Privacy policy
Denby collects the personal data needed to run client portals: account details for firm staff, the client contacts and files firms add, and logs of who did what. We never sell it or use it for advertising. Firms control their clients' data; we process it on their instructions and delete it when they ask.
Denby is provided by Telezoid, Calicut, Kerala, India, which is the controller for the data described below as ours.
This policy explains what personal data Denby collects, why, how long we keep it and what rights you have. It covers the Denby website, the Denby app used by firms, and the client portals firms create. Questions go to privacy@denby.app.
Two kinds of data, two roles
Data about firms and their staff. When you sign up for Denby, we decide how that data is used, so we are its controller.
Data firms put into Denby about their clients. Client names, email addresses, files, messages and approvals belong to the firm. The firm is the controller; Denby is its processor and handles that data only to provide the service, under our data processing agreement. If you are a firm’s client, contact the firm first about your data; we will help them respond.
What we collect
- Account details: your name, email address, and a password hash if you set a password (we use Argon2id and never store the password itself). Two-step sign-in secrets are stored so we can check your codes.
- Firm details: your firm’s name, logo, colour, custom domain, plan and billing status.
- Client data added by firms: client and contact names, email addresses, phone numbers if added, files, messages, requests, approvals, invoices and form responses.
- Sign-in and activity records: the time, IP address and browser of sign-ins, uploads, downloads, approvals and settings changes. These form the audit log firms rely on.
- Email delivery records: which emails we sent, to whom and whether they were delivered or bounced.
- Billing records: your plan and subscription status. Card details are handled by our payment provider and never reach Denby.
- Website visits: counted with Cloudflare Web Analytics. It records pages viewed, referrers, country and browser type, without cookies or personal identifiers.
Why we use it
To provide the service you signed up for; to keep it secure, including detecting abuse and investigating incidents; to send the emails the product sends (sign-in links, reminders, notifications); to bill you; and to answer you when you contact us. The legal bases are performance of our contract with you and our legitimate interest in running a secure service. We do not use personal data for advertising and we do not sell it.
How long we keep it
- Firm and client data: for as long as the firm’s account exists. When a firm deletes its account, everything is permanently erased 30 days later.
- Deleted files: restorable for 30 days, then permanently removed.
- Audit records: 24 months, then deleted.
- Email delivery records: 12 months.
- Billing records: as long as tax law requires.
Who else processes it
We use a small number of providers for hosting, storage, database, email, billing and website analytics. Each is listed on our sub-processors page with what it does and where.
Where it’s stored
Denby stores data in the United States: the database in US East (Ohio), files in Cloudflare R2 in eastern North America, and files being virus-scanned on Google Cloud Run in US East (Ohio). If you’re outside the United States, your data is transferred there; where the law requires it, transfers are covered by standard contractual clauses. We don’t offer a choice of region yet.
Your rights
Depending on where you live, you can ask to see, correct, export or delete your personal data, object to or restrict how we use it, and complain to your data protection authority. Firm owners can export all of their firm’s data from Settings at any time. For anything else, email privacy@denby.app and we will reply within 30 days.
Cookies
The website sets no cookies. The app uses only the cookies needed to keep you signed in. Details are in our cookie policy.
Changes
If we change this policy in a way that matters, we will email firm owners before the change takes effect. The date at the top shows when it last changed.