Privacy Policy

Who decides about your data

A practice's records about its clients belong to the practice. The practice decides what it records about a client, who on its staff sees it, and when it is erased. We hold those records for the practice, and use them only to run DoulaCloud for it.

For the account of each person who owns or works at a practice, and for a visitor to this site, we decide, and this policy says how.

What we never do

• We do not sell anyone's data.
• We do not use it for advertising, and DoulaCloud shows no advertisements.
• No email we send is tracked for opens or clicks. A message from your doula is only a message.
• We do not study what a named person does in DoulaCloud. The record of who changed what is there for the practice to read, and the only use we measure is how many Credits each practice bought and spent.

If you own a practice

When you create a practice, and while you run it, we hold:

• your name and email address, and the password and any second sign-in factor you set. Google Identity Platform checks your password for us, and we do not store it;
• your practice's name, its time zone, and what else you enter about it;
• the Credits your practice buys and spends. Stripe takes the payment, and we never see your card number;
• your practice's Stripe account number, and whether Stripe says it can take payments;
• your practice's public page, if you publish one. It is public by design, and shows what you put on it, including the name and email address you give as its contact;
• the date, the time and the IP address when your practice agrees to our Terms of Service and to this policy;
• what you tell us through Feedback, with the name and version of your browser;
• a record of each change you make, with who made it and when.

We use it to run DoulaCloud for your practice, to charge for Credits, to email you about your practice's account, and to answer you.

If you work at a practice

When a practice invites you to work with it, we hold your name and email address, your password and second sign-in factor as the section above says, the practices you work at and your role at each, and what you do at each: the visits you are given, the messages you write, and the changes you make, with when you made them. We also hold what you tell us through Feedback, with the name and version of your browser.

You are one person with one login, even if you work at more than one practice. Each practice sees your name, your email address and the work you do for it. It does not see the other practices you work at, or what you do there.

You can delete your login yourself. It is deleted at once, and your place at every practice ends. Your name and email address are replaced, and the work you did stays in each practice's records under “Deleted Staff Member”. If you are the last Owner of a practice, another person must become an Owner, or the practice must be deleted, first.

The Feedback you sent us stays when your login is deleted, and when a practice you work at is deleted. Once your login is deleted, your Feedback no longer names you. It is deleted 24 months after you sent it.

If you are a client of a practice

Your doula's practice uses DoulaCloud to keep its records about you. This section is written to you.

Your practice decides what it records. That can include your name, contact details, address and date of birth; what it records about your pregnancy, birth and care; your visits; your plans, such as a birth plan; the contracts you sign; your invoices and payments; and the messages and files you and your doula send each other. When you sign a contract, we record the time and the IP address it was signed from.

You sign in to your practice's portal with a link we email to you. There is no password.

When you pay an invoice, the payment form comes from Stripe, and your card details go straight to Stripe. We never see or store a card number. Stripe receives your name and email address with each invoice, and collects information about your device to prevent fraud.

To see, correct or erase your record, ask your practice. It is your practice's record, and your practice decides. If your practice does not answer you, write to us at hello@doula.cloud. We cannot change a practice's record ourselves, but we will send your request to your practice and ask it to answer you.

When your practice erases your record, your name, contact details, address, date of birth and the details it recorded about you in its own fields are removed, Stripe's customer record of you is deleted, and the history of changes to those details becomes unreadable. What was written in messages, contracts and notes stays, because those are your practice's own records of the care it gave and what it charged.

You can tell us what you think of DoulaCloud through Feedback in the portal. It comes to us, never to your practice. We keep what you send, with the name and version of your browser, and erase it when your practice erases your record or is deleted. If more than one practice keeps a record of you, Feedback you sent from a portal page that is not about one practice is erased when the last of them erases your record.

If you visit this site

This site sets no cookies. Its home page runs two scripts: one of ours, which copies any campaign tags in the address you arrived by, such as utm_source, into the waitlist form, and one from Pirsch, which counts visits to that page. No other page runs a script.

Pirsch, a German company, counts how many people visit the home page, and holds its counts in Germany. It works out that two visits came from the same person by mixing your IP address, your browser's own description of itself, the date and a secret value into a fingerprint that cannot be unscrambled. Your IP address goes in and is thrown away, never stored. The secret changes daily and differs from site to site, so nothing can recognize you tomorrow or on another site. Your rough location comes from a list Pirsch holds on its own machines, not from keeping your address. Pirsch never sees your name or your email address, and it cannot connect a visit to a signup. We count visits because a waitlist number means little without knowing how many people saw the page. A tracker blocker stops the count, and nothing on the page breaks.

Firebase Hosting, a Google service, delivers each page, and receives your IP address to do so.

If you join the waitlist, your email address and first name are kept by Buttondown, the service that runs the list, together with the campaign tags from the address you arrived by, if it had any. After you confirm your address, the list sends you one email straight away, which asks whether you would like to join the pilot, and then writes to you when DoulaCloud opens in January 2027. You can leave the list from any of its emails.

DoulaCloud does not follow you across other sites, so it treats every visit the same whether or not your browser sends a Do Not Track signal.

Who else receives data

These companies receive data to run DoulaCloud, and each receives only what its job needs:

• Google Cloud runs DoulaCloud and stores all of its data, in the United States: the database, files such as contract documents and message attachments, and the jobs that send its email.
• Google Identity Platform checks the sign-in of each person who owns or works at a practice: the email address, the password and the second sign-in factor.
• Firebase Hosting, a Google service, delivers the DoulaCloud app and this site, and receives the IP address of each request.
• Buttondown keeps the waitlist: the email address and first name of each person who joins, and the campaign tags from the address they arrived by. It sends the confirmation email and the one email when DoulaCloud opens.
• Pirsch, a German company, counts visits to the home page of this site, and holds its counts in Germany. It sets no cookie and keeps no IP address.
• Mailgun sends DoulaCloud's email. It receives each address and message, and deletes its logs of them within 30 days.
• Stripe takes payments: a practice's payment for Credits, and a client's payment of an invoice. It receives what each payment needs, including a client's name and email address with an invoice, and it holds each practice's own Stripe account. Stripe processes data as Stripe's Privacy Policy explains.
• Your browser's push service — Google, Apple or Mozilla, depending on your browser — carries the signal that tells your device a new message is waiting. The signal says only that something is waiting, never what it is.
• GitHub keeps a note of each piece of Feedback in a private repository, so that we can sort it. The note holds only:
  • the kind of Feedback;
  • the kind of page it was sent from, never that page's address;
  • the version of the app, the width of the screen, and the name and version of the browser;
  • the time it was sent;
  • the role of the person who sent it, such as Owner or Client;
  • a link that only we can open.
  It never holds the words a person typed, a person's name, or a practice's name. The note names nobody, so it stays after the Feedback is erased or deleted.

A company is added to this list, in a new version of this policy, before it receives anyone's data.

Cookies and storage on your device

DoulaCloud sets one cookie, __session, which keeps you signed in. It is used for nothing else, and it ends when you sign out or your session expires.

When a person who owns or works at a practice signs in, Google's sign-in library keeps a record of the sign-in in the browser's own storage until they sign out. The app also keeps a form you have not sent yet, such as a new client's intake, in the browser tab's own storage until the tab is closed.

This site sets no cookies.

How long we keep data

• We keep a practice's records for as long as the practice uses DoulaCloud.
• A client's record is erased at once when the practice erases it, as described above.
• A practice's records are erased at the end of its 30-day deletion window, as the Terms of Service describe.
• A login is deleted at once when its owner deletes it, as described above.
• The database is backed up each day, and each backup is kept for 7 days. Something erased can stay in a backup for up to 7 days after it was erased, and is then gone.
• Mailgun deletes its logs of each email within 30 days.
• Feedback is deleted 24 months after it was sent, unless it is erased sooner as described above. GitHub's note of it names nobody, and stays.

Some records stay after a practice or a login is deleted: the practice's own name and details, the Credits it bought and spent, the record of what was done and by whom, with each client's details made unreadable, and the record of when an Owner agreed to the Terms of Service and to this policy. We keep them for our accounts and taxes, and because the record of an agreement is needed most after the person who agreed has gone.

How we protect data

We keep a program of safeguards, as New York's SHIELD Act asks. Among them:

• every connection to DoulaCloud and to this site is encrypted;
• Google Cloud encrypts the data it stores;
• the database itself keeps each practice's records apart from every other practice's;
• each person who owns or works at a practice can add a second sign-in factor;
• the history of changes to a client's details is locked with a key of its own, which is destroyed when the record is erased.

If there is a breach

If someone gets access to data they should not have, we tell each practice whose data is affected, without unreasonable delay, so that it can tell its clients. We also tell the people and the authorities that the law says we must.

Children

DoulaCloud is for adults, and a child cannot have an account. A practice's record can name a baby. That information comes from the baby's parent or from the practice, and the parent can ask the practice about it as the section for clients describes.

Where this policy applies

DoulaCloud is offered in the United States, and its data is stored there. This policy is written for the laws of the United States.

When this policy changes

We decide for each new version whether the change is material, as the Terms of Service describe. A change to what happens to anyone's data is material. For a material change, we email each Owner at least 30 days before the new version takes effect.

A material change to how we use data we already hold applies to that data only after an Owner of the practice has agreed to it. Until then, that data keeps the promises this policy made when it was collected.

Every version is posted on this page, and the history below says what changed.

Contact us

Email hello@doula.cloud. That address reaches a person.

Version history

1. October 22, 2026. Not a material change. Names Buttondown, which keeps the waitlist, and Pirsch, which counts visits to the home page without a cookie.
2. October 3, 2026. Not a material change. Writes the name of the product as one word, DoulaCloud.
3. October 2, 2026. Not a material change. Says how long Feedback is kept, what erases it, and that GitHub keeps a note of each piece.
4. September 29, 2026. Not a material change. First version.