Privacy Policy

This Privacy Policy explains what personal data Datorix (the "Service") processes, why, and what rights you have. We collect only what we need to run the Service. We do not sell your data, show ads, or use analytics or tracking tools.

1. Controller

The controller of your personal data is Jakub Vondra, a private individual based in the Czech Republic. Contact: hello@datorix.app.

2. What data we process

Account data

Your name, email address, password (stored only as a one-way hash, never in readable form), whether your email is verified, your account role, and the date you accepted the Terms.

Login and security data

Your IP address and browser identification (user agent), stored with your login session. IP addresses are also used briefly to limit repeated requests (rate limiting) and appear in technical server logs.

Export configuration

The API endpoints, settings, field mappings, processing steps and schedules you create, and a small sample of an API response that is used to offer fields for mapping.

API credentials

API keys, tokens and passwords you enter for the APIs you connect. They are stored encrypted, are never shown back in the app, and are used only to make the requests you configure.

Exported data

Data returned by the APIs you connect, the export files generated from it, and your export history (status, timing, error messages). If this data contains personal data of other people, you decide what is processed and we process it only on your behalf (see section 5 of the Terms of Service).

Emails

We send you service emails only: email verification, password reset, and notices when an export fails. If you write to us, we process your message and email address to reply.

3. Why we process it (legal basis)

• Providing the Service (account, exports, service emails): performance of our contract with you, Art. 6(1)(b) GDPR.
• Security, abuse prevention, troubleshooting and backups: our legitimate interest in running a secure and reliable service, Art. 6(1)(f) GDPR.
• Replying to your messages: our legitimate interest in communicating with you, Art. 6(1)(f) GDPR.
• Legal obligations, where they apply: Art. 6(1)(c) GDPR.

We do not use your data for marketing, profiling or automated decision-making.

4. Cookies

We use only cookies that are strictly necessary for the Service to work, so no consent banner is needed. We do not use analytics, advertising or third-party tracking cookies, and fonts are served from our own servers.

5. Who processes data for us

We use the following service providers (processors), only to the extent needed to run the Service:

• DigitalOcean: hosting. Our servers and database are located in Frankfurt, Germany (EU).
• Mailtrap: delivery of service emails.
• Namecheap: domain registration and forwarding of emails sent to hello@datorix.app.

These providers are based in the United States, so some personal data may be transferred outside the European Economic Area. Such transfers are covered by the providers' data processing agreements: DigitalOcean and Mailtrap are certified under the EU–U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses as a fallback, and Namecheap relies on the Standard Contractual Clauses.

When you run an export, the Service sends requests to the third-party APIs you configured, with the credentials you provided. Those services process the requests under their own privacy policies.

6. How long we keep data

• Account data and export configuration: until you delete them or your account.
• Export files: deleted automatically 7 days after they are created.
• Export history: until you delete the export definition or your account.
• Login sessions: expire after 2 hours of inactivity.
• Database backups: kept for up to 30 days, then deleted. Data you delete disappears from backups within 30 days.
• Server logs: kept for up to 14 days.

7. Security

All traffic is encrypted with HTTPS. Passwords are hashed, API credentials are encrypted, and access to servers and data is restricted to the operator.

8. Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format.

You can delete your account yourself at any time in your Profile under Delete account. This immediately and permanently deletes your account, export definitions (including stored API credentials), export history and export files; remaining copies in backups disappear within 30 days.

To exercise any other right, email hello@datorix.app from the address registered to your account. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority, in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or the authority in the EU country where you live.

9. Children

The Service is not intended for people under 16, and we do not knowingly collect their data.

10. Changes to this policy

We may update this Privacy Policy. The date at the top shows the latest version. For material changes we will notify you by email or in the app.