Privacy Policy
Last updated: October 21, 2026 · How we safeguard your data and protect your operational privacy
Zero Data Monetization & Zero Stored Payment Card Credentials
Duevora never sells your information, displays third-party advertising, or tracks your activity across other websites. All payments are securely tokenized by licensed PCI-compliant payment gateways.
1. Information We Collect
We collect only the minimum information necessary to provide, protect, and maintain Duevora:
- Account Information: When you register, we collect your name, email address, password hash, and optional profile image. If you authenticate via Google or GitHub OAuth, we receive your verified email and name from those providers.
- Operational Workspace Data: Information you enter into Duevora to operate your business, including client names and contact info, renewal deadlines, service categories, itemized quotes, deliverables, and project milestones.
- Technical & Security Logs: IP addresses, request timestamps, user-agent strings, and security event logs (such as failed authentication attempts or password updates) for threat detection and abuse prevention.
2. Payment & Financial Data Security
When you purchase a subscription or add-on:
- Payment Processors: Transactions are handled directly by authorized, PCI-DSS certified third-party payment processors.
- Zero Card Storage: Your full credit card numbers, expiration dates, CVVs, and banking passwords never pass through or touch Duevora’s application servers or databases.
- Stored Billing Records: We only store metadata returned by the provider needed for entitlement verification (such as transaction references, plan name, payment status, currency, and renewal timestamps).
3. Cybersecurity Protections & Data Safeguards
Duevora employs strict technical and organizational measures to prevent unauthorized data access:
Strict Multi-Tenant Isolation
All database queries strictly filter by account owner ID. No cross-tenant data leakage or enumeration is possible.
Encryption in Transit & at Rest
All traffic is enforced over TLS/HTTPS with HSTS. Passwords and sensitive tokens are hashed and encrypted using modern cryptographic standards.
Two-Factor Authentication (2FA)
Accounts can enable TOTP-based 2FA (Google Authenticator, 1Password, Authy) with emergency recovery codes.
Automated Defense & Rate Limits
Endpoints enforce throttles against brute-force attacks, credential stuffing, and unauthorized scraping.
4. How We Use Your Data
We process your data strictly to:
- Deliver your automated renewal reminder emails at 30 days, 7 days, and 1 day before expiration.
- Provide you with client directory records, quotes, project boards, and deliverable reviews.
- Verify your subscription plan entitlements and usage quotas.
- Maintain the security, operational integrity, and performance of the Service.
5. Cookies & Local Storage
Duevora uses essential cookies only:
- Session Cookie: An encrypted session identifier allowing you to stay securely signed in.
- CSRF Cookie: A token to protect against Cross-Site Request Forgery attacks.
- No Third-Party Ad Trackers: We do not load advertising trackers, behavioral profiling scripts, or marketing cookies.
6. Data Portability & Account Deletion
You maintain total control over your data:
- One-Click CSV Export: Export your full client records and tracked renewal schedules at any time from your settings.
- Account Deletion: You can delete your account permanently in Account Settings. Once confirmed, all your clients, renewals, quotes, projects, and personal data are permanently purged from active databases.
7. Security & Privacy Contact
If you have any questions or data privacy requests, contact us directly:
Data Protection Officer & Security Contact
Email: itsjmlahorra@gmail.com