Dottr Privacy Review: Is This AI Contract Agent Safe for Freelancers?

Short answer: Dottr keeps the contracts and email threads you CC to it for as long as it says it needs them, runs them through AI providers it does not name, and may reuse them, de-identified where practical, to improve its own features. Our verdict is USE WITH CAUTION for client work. Policy reviewed October 2026, two days after Dottr launched on Product Hunt with a pitch built for small operators: copy it on a thread and it drafts the agreement, flags risky clauses in plain English, sends it out for signature and chases every signer, for about a dollar per contract. For a solo consultant who loses deals to slow paperwork, that is a real time saver. It also means each contract, plus the negotiation emails around it, now sits with one more vendor. Below is what Dottr’s own documents say, checked against our review methodology.

What Dottr does with your data

Privacy at a glance

Privacy dimension	Dottr’s answer
Trains on your data?	No third-party model training; own-feature improvement allowed
Training opt-out	None documented for own-feature improvement
Data retention	As long as needed; no fixed period stated
Third-party sharing	Unnamed AI providers, hosting, e-signature, legal requests
Storage region	United States and other countries, with SCCs
Enterprise-team tier	SSO and security review on request only
Certifications	GDPR and SOC 2 both marked coming soon

Dottr is run by Billions Dots Inc., a Delaware company. Its privacy policy and terms both took effect on June 29, 2026 (per Dottr’s privacy policy, retrieved 2026-10-16).

What it collects. Beyond the usual account, billing and usage data, the policy lists two categories that matter for freelancers: the full content of anything you submit or copy Dottr on (documents, attachments and the email messages themselves), and the routing metadata around it, meaning sender, recipients, subject lines and timestamps. If you CC Dottr on a live negotiation, the whole thread is in scope, not only the final PDF.

Who processes it. To produce risk flags, summaries and signature fields, contract text goes through automated systems that may include outside AI model providers working as Dottr’s service providers. The policy says those providers are not allowed to train general-purpose models on your content, and that Dottr does not sell it. Dottr’s public trust center lists about a dozen sub-processors, including AWS, Vercel, Slack, Notion and Apollo.io, but no AI model provider and no e-signature provider (per Dottr’s trust center, retrieved 2026-10-16). So you cannot tell from public documents which model reads your client’s contract.

Improvement use. The privacy policy allows Dottr to use content to improve its own features, with a commitment to minimize and de-identify data where practical. The terms of service go further: the content license you grant covers improving the Service, and the training promise is narrower, ruling out foundation models built for unrelated third parties (per Dottr’s terms, retrieved 2026-10-16). We found no setting or request route to opt out of improvement use.

Retention and location. There is no fixed retention period. Dottr keeps data while it needs it to run the service, meet legal duties, settle disputes and enforce its agreements, and deletion requests apply to account data with legal exceptions. Data may be processed in the US and elsewhere, with standard contractual clauses where required. Security claims cover encryption in transit and at rest, access controls and monitoring.

What this means for solo freelancers

Dottr is aimed squarely at people like you: small teams, no legal department, seats never billed. That makes the gaps in its paperwork matter more, because you are the one answering to the client. We apply the same three questions to every contract tool we cover, and you can see how they played out for a much riskier product in our GLM-Legal privacy review.

• If you CC Dottr on an NDA-covered negotiation, the thread can include rate discussions, internal comments and details about the client’s project that never make it into the final agreement. Contract text is hard to de-identify in practice: names, fees and unusual scope language identify a deal on their own. Based on the policy as written, this approach carries a risk that confidential deal context is retained for an open-ended period and reused for product improvement.
• If your client or their signers are in the EU or UK, you are passing their names, email addresses and contract terms to a US processor that has not published a data processing agreement, marks GDPR as coming soon and does not name its AI providers. Based on the policy as written, you would struggle to tell a client where their data went. Our explainer on what a data processing agreement means for solo consultants lists what to ask for.
• If something goes wrong, the terms put the burden on you. You confirm you hold every right and consent needed to submit the content, you indemnify Dottr for claims tied to it, and Dottr’s liability is capped at the greater of fees paid in the last year or 100 US dollars. At a dollar per contract, that cap is close to the floor.

Signers do not need an account, which is good for conversion but means your counterparties never see or accept Dottr’s policy. You become their only privacy notice.

How to use it safely

If the time savings are worth it, set Dottr up so it sees as little as possible:

1. Start a clean thread. Do not CC Dottr on the existing negotiation. Open a new email containing only the agreed terms, then copy Dottr on that one.
2. Use templates with placeholders. Keep fee schedules, client IP descriptions and confidential annexes out of the draft Dottr builds, and attach them yourself after signature where your contract structure allows.
3. Test on a dead contract first. The first five contracts are free. Run an expired or fictional agreement through it before anything live.
4. Ask in writing before client use. Email privacy@dottr.io and request a DPA, the names of the AI providers and the e-signature provider, the retention period for contract content, and whether improvement use can be switched off for your workspace. Keep the reply on file.
5. Limit Google Drive access. If you attach files from Drive, read the permissions on Google’s consent screen, then remove Dottr under Google Account, Security, Your connections to third-party apps and services when you stop using it.
6. Tell your counterparties. Add one line to your proposal saying an AI contract tool, with its name, will process the agreement and signer details.
7. Watch the reminder emails. Dottr chases signers automatically. Check the wording of those reminders on your test contract, since they go out under your deal and reach your client’s inbox.
8. Close the loop. Download every signed PDF to your own encrypted storage. Deletion is described at account level, so if you stop using Dottr, close the account and request deletion of your data by email.

For the same opt-out routine across ChatGPT, Claude and other assistants, see our guide to opting out of AI training for freelance work.

Privacy-friendlier alternatives

No single tool replaces Dottr’s draft-review-sign-chase loop, but you can rebuild it from parts that keep contract text under tighter control.

Lumo by Proton for AI contract review. What it gives you that Dottr does not: Proton says conversations are stored with zero-access encryption, its code is published, and it does not use your data to train AI models. Paste a contract with client names redacted and ask for a plain-English risk summary. Pricing: free tier, or Lumo Plus at $12.99 per month ($9.99 per month billed yearly). Best for freelancers who want risk flags without handing over a whole email thread. Our Lumo privacy review covers its limits.

Documenso for e-signatures. What it gives you that Dottr does not: open-source code and a self-hosted option, so the signing workflow can run on infrastructure you control, plus a published, inspectable codebase. Pricing: free hosted plan for occasional signers, Individual at $25 per month billed yearly ($300), Teams at $40 per month billed yearly. Best for consultants who send contracts every week and want a signing tool they can audit. For a mainstream signing tool with AI add-ons compared on the same criteria, see our Jotform Sign privacy review.

Proton Drive for templates and signed copies. What it gives you that Dottr does not: end-to-end encrypted storage where Proton says it cannot view your files, and ten years of version history on paid plans. Store master templates and every signed PDF here instead of leaving the archive inside an AI tool. Pricing: 5 GB free, Drive Plus at $4.99 per month for 200 GB, Drive Professional at $9.99 per user per month. Best for anyone who needs a clean, client-ready record of what was signed.

If your contracts are highly sensitive, an open-weight model run locally on your own laptop keeps review entirely offline, at the cost of setup time and weaker drafting. Nothing leaves the machine, so there is no retention question to ask.

Put together, the stack looks like this: draft from your own template, ask Lumo to flag risky clauses on a redacted copy, send through Documenso, and file the signed PDF in Proton Drive. It costs more clicks than copying one address on an email, and you lose Dottr’s automatic signer chasing. In exchange, you can name every place a client’s contract went, which is the first thing a careful client will ask.

The verdict

Frequently asked questions

Does Dottr train AI on my contracts?

Not in the general sense. The privacy policy says its outside AI providers may not use your contract content to train general-purpose models, and the terms rule out foundation models for unrelated third parties. However, Dottr itself may use content to improve its own features, de-identified where practical, and we found no opt-out for that use. If your contract includes confidential client terms, treat improvement use as a live possibility and redact before sending.

Is Dottr GDPR-friendly for EU clients?

Based on the policy as written, it is hard to document. Dottr is a US company that may process data in the US and other countries using standard contractual clauses, and its trust center marks GDPR as coming soon. It has not published a data processing agreement, and its public sub-processor list does not name the AI providers that read contracts. Before handling EU signers’ personal data, request a DPA and the full provider list in writing.

Can I use Dottr for HIPAA data or healthcare contracts?

Based on the public documents, no. Neither Dottr’s privacy policy nor its terms mention HIPAA or offer a business associate agreement, and the trust center lists no healthcare safeguards. Agreements with clinics, therapists or health startups can include protected health information in schedules or recitals. Keep those contracts out of Dottr entirely, or strip any patient data first and use a signing tool whose vendor will sign a business associate agreement.

Do the people signing my contract need to accept Dottr’s terms?

No. Dottr advertises that signers do not need to log in, so your clients never create an account or agree to Dottr’s privacy policy. Their names, email addresses and the contract content are still processed. Dottr’s terms make you responsible for holding the rights and consents to submit that content. In practice, you should tell counterparties up front that an AI contract tool will handle the agreement and their signature details.

How long does Dottr keep my contracts?

The policy gives no fixed period. Dottr keeps information for as long as it needs it to run the service, meet legal obligations, resolve disputes and enforce agreements. The product also advertises that it remembers terms and dates so you can query past deals, which implies long-lived storage by design. You can request deletion of account data through privacy@dottr.io, subject to legal exceptions, so download signed copies before closing your account.

Sources

• Dottr Privacy Policy, effective 2026-06-29 (retrieved 2026-10-16)
• Dottr Terms and Conditions, effective 2026-06-29 (retrieved 2026-10-16)
• Dottr Trust Center, compliance status and sub-processor list (retrieved 2026-10-16)
• Dottr pricing page (retrieved 2026-10-16)
• Dottr on Product Hunt, launched 2026-10-14 (retrieved 2026-10-16)
• Lumo by Proton, product and pricing page (retrieved 2026-10-16)
• Documenso pricing page (retrieved 2026-10-16)
• Proton Drive pricing page (retrieved 2026-10-16)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of October 16, 2026.