Privacy Policy
This policy explains what personal data Darwa handles when you visit our website, create an account, pay for or use a service, connect a provider, or contact us.
- We do not sell personal data, use it for third-party advertising, or train models on your content.
- We are a controller for account and business data, and a processor for data you place in hosted applications.
- Public-site analytics are cookie-free. Essential cookies and browser storage keep accounts, checkout, preferences, and setup flows working.
- You may request access, correction, deletion, restriction, objection, or portability, subject to applicable law.
1. Scope and our role
Zevello, Inc. is the legal entity and data controller for the Darwa product and for personal data used to operate our website, accounts, billing, support, security, and business. When you deploy an application and decide what personal data it processes, you are the controller and Darwa is your processor. That processing is governed by the Data Processing Addendum and your instructions.
This policy does not govern personal data collected independently by a customer application or by a third-party website or product you choose to use. Those parties provide their own privacy notices.
2. Personal data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account and profile | name, email, organisation, role, country, referral or invitation details, password hash, provider identity | Create, administer, and secure your account |
| Authentication and security | IP address, device and browser details, session and CSRF identifiers, sign-in events, MFA status, security and abuse signals | Authenticate requests, prevent fraud and abuse, and investigate incidents |
| Billing and transaction | plan, usage, invoices, billing contact, tax identifiers, Stripe customer and payment-method tokens, card brand and last four digits | Process payments, administer subscriptions, and meet accounting obligations |
| Referral program | referral code, referring and referred workspace, referral date, IP address, device and browser, purchase eligibility, earnings, and withdrawal status | Attribute referrals, prevent self-referral and fraud, verify qualifying purchases, and process reward withdrawals |
| Source connections | Git provider, account identifier, repository name, branch, commit SHA and author, encrypted connection credential | Connect repositories, build code, and attribute deployments |
| Service and operational | project configuration, region, domain, deployment events, logs, metrics, traces, request timing and resource use | Provide, monitor, troubleshoot, and improve the service |
| Support and communications | messages, call or ticket details, feedback, attachments, and communication preferences | Respond to you and keep a record of support and legal requests |
| Website use | page, referrer, country, device class and aggregate performance information | Understand public-site use through aggregate, cookie-free analytics |
Stripe collects full payment-card details directly through its payment components; Darwa does not receive or store the complete card number or security code. We do not intentionally request special category or highly sensitive personal data for account administration. If your hosted application processes such data, it is customer content handled under the DPA.
3. Where personal data comes from
- Directly from you when you register, configure a service, pay, submit a form, or contact support.
- Automatically from your browser, device, and use of the website or platform.
- From your organisation administrator or another user who invites you to a workspace.
- From a referral link or code you use when creating your first workspace.
- From GitHub, GitLab, Bitbucket, or another provider when you ask us to connect that account.
- From payment, identity, fraud-prevention, or infrastructure providers involved in a transaction or service.
- From public authorities or other parties where necessary to respond to abuse, security, or legal matters.
We do not purchase personal profiles from data brokers.
4. Why we use personal data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create accounts; provide hosting, databases, storage, domains, deployments, and support; process requested transactions | Necessary to perform our contract with you or take steps you request before entering one |
| Authenticate users; protect accounts and infrastructure; detect fraud, spam, abuse, and security incidents; improve service reliability | Our legitimate interests in operating a secure, reliable platform and protecting Darwa, customers, and the public |
| Maintain financial, tax, dispute, and compliance records; respond to valid legal process | Compliance with legal obligations |
| Send service, security, billing, and policy notices | Performance of our contract, legal obligation, or legitimate interests, depending on the notice |
| Attribute and verify referrals, prevent self-referral or fraud, and administer earned reward withdrawals | Performance of the referral program and our legitimate interests in operating it fairly |
| Send optional marketing or use optional browser technologies, if offered | Your consent, which you may withdraw at any time |
| Establish, exercise, or defend legal claims and protect a person from serious harm | Legitimate interests, legal obligation, or vital interests as applicable |
Where we rely on legitimate interests, we consider necessity, proportionality, and the effect on your rights. We do not use personal data for a materially different purpose without identifying a valid basis and giving any notice required by law.
5. Your application content
Databases, object storage, environment variables, code, prompts, logs, and everything your application writes are your content. We process it to provide the service on your instructions. We access content only when you request support, when reasonably necessary to secure the platform or prevent abuse, or when required by law. Staff access is authenticated, scoped, time-limited, and recorded.
We do not train models on your code, logs, prompts, or application data. An AI feature sends only the context needed to complete the request you trigger. Model providers are sub-processors and must handle that context under the terms described in our DPA.
6. Cookies and browser storage
Darwa does not use advertising cookies on the public website. Public-site analytics are aggregate and cookie-free. We do use technologies that are necessary to provide requested functionality:
| Technology | What it does | Duration |
|---|---|---|
| Authentication and CSRF cookies | Keep you signed in, authenticate API requests, and protect forms and state-changing actions | Session or the configured sign-in period |
| Local storage | Remember your theme and drafts created in browser-based tools | Until you clear it or replace the saved preference or draft |
| Session storage | Carry account setup, invitation, referral, checkout verification, and project choices between steps | Until the browser tab or flow is closed or completed |
| Stripe payment technologies | Securely render payment fields, prevent fraud, and complete payment-method verification or checkout | Set by Stripe according to its privacy and cookie notices |
Blocking essential cookies or browser storage may prevent sign-in, checkout, or multi-step setup from working. If we introduce optional analytics or advertising technologies, we will provide appropriate notice and controls before using them where consent is required.
7. Who receives personal data
We disclose only what is reasonably necessary to:
- Infrastructure and network providers that run compute, storage, delivery, and security services.
- Stripe and other payment, invoicing, tax, and fraud-prevention providers used for billing.
- Email and support providers that deliver account communications and support conversations.
- A referring workspace, which may see the referred workspace name and public identifier, referral date, eligibility status, and reward amount. We do not show the referrer your email, payment method, invoices, or application content.
- GitHub, GitLab, Bitbucket, and other integrations you deliberately connect.
- Model providers when you deliberately trigger an AI feature.
- Professional advisers, auditors, insurers, or a prospective buyer during a financing, reorganisation, merger, or sale, subject to confidentiality and applicable law.
- Courts, regulators, law enforcement, or other parties when required by valid legal process, to protect rights or safety, or to investigate fraud, abuse, or security threats.
The current service-provider categories, purposes, and processing locations are listed in the DPA. We do not sell personal data, share it for cross-context behavioural advertising, or permit service providers to use it for their own advertising.
8. International transfers and data location
You choose the available region where your application services run. Account, security, support, and billing data may be processed in the US, EU, and other locations where authorised providers operate. Where required, international transfers rely on an adequacy decision, Standard Contractual Clauses, the UK Addendum, contractual safeguards, or another lawful transfer mechanism. Application data location and sub-processor commitments are described further in the DPA.
9. How long we keep personal data
- Authentication credentials and active source-connection tokens: until the account or connection is removed, then deleted or invalidated through the applicable deletion process.
- Application logs and traces: 7 to 90 days depending on the selected plan.
- Metrics: aggregated for up to 13 months.
- Application backups: for the retention window shown on the selected plan.
- Deleted resources and customer content: purged within 30 days, including from backup media, unless law requires preservation.
- Closed-account content: available for export for 14 days, then deleted within a further 30 days.
- Account, invoice, payment, tax, dispute, and compliance records: up to 7 years after closure where needed for law, accounting, fraud prevention, or legal claims.
We may keep a de-identified aggregate that can no longer reasonably identify a person. A legal hold or regulatory requirement may extend a stated period; when it ends, the normal deletion process resumes.
10. How we protect personal data
We use administrative, technical, and organisational safeguards appropriate to the risk, including encryption in transit and at rest, access controls, tenant isolation, audit logging, credential protection, backups, monitoring, and incident response. No system is completely secure. You are responsible for protecting your credentials, configuring your application, and controlling workspace access as described in our Shared Responsibility Model.
11. Your privacy rights
Depending on where you live and the circumstances, you may have the right to:
- Know whether we process your personal data and receive a copy of it.
- Correct inaccurate data or complete data that is incomplete.
- Delete personal data, or restrict or stop certain processing.
- Object to processing based on legitimate interests and to direct marketing at any time.
- Receive data you provided in a portable format and ask us to transfer it where technically feasible.
- Withdraw consent without affecting processing that was lawful before withdrawal.
- Complain to a competent privacy or data-protection supervisory authority.
These rights are not absolute. For example, we may retain invoice records required by law or decline to disclose data that would adversely affect another person. We will explain any applicable limitation.
12. How to make a privacy request
Use available dashboard controls or email privacy@darwa.com. Describe the account and the right you want to exercise. We may verify your identity and authority using information proportionate to the request; do not send identity documents unless we ask for them. An authorised agent may submit a request where local law permits, but we may require proof of authority and confirmation from you.
We respond without undue delay and generally within 30 days, or within another period required by applicable law. If a request is unusually complex, we will explain any lawful extension. We do not discriminate against anyone for exercising a privacy right. If we deny a request, you may reply to appeal and a person not involved in the initial decision will review it.
13. Children
Darwa accounts are not directed to anyone under 16, and we do not knowingly create accounts for them. Contact privacy@darwa.com if you believe a child provided account data to us, and we will investigate and take appropriate action.
14. Changes to this policy
We update the version, effective date, and updated date when this policy changes. Material changes are announced by email or in the dashboard before they take effect where reasonably possible and where law requires advance notice. Previous versions are available on request.
Contact
Darwa is a product and brand of Zevello, Inc., a C corporation. Written notice may be sent to legal@darwa.com. Security reports go to security@darwa.com. Privacy requests go to privacy@darwa.com.