Privacy

Last updated 5 October 2026.

Dossair is run by Rizqey Labs, Malaysia. This page says, in plain words, what Dossair does with your information. If something here is not true to how the app works, tell us at friends@rizqey.com.

How you sign in

You sign in with Google, with LinkedIn, or with a link we send to your email. We get your email address, and we get no password from you. If you use LinkedIn, LinkedIn gives us your name and email. We do not ask LinkedIn for anything else, and we do not keep a LinkedIn token. Supabase, which runs our sign-in, keeps the sign-in record (name and email) the same way it does for Google.

What we store about you

• Your email address, whether you are on the early list or let in, and when your account was made.
• The facts you write about yourself and your company.
• The programmes you track, their questions, and the drafts, checks and final answers for each.
• What you add as context: links to your resume, portfolio or LinkedIn page, the text we read from them, and files you upload. Uploaded files sit in a private folder that only your account can open.
• Your RL Token record: free tokens, tokens spent, and plan payments. A payment record carries a Stripe customer reference, not your card details.
• If you claim an ITEC SEA 2026 pitch brief: your email, which startup you tried to claim, how you proved it (an email on its website, or your LinkedIn name), the result, and the time of each try, including refused tries. When you verify with LinkedIn we compare the name on your LinkedIn with the startup's presenter and we do not keep that name.
• A few small settings in your browser, such as light or dark mode.

Who handles your data

Your data is stored in Supabase, which holds our database, sign-in and private file storage. The site runs on Vercel. Google handles Google sign-in. Stripe handles payments: you pay on a Stripe page, and we never see your card number.

When you ask Dossair to draft or check an answer, we send the question, your facts and any context text to an AI model provider so it can write or check the answer. The providers we can use include Google (Gemini), OpenRouter, Groq and xAI (Grok). We send only what is needed for that answer. Each provider has its own rules for how long it keeps what it receives, and we do not control that.

If you add a link as context, Dossair visits that public page to read it.

Cookies and emails

We use cookies to keep you signed in, to remember where to send you after you sign in, to remember for 30 minutes that the presenter-name step of an ITEC claim passed, to remember that you have seen a first-time card, and, if you came through an invite link, to remember the invite. We do not use advertising or tracking cookies. The home page loads some animation code from a public content network (jsDelivr), which sees your internet address when it does.

On the ITEC pages we count visits and steps using a random anonymous number kept in your browser (not a cookie), and note which link you came from and, if you are signed in, your account; we keep no internet address, use no outside tracker, and skip the count if your browser says Do Not Track.

The sign-in link email is sent through our sign-in service. We may send one short welcome email when you are let in, if that is switched on. We do not send marketing email.

Who can see it

You can see your own data. The person who runs Dossair can see account emails and status, in order to let people in and keep the service working. We do not sell your data, we do not rent it, and we do not use it for advertising.

Deleting your data

To have your account and data deleted, email friends@rizqey.com from the address you signed in with, and say what you want removed. We will delete your account, facts, answers, uploaded files and token record, and reply when it is done. You can also ask us what we hold about you at the same address.

Changes

If we change what Dossair does with your information, we will change this page and its date.