1. Responsibility and contact
N.I. BLOOM INVESTMENTS LTD, HE 460140, VAT CY60073409S, at Kosta Chatzikakou 10, ATLANTIS, 4th floor, Office 401, 6027 Larnaca, Cyprus, is responsible for Doviria account administration, security and support. Contact support@doviria.com about personal data. This is a privacy contact, not a claim that a statutory data protection officer has been appointed.
For personal data a business puts into its workspace, that business normally decides why the data is used and acts as controller; Doviria processes it on the business’s instructions. In Ukrainian legal terminology these roles correspond to the data holder and data processor. A business’s own notice applies to its purposes. We can help identify the responsible workspace owner if you contact us.
2. Information we handle and its sources
Account information comes from you or an authorised business administrator: name, email address, sign-in and verification information, workspace membership, permissions, language choices and policy-acceptance records. Technical records can include IP address, browser or device information, request times, security events and operational errors. Support messages contain the information you choose to send.
Workspace information comes from you and authorised colleagues or imports: business and contact details, tax identifiers, invoices, journal entries, transaction descriptions, amounts, documents and attachments. Those records may concern employees, customers, suppliers and other contacts who do not have Doviria accounts. We do not need unrelated sensitive information or full payment-card details in those records.
3. Purposes and legal grounds
We use account information to provide access, manage your account and respond to service requests. Where you are personally a party to the service contract, this is necessary to perform that contract. For employees or representatives of a business customer, we rely on our legitimate interests in operating the customer’s account and communicating with its authorised users, with appropriate safeguards for their rights.
We use proportionate technical and security records to prevent unauthorised access, investigate faults and protect the service, relying on legitimate interests balanced against your rights. We retain or disclose particular records where a specific legal obligation requires it. If an optional use requires consent, we will ask separately and you may withdraw it without affecting prior lawful processing. Business workspace data is processed on the customer’s instructions; the customer is responsible for its own legal basis.
The sign-in and business details needed to provide access cannot be omitted if you want to use the corresponding service. Optional support attachments are your choice. We do not use the current service to make solely automated decisions producing legal or similarly significant effects about individuals.
4. Disabled features
AI features, bank connections, Google sign-in and paid billing are disabled in the initial Doviria service. It does not send workspace records to AI providers, retrieve bank feeds, obtain a Google profile through sign-in or collect card information for a subscription through those disabled features. Tax filing, qualified electronic signatures, State Tax Service submissions and payroll are also outside this launch.
Before enabling a feature that changes data use or recipients, we will update the relevant information and obtain any required permission. A mention of a provider elsewhere on the website does not by itself establish an active connection.
5. Recipients and service providers
Authorised members of your business can access records according to their permissions. Within the operator, access for support, security and administration is limited to the company’s owner and employees when necessary for those duties, subject to confidentiality and access controls. The company’s own support team handles privacy requests and incident reports through support@doviria.com. We disclose data to authorities only where a valid legal requirement applies, and to professional advisers where necessary under confidentiality obligations.
The infrastructure uses Cloudflare, Inc. for website and application delivery, network protection, D1 data storage, email routing, native transactional Email Sending through auth.doviria.com and R2 recovery storage, and Hetzner Online GmbH for the dedicated PostgreSQL database, live files and supporting document services. D1 and R2 recovery storage are configured in the EU. Cloudflare routes support messages to the company’s Google-hosted email inbox, where its support team handles them. Cloudflare also sends the account verification and password-reset messages; no separate transactional sending vendor is configured.
Service providers may use data only for the contracted service and applicable legal obligations. We do not sell workspace records or permit their use for unrelated advertising. The approved subprocessor list and the change process form part of the workspace-processing terms.
6. Locations and international transfers
EU-configured storage does not mean every network request, provider operation or authorised administrative access stays in the EU. Doviria is operated by a Cyprus company for Ukrainian businesses. The company’s owner and employees provide support and administer the service from Cyprus, the United Arab Emirates, Norway and Brazil. These are personnel access locations, not a claim that Doviria stores all records in those countries. This internal support access is within the same company. Infrastructure providers may process information internationally under their applicable service and data-protection arrangements.
Where a disclosure to another recipient constitutes a restricted international transfer, an applicable adequacy decision or appropriate safeguards must cover it, with additional measures where needed. Access by the company’s own staff does not remove confidentiality, access-control or security duties. Ask support@doviria.com about the arrangements relevant to your data and how to obtain a copy of applicable safeguards, subject to necessary redactions.
7. Retention and deletion
Active business records are retained to provide the workspace until deletion or closure. An owner’s closure request restricts normal use immediately and has a 30-day cancellation period. Scheduled business deletion follows, with a configured target within 90 days of the request, subject to a documented legal hold or unresolved dependent service. A limited closure record containing closure ID, business ID and business name remains; closing one business does not automatically delete a sign-in account used by other businesses.
Recovery backups are encrypted and scheduled every six hours. EU R2 recovery snapshots and local recovery copies are retained for up to 30 days. They are for controlled recovery, not routine customer access. Before reopening restored data, we reapply later closures, original expiry dates and relevant holds. Restoration must not restart retention clocks.
Verification links expire after one hour. Login sessions last up to seven days and can be renewed daily while used. These validity limits are not promises that every related audit record is deleted at the same moment. The transactional-email processor clears its encrypted payload immediately after the provider accepts a message. Encrypted payloads in captured, failed or unknown states are cleared after seven days. Provider acceptance does not establish inbox delivery, and these controls do not establish retention of all delivery metadata or copies in a recipient mailbox.
Ordinary security and operational records use a retention schedule of up to 90 days. Expired sign-in sessions are removed once they are over 90 days old; live sessions remain usable, but their old IP address and browser-identification fields are cleared at that age. Attempt counters expire after 90 days without activity. Ordinary email-delivery metadata expires 90 days after its last update, except for active sending leases or documented holds. Cloudflare Worker logs and traces have a seven-day provider retention period; dedicated server log rotation and expiry keep ordinary files within the 90-day schedule. Automated expiry runs periodically rather than at the exact instant a record reaches its age limit.
Closed support and incident records, including copied attachments, are kept for up to 12 months after the case closes. The company’s support team assigns responsibility and a deletion date, reviews closed cases monthly and removes the records under this procedure. This is an employee procedure, not a claim of automatic deletion configured in Google Workspace.
Policy-acceptance receipts remain with active personal accounts and are removed when those accounts are deleted. Closing one business does not delete a still-active personal account. Separate necessary closed-account policy or closure evidence is kept for no more than 24 months after closure. Application closure markers are scheduled to expire 730 days after recorded closure; accounting-service markers expire 730 days after completed deletion. Separate control metadata preserves the original expiry and any holds. Markers are not removed while the business or unfinished deletion work remains. A documented legal hold or specific legal duty may require particular evidence for longer, with its reason, scope and review recorded; this does not permit indefinite retention of all workspace data. Public policy versions and digests contain no personal acceptance records and remain available as publication history. Contact support@doviria.com for personal-account deletion requests.
8. Security and recovery
Controls include encrypted network connections, authentication, workspace access restrictions, restricted infrastructure credentials, file checks and encrypted recovery copies. Recovery tests have been performed on the independent Doviria environment. They do not guarantee that every future failure can be recovered without loss or delay.
Disk encryption for the live file directory has not been verified. We do not describe all stored files as encrypted, claim end-to-end encryption or claim a security certification. Report a suspected incident to support@doviria.com without sending passwords or unnecessary sensitive records.
9. Cookies and device storage
Doviria uses a necessary session cookie, __Secure-doviria.session_token, on app.doviria.com to keep you signed in. It is restricted to secure connections, is not readable by page scripts and uses SameSite=Lax. Its validity is up to seven days, with renewal during use as described above. Blocking this cookie can prevent sign-in or authenticated account functions.
The browser also stores functional data locally. This includes language, appearance, sidebar and layout settings and recently selected businesses. Accounting forms may use local or session storage for pending operations, draft identifiers, amounts, references and recovery when a submission’s outcome is uncertain. This is broader than preference storage and can contain business information. Session storage is tied to the browser tab’s session. Persistent local preferences and recovery records can remain until the application resolves or clears them, or you clear the browser’s site data. Clearing site data may remove unsent drafts or recovery information; it does not by itself delete records already saved to the service.
Optional analytics and advertising tracking are not enabled in the current release. If we introduce such tools, we will explain the relevant processing and provide any choice required before activation. This notice does not grant consent to optional tracking.
10. Your rights and complaints
Depending on the law and circumstances, you may request access, correction, erasure, restriction or a portable copy of your personal data, object to processing based on legitimate interests and withdraw consent for uses relying on it. Rights are subject to applicable conditions, including other people’s rights and specific legal retention duties. Send requests to support@doviria.com; we may ask for proportionate identity verification. If the request concerns a customer’s workspace data, we will direct it to the responsible business and assist as appropriate.
We will respond within the period required by the law applicable to your request. Under the GDPR the usual period is one month, with a lawful extension where necessary and notice within the first month. Applicable Ukrainian time limits and procedures also remain available; a GDPR extension does not override a shorter mandatory deadline.
You may complain to the Cyprus Commissioner for Personal Data Protection, the Ukrainian Parliament Commissioner for Human Rights, another competent supervisory authority or a competent court. You do not have to contact us first. Official information is available at dataprotection.gov.cy and ombudsman.gov.ua.
11. Updates
This notice’s version and effective date are shown with the document. Material changes to data use will be explained through the service or an appropriate account notice. We review the affected processing before enabling a new provider or feature.