Privacy policy

1. Who we are and how to contact us

1.1 Dvelopin LLC is a Texas limited liability company. We refer to ourselves as "Dvelopin" in this policy.

1.2 Dvelopin is the controller of the personal data in every Client Portal account: the account owners who sign up with us and the people a customer invites to its organization. Dvelopin is also the controller of the data it processes to run the Client Portal at cloud.dvelopin.com: accounts, sign-in and multi-factor authentication, security logs, billing contacts and payments, and text messages.

1.3 For the websites, servers, and content Dvelopin hosts for its customers, Dvelopin acts as the customer's processor, not as a controller. That processing is governed by our Data Processing Agreement or our terms with that customer, not by this policy.

1.4 How to reach us:

• Privacy contact: privacy@dvelopin.com
• General contact: info@dvelopin.com
• Website: dvelopin.com
• Client Portal: cloud.dvelopin.com
• Location: Phoenix, Arizona
• Phone: (972) 861-2338

1.5 We have not appointed an EU representative or a data protection officer. We will name them here if we appoint them.

2. Scope

2.1 This policy covers the personal data Dvelopin collects and processes on its public website at dvelopin.com and in the Client Portal at cloud.dvelopin.com.

2.2 This policy does not cover the data Dvelopin processes on behalf of its customers when it hosts websites, servers, or content for them. For that processing, Dvelopin acts as the customer's processor, under our Data Processing Agreement or our terms with that customer.

2.3 "Personal data" means any information that identifies or can reasonably identify a living person, as defined by applicable law.

3. What we collect on the website

3.1 The public website at dvelopin.com collects the following:

• Contact form: your name, email address, phone number (optional) and message. We use them only to answer you, and the form sends them to us by email. A hidden form field blocks spam; it collects nothing about you. Before the form sends, your browser solves a short computing puzzle that our server checks, to keep automated spam out; it uses no cookie and no outside service. To limit spam, the website also keeps a one-way hash of your IP address and the times you sent the form, for the 15-minute sending limit; a routine cleanup then deletes it.
• Analytics: Google Analytics 4. It records the pages you visit, roughly where you are (city or region, worked out from your IP address), your browser and device type, and how you reached the website. Google states that Google Analytics does not log or store IP addresses for visitors in the EU, Switzerland, or the UK. We use it only to see how the website is used. Google signals is turned off, so Google Analytics does not link your visits to a signed-in Google account, and we do not send Google Analytics any user IDs or customer data. Google Analytics keeps event data for 2 months and data linked to a visitor identifier for 14 months; the 14 months start again each time you return to the website. These limits do not affect most standard reports, which are built from combined, aggregated data.
• Hosting: Amazon Web Services, in the United States. Like any web server, it records your IP address, browser type and the pages you request in its logs.
• Cookies: two Google Analytics cookies on every page, and one session cookie on the contact page only, which protects the form against forged submissions. Section 12 and our Cookie Policy list them. The website loads no advertising tools.

3.2 We do not sell personal data collected on the website or share it for advertising purposes.

3.3 Why we may use it, and for how long. We answer contact-form messages because we have a legitimate interest in replying to people who write to us (GDPR Art. 6(1)(f)), or because you asked us to take steps before entering into a contract (Art. 6(1)(b)). We keep a message for as long as we need it to deal with your inquiry and any work that follows. Messages arrive in our business mailbox in Google Workspace, which has no deletion schedule today; we will add the period here when we set one. Web server logs are kept for about 10 days and then deleted automatically; we use them to keep the website secure and running (legitimate interests, Art. 6(1)(f)). We use Google Analytics to understand how the website is used and improve it (legitimate interests, Art. 6(1)(f)). Google Analytics loads without asking for consent first, for every visitor; you can block it as our cookie policy explains.

4. What we collect in the Client Portal

4.1 The Client Portal at cloud.dvelopin.com collects the following categories of personal data:

• Account details: email address, first name, last name, company name (at registration); phone number (when you edit My account); a new email address you asked to change to, until you confirm it; organization memberships and roles; invited email addresses; billing contact email; your organization's US tax state, tax-exempt status, and exemption certificate reference; tax-exemption documents (PDF or image files) and who uploaded them; display preferences.
• Security and sign-in data: passkey device names, authenticator app enrollment, and recovery codes (stored as hashes); failed sign-in count and account lock time; email address, IP address, and user agent at each sign-in; IP address and user agent per session; IP address and user agent per API token; IP address, user agent, and event detail for refused requests; request details and IP address when request capture is switched on (off by default); IP address and email address as rate-limit keys; session records.
• Logs: names, email addresses, IP addresses, and user agents in our action log and audit trail of changes to accounts and records; the version of this policy and our terms you were shown at registration, invitation acceptance, or account setup; emails we send you (to, cc, from, subject); delivery, bounce, and complaint notices from our email provider, which contain mailbox addresses; addresses we must not email again after a bounce, a complaint, or a staff decision.
• Billing data (processed through Stripe): Stripe customer ID; saved payment method (for a card: brand, last four digits, expiry month and year, wallet type; for a US bank account used for ACH payments: bank name and the last four digits of the account number); raw Stripe event messages about payments and customers; invoices, payments, and subscriptions. We never receive or store full card or bank account numbers.
• Text messages to our business numbers: phone numbers, message text, attachments, and delivery status for text messages to and from our business phone numbers.

4.2 Where we get it:

• From you: your registration details, phone number, a new email address, sign-in security settings and display preferences.
• From your organization's owner, an admin or a billing member: memberships and roles, invitations, the billing contact email, and tax-exemption documents.
• From our staff: memberships they add, your organization's US tax state, tax-exempt status and exemption certificate reference, tax-exemption documents they upload, and addresses we must not email.
• From your browser or the app that uses our API: IP addresses, user agents, request details and rate-limit keys.
• From our own systems: failed sign-in counts and lock times, the action log and audit trail (your actions, your colleagues' and our staff's), the version of this policy you were shown, the emails we send, and invoices, payments and subscriptions.
• From Amazon Web Services: email delivery, bounce and complaint notices, and bounce-based suppressions.
• From Stripe: your Stripe customer ID, saved payment method details and payment event messages.
• From you, our staff and Telnyx: text messages to and from our business phone numbers.

5. How and why we use it

5.1 We process your personal data for the following purposes. No processing in the Client Portal relies on your consent.

• To run your account and your organization's service on the Client Portal.
• To send service emails: verification, password reset, invitations, security notices, receipts, and payment notices.
• To process billing and payments through Stripe.
• To work out sales tax on invoices and keep tax-exemption documents.
• To protect security: sign-in logs, rate limits, bot checks, abuse prevention, and incident response.
• To keep an audit trail of actions on accounts and records for security and legal claims.
• To keep billing records after an account or organization closes, to meet tax and accounting record-keeping rules and to handle refunds, disputes, and other legal claims.
• To send and answer text messages with people who text our business phone numbers, and to keep a record of them.
• To record which version of this policy and our terms you were shown, so we can demonstrate that we gave you notice.
• To answer your privacy requests and keep a record of them.
• To keep a suppression list so we never email a bounced or complaining address again.

5.2 For people in the EU, the UK, and Switzerland, the legal bases are:

• Running your account, sending service emails, and billing and payments: performance of a contract (GDPR Art. 6(1)(b)).
• Working out sales tax and keeping tax-exemption documents: legitimate interests (Art. 6(1)(f)) in meeting the US state tax laws that apply to us. GDPR's "legal obligation" basis covers only EU and EU member state law, so we do not rely on it here.
• Security, and the audit trail kept for security and legal claims: legitimate interests (Art. 6(1)(f)) in ensuring network and information security (Recital 49).
• Keeping billing records after an account or organization closes: legitimate interests (Art. 6(1)(f)) in meeting US tax and accounting record-keeping rules and handling refunds, disputes and other legal claims.
• Text messages with people who text our business phone numbers: legitimate interests (Art. 6(1)(f)) in answering people who contact us and knowing what was said.
• Recording which version of this policy you were shown: legitimate interests (Art. 6(1)(f)) in showing that we gave you notice, as GDPR's accountability principle requires (Art. 5(2)).
• Answering your privacy requests and keeping a record of them: legal obligation (Art. 6(1)(c)), because GDPR requires us to act on them (Arts. 12 to 22).
• Keeping the email suppression list: legitimate interests (Art. 6(1)(f)) in not emailing people who complained or whose address bounced, and in keeping our email deliverable.

6. Who we share it with

6.1 Service providers (processors). We share personal data with the following service providers, who process it on our behalf:

• Amazon Web Services (Lightsail, S3, SES, SNS): hosting, server management, file storage, backups, and email.
• Stripe: payment processing.
• Telnyx: text messages (SMS and MMS) to and from our business phone numbers.
• Google (Google Analytics): website usage statistics.
• Google (Google Workspace): our business email. Email sent to or from any @dvelopin.com address, including contact-form messages and privacy@dvelopin.com, is received and stored in Google Workspace.

The full list, with locations and transfer tools, is in our Sub-processor List and at cloud.dvelopin.com/subprocessors.

6.2 Independent controllers. The following parties decide how they use the data and are not acting on our instructions. You can contact them under their own privacy notices:

• Stripe (fraud prevention, anti-money-laundering, know-your-customer checks, and analytics)
• Stripe Financial Connections, only if you link a US bank account for ACH payments on the billing page (Stripe's own privacy notice covers the bank details you give it)
• Telnyx (account and usage data, including message logs)
• Google Pay, only if you choose it when adding a payment method on the billing page (inside Stripe's Express Checkout, under Google's own API terms)
• Apple Pay, offered in the same Express Checkout.
• Let's Encrypt (issues the security certificate for the Client Portal's web address; acts for its own purposes)

6.3 We do not sell personal data or share it for advertising purposes.

7. Where data is stored and international transfers

7.1 Dvelopin is a US company. Our server, email sending, backups, and text-message attachments are all with Amazon Web Services in the United States (region us-east-2). Tax-exemption documents are stored in Amazon S3. Stripe says it may store and process data in any country where it does business. Email to @dvelopin.com addresses, including contact-form messages, is held by Google, which may process it in any country where Google or its sub-processors have facilities.

7.2 If you are in the EU, the UK, or Switzerland, your data is transferred to the United States. The safeguards in each vendor's own terms are:

• Amazon Web Services: Standard Contractual Clauses (Modules 2 and 3), UK Addendum, EU-US Data Privacy Framework.
• Stripe: EU-US Data Privacy Framework first, then Standard Contractual Clauses (Modules 1 to 3), UK Addendum.
• Telnyx: Standard Contractual Clauses (Modules 1 to 3), UK Addendum, EU-US Data Privacy Framework.
• Google Pay, Let's Encrypt: not stated in their terms.
• Google (Google Workspace, Google Analytics): the EU-US Data Privacy Framework, with the Swiss-US Framework and the UK Extension, first, then Standard Contractual Clauses.

7.3 Dvelopin itself is not certified under the EU-US Data Privacy Framework today. Where Standard Contractual Clauses are used, a transfer impact assessment is done. To get a copy of the transfer safeguards, email privacy@dvelopin.com.

7.4 We do not run an EU-region instance of the Client Portal today.

8. How long we keep it

8.1 The following retention periods apply to data that exists in the Client Portal today:

• Account profile, memberships, sign-in security settings: while your account is open.
• Sign-in log: 365 days.
• Security events: 180 days.
• Email log: 400 days.
• Amazon SES delivery notices: message content removed after 30 days; record deleted after 90 days.
• Request capture log (off by default): 90 days.
• Rate-limit keys: 24 hours.
• Session records: deleted when you sign out, or within a day after 15 minutes without activity.
• Expired sessions: deleted once expired.
• API tokens: deleted 7 days after they expire.
• Invitations: expired and revoked ones are deleted 90 days after their expiry date; accepted ones are kept.
• Action log: IP addresses and names or emails cleared after 365 days; the record of what was done is kept.
• Audit trail: events kept 730 days by default, never less than 365; the name and email address an event refers to are kept while your account exists. Removing them when you delete your account is planned.
• Stripe event messages: content cleared after 90 days; the record and its IDs are kept.
• Email suppression list: kept so we never email that address again, stored as a keyed hash instead of the address.
• Billing records and tax-exemption documents: kept for 7 years.
• Text messages, their attachments, and Telnyx event messages: no deletion schedule today; we will add the period here when we set one.
• The record of which policy and terms versions you were shown: no deletion schedule today.
• Email to and from our @dvelopin.com mailboxes in Google Workspace: no deletion schedule today.
• Backups: daily; database backups expire after 7 days and are permanently deleted about 7 days later (about 14 days in all).

9. Security

9.1 We use reasonable technical and organizational measures to protect personal data. These include encryption in transit (HTTPS), passwords stored only as one-way hashes, multi-factor sign-in (an authenticator app or a passkey), rate limits on sign-in, logging of refused requests with alerts to our staff, and daily backups.

9.2 If a security breach affects your personal data, we notify you as the law requires, and we describe what happened, what data was affected, and what steps we are taking. Where we host data for a customer, we notify that customer within 48 hours of becoming aware of a breach affecting it.

9.3 If you believe your data has been compromised, contact us at privacy@dvelopin.com.

10. Your rights

10.1 You have the following rights, depending on your location and applicable law:

• Access: get a copy of the personal data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: have your data deleted.
• Restriction: ask us to limit how we use your data, for example while a dispute is open.
• Portability: receive the data you gave us in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: no processing in the Client Portal relies on consent today. If we add a consent-based feature, you can withdraw consent at any time.
• Complain to a supervisory authority: you can complain to a data protection authority in your jurisdiction.

10.2 How to use your rights. Today we handle every rights request by email. Write to privacy@dvelopin.com, including to get a copy of your data or to delete your account. You can also correct your details and change your email address yourself in My account at cloud.dvelopin.com.

10.3 We confirm your identity through your account sign-in or a confirmation code, not copies of ID documents.

10.4 Response times. We answer within one month (for people in the EU, UK, and Switzerland) or 45 days (for people subject to US state privacy laws), whichever is earlier. We may extend by two further months (EU, UK, Switzerland) or once by 45 days (US state laws), and if so we tell you within the first period.

10.5 Requests are free, unless they are clearly unfounded or excessive.

11. US state privacy rights and appeals

11.1 Some US states (including California, Colorado, Texas, and Virginia) give residents the right to know, delete, and correct their personal data, and to opt out of its sale or sharing. These laws apply to businesses above certain size thresholds. These rights are open to every user of the Client Portal, wherever they live.

11.2 Sale or sharing. We do not sell your personal data or share it for advertising, so there is nothing to opt out of. For the same reason, a Global Privacy Control signal changes nothing here.

11.3 How to ask. Email privacy@dvelopin.com. You can also correct your details and change your email address yourself in My account. We answer within 45 days. If we need longer, we may extend once by 45 days, and we tell you why within the first 45 days.

11.4 Appeal. If we turn down your request, you can appeal by emailing privacy@dvelopin.com with "Appeal" in the subject line. We tell you in writing what we decided and why within 45 days of receiving your appeal. With that answer we tell you how to contact your state attorney general if you have concerns about the result, including the attorney general's online complaint form where there is one. Residents of several states, including Virginia, Colorado, and Texas, have this right to appeal.

12. Cookies

12.1 Client Portal. We set one cookie of our own: a session cookie (PHPSESSID) on your first visit to any Client Portal page. It has no expiry date and ends when you close your browser. It is Secure, HttpOnly, and SameSite=Lax. It is needed to keep you signed in and to protect forms. Your session also ends on our side after 15 minutes without activity.

12.2 On the billing page only, Stripe.js sets cookies (__stripe_mid and __stripe_sid) to prevent fraud. Google Pay and Apple Pay also load there if available. We treat them as strictly necessary: they protect the payment from fraud and load only on the billing page.

12.3 We do not use analytics or advertising cookies in the Client Portal, or any other tracking.

12.4 Public website. The website at dvelopin.com sets two Google Analytics cookies (_ga, and _ga_ followed by a property code; 2 years by default) on every page to count visits and visitors, and one session cookie of its own (dvwww) on the contact page only. dvwww protects the form against forged submissions, ends when you close your browser, and is Secure, HttpOnly, and SameSite=Lax. You can opt out of Google Analytics with Google's browser add-on at https://tools.google.com/dlpage/gaoptout. The website uses no advertising cookies.

12.5 The full list, with how long each cookie lasts, is in our Cookie Policy and on the Client Portal's own cookie page at cloud.dvelopin.com/cookies, which is built from the portal's code.

13. Automated decision-making

13.1 We do not make decisions about you by automated means that have legal or similarly significant effects (GDPR Art. 22). If we add AI features, we will review this and update this policy first.

14. Children

14.1 The website at dvelopin.com and the Client Portal at cloud.dvelopin.com are for businesses and are not directed at children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have collected such data, we will delete it.

15. Changes to this policy

15.1 We update this policy when our practices change. Each version has a number and a date. When you register, accept an invitation, or finish setting up your account, we record which version you were shown.

15.2 Effective date: 2 November 2026