10当 AI Agent 代你行事

Agent 可以阅读我们的网站、给我们发邮件、提交需求、转述报价。我们会把 Agent 的消息作为订单记录的一部分保存。Agent 所代表的个人或公司对 Agent 的指令和授权负责。付款、验收、退款等重要决定，我们可能通过邮件与真人确认。

11未成年人

本服务面向成年人（18 岁以上）和企业。我们不会有意收集 18 岁以下人士的信息；如你认为我们收集了，请联系我们删除。

12政策变更

我们可能不时更新本政策。页首日期为当前版本。重大变更会在 dorepal.com 公告，或通过邮件通知活跃的需求方和供给方。

13联系我们

dorepal，由 KOSMART（香港）运营 · hello@dorepal.com · 供给方：同一邮箱，主题写 [supply]

如中英文本有歧义，以英文版本为准。