Privacy Policy

Duwora (duwora.com) is operated by Jiří Veselý, a sole trader registered in the Czech Republic, IČO [IČO], with its address at Dandova 2619/13, 190 00 Praha 9, Česká republika ("Duwora", "we", "us").

For privacy questions write to info@duwora.com. If you are a customer and your question is about your account, you can also use support@duwora.com.

Duwora as controller. We decide how and why we process the data of the people who visit our website and who hold a Duwora account: account, billing, support and technical data. This policy describes that processing.

Duwora as processor. When you use Duwora to run your business, you put in data about your own customers — names, contact details, addresses, requests, quotes, appointments, files and emails. For that data, your business is the controller and Duwora processes it only on your behalf and on your instructions, under the data processing terms that form part of our Terms of Service.

• Account data: your name, email address and sign-in details (handled by our authentication provider), your language, trial dates and account settings.
• Business data: the details you enter for each business, such as its name, legal name, address, phone, website, logo, company and tax numbers, bank details, working hours and quote terms.
• Customer and job data you enter: customers, requests, services, quotes (including the frozen copy of every issued quote), appointments, tasks, notes and activity history.
• Files: photos, documents and email attachments you upload or that arrive with a connected mailbox (up to 25 MB per file, 500 MB per account).
• Email data (only if you connect a mailbox): the messages Duwora syncs from your mailbox — sender, recipients, subject, message text and HTML, and attachments — plus messages you send through Duwora.
• Billing data: plan, subscription status, billing country and currency, billing address and VAT number if you provide one, and invoice history. Card details are entered directly with our payment provider; Duwora never sees or stores your card number.
• Technical data: IP address and the country derived from it (used to show prices in the right currency), browser and device information, server logs, and error reports.
• Communications: messages you send us, for example to info@ or support@.

We record a small number of product milestones (for example, "first quote issued") in our own database to understand how Duwora is used. We do not use third-party analytics or advertising trackers.

• To provide Duwora — create and run your account, store and display your data, generate quote PDFs, sync and send email, and schedule work. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To bill you — take payments, issue invoices and keep accounting records. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)).
• To keep Duwora secure and working — prevent abuse, fix errors and monitor performance. Legal basis: our legitimate interest in a reliable, secure service (Art. 6(1)(f)).
• To support you and tell you about the service — answer your messages and send essential notices about your account, billing or changes to these documents. Legal basis: contract and legitimate interest.
• To improve Duwora — understand, in aggregate, which features are used. Legal basis: legitimate interest.

We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing.

Gmail and iCloud are connected with an app password you create in your email account; Duwora never receives your main password and you can revoke the app password at any time.

• Duwora checks for new mail in the background and stores the messages it syncs in your account, so your history stays available.
• New conversations go to a triage queue. Nothing becomes a Request unless you decide so, and nothing is sent to your customers without you reviewing it.
• When you handle a conversation in Duwora, the message may be marked as read in your mailbox.
• Mail you delete in your mailbox that never became part of a job is removed from Duwora during regular clean-up.
• When you disconnect a mailbox or stop paying for it, Duwora's access is revoked immediately. Messages already stored and linked to your customers and jobs remain in your account as part of your business history until you delete them or your account.

We use carefully chosen providers to run Duwora. They process data only for us and under data processing agreements:

• Cloudflare, Inc. — website hosting, content delivery and security (global network).
• Convex, Inc. — application database and file storage (USA).
• Clerk, Inc. — sign-in and account authentication (USA).
• Stripe Payments Europe, Ltd. — payments, subscriptions, invoices and tax calculation (Ireland, with processing by Stripe group companies).
• Nylas, Inc. — connection to your mailbox, only if you connect one. Data is hosted in the EU region.
• Functional Software, Inc. (Sentry) — error monitoring, configured not to collect message content, request bodies or default personal data (USA).

If we add or replace a subprocessor, we will update this list before the change takes effect.

Some of our providers are based in, or use infrastructure in, the United States or other countries outside the European Economic Area. Where that happens, transfers are protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses together with additional safeguards.

Duwora uses only cookies and browser storage that are strictly necessary for the service:

• Sign-in cookies set by our authentication provider to keep you signed in securely.
• A language cookie that remembers the language you chose.
• Local storage in your browser for interface preferences, such as the business you last selected and column widths.

We do not use analytics, advertising or social media cookies, so we do not show a cookie consent banner. If that ever changes, we will ask for your consent first.

• While your account is active, we keep your data so you can use it.
• After a free trial ends without a subscription, your account becomes read-only and your data is kept so you can export it or subscribe later. If we ever introduce a time limit for this, we will tell you by email at least 30 days in advance.
• When you delete your account, mailbox connections are revoked immediately and, after a 30-day grace period in which you can change your mind, your business data is permanently deleted. Copies in backups are overwritten within a further 30 days.
• Billing records (invoices and payments) are kept for as long as Czech tax and accounting law requires, usually up to 10 years.
• Error and server logs are kept for a limited period, typically no longer than 90 days.
• Messages to support are kept for as long as needed to help you and for up to 3 years afterwards.

Data is encrypted in transit and at rest with our providers. Each account's data is isolated and access is checked on the server for every request. Mailbox access tokens are treated as credentials, and access within Duwora is limited to what is necessary to operate and support the service. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the authorities as the law requires.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted, and delete your account yourself in Settings;
• export your data — Duwora exports your records to CSV at any time;
• restrict processing or object to processing based on our legitimate interests;
• withdraw any consent you have given, without affecting earlier processing.

To exercise these rights, write to info@duwora.com or support@duwora.com. We will reply within one month. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz) or with the supervisory authority where you live or work.

If a business uses Duwora to manage your request or quote, that business is responsible for your data. Please contact it directly. If you contact us, we will pass your request to the business concerned where we can identify it.

Duwora is a service for businesses and is not intended for children under 16. We do not knowingly collect their data.

We may update this policy as Duwora or the law changes. We will publish the new version here with its effective date and, for material changes, tell account holders by email or in the app before they take effect.