Privacy policy

Version 5, last changed on 15 October 2026.

This policy covers the personal data Dovalis decides about: the accounts of the businesses that use it and their payments, visits to dovalis.com, requests for early access, and reports about published testimonials. For testimonials themselves, the business that collects them decides, and each of its forms links to its own notice.

Who is responsible

SOULSOLUTIONS S.R.L., Romania, runs Dovalis and decides about the data this policy covers. Contact: support@dovalis.com.

What we keep, and why

  • Your login, your business's details (what you enter, or let us read from your website), your settings, the documents you accepted and the messages you send us in the app: to provide your account. The basis is our contract with you.
  • When your business pays: its name, address, tax or VAT number and the email address for invoices, and a record of each payment. To charge and invoice you. The basis is our contract with you, and keeping invoices is our legal obligation. Card details go to Stripe and never reach us.
  • A record of the actions taken in your account, by your team or by our staff, and why: to keep accounts safe and show who did what. The basis is our legitimate interest in that.
  • The network address and time of each request, kept by our hosting and login providers: to stop abuse. The basis is our legitimate interest in a safe service.
  • When you ask for early access, your email address and the language you asked in: to confirm the address and tell you once that Dovalis has opened. The basis is your consent. You can withdraw it at any time by writing to support@dovalis.com; that does not undo what was done before.
  • When you write to one of our addresses, such as support@dovalis.com: your address and what you write, to answer you. The basis is our contract with you, or our legitimate interest in answering.
  • When you report a testimonial, your name, email address, reason and message: to decide on the report and tell you the outcome. The basis is our legal obligation under the EU Digital Services Act.
  • The email address of someone warned for reporting in bad faith, in a form that cannot be read back: to pause their reports. The basis is our legitimate interest in stopping abuse of reports.
  • Addresses that asked not to be contacted, or that cannot receive mail, in a form that cannot be read back: so that no business using Dovalis contacts them again. The basis is our legitimate interest in respecting that.

Without your email address we cannot provide an account.

Who handles it for us

Your account's data is stored in the European Union, in Frankfurt, Germany. These companies handle it for us, each bound by a contract to protect it. Those outside the European Union, or owned from outside it, could reach it from there; standard contractual clauses protect it, and you can ask us for a copy.

  • Supabase

    The database, the logins and the stored files.

    Contracted company
    Supabase Pte. Ltd., Singapore.
    Where
    Frankfurt, Germany.
    Outside the EU
    Standard contractual clauses.

  • Vercel

    Hosting: it runs the application.

    Contracted company
    Vercel Inc., United States.
    Where
    The application runs in Frankfurt, Germany; pages pass through its network worldwide.
    Outside the EU
    Standard contractual clauses.

  • Resend

    Sending email, for Dovalis and for the businesses that use it.

    Contracted company
    Plus Five Five, Inc., United States.
    Where
    Ireland.
    Outside the EU
    Standard contractual clauses.

  • Cloudflare

    The dovalis.com domain name, and passing on email sent to Dovalis's own addresses.

    Contracted company
    Cloudflare, Inc., United States.
    Where
    Its network, worldwide.
    Outside the EU
    Standard contractual clauses.

  • Amazon Web Services

    Receiving the copies of emails a business sends to its Dovalis address in Bcc: their envelope, headers and checks, never their content.

    Contracted company
    Amazon Web Services EMEA SARL, Luxembourg.
    Where
    Frankfurt, Germany.
    Outside the EU
    Standard contractual clauses.

  • Stripe

    Charging for paid plans: the paying business's billing details and how it pays. Never testimonials.

    Contracted company
    Stripe Payments Europe, Limited, Ireland.
    Where
    The European Union and the United States.
    Outside the EU
    Standard contractual clauses.

  • StartCo

    Issuing Dovalis's invoices and sending them to the Romanian tax authority: the paying business's billing details. Never testimonials.

    Contracted company
    STARTCONTABILITATE S.R.L., Romania.
    Where
    Romania.
    Outside the EU
    Not sent outside the EU.

Standard contractual clauses: the European Commission's clauses in each company's contract with us, which protect the data outside the European Union.

The same list is on its own page. A paying business's tax or VAT number is checked in the public register: ANAF's for a Romanian company, the EU's VIES for one elsewhere in the EU. Invoices are also reported to the Romanian tax authority (ANAF), as Romanian law requires.

Mail sent to our own addresses is forwarded to an inbox at Yahoo (Yahoo International Limited, Ireland), part of a group based in the United States.

How long we keep it

  • Your account's data: for as long as the account exists. When it is deleted, everything is deleted except invoices and payment records; the business's short name, so an old link never opens another business; and a record of the deletion, for 24 months.
  • Invoices and payment records: 5 years from 1 July of the year after the financial year they belong to, as Romanian accounting law requires.
  • A sign-up that is never confirmed: 7 days.
  • An early-access address that is never confirmed: 7 days. A confirmed one: until we tell you that Dovalis has opened, or until you withdraw.
  • Emails to our addresses: for as long as the conversation needs.
  • The record of actions in an account: at most 24 months.
  • The network address and time of each request, at our hosting and login providers: at most 7 days.
  • The record of what our staff did: 24 months, or longer only while a decision it records still applies.
  • A reporter's name and email address: 6 months after the report is closed.
  • The address of someone warned for reporting in bad faith: 12 months after the warning, and any pause of their reports, have ended.
  • Addresses that no business may contact: for as long as Dovalis runs, also after the account that added them is deleted. An address that asked one business to stop goes when that business's account is deleted.
  • Backups: something deleted leaves our backups within 30 days.

Your rights

You can ask to see your data, to correct it, to delete it, to restrict its use, or to receive it in a common format. Write to support@dovalis.com from the email address it concerns. You can also complain to the Romanian data protection authority (ANSPDCP) or to the one where you live.

Your right to object

You can object at any time to what we do in our legitimate interest, listed above. Write to support@dovalis.com, and we stop unless the law allows us to continue.