Cloud

Privacy notice

Version 2026-10-11, effective 2026-10-11

Draft for review. This document is not yet in effect.

Who we are and how to contact us

Dvelopin LLC is a Texas limited liability company based in Arizona, USA. [to be confirmed: change to Arizona when the domestication is complete]

Dvelopin is the controller of the personal data in every portal account: the account owners who sign up with us and the people a customer invites to its organization. Dvelopin is also the controller of the data it processes to run the portal: accounts, sign-in and MFA, security logs, billing contacts and payments, and text messages.

Privacy contact: privacy@dvelopin.com
Postal address: [to be confirmed]
We have not appointed an EU representative (GDPR Art. 27) or a data protection officer (GDPR Art. 37). We will name them here if we appoint them. [to be confirmed]

Websites, servers and content we host for customers

For the websites, servers and content Dvelopin hosts for its customers, Dvelopin acts as the customer's processor, not as a controller. That processing is governed by our data processing agreement or our Terms, not by this notice. [to be confirmed]

What personal data we collect and where we get it

Email address, first name, last name, company name: you, when you register. Phone number: you, when you edit My account
A new email address you asked to change to, until you confirm it: you
Organization memberships and roles: you, or the organization owner or admin, or our staff, who adds you
Invited email address: the organization owner or admin who invites you
Billing contact email: your organization's owner, an admin or a billing member
Your organization's US tax state, whether it is tax-exempt, and its exemption certificate reference: our staff
Tax-exemption documents (PDF or image files) and who uploaded them: your organization's owner, an admin or a billing member, or our staff
Sign-in security settings: passkey device names, authenticator app enrollment, recovery codes (stored as hashes): you
Failed sign-in count and the time an account was locked: our sign-in system
Display preferences: you
Email address, IP address, user agent at each sign-in: your browser, when you sign in
IP address, user agent per session: your browser
IP address, user agent per API token: the app or script that uses the API
IP address, user agent, event detail for refused requests: your browser
Request details and IP address, only when request capture is switched on (off by default): your browser
IP address and email address as rate-limit keys: your browser
Names, email addresses, IP addresses and user agents in our action log and audit trail of changes to accounts and records: your own actions, your colleagues' and our staff's
Which version of this notice and our terms you were shown: our system, when you register, accept an invitation or finish setting up your account
Emails we send you: to, cc, from, subject: our email system
Delivery, bounce and complaint notices from Amazon SES, which contain mailbox addresses: Amazon Web Services
Addresses we must not email again after a bounce, a complaint or a staff decision: Amazon Web Services, or our staff
Text messages to and from our business phone numbers (phone numbers, message text, attachments, delivery status): you, when you text us; our staff, when they text you; Telnyx
Emails you send to any @dvelopin.com address, including privacy@dvelopin.com (sender, recipients, subject, message and attachments): you
Stripe customer ID: Stripe
Saved payment method: card brand, last four digits, expiry month and year, wallet type: Stripe. We never receive or store full card numbers
Raw Stripe event messages about payments and customers: Stripe
Invoices, payments and subscriptions: our billing system

Why we process it and the lawful basis

No processing on the portal relies on your consent.

Run your account and your organization's service on the portal: performance of a contract (GDPR Art. 6(1)(b))
Send service emails (verification, password reset, invitations, security notices, receipts and payment notices): performance of a contract (Art. 6(1)(b))
Billing and payment processing (Stripe): performance of a contract (Art. 6(1)(b))
Work out sales tax on invoices and keep tax-exemption documents: legitimate interests (Art. 6(1)(f)) in meeting the US state tax laws that apply to us. GDPR's "legal obligation" basis covers only EU and EU member state law, so we do not rely on it here
Security: sign-in logs, rate limits, bot checks, abuse prevention, incident response: legitimate interests (Art. 6(1)(f)): "ensuring network and information security" (Recital 49)
Audit trail of actions on accounts and records, kept for security and legal claims: legitimate interests (Art. 6(1)(f), Recital 49)
Keep billing records after an account or organization closes: legitimate interests (Art. 6(1)(f)) in meeting US tax and accounting record-keeping rules and in handling refunds, disputes and other legal claims. How long we keep them is [to be confirmed]
Send and answer text messages with people who text our business phone numbers, and keep a record of them: legitimate interests (Art. 6(1)(f)) in answering people who contact us and knowing what was said
Read and answer emails people send to our @dvelopin.com addresses, and keep them: legitimate interests (Art. 6(1)(f)) in answering people who contact us and knowing what was said
Record which version of this notice and our terms you were shown: legitimate interests (Art. 6(1)(f)) in being able to show that we gave you this notice, as GDPR's accountability principle requires (Art. 5(2))
Answer your privacy requests and keep a record of them [request tracking ships with G5]: legal obligation (Art. 6(1)(c)), because GDPR requires us to act on them (Arts. 12 to 22)
Keep a suppression list so we never email a bounced or complaining address again: legitimate interests (Art. 6(1)(f)) in not emailing people who complained or whose address bounced, and in keeping our email deliverable

Who we share it with: service providers (processors)

Amazon Web Services (Lightsail, S3, SES, SNS): hosting, server management, file storage, backups and email. [to be confirmed]
Stripe: payment processing. Stripe is also an independent controller for fraud prevention, anti-money-laundering, know-your-customer checks and analytics, under its own privacy policy.
Telnyx: text messages (SMS and MMS) to and from our business phone numbers. Telnyx is also an independent controller for account and usage data, including message logs. [to be confirmed]
Google (Google Workspace): our business email. Email sent to or from any @dvelopin.com address, including privacy@dvelopin.com, is received and stored in Google Workspace.

Full sub-processor list

Who we share it with: independent controllers

They decide how they use the data; you can contact them under their own notices.

Stripe (fraud, anti-money-laundering, know-your-customer, analytics)
Telnyx (account and usage data, including message logs)
Google Pay, only if you choose it when adding a payment method on the billing page (inside Stripe's Express Checkout, under Google's own API terms)
Apple Pay is offered in the same Express Checkout. [to be confirmed]
Let's Encrypt (issues the security certificate for the portal's web address; acts for its own purposes)

Providers we plan to add

Planned, not used today: none. The portal's code includes a Twilio text-message option that is not switched on, so no data goes to Twilio.

Where your data is stored, and transfers outside the EU

Dvelopin is a US company. Our server, email sending, backups and text-message attachments are all with Amazon Web Services in the United States (region us-east-2). Tax-exemption documents are stored in Amazon S3; their region is [to be confirmed]. Stripe says it may store and process data "in any country where we do business". Email to @dvelopin.com addresses is held by Google, which may process it in any country where Google or its sub-processors have facilities.

If you are in the EU, the UK or Switzerland, your data therefore goes to the United States. The safeguards in each vendor's own terms are:

Dvelopin itself is not certified under the DPF today. The safeguard for data you give Dvelopin directly, and whether the DPF covers these onward transfers, is [to be confirmed]. Where SCCs are used, a transfer impact assessment is done. To get a copy of the safeguards: [to be confirmed]

We do not run an EU-region instance of the portal today.

Amazon Web Services: Standard Contractual Clauses (SCCs) Modules 2 and 3, UK Addendum, EU-US Data Privacy Framework (DPF)
Stripe: DPF first, then SCC Modules 1 to 3, UK Addendum
Telnyx: SCC Modules 1 to 3, UK Addendum, DPF
Google: DPF (EU-US, Swiss-US and the UK Extension) first, then SCCs
Google Pay, Let's Encrypt: not stated in their terms

How long we keep it today

Account profile, memberships, sign-in security settings: while your account is open
Sign-in log: 365 days
Security events: 180 days
Email log: 400 days
Amazon SES delivery notices: message content removed after 30 days; record deleted after 90 days
Request capture log (off by default): 90 days
Rate-limit keys: 24 hours
Session records: deleted when you sign out, or within a day after 15 minutes without activity
Expired sessions: deleted once expired
API tokens: deleted 7 days after they expire
Invitations: expired and revoked ones are deleted 90 days after their expiry date; accepted ones are kept
Action log: IP addresses and names or emails cleared after 365 days; the record of what was done is kept
Audit trail: events kept 730 days by default, never less than 365; the name and email address an event refers to are kept while your account exists [removal on deletion ships with G3]
Stripe event messages: content cleared after 90 days; the record and its IDs are kept
Email suppression list: kept so we never email that address again, stored as a keyed hash instead of the address
Billing records and tax-exemption documents: kept; the period is [to be confirmed]
Text messages, their attachments and Telnyx event messages: no deletion schedule today; the period is [to be confirmed]
Email to and from our @dvelopin.com mailboxes in Google Workspace: no deletion schedule today; the period is [to be confirmed]
The record of which notice and terms versions you were shown: no deletion schedule today
Backups: daily; database backups expire after 7 days and are permanently deleted about 7 days later (about 14 days in all) [to be confirmed]

Planned retention schedule

Your account after you delete it: personal details removed or anonymized; the row stays, with no name, email, phone or company [ships with G3]
A closed organization's data: destroyed after the closure grace period, except billing records [ships with G3]
Billing records: kept for the period counsel sets, then destroyed [to be confirmed]
Personal data export: never stored: it is built when you download it [ships with G2]
Organization exports: deleted after 7 days [ships with G2]
Backups: an age-out date recorded for each; if a backup taken before you deleted your account is ever restored, your deletion is applied again [ships with G3]

Your rights

Requests are free, unless they are clearly unfounded or excessive.

Access: get a copy of the personal data we hold about you
Rectification: correct inaccurate data
Erasure: have your data deleted
Restriction: ask us to limit how we use your data, for example while a dispute is open
Portability: receive the data you gave us in a structured, machine-readable format
Objection: object to processing based on legitimate interests
Withdraw consent: no processing on the portal relies on consent today. If we add a consent-based feature, you can withdraw consent at any time
Complain to a supervisory authority: you can complain to a data protection authority

How to use your rights

Today we handle every rights request by email: write to privacy@dvelopin.com, including to get a copy of your data or to delete your account. You can already correct your details and change your email address yourself in My account. The download and delete tools described below are not built yet.

Correct your details: edit your name, company and phone number in My account at any time
Change your email address: in My account. We send a confirmation link to the new address and a notice to the old one, and the new address works only once confirmed. Profile changes are logged
Download your data: in My account, as JSON with a CSV file per table. You confirm your identity again before the download [ships with G2]
Delete your account: in the danger zone of My account. You confirm your identity, then a 14-day grace period starts, and the email we send has a link to cancel. After that your personal data is erased. If you are the last owner of an organization, you must first hand ownership to someone else or close the organization. Billing records are kept (see above) [ships with G3]
Everything else (access without an account, restriction, objection, or any other request): email privacy@dvelopin.com. We confirm your identity through your account sign-in or a confirmation code, not copies of ID documents. We answer within one month (GDPR) or 45 days (US state laws), whichever is earlier. We may extend by two further months (GDPR) or once by 45 days (US state laws), and if so we tell you within the first period [request tracking ships with G5]

Cookies and device access

We set one cookie of our own: a session cookie (PHPSESSID) on your first visit to any portal page. It has no expiry date and ends when you close your browser. It is Secure, HttpOnly and SameSite=Lax. It is needed to keep you signed in and to protect forms. Your session also ends on our side after 15 minutes without activity.

On the billing page only, Stripe.js sets cookies (__stripe_mid and __stripe_sid; see the full cookie list) to prevent fraud. Google Pay and Apple Pay also load there if available. Whether Stripe's fraud cookies are strictly necessary is [to be confirmed].

We do not use analytics or advertising cookies, or any other tracking.

Full cookie list

Automated decision-making

We do not make decisions about you by automated means that have legal or similarly significant effects (GDPR Art. 22). If we add AI features, we will review this and update this notice first.

US state privacy rights

Some US states (including California, Colorado, Texas and Virginia) give residents the right to know, delete and correct their personal data, and to opt out of its sale or sharing. These laws apply to businesses above certain size thresholds. [to be confirmed] These rights are open to every user, wherever they live.

Sale or sharing: we do not sell your personal data or share it for advertising, so there is nothing to opt out of. For the same reason, a Global Privacy Control signal changes nothing here.
How to ask: email privacy@dvelopin.com (you can also correct your details and change your email address yourself in My account). We answer within 45 days. If we need longer, we may extend once by 45 days, and we tell you why within the first 45 days.
Appeal: if we turn down your request, you can appeal by emailing privacy@dvelopin.com with "Appeal" in the subject line. We tell you in writing what we decided and why within 45 days of receiving your appeal. With that answer we tell you how to contact your state attorney general if you have concerns about the result, including the attorney general's online complaint form where there is one. Residents of several states, including Virginia, Colorado and Texas, have this right to appeal.

Changes to this notice

We update this notice when our practices change. Each version has a number and a date. When you register, accept an invitation or finish setting up your account, we record which version you were shown.