Privacy Policy

The controller for Douvo is SAMPATZE VALERIOS, THESSALONIKI, Greece — referred to below as “we” or “Douvo”.

For anything to do with personal data, write to app.douvo@gmail.com. We answer within one month at the latest.

We have not appointed a Data Protection Officer: the GDPR does not require one for a business of this size and activity. Requests go to the address above and we handle them ourselves.

• The Douvo app for iPhone and Android.
• The douvo.app website.
• The public project links (the client portal) that you send to your own clients.

It does not cover third-party services you may reach through Douvo — your phone's maps or dialler, for instance. Their own policies apply there.

This distinction is the most important thing in the document, because it decides who any given request should go to.

For your own account data — email, name, business, settings — we are the controller.

For everything you enter in the app about your clients — names, phone numbers, addresses, floors, doorbells, notes, photos, amounts — you are the controller. We are the processor and act only on your instructions.

• You make sure you have a lawful basis for holding those details, usually performance of your contract with the client.
• You tell your clients that you keep their details in a digital tool.
• You answer them if they ask for access or deletion. The app gives you the buttons to do it.
• We do not touch that data for our own purposes. We do not read it either, unless you ask us for help with a specific problem and give us access.

If you are a client of a tradesperson and want to know or delete what they hold about you, contact them — it is their decision. If you don't know who to ask, write to us and we will pass the request on.

• We use no analytics, tracking pixels or advertising SDKs. Not in the app, not on the website. We do not know which screens you open.
• We do not sell, rent or trade data with anyone.
• We do not read your contacts, your messages or your photo library. Only the photo you choose is uploaded.
• We do not collect your location. The “Map” button simply opens your maps app with the address you typed; we never read GPS.
• We do not use your data to train artificial-intelligence models.
• We make no automated decisions about you and build no profiles (GDPR art. 22).

Every permission can be withdrawn in your device settings. The app keeps working — it just loses that one piece.

The website uses no tracking, analytics or advertising cookies, and no third-party cookies. It uses only what is strictly necessary for it to work — the cookies the law (the ePrivacy Directive, article 5(3)) allows without consent. That is why you see no banner: there is nothing to accept or reject.

Subscription payments happen on Stripe's checkout page (checkout.stripe.com), not on douvo.app. There Stripe sets its own cookies for payment security and fraud prevention under its own policy, which you can read at stripe.com/cookies-policy/legal.

You can delete or block cookies in your browser settings. If you block the sign-in cookies you will not be able to sign in to your account on the web; the website and the phone app keep working.

The app keeps a copy of your data locally so it works with no signal. That copy is cleared when you sign out or uninstall.

We give data to no one for their own purposes. We do use infrastructure providers that process it on our behalf, under a data-processing agreement:

Beyond those, we may have to disclose data where a law, a court order or a competent authority requires it, or to establish and defend legal claims.

Your data is stored on servers inside the EU (Frankfurt) and in the United Kingdom (London). The UK is covered by a European Commission adequacy decision, so a transfer there is treated like a transfer within the EU.

Some of the providers above (Supabase, Vercel, Expo, Stripe, Resend, Apple, Google) are US companies whose staff may access data for maintenance and support. Those transfers rely on the European Commission's Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework, depending on what each provider certifies.

The text of a push notification — the job title and the client's name, for example — travels through Expo's, Apple's and Google's networks to reach the handset. Don't put anything in a job title that you would not want to travel that way.

When you turn sharing on for a project, Douvo mints a link with a random, unguessable token, and you hand it to your client.

• The page shows progress, phases, visits and photos for that one project.
• Financial figures appear only if you switch them on — and never your expenses or your margin.
• The pages are marked noindex and excluded in robots.txt, so they stay out of search engines.
• Photos are served through signed links that expire within an hour.
• The moment you stop sharing, the link stops working and shows an error page.

Anyone holding the link can see it — there is no password. Send it only to the person who needs it, and stop sharing once the project is done.

You delete your account yourself, from inside the app. You do not need to ask us, send an email, or give a reason.

Open the menu, go to your profile, and from there to “My details”. Account deletion sits at the bottom of that screen. You will be asked to confirm, because the action cannot be undone.

Your account takes all of your data with it: clients, jobs, appointments, projects and phases, materials, expenses, payments, photos and settings. We keep no copy for our own use, and no dormant account on the side.

Data leaves our live systems within 30 days. Backups roll over and clear within a further 30 days; until then we touch them for nothing but disaster recovery.

Any public project link you had shared stops working along with the project: a client who opens it afterwards gets an error page, not stale data.

Two things survive, both because they are not yours to delete. If you belong to a business with several members, the business's work data stays with the business and only your own account goes — it belongs to the business, not the individual. And anything with tax or accounting significance we keep for as long as the law requires.

If you cannot get into the app to finish the deletion — lost password, lost device — write to app.douvo@gmail.com from the account's email address and we will do it for you.

• Encryption in transit (TLS) and encryption at rest by the provider.
• Row Level Security in the database: each row is reachable only by the user or the business it belongs to, regardless of what the app asks for.
• Project photos sit in private storage and are served only through signed, short-lived links.
• Roles: an employee sees the jobs assigned to them, not prices, profit or statistics.
• Administrative keys live on the server only and never reach a browser or a handset.

Your profile picture is stored in public storage under a random filename, so anyone with the exact link can view it. Don't use an image you would mind being reachable that way.

No service is perfectly secure. If a breach affects you, we will notify the supervisory authority within 72 hours and you without undue delay, as the GDPR requires.

Douvo is built for working professionals. It is not intended for anyone under 18 and we do not knowingly collect their data. If we find that we have, we delete the account.

The GDPR gives you the following, and we honour them without conditions:

• Access — find out what we hold and get a copy.
• Rectification — correct anything wrong or incomplete.
• Erasure — ask for your data to be deleted.
• Restriction — freeze processing while a disagreement is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — at any time, without affecting what came before.

Most of these you can exercise yourself inside the app: edit your profile, delete clients, jobs and photos, stop sharing, delete your account. For the rest, email app.douvo@gmail.com.

We answer within one month. Complex requests may take two months longer, and we will tell you if that happens. There is no charge unless a request is manifestly unfounded or excessive.

If you think we handled you badly, you can complain to the Hellenic Data Protection Authority: 1-3 Kifissias Avenue, 115 23 Athens, Greece, +30 210 6475600, contact@dpa.gr, www.dpa.gr — or to the supervisory authority of the EU/EEA country where you live.

This section applies when you use Douvo as a business and we process your clients' and crew members' data on your behalf. It is the agreement article 28 of the GDPR requires between you (the controller) and us (the processor), and it binds both sides from the moment you accept the Terms of Service.

• Subject matter and duration: running your account and your business in Douvo, for as long as the account exists.
• Nature and purpose: storing, syncing, displaying and backing up the data you enter, so that the app works.
• Types of data and data subjects: your clients' contact and address details, notes, photos and job amounts; your crew members' names, emails and roles.
• Your instructions: your use of the app and its settings are your documented instructions. We process the data only on those, unless the law requires otherwise — in which case we tell you first, where the law allows.
• Confidentiality: anyone with access on our side is bound by a duty of confidentiality.
• Security: we apply the measures in “How we protect it” and keep them up to date as technology moves.
• Sub-processors: the providers in the table under “Who else sees data”, each bound to us by a contract with equivalent obligations. By accepting this agreement you authorise us to use them. If we add or replace one, we email you at least 30 days beforehand; if you object, you can delete your account before then.
• Data-subject rights: if one of your clients asks for access, correction or deletion, the app gives you the means to answer; where it does not reach, we help. If the request comes to us, we tell you without delay and do not answer in your place.
• Assistance: we help you, as far as we reasonably can and based on what we know, with the security of processing, impact assessments and any consultation with the authority.
• Breach: if we become aware of a personal-data breach affecting your data, we notify you without undue delay and at the latest within 72 hours of becoming aware, with what we know so that you can meet your own obligations.
• Termination: when you delete your account, the data is deleted as described under “How long we keep it”. Before that, on request, we give you a copy within 30 days in a common machine-readable format of our choosing (for example CSV or JSON).
• Audits: we provide the information you need to demonstrate compliance with article 28 and answer reasonable questions. An on-site audit takes place only where that is not enough, with 30 days' notice, once a year, at your expense.
• Liability: our liability under this agreement is subject to the limitation of liability in the Terms of Service, where the law allows.

We may update it when something changes in the app or among our providers. The date at the top always marks the current version.

If a change is material — a new category of data, or a new purpose — we will tell you in the app or by email at least 30 days before it takes effect.

SAMPATZE VALERIOS, THESSALONIKI, Greece. Data-protection email: app.douvo@gmail.com.

Write to us in Greek or in English. No formal request template is needed — one clear sentence about what you want is enough.