Privacy policy
Privacy policy
How the Dorelyo service handles personal data of visitors to dorelyo.com, users of the application at app.dorelyo.com, and people who contact us.
Version effective from 10 November 2026Slovenská verzia
This policy explains what personal data we process, why, on which legal basis, whom we share it with, how long we keep it and what rights you have. We process personal data in line with Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data.
Dorelyo is a tool for marketplace sellers: it gathers messages, orders, reviews and disputes from connected selling accounts into one inbox and helps answer them. For most of the data that flows through the application we are therefore not the controller but a processor acting on the seller’s instructions — section 2 explains the difference.
1.Controller and contact
The controller of personal data and the provider of the Dorelyo service is NOCONTI s.r.o., with its registered office at Sídlisko 168/38, 027 44 Tvrdošín, Slovak Republic, company ID (IČO): 57681031, tax ID (DIČ): 2122885897, registered in the Commercial Register of the Slovak Republic (“we” or the “Controller”).
For anything concerning personal data, write to [email protected] or to the registered office address. We have not appointed a data protection officer, as the law does not require one of us; requests are handled directly by the Controller.
2.The role in which we process data
As a controller
We are the controller of data about visitors to dorelyo.com, about customers who created an account at app.dorelyo.com, about the people who act for a customer or whom a customer invited into the application (operators, administrators, agency staff), and about anyone who contacts us. Sections 3 to 11 describe this processing.
As a processor
Messages, orders, reviews, claims and other data about buyers that reach the application from a customer’s connected marketplace accounts and mailboxes are processed on the customer’s behalf and instructions, as a processor within the meaning of Article 28 GDPR. The controller of that data is the customer (the seller). That processing is governed by the Data Processing Agreement, which is Appendix 1 to the Terms of Service.
If you are a buyer and wish to exercise your rights over data a seller holds about you in Dorelyo, contact the seller. If you write to us directly, we will pass your request to the relevant customer without undue delay and help them handle it.
3.What we process, why, and on which basis
An overview of the purposes for which we process data as a controller:
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account and provision of the service | e-mail, name, password (stored only as a hash), role and team, language and interface settings, invitations, login times and IP addresses | performance of a contract — Art. 6(1)(b) GDPR | for the term of the contract and 30 days after; login records 12 months |
| Connecting marketplaces and e-mail | access tokens and keys for external accounts (encrypted), shop identifier and name, connection settings | performance of a contract — Art. 6(1)(b) | while the connection is active; tokens are deleted on disconnection |
| Invoicing and payments | billing details (name, address, company and tax IDs), invoice e-mail, payment and invoice history; card details are handled solely by the payment provider — we never see or store them | performance of a contract — (b); legal obligation — (c) (accounting and VAT law) | 10 years from the end of the accounting period |
| Communication and support | e-mail, name, content of the message and attachments, communication history | performance of a contract — (b); for other people legitimate interest — (f) (answering the enquiry) | 3 years from the last communication |
| Security and abuse prevention | IP address, browser identification, technical and error logs, change records (audit log) | legitimate interest — (f) (security of the service, detecting and proving incidents) | 12 months |
| Website statistics | anonymous events without cookies (page and section shown, button clicked, language); the IP address is not stored | legitimate interest — (f) (knowing how the site is used) | aggregated, 24 months |
| Service news | customer e-mail | legitimate interest — (f) (telling existing customers about changes and new features), with the option to opt out at any time | until you opt out or the contract ends |
| Browser (push) notifications | browser push subscription identifier | consent — Art. 6(1)(a), given by allowing notifications in the browser | until withdrawn (revoke in the browser or in the application settings) |
| Establishing, exercising and defending legal claims | data from the purposes above, as far as necessary | legitimate interest — (f) | for the limitation period, usually 4 years |
The data needed to create an account and to invoice is a contractual requirement — without it we cannot provide the service. Any other data you provide voluntarily.
4.Data we process on behalf of customers
Data about a customer’s buyers and business partners flows through the application, in particular:
- messages and conversations from marketplaces (Allegro, Amazon, eBay, Kaufland, eMAG) and from connected mailboxes, including attachments,
- order data: the buyer’s name and address, contact details, items, payment, shipment status and tracking,
- ratings, reviews, claims, returns and disputes,
- internal notes, assignments and replies written by the customer’s operators.
We use this data solely to provide the service to the customer: to show it in the inbox, translate it, draft a reply, send the reply back to the marketplace and keep the history. We never use it for our own marketing, never sell it and never share it with other customers. Only the people the customer invited into their account can access it, within the permissions the customer set.
Data obtained through marketplace interfaces (for example the Amazon Selling Partner API or the Allegro REST API) is handled in line with the terms and security requirements of that platform: it is encrypted in transit and at rest, kept only as long as needed to handle customer communication, and used for no other purpose.
5.Artificial-intelligence features
Dorelyo uses language models to translate messages, draft replies, summarise conversations and determine the reason behind a review. For that, the text of the message and the necessary context (such as the order status) is sent through an API to the model provider named in section 7. Login details and payment details are never sent.
The model provider processes the data on our instructions as a processor, keeps it no longer than needed to handle the request and run the service, and does not use it to train its models. We store the results (translations, drafts) so the same text need not be processed again.
AI output is a suggestion. The decision to send a reply to a buyer is made by the customer’s operator; automatic template replies are switched on and configured by the customer. We make no automated decisions with legal effects for data subjects within the meaning of Article 22 GDPR.
7.Recipients and processors
We run the service with vetted suppliers who process data under an Article 28 GDPR agreement and only on our instructions:
| Supplier | For what | Where |
|---|---|---|
| Hetzner Online GmbH, Germany | servers, database and running the application | EU (Germany) |
| Cloudflare, Inc. (Cloudflare Germany GmbH), USA/EU | storage of attachments and backups, network protection and DNS | EU data locations; transfers covered by the EU-US Data Privacy Framework and standard contractual clauses |
| OpenAI Ireland Ltd. / OpenAI, L.L.C., Ireland/USA | language models for translations, drafts and summaries (section 5) | EU/USA; EU-US Data Privacy Framework and standard contractual clauses |
| Stripe Payments Europe, Ltd., Ireland | card payments, subscriptions and invoices | EU; for payment data Stripe is an independent controller |
| Functional Software, Inc. (Sentry), USA | recording technical errors of the application, where enabled | USA; EU-US Data Privacy Framework |
| e-mail delivery provider | transactional e-mail (invitations, notifications, invoices) | EU |
| accounting, tax and legal services | statutory duties and defence of claims | Slovak Republic / EU |
Marketplace operators (Allegro, Amazon, eBay, Kaufland, eMAG) and mailbox providers are independent controllers. We pass data to them only when the customer, through the application, sends a reply or performs another action in their account on that platform.
We disclose data to public authorities only to the extent and under the conditions the law requires. The current list of processors we use for data processed on behalf of customers is part of the Data Processing Agreement; customers are notified of changes in advance.
8.Transfers outside the European Economic Area
Data is stored on servers in the European Union. Transfers outside the EEA happen only with the US-based suppliers listed in section 7, on the basis of a European Commission adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses under Article 46(2)(c) GDPR with supplementary measures (encryption in transit and at rest, minimisation of the data sent). A copy of the safeguards is available on request.
9.Retention and deletion
We keep data only for the periods in section 3. After the contract ends, the customer has 30 days to export their data; then we delete the account and the data processed on its behalf, except what we must keep by law (chiefly accounting records) or need to defend legal claims.
Database backups are kept for 30 days and then rotated; data deleted from the application therefore leaves the backups within 30 days at the latest. We restore from backups only after a failure.
10.Security
We have put in place technical and organisational measures appropriate to the risk, in particular:
- encryption in transit (TLS) on the website, in the application and towards marketplaces and suppliers,
- passwords stored only as hashes using a resistant function; access tokens for external accounts encrypted at rest,
- access to a customer’s data governed by roles and permissions the customer sets; ticket status and settings changes written to an audit log,
- separate environments, production access limited to the people who need it and only by key, regular updates,
- regular backups kept off the primary server, and recovery procedures,
- availability and error monitoring.
Should a personal data breach occur that is likely to pose a risk to people’s rights and freedoms, we will notify the Slovak data protection authority within 72 hours and the affected customers without undue delay, together with the nature of the incident and the measures taken.
11.Your rights
In relation to the processing of your personal data you have the right:
- to access the data we hold about you and to obtain a copy (Art. 15 GDPR),
- to have inaccurate or incomplete data rectified (Art. 16),
- to erasure, where the data is no longer needed, you withdrew consent, you objected, or the processing was unlawful (Art. 17),
- to restriction of processing (Art. 18),
- to portability of the data you gave us and that we process under a contract or consent, in a machine-readable format (Art. 20),
- to object to processing based on legitimate interest, including direct marketing — for marketing we always honour the objection (Art. 21),
- to withdraw consent at any time where processing rests on it; withdrawal does not affect the lawfulness of earlier processing.
To exercise your rights, e-mail [email protected]. We reply without undue delay and within one month at the latest; for complex requests we may extend this by two further months and will tell you so. We may verify your identity before acting on a request.
If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk. You may also complain to the supervisory authority in the member state of your habitual residence.
12.People under 16
The service is intended for businesses and their staff. We do not knowingly process data of people under 16; if we learn of such processing, we delete the data.
13.Changes to this policy
We may update this policy when the service, our suppliers or the law change. The current version with its effective date is always published on this page. We tell customers about material changes in advance by e-mail or a notice in the application.