Privacy Policy

This policy says what Deeevas ("Deeevas", "we") collects about you, why, and what you can do about it. The short version: we keep what the service needs to work, we do not sell it, and nothing you collect is shown to anyone outside the spaces it is in. If you appear in something a member collected and are not a member yourself, the Notice for Non-Users is for you.

Who we are

The controller of your data is Deeevas, NDSM-plein 90c
1033 WB Amsterdam. Privacy questions and requests go to [email protected].

What we collect

Your account

You sign in through Auth0, which gives us your email address, a display name, and an identifier for the provider you signed in with — Google, or an email and password Auth0 holds and we never see. Whether your email is verified is part of that.

What you collect

Everything you collect: the picture or file, the URL it came from, its title, the tags you give it, which space it is in, and when. Pictures are stored on our behalf by Amazon S3. This is the substance of the service, and it is private to the spaces it is in.

Device and log data

Like any web service we receive your IP address, browser, and the pages and requests you make, and keep them in server logs for a short time for security and to fix what breaks. We run no analytics beyond those logs.

If you ask for an invite

Deeevas is invite-only for now. If you ask for an invite from the front page, we keep the email address you give, and nothing else. We use it to decide on your request, and for one email, telling you you’re in. We keep the request after we decide, so that asking again doesn’t reopen it.

To keep bots off that form, it uses Cloudflare Turnstile, which looks at signals from your browser and your IP address to tell a person from a bot. It sets no tracking cookies.

Payment

If you subscribe to Plus, Stripe handles the payment. Stripe sees your card details; we never do. We keep your Stripe customer id and the status of your subscription, which is what the service needs to know what plan you are on.

How we use it

• To run the service: sign you in, keep what you collect, show it to you and to the members of your spaces, and find it by tag.
• To bill Plus, and to tell you when a payment fails.
• To send the emails the service sends: an invite to a space, the email telling you your invite request was accepted, a notice about your account. Never marketing.
• To keep Deeevas secure and to enforce the Terms of Service.
• To meet a legal obligation, or to respond to a valid request from an authority.

Where the GDPR applies, our legal bases are performing our contract with you, our legitimate interest in running a secure service, your consent where we ask for it, and compliance with the law.

Cookies

Deeevas sets two cookies of its own: the session cookie that keeps you signed in, and deeevas.scope, which remembers which space you last had open. A third remembers your theme if you set one. There are no advertising or tracking cookies, and no third-party cookies other than the ones Auth0 and Stripe need to do their part.

We do not sell or share

We do not sell your data and do not share it for advertising. It is processed by the services we build on, each only for its part:

• Auth0 — sign-in.
• Sanity — the database that holds your account and what you collect.
• Amazon Web Services (S3) — storage for pictures.
• Stripe — payment, for Plus.
• Resend — sending the emails the service sends.
• Cloudflare — Turnstile, telling a person from a bot on the invite request form.

We may also disclose data if the law requires it, to protect the rights or safety of a person, or to a successor if the service changes hands, in which case we will tell you.

Your choices

You can delete your account from the dashboard at any time; it deletes what you collected and every space you started. You can delete any item, or leave any space, whenever you like.

If you are in the European Economic Area, the United Kingdom or Switzerland you also have the right to access, correct, export, restrict or object to our processing of your data, and to complain to your data protection authority. Write to [email protected]; we answer within a month.

Age

Deeevas is not for anyone under 13, or under 16 where the law where you live sets that age. If you believe a child has an account, tell us at [email protected] and we will remove it.

How long we keep it

For as long as your account exists. When you delete an item or your account, it is removed from the service at once and from backups within 30 days. An invite request is kept until you ask us to delete it at [email protected]. Server logs are kept for up to 90 days. Billing records are kept as long as tax law requires.

Where data lives

Our processors run in the regions they run in, which may be outside the country you live in, including the United States. Where the GDPR applies, transfers rest on the European Commission’s standard contractual clauses or an adequacy decision.

Changes

We may update this policy. The date at the top says when it last changed in substance, and for a change that matters we will tell you by email or in the service.

Contact

Deeevas, NDSM-plein 90c
1033 WB Amsterdam. Privacy requests: [email protected]. Anything else: [email protected].