Privacy Policy (DRAFT)
Who is responsible
Dev-Harbour EOOD is the controller of the personal data described here. Contact: office@dev-harbour.com.
This policy covers this marketing website only. The ClientCore apps have their own privacy policy.
What we collect
When you use the contact form we collect only what you type into it:
- Name
- Work email
- Organisation
- Message
Abuse protection
To limit spam and automated abuse, the contact endpoint stores a SHA-256 hash of your IP address (never the address itself) together with a request counter and time, and uses it to throttle repeated submissions. A hash of an IP address is pseudonymised, not anonymous, so we treat it as personal data.
Cookies and analytics
This website does not use cookies. There is no analytics, advertising or tracking software on it. The only thing kept in your browser is your light or dark theme choice, stored locally on your device and never sent to us.
Why we use it, and who receives it
We use your contact form details only to read and answer your message (legitimate interest in replying to business enquiries, GDPR Art. 6(1)(f), or steps at your request before a contract, Art. 6(1)(b)). We do not sell personal data.
Your message is not stored by the website. It is delivered by email through Brevo (our email delivery provider) to office@dev-harbour.com. Our processors are: Firebase Hosting (Google) for the website, Google Cloud Functions and Firestore (Google) for the contact endpoint and the hashed throttle counter, and Brevo for email delivery. Our contact function runs in Frankfurt (Google Cloud region europe-west3). Each provider processes data on our behalf under its standard data processing terms.
How long we keep it
Contact messages live in our office mailbox and in Brevo's own delivery logs. We keep an enquiry for as long as we need it to answer you and to keep ordinary business records, then delete it; you can ask us to delete it earlier. Brevo keeps its delivery logs for the period set by its own retention settings.
The hashed IP throttle counters are short-lived abuse-protection records. They are not currently deleted automatically; they hold no name, email or message, only a hash, a counter and a time.
Your rights
You can ask us at office@dev-harbour.com for access to your data, for its correction or erasure, or object to our use of it. You can also complain to the Bulgarian Commission for Personal Data Protection (КЗЛД, Комисия за защита на личните данни), www.cpdp.bg, or to the authority in your own country.