Privacy Policy
1. Data Controller
Devi Devs Technologies S.R.L.
Registration: J40/13982/2023 · CUI: 48553919
Aleea Textiliștilor 7, Bl. MY12, Sc. 2, Et. 8, Ap. 63, Sector 3, București, România
General: contact@devidevs.com
Data protection: security@devidevs.com
DeviDevs acts as the Data Controller (GDPR Art. 4(7)) for all personal data processed through this Website.
2. Data We Collect
Data you provide directly
- Contact form: name, email, phone number, company name, message content
- Newsletter subscription: email address
- EU AI Act Risk Assessment: email address, quiz responses (AI system type, sector, risk factors), risk classification result, compliance readiness status
- GDPR requests: name, email address, request type and details
Data collected automatically
- Technical data: IP address, browser type and version, device type, operating system, referral URL
- Analytics data (with consent): page views, session duration, interactions, UTM campaign parameters
- Session recordings (with consent): Microsoft Clarity records clicks, scrolling, mouse movement and the pages you visit, together with your browser, device and country, and builds heatmaps and session replays from them
- Error reports: when a page or form on the site fails, Sentry receives a technical report about the error (see section 9)
- Cookie data: consent preferences, session identifiers (see our Cookie Policy)
3. Purpose, Legal Basis & Retention
| Category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact form data | Responding to inquiries, pre-contractual steps | Art. 6(1)(b) GDPR | 3 years from last interaction |
| Newsletter email | Sending updates, insights, and marketing | Art. 6(1)(a) GDPR (consent) | Until unsubscribe + 30 days |
| Risk assessment data | Providing EU AI Act risk classification, sending compliance checklist, follow-up consultation | Art. 6(1)(a) GDPR (consent via checkbox) | Until erasure request + 30 days |
| GDPR request data | Processing data subject requests | Art. 6(1)(c) GDPR (legal obligation) | 3 years (proof of compliance) |
| Analytics data | Website usage analysis, UX improvement | Art. 6(1)(a) GDPR (consent) | Google Analytics 4: event-level data 14 months, user-level data 14 months, reset on each new visit (our property settings) |
| Session recordings (Microsoft Clarity) | Seeing where visitors get stuck on a page, fixing layout and usability problems | Art. 6(1)(a) GDPR (consent) | 30 days; recordings we mark as favorites and a random sample kept by Microsoft up to 9 months |
| Website error reports (Sentry) | Finding and fixing pages or forms that stop working | Art. 6(1)(f) GDPR (legitimate interest in a working, secure site) | Up to 90 days |
| Email engagement | Monitoring deliverability | Art. 6(1)(f) GDPR (legitimate interest) | 12 months |
| Security logs | Rate limiting, abuse prevention, security monitoring | Art. 6(1)(f) GDPR (legitimate interest) | 12 months |
| Cookie consent choice | Remembering which cookie categories you accepted or refused | Art. 6(1)(c) GDPR (legal obligation) | 1 year, only in the cookie_consent_v2 cookie in your browser; no copy on our servers |
4. Data Processors (Sub-Processors)
We use the following third-party processors to provide our services:
| Provider | Service | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Database (PostgreSQL) | EU (Frankfurt) | N/A (EU data) |
| Upstash Inc. | Rate limiting (Redis) | EU (Frankfurt) | N/A (EU data) |
| Vercel Inc. | Website hosting (Next.js) | USA (Edge: global) | EU-US DPF + SCCs |
| Resend (Plus Five Five, Inc.) | Transactional email | USA | SCCs |
| Google LLC | reCAPTCHA + Analytics (GA4) | USA | EU-US DPF + SCCs |
| Microsoft Ireland Operations Ltd. | Session recordings and heatmaps (Microsoft Clarity), only with your consent | EU contract; data stored in Microsoft Azure, with transfers to Microsoft Corporation (USA) | SCCs |
| Functional Software, Inc. d/b/a Sentry | Website error monitoring | EU (Frankfurt, Germany); our Sentry account data in the USA | EU-US DPF + SCCs |
| Plausible Insights OÜ | Privacy-respecting analytics | EU (Estonia) | N/A (EU data) |
5. International Data Transfers
Some of our processors are located outside the EU/EEA. We ensure adequate protection through:
- EU-US Data Privacy Framework (DPF): For US-based providers certified under the framework (adequacy decision adopted July 10, 2023).
- Standard Contractual Clauses (SCCs): Commission Implementing Decision (EU) 2021/914, used as primary or supplementary safeguard for all US transfers.
- We do not transfer personal data to countries without an adequate level of protection unless one of the above safeguards is in place.
6. Your Rights (GDPR Chapter III)
As a data subject, you have the following rights under GDPR:
| Right | GDPR Article | Description |
|---|---|---|
| Access | Art. 15 | Obtain confirmation and a copy of your personal data |
| Rectification | Art. 16 | Correct inaccurate or incomplete data |
| Erasure | Art. 17 | Request deletion of your personal data |
| Restriction | Art. 18 | Restrict processing in specific circumstances |
| Portability | Art. 20 | Receive your data in a structured, machine-readable format |
| Objection | Art. 21 | Object to processing based on legitimate interest |
| Withdraw consent | Art. 7(3) | Withdraw consent at any time (does not affect prior processing) |
To exercise your rights: security@devidevs.com or use our GDPR request form. We respond within 30 days, extendable to 90 days for complex requests (with prior notification).
7. Security Measures
We implement appropriate technical and organizational measures (GDPR Art. 32) including:
- TLS 1.2+ encryption for all data in transit
- Nonce-based Content Security Policy (CSP) with strict-dynamic
- Rate limiting via Upstash Redis to prevent abuse
- Input validation and XSS protection (Zod schemas, entity escaping)
- reCAPTCHA v3 + honeypot fields for form abuse prevention
- Row Level Security (RLS) at database level
- HSTS with preload for enforced HTTPS
- Regular security reviews and dependency auditing
No system is 100% secure. We continuously improve our security posture.
8. Cookies & Analytics
- Consent-based: Google Analytics 4 and Microsoft Clarity load only after you accept analytics cookies in our banner. Before that, the site sends no request to Google Analytics or Clarity. You can withdraw consent at any time.
- Microsoft Clarity: records how the pages are used (clicks, scrolling, mouse movement, pages visited) so we can see what is hard to find or broken. Clarity sets the cookies _clck and _clsk on our domain and Microsoft may set its own cookies (such as MUID and CLID). Recordings are kept for 30 days; favorites and a random sample kept by Microsoft up to 9 months. See the Microsoft Privacy Statement.
- Privacy-respecting: We also use Plausible Analytics, which requires no cookies and collects no personal data.
- reCAPTCHA: Used for form abuse protection, subject to Google's Privacy Policy and Terms.
- Google signals (if enabled): allows Google to associate visit information with signed-in Google accounts. You can control this in Ads Settings and My Activity.
- Ads personalization: When allowed, GA audiences/events may be exported to linked Ads accounts. Disable via our banner or your Google settings.
For full details, see our Cookie Policy.
9. Error Monitoring (Sentry)
We use Sentry to learn when a page or a form on devidevs.com stops working, so we can fix it. Your browser sends data to Sentry only after an error happens on the page: the error report, or, for errors we ignore or that repeat, only their count.
For each reported error, from the browser or from our server, Sentry receives: the error message and where it happened in the code (file, line), and for server errors sometimes a few lines of the surrounding code; the page address without parameters (nothing after “?” or “#”); the site version; and the technical steps before the error, meaning page navigation and network requests, also without parameters. For browser errors Sentry also receives the User-Agent string (browser and operating system type and version) and the page elements you clicked or typed into, described by their HTML tag, id, classes and a few attributes, never the text you typed. For server errors it receives technical data about our server (name, operating system, processor, memory, time zone, software versions); the server also sends data about its own sessions, mostly aggregated totals, with no visitor data.
Before anything is sent, the site removes cookies, the referring page (Referer), the other request headers, request bodies (including form contents) and browser console messages, and does not add your IP address to the event. When your browser connects to Sentry, Sentry can see your IP address as part of the connection, but the site asks it not to infer it or attach it to the event. An error message can rarely contain a value involved in the error; we do not collect such data on purpose. We do not use session replay or performance measurement in Sentry.
Data is stored in the Sentry EU region (Frankfurt, Germany) and error reports are kept for up to 90 days. Legal basis: our legitimate interest in keeping the site working and secure (Art. 6(1)(f) GDPR).
10. Automated Decision-Making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Art. 22.
Our EU AI Act Risk Assessment tool uses rule-based logic (not AI or machine learning) to classify your AI system into risk categories based on your responses. This classification is informational only, has no legal effect, and does not constitute legal advice. The logic is deterministic (if/else rules derived from Regulation (EU) 2024/1689) and does not involve profiling.
11. Children's Data
Our services are not directed to individuals under 16 years of age (GDPR Art. 8(1), as maintained by Romania). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly.
12. Supervisory Authority
You have the right to lodge a complaint with the competent supervisory authority (GDPR Art. 77):
ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336, București, România
Email: anspdcp@dataprotection.ro
Website: www.dataprotection.ro
13. Legislative References
- General Data Protection Regulation (Regulation (EU) 2016/679)
- Romanian Law 190/2018 (GDPR implementation)
- Romanian Law 506/2004 (electronic communications data processing)
- ePrivacy Directive 2002/58/EC
- EU AI Act (Regulation (EU) 2024/1689)
- EDPB Guidelines 05/2020 (consent)
14. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated where practicable. The latest version will always be published on this page.
Version: v2.1.0 · Last updated: 2026‑09‑28