DoersRise Privacy Policy

Effective date: 4 November 2026

1. Who this covers

DoersRise is a brand operated by Genufly LLC, a New York limited liability company ("Genufly LLC", "we", "us"). This policy explains what Genufly LLC does with information in connection with the DoersRise website, customer workspace, free resources, Mobile Detailer Message-to-Booking Kit, Worked Inquiry Examples Pack, Implementation Workshop and Kit + Examples bundle.

• Legal notice address: Genufly LLC, 276 5th Avenue, Ste 704-1444, New York, NY 10001
• Contact: support@doersrise.com

2. Two separate sets of records, and why that matters to you

Your purchase involves two organisations:

Whop operates checkout and payment, and provides the Kit PDF downloads. DoersRise provides the customer workspace and online extras. Whop collects and holds your payment and account information, and it does so under its own privacy policy and its own control. We do not control how Whop collects, uses or keeps that information, and this policy does not describe Whop's practices. For those, read Whop's privacy policy and direct requests about Whop's records to Whop.

Genufly LLC (DoersRise) holds a deliberately small set of records about the transaction, described below. We built our systems to keep as little as possible.

3. What we receive, and what we keep — these are different

This distinction is important and we state it plainly rather than imply we never see anything.

What passes through our systems

When you buy, Whop sends our server an automated notification (a "webhook") about the event. That notification can contain more about you than we keep. Depending on which version of Whop's message format is sent, it can include:

• contact and identity details — an email address, a name or username, a phone number, billing or shipping address details;
• payment details — a card's brand, last four digits and issuing range;
• verification results — what the card issuer returned when it checked the billing address, the cardholder name and the security code;
• fraud and risk information — Whop's own risk score for the transaction and the factors behind it;
• platform references, credentials and links — internal Whop identifiers, and credentials or sign-in links Whop generates for the checkout.

This list describes categories rather than a fixed inventory of fields. The notification is Whop's, and what it contains is Whop's to change.

Our server:

1. receives that notification in memory;
2. verifies its cryptographic signature to confirm it genuinely came from Whop;
3. reads out a fixed, pre-defined list of fields and nothing else;
4. discards the rest.

We do not store the full notification. Our purchase records keep only the fields listed below. We also retrieve the purchase contact email from Whop and retain it in a separate buyer-contact record linked to the payment, product and Whop user identifiers. We do not retain billing addresses, phone numbers or card descriptors in that contact record.

Customer records and marketing permission are separate. We keep buyer contact emails for customer service, purchase history and managing our customer list, including after a refund. A purchase or refund does not subscribe you to marketing. Optional Kit set-up and free-resource emails require the consent described below. Unsubscribing stops marketing; it does not automatically erase customer records. We do not sell this list.

Optional Kit set-up emails. If you ask for these emails, you enter and confirm the address to use. That address may differ from your Whop purchase contact. We keep your consent and apply unsubscribe choices to marketing sends. Capturing a purchase contact does not overwrite those choices or start an email sequence.

What we actually keep

Two points about that table:

• The fingerprint lets us recognise whether the same message arrived again, or changed, without retaining the message. A fingerprint cannot be turned back into the content.
• The structural diagnostics record only field names and the type of value found at each (for example: "this field was present and was text"). They never record the value itself. The names we record come from a fixed list in our code, with one exception: where a notification cannot be processed — because its format is one we do not recognise, or because a field we require is missing — we also record that notification's own top-level field names, so the problem can be diagnosed at all. Those are names only — each limited in length, at most forty of them, and never the values behind them.

The pseudonymous Whop user identifier is an opaque reference issued by Whop. We use it to tie a payment record to a purchase. It is not your name or your email.

When you sign in to the customer workspace

We ask Whop to establish your identity and use its user reference to check the paid purchase for the product you are opening. We read the relevant account, product, user, payment status, amount and refund information from Whop. A fully refunded purchase does not grant online access; a different qualifying purchase can still do so. Signing up for emails is not required.

We use essential, secure sign-in cookies. A short-lived cookie protects the sign-in exchange. The customer session cookie contains a Whop user reference and issue/expiry times, not an email address, payment entitlement or product list. It expires after 30 days, or is cleared when you sign out of that browser. Signing out does not delete the underlying purchase records.

Optional Workshop working notes

While you type an exercise, its draft is held in the page. If you select Save in this tab, the draft is stored in that browser tab using session storage. The note text is not sent to DoersRise, is not stored in our database and does not sync across devices. This functional storage is not analytics or advertising.

Closing a tab normally clears session storage, but a browser's restore feature may bring a tab back. We therefore do not promise secure deletion on tab closure. Use Clear these notes on a shared device and sign out when finished. Use fictional or anonymised inquiries and leave out customer names, contact details and addresses. Print or copy drafts you want to keep; a printed or saved copy is under your control.

If you ask us for a free resource

When you ask us to email you something free — the Mobile Detailer Inquiry Response Cheat Sheet, for example — you give us your email address and tick a box agreeing to receive it. We keep:

We do not ask for your name, and we do not set cookies or run analytics on that page.

What we do with it. We send you the resource, and follow-up emails about putting it to work. Nothing else. Every email carries an unsubscribe link that works, and leaving stops the emails immediately.

Leaving does not take the resource back. If you unsubscribe, we stop emailing you. The file you already asked for stays yours and any download link you hold keeps working — we do not think a person should have to weigh losing something they already have against stopping our emails.

We do not sell your address or share it for anyone else's marketing. Our email service provider processes the recipient address to deliver the messages you requested on our behalf. We do not provide it to advertisers or use it to build an advertising profile.

Deleting it. Ask and we remove the record entirely. That also ends any download link tied to it, because the link resolves through that record.

When you visit our website

We use no third-party analytics and no advertising tracking scripts. Anonymous resource-request pages do not set cookies. Customer sign-in uses the essential cookies described above; optional Workshop notes use browser-tab storage only when you choose to save them.

Our web server does keep ordinary access logs, as almost all web servers do: the IP address the request came from, the page requested, the time, the browser's user-agent string, the page that referred your browser to us where your browser sends one, and the response our server returned. That log is rotated daily and deleted after about two weeks.

Our web server also keeps a separate error log, which records the same IP address and request where a request fails. Because it is rotated only when it has something in it, entries there can persist for a month or more. We are telling you that rather than let the two-week figure above stand for everything.

Operational and security logs

Our server writes operational logs so that failures can be diagnosed. These contain identifiers, event types, error classifications, database error codes and the structural diagnostics described above — not the contents of notifications.

These logs are held in three places on our own infrastructure, with different lifetimes:

• the system journal, bounded by disk size rather than by any fixed period, so it can hold entries for a long time — at the time of writing, several months;
• the system log files, which rotate weekly and are kept for about a month;
• the database's own container log, which has no configured size or time limit at all, so entries there persist until the database container is replaced.

We would rather tell you that than imply a single tidy schedule we do not actually configure. None of these three records the contents of a notification.

If you contact support

When you contact support, Genufly LLC holds the correspondence needed to address your request. Email is handled through Stackmail (20i). Your mailbox may be supplied through a reseller. Where a connector is enabled, message text, sender and thread identifiers, subject and timestamps may also be copied into our staff support inbox. Our inbox holds conversation status, assignment, read state, internal notes and reply drafts. Email attachments remain with the mailbox provider; attachment filenames may be copied. A saved reply draft is not a sent reply.

Where WhatsApp support is enabled, Meta delivers incoming message notifications to our server. We verify their signatures and accept messages only for the configured DoersRise account and phone number. Our current integration stores incoming text, the sender's phone number, message and conversation identifiers, and timestamps. It accepts text only, stores at most 10,000 characters per message, and does not import attachments, calls, phone-app message history or message echoes. Do not use this channel for payment-card details or other sensitive information. WhatsApp and Meta also process data under their own terms and privacy policies. Coexistence pairing and live delivery must be verified before we describe WhatsApp support as available; outbound WhatsApp replies are not currently implemented.

Authenticated founder and operator staff can access support content; reviewer accounts cannot. Staff actions may create audit metadata without copying message bodies into the audit record. We use support data to handle requests and operate and secure the service, not to enroll you in marketing. Contacting support does not change unsubscribe choices.

4. Why we hold it

We do not use any of it for advertising or profiling, we do not sell it, and we do not share it with anyone for their own marketing.

5. Who else is involved

• Whop — checkout, payment processing and file delivery, as an independent organisation with its own policy.
• Infrastructure and hosting providers — our server, and the backup copies we store off-host, which are encrypted before they leave our server.
• Our email provider — the support mailbox and delivery of the resource or set-up emails you requested, on our behalf.
• Professional advisers — accountants or lawyers, where genuinely needed.
• Card issuers and payment networks — where a payment is disputed or a chargeback is defended, as described in the Refund Policy.
• A successor — if the business is reorganised or sold, as clause 17 of the Terms permits.
• Authorities — where we are legally required to disclose something, or to establish or defend legal claims.

Public-authority requests

We assess public-authority requests before disclosure, verify the requester and legal basis, and seek clarification or challenge requests that appear unlawful or overbroad as appropriate with legal advice. We limit any disclosure to the information lawfully required and keep a restricted record of the request, decision, responsible people and response. We provide notice where lawful and appropriate. These controls do not imply that a request has occurred or that we can disregard a binding legal obligation.

6. How we protect it

• Notifications from Whop are cryptographically verified before they are acted on; an unverified or mis-signed message is refused.
• The payload is not retained, so there is no store of it to be exposed.
• Credentials are stored outside the application, in files readable only by the system's administrative account, and are supplied to the service when it starts. To be accurate rather than flattering: the secrets the application itself needs are present in the running process, as they must be for it to work — its database connection, the key it uses to verify Whop's signatures, the keys used for staff and customer sign-in, the server-side Whop API key used to check purchases, and the credentials it uses to read and write our own file storage. The database owner password and the key that encrypts our backups are not needed by the application and are not supplied to it.
• Database access uses least-privilege accounts.
• Database backups that we store off-host are encrypted on our own server before upload, so the storage provider never holds readable data, and we have proven by test restore that an encrypted backup can actually be recovered rather than assuming it. Backups are currently taken at release boundaries rather than on an automatic schedule.
• Two database copies from September 2026 are also held on the server itself, taken before a release and before a database change. Being accurate rather than flattering again: those copies are not encrypted. They are readable only by the administrative accounts that operate the server, and they never leave it.
• Access to production systems is limited to those who operate them.

No system is perfectly secure, and we do not claim otherwise.

7. Where it is held

Our server is located in the United States, and information relating to your purchase is handled there.

Our encrypted backups are held with a cloud storage provider. We have not pinned those backups to a particular storage region, so we do not tell you where the encrypted copies physically sit — we would rather say that than name a country we have not actually configured.

We do not claim any specific legal mechanism for transferring information outside the United States, because we have not put one in place. Saying otherwise would not be true.

8. How long we keep it

We do not currently run an automatic deletion schedule for the records we hold about you. We would rather tell you that plainly than describe a tidy lifecycle our systems do not perform. Logs, unconfirmed set-up requests and browser-session storage have the specific lifetimes described in this policy.

What that means in practice:

• purchase and payment records are kept while they are needed for accounting, tax and dispute-handling purposes, and are not deleted automatically;
• failure markers are marked resolved when the underlying problem is fixed, and the record is kept rather than removed;
• buyer-contact emails are retained, including after refunds and unsubscribes, until removed in response to a verified request or our manual retention review. Contact records have no automatic expiry. We can remove the address while retaining a payment reference to prevent a replay from restoring it;
• support correspondence stays in the mailbox;
• Kit set-up requests. The confirmation link expires after 24 hours. Unconfirmed set-up records are removed by the next hourly cleanup. A confirmed one is kept. If you unsubscribe we stop sending and mark you unsubscribed; the record linking your address to your purchase is kept — unsubscribing does not remove it. If you ask us to remove that link, we will: email support@doersrise.com with your Whop order or payment reference. We delete any set-up emails that have not been sent, and then remove the address from that record, so it no longer says which address set the purchase up. Four things stay, and we would rather say so: the record that the purchase was set up at all; the record of what you agreed to and when; the payment record itself — which we keep for accounting, tax and dispute handling, and which holds no address; and any set-up email we had already sent you, which stays in our sending record. Your subscription to any other list is unaffected unless you ask for that too;
• website access logs are deleted automatically, after about two weeks — but the web server's error log is not bounded by a calendar period, as section 3 explains;
• of the three operational log stores in section 3, one rotates weekly, one is bounded only by disk size, and one is not bounded at all.

Records are therefore retained until we delete them — in response to a request under section 9, or as part of a review — rather than on a timer.

Apart from the log rotation described above, we do not publish fixed retention periods for the records we hold about you. A published period is a commitment the system has to enforce to be true, and for those records ours does not currently enforce one. Telling you the actual position is more useful than a number that quietly does not hold.

One limitation worth stating: backups are kept for disaster recovery, and a deletion request cannot reach a backup immediately. We do not currently expire backups automatically — a backup is deleted only when we delete it. The same is true of any copy held from before a change to what we store: an older backup still contains what the system held at the time it was taken.

Support inbox records

Support correspondence may exist in both the provider's system and our support database. Resolving a conversation does not erase it. There is no automatic expiry for our support conversations, messages, internal notes or drafts, and no dedicated self-service support-message deletion tool. Ask support@doersrise.com for access, correction or an erasure review. Removal from one system does not automatically remove other copies or provider-held records. Any manual maintenance must respect legal holds and applicable record-keeping obligations; backups have the limitations already described in this policy. We do not promise a deletion deadline or automatic deletion process that the system does not enforce.

9. Your rights

Depending on where you live, you may have the right to ask us to:

• tell you what information we hold about you;
• correct it if it is wrong;
• delete it;
• provide a copy in a portable form;
• restrict or object to a particular use;
• withdraw consent, where we relied on consent.

To exercise any of these, email support@doersrise.com. We will ask for enough information to be confident we are dealing with the right person, and will respond within the time any applicable law requires.

Two honest limits, and one practical point:

Our payment ledger holds Whop references, and our separate buyer-contact record links a contact email to the purchase. You may request access, correction or removal using your contact address and an order or payment reference. We verify ownership before changing records. A contact removal request covers the separate buyer-contact record as well as any set-up association you identify; marketing unsubscribe choices remain separate.

Support correspondence is different, and we would rather you knew it. If you have emailed us, that correspondence sits in our mailbox under the address you wrote from. It is covered by the rights above, and we can find it without any Whop reference.

• Some records we must keep for accounting, tax or legal-claim reasons, and we may not be able to delete those on request.
• Most of what identifies you personally sits with Whop, not with us. If you want your purchase information corrected or erased, you will usually need to make that request to Whop as well. We will tell you so rather than let you assume one request covers both.

If you believe we have handled your information improperly, you may complain to your local data protection authority where that right applies.

10. Children

The covered products are for people running or starting a business, and are not directed at children. We do not knowingly collect information from children.

As in the Terms, we require capacity to enter the agreement rather than setting a numerical age limit.

11. Changes to this policy

If we change this policy we will post the updated version and change the effective date. Where a change is significant, and we hold a way to contact you, we will make reasonable efforts to tell you.

12. Contact

Genufly LLC (operating as DoersRise) 276 5th Avenue, Ste 704-1444, New York, NY 10001 support@doersrise.com