Legal
Government Data Request Policy
Version 2026-10-09 · Effective October 9, 2026 · Legal owner: Josue Phillips, legal representative of Donefy Corp · Security owner: Donefy development team
1. Scope
This policy explains how Donefy Corp (“Donefy”) handles requests from governments, law enforcement agencies, courts and other public authorities for personal data of Donefy users or of the customers of businesses that use Donefy, including requests made for national security purposes. It applies to every request, whatever the authority or country it comes from.
2. Every request is reviewed for legality
Every request is reviewed by Donefy's legal representative before any data is disclosed. We disclose data only in response to valid legal process that is in writing, issued by an authority with jurisdiction over Donefy, and that complies with applicable law — for example, a subpoena for basic account information, a court order for other non-content records, or a search warrant for the content of messages and files. We do not give any government direct or unrestricted access to our systems or data, and we do not disclose data voluntarily, except in an emergency as described in section 6. Requests from authorities outside the United States must be made through a mutual legal assistance treaty or another process recognized by U.S. law.
3. Unlawful or overbroad requests are challenged
If a request is unclear, overbroad, not supported by the legal process it cites, or otherwise unlawful, we ask the authority to narrow or withdraw it, and where appropriate we challenge it in court. We do not comply with a request we have concluded is unlawful.
4. Data minimization
When we must comply, we disclose only the minimum data the legal process specifically requires, for the accounts and the time period it names. Data that belongs to a business using Donefy (for example its customer records and conversations) belongs to that business: where possible we ask the authority to request it from the business directly.
5. Notice to the people affected
We notify the affected Donefy customer of a request for their data before disclosing it, so that they can seek legal remedies, unless we are prohibited by law or court order from doing so, or in an emergency. When such a prohibition ends, we notify the customer at that time.
6. Emergencies
If we believe in good faith that there is an imminent risk of death or serious physical injury, we may disclose limited information without legal process to an authority able to help. Each emergency disclosure is limited to what the emergency requires, documented, and reviewed by our legal representative afterwards.
7. Documentation
We keep a record of every request: the date it was received, the requesting authority, the legal process and basis cited, the data requested, our decision and the reasoning for it, any challenge we made, what was disclosed, when the affected customer was notified, and who reviewed it. These records are kept for at least five years. We may publish aggregate figures about the requests we receive, to the extent the law permits.
8. How to submit a request
Requests must be sent in writing to legal@donefy.io or by mail to Donefy Corp, 3510 US Hwy 80 E, Mesquite, TX 75149, United States, and must identify the requesting authority, the legal basis, the account or data requested and a contact for follow-up. Sending a request by email does not waive any requirement for formal service of legal process.
9. Changes
We review this policy at least once a year and update it when the law or our practices change. This policy describes our practices; it does not create rights for any third party.