Privacy Policy
This policy explains what personal data Darwa handles across our website, accounts, workspaces, cloud services, professional email, AI features, integrations, billing, and support.
- We do not sell personal data, use it for third-party advertising, or train models on your content.
- We are a controller for account and business data, and a processor for customer content in hosted applications, mailboxes, storage, databases, analytics, and AI tools.
- Essential cookies keep the service working. Optional Google Analytics, Mixpanel, and Microsoft Clarity technologies are disabled until you allow analytics.
- Analytics enabled by a customer on its own website is separate; that customer controls the data and must provide any required notice or consent.
- You may request access, correction, deletion, restriction, objection, or portability, subject to applicable law.
1. Scope and our role
Zevello, Inc. is the legal entity and data controller for the Darwa product and for personal data used to operate our website, accounts, workspaces, billing, support, security, referrals, startup program, and business. When you decide what personal data is placed in a hosted application, database, bucket, mailbox, customer analytics property, or AI feature, you are the controller and Darwa is your processor. That processing is governed by the Data Processing Addendum and your instructions.
This policy does not govern personal data collected independently by a customer application or by a third-party website or product you choose to use. Those parties provide their own privacy notices.
2. Personal data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account and profile | name, email, account type, country, industry, developer role, experience level, goals, password hash, provider identity | Create, personalise, administer, and secure your account |
| Workspace and team | workspace and legal name, slug, website, team size, deployment interests, member roles, invitations, default region, currency, and security settings | Operate the workspace, apply permissions, and provide selected services |
| Authentication and security | IP address, device and browser details, session and CSRF identifiers, sign-in events, MFA status, security and abuse signals | Authenticate requests, prevent fraud and abuse, and investigate incidents |
| Billing and transaction | plan, term, usage, invoices, billing contact, tax identifiers, payment status, Stripe customer and payment-method tokens, card brand, expiry, country, and last four digits | Process payments, administer subscriptions and credits, prevent fraud, and meet accounting obligations |
| Referral program | referral code, referring and referred workspace, referral date, IP address, device and browser, purchase eligibility, earnings, and withdrawal status | Attribute referrals, prevent self-referral and fraud, verify qualifying purchases, and process reward withdrawals |
| Source connections | Git provider, external account identifier and name, scopes, encrypted access credential, repository, branch, webhook event, commit SHA and author | Connect repositories, build code, and attribute or trigger deployments |
| Cloud service and operational | projects, service type, configuration, environment variables and secret files, region, domain and DNS records, deployment events, logs, metrics, traces, alerts, backups, request timing, resource use, and audit events | Provision, operate, monitor, secure, bill, troubleshoot, back up, and delete services |
| Professional and transactional email | domains, DNS verification, mailboxes, aliases, forwarding targets, contacts, settings, spam rules, message headers, sender and recipient, message content and attachments, delivery events, suppressions, and storage use | Send, receive, store, search, secure, and troubleshoot email |
| AI and browser tools | prompts, visible conversation messages, selected files or email thread context, tool inputs and outputs, saved memories, generated suggestions, model, token use, AI credit transactions, and visual-builder canvas data | Provide the AI or visual feature you invoke, retain your saved work, enforce limits, and calculate usage |
| Customer web analytics | pseudonymous visitor and session identifiers, page ID, path, title, referrer, country, device class, language, duration, event name, properties, and timestamps | Provide analytics to the customer that enabled Darwa Analytics on its website |
| Applications and enquiries | contact form details; startup company, founder, funding, team, cloud spend, provider, service interests, migration timeline, application status, notes, IP hash, and device information | Respond to enquiries and assess, administer, and protect application programs |
| Support and communications | messages, call or ticket details, feedback, attachments, and communication preferences | Respond to you and keep a record of support and legal requests |
| Darwa website and product analytics | browser identifier, page, interaction, referrer, country, device class and performance information; for signed-in users, Darwa user ID and profile attributes | Understand and improve Darwa through optional, consent-based Google Analytics, Mixpanel, and Microsoft Clarity |
Stripe collects full payment-card details directly through its payment components; Darwa does not receive or store the complete card number or security code. We do not intentionally request special category or highly sensitive personal data for account administration. If your hosted application processes such data, it is customer content handled under the DPA.
3. Where personal data comes from
- Directly from you when you register, configure a service, pay, submit a form, or contact support.
- Automatically from your browser, device, and use of the website or platform.
- From your organisation administrator or another user who invites you to a workspace.
- From a referral link or code you use when creating your first workspace.
- From GitHub, GitLab, Bitbucket, or another provider when you ask us to connect that account.
- From payment, identity, fraud-prevention, or infrastructure providers involved in a transaction or service.
- From senders, recipients, website visitors, and other people who interact with a service you operate.
- From DNS, certificate, delivery, monitoring, and abuse systems used to operate a domain or workload.
- From public authorities or other parties where necessary to respond to abuse, security, or legal matters.
We do not purchase personal profiles from data brokers.
4. Why we use personal data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create accounts; provide hosting, databases, storage, domains, deployments, and support; process requested transactions | Necessary to perform our contract with you or take steps you request before entering one |
| Authenticate users; protect accounts and infrastructure; detect fraud, spam, abuse, and security incidents; improve service reliability | Our legitimate interests in operating a secure, reliable platform and protecting Darwa, customers, and the public |
| Maintain financial, tax, dispute, and compliance records; respond to valid legal process | Compliance with legal obligations |
| Send service, security, billing, and policy notices | Performance of our contract, legal obligation, or legitimate interests, depending on the notice |
| Process customer content in hosting, databases, storage, email, analytics, and AI features | Performance of our contract and the customer's documented instructions as described in the DPA |
| Attribute and verify referrals, prevent self-referral or fraud, and administer earned reward withdrawals | Performance of the referral program and our legitimate interests in operating it fairly |
| Send optional marketing or use optional browser technologies, if offered | Your consent, which you may withdraw at any time |
| Establish, exercise, or defend legal claims and protect a person from serious harm | Legitimate interests, legal obligation, or vital interests as applicable |
Where we rely on legitimate interests, we consider necessity, proportionality, and the effect on your rights. We do not use personal data for a materially different purpose without identifying a valid basis and giving any notice required by law.
5. Customer content across Darwa services
Code, repositories, databases, buckets, files, environment values, secret files, build output, logs, backups, website analytics, email messages and attachments, contacts, prompts, AI conversations, saved memories, visual-builder graphs, and everything your workloads write are customer content. We process it to provide the selected service on your instructions.
Authorised personnel may access customer content when you request support, when reasonably necessary to operate or secure the platform, investigate abuse, restore or troubleshoot a service, or comply with law. Access is subject to role-based controls, confidentiality duties, and applicable audit logging. Workspace owners and authorised members control who can access content within their workspace.
We do not train models on your code, email, logs, prompts, or application data. When you invoke an AI feature, Darwa sends the selected prompt and relevant context to the configured model provider to generate the requested result. Model providers act as sub-processors under the terms described in our DPA.
6. Cookies and browser storage
Darwa does not use advertising cookies on the public website. Essential technologies operate without optional consent because they are necessary to provide requested functionality. Analytics technologies remain disabled unless you select “Allow analytics”:
| Technology | What it does | Duration |
|---|---|---|
| Authentication, security device, and CSRF cookies | Keep you signed in, authenticate API requests, protect forms and state-changing actions, and help prevent banned-account evasion | Session, the configured sign-in period, or up to one year for the security device cookie |
| Local storage | Remember your theme, browser-tool drafts, and a user-ID conversion marker that prevents duplicate affiliate signup reporting | Until you clear it or replace the saved preference, draft, or marker |
| Session storage | Carry account setup, invitation, referral, checkout verification, and project choices between steps | Until the browser tab or flow is closed or completed |
| Stripe payment technologies | Securely render payment fields, prevent fraud, and complete payment-method verification or checkout | Set by Stripe according to its privacy and cookie notices |
| Google Analytics, Mixpanel, and Microsoft Clarity | Measure website use, navigation, interactions, device class, and aggregate performance so we can improve Darwa | Only after consent; according to your cookie choice and the providers’ retention settings |
| Reditus affiliate attribution | Records a partner attribution identifier only when a visitor follows a Darwa affiliate link; it is not used to build an advertising profile | The referral window configured by Darwa |
Blocking essential cookies or browser storage may prevent sign-in, checkout, or multi-step setup from working. You can accept or reject analytics from the consent banner and change that choice later through “Cookie settings” in the website footer. Withdrawing consent does not affect prior lawful processing.
Names, providers, purposes, durations, and instructions for withdrawing consent are set out in our Cookie Policy.
The Darwa cookie banner controls analytics on Darwa's own website and product. It does not control the customer web analytics script that a workspace owner chooses to install on a customer-operated site. That workspace owner is responsible for providing its visitors with any notice, consent mechanism, or opt-out required by applicable law and for avoiding sensitive or directly identifying custom-event data.
7. Who receives personal data
We disclose only what is reasonably necessary to:
- Infrastructure and network providers that run compute, storage, delivery, and security services.
- Stripe and other payment, invoicing, tax, and fraud-prevention providers used for billing.
- Email and support providers that deliver account communications and support conversations.
- Email delivery and mailbox infrastructure providers used to transmit or store professional and transactional email.
- Google Analytics, Mixpanel, and Microsoft Clarity when you allow optional analytics on Darwa.
- Reditus when you arrive through a Darwa affiliate link, for referral attribution and commission administration.
- A referring workspace, which may see the referred workspace name and public identifier, referral date, eligibility status, and reward amount. We do not show the referrer your email, payment method, invoices, or application content.
- GitHub, GitLab, Bitbucket, DNS, certificate, domain, and other integrations you deliberately connect or use.
- Model providers when you deliberately trigger an AI feature.
- Professional advisers, auditors, insurers, or a prospective buyer during a financing, reorganisation, merger, or sale, subject to confidentiality and applicable law.
- Courts, regulators, law enforcement, or other parties when required by valid legal process, to protect rights or safety, or to investigate fraud, abuse, or security threats.
The current service-provider categories, purposes, and processing locations are listed in the DPA. We do not sell personal data, share it for cross-context behavioural advertising, or permit service providers to use it for their own advertising.
8. International transfers and data location
For services that offer regional placement, you choose an available region for the primary workload or data resource. A region choice does not necessarily locate account records, billing data, source metadata, DNS and edge processing, security telemetry, support records, email delivery metadata, backups, or third-party integrations in that same region. Those records may be processed in the US, EU, and other locations where authorised providers operate. Where required, international transfers rely on an adequacy decision, Standard Contractual Clauses, the UK Addendum, contractual safeguards, or another lawful transfer mechanism. Application data location and sub-processor commitments are described further in the DPA.
9. How long we keep personal data
- Authentication credentials and active source-connection tokens: until the account or connection is removed, then deleted or invalidated through the applicable deletion process.
- Application logs and traces: 7, 14, or 30 days depending on the selected plan.
- Customer web analytics events: for the retention period shown for that analytics property, currently 30 days by default.
- Operational metrics, audit events, security events, and delivery telemetry: for the period reasonably needed to operate, secure, troubleshoot, and document the service.
- Application backups: for the retention window shown on the selected plan.
- Email content, AI conversations, saved tool data, databases, files, and other customer content: while the resource is active, then through the deletion, recovery, or backup window applicable to that product.
- Suspended or cancelled resources: through the grace and deletion schedule shown in the product or account notice; different services use different schedules.
- Contact, support, startup-program, referral, and application records: while the matter or program is active and afterward as reasonably needed for follow-up, fraud prevention, disputes, and business records.
- Account, invoice, payment, tax, dispute, and compliance records: up to 7 years after closure where needed for law, accounting, fraud prevention, or legal claims.
Deletion from active systems may not immediately remove copies from encrypted backups; those copies age out under the applicable backup schedule and are not restored except for recovery or continuity. We may keep a de-identified aggregate that can no longer reasonably identify a person. A legal hold, security investigation, dispute, or regulatory requirement may extend a stated period; when it ends, the normal deletion process resumes.
10. How we protect personal data
We use administrative, technical, and organisational safeguards appropriate to the risk, including encryption in transit and at rest, access controls, tenant isolation, audit logging, credential protection, backups, monitoring, and incident response. No system is completely secure. You are responsible for protecting your credentials, configuring your application, and controlling workspace access as described in our Shared Responsibility Model.
11. Your privacy rights
Depending on where you live and the circumstances, you may have the right to:
- Know whether we process your personal data and receive a copy of it.
- Correct inaccurate data or complete data that is incomplete.
- Delete personal data, or restrict or stop certain processing.
- Object to processing based on legitimate interests and to direct marketing at any time.
- Receive data you provided in a portable format and ask us to transfer it where technically feasible.
- Withdraw consent without affecting processing that was lawful before withdrawal.
- Complain to a competent privacy or data-protection supervisory authority.
These rights are not absolute. For example, we may retain invoice records required by law or decline to disclose data that would adversely affect another person. We will explain any applicable limitation.
12. Automated processing
Darwa uses automated signals to detect abuse and fraud, protect sign-in, rate-limit activity, route support, measure resource use, and determine whether a transaction or referral meets published rules. These systems may delay, challenge, limit, or suspend activity. You may contact us to request human review of a material account or billing decision. Darwa does not use optional analytics or AI-generated content to make decisions producing legal or similarly significant effects about you.
13. How to make a privacy request
Use available dashboard controls or email privacy@darwa.co. Describe the account and the right you want to exercise. We may verify your identity and authority using information proportionate to the request; do not send identity documents unless we ask for them. An authorised agent may submit a request where local law permits, but we may require proof of authority and confirmation from you.
We respond without undue delay and generally within 30 days, or within another period required by applicable law. If a request is unusually complex, we will explain any lawful extension. We do not discriminate against anyone for exercising a privacy right. If we deny a request, you may reply to appeal and a person not involved in the initial decision will review it.
14. Children
Darwa accounts are not directed to anyone under 16, and we do not knowingly create accounts for them. Contact privacy@darwa.co if you believe a child provided account data to us, and we will investigate and take appropriate action.
15. Changes to this policy
We update the version, effective date, and updated date when this policy changes. Material changes are announced by email or in the dashboard before they take effect where reasonably possible and where law requires advance notice. Previous versions are available on request.
Contact
Darwa is a product and brand of Zevello, Inc., a C corporation headquartered in Newark, Delaware, United States. Written notice may be sent to legal@darwa.co. Finance, billing, and technical questions go to support@darwa.co. Security reports go to security@darwa.co. Privacy requests go to privacy@darwa.co.