# Privacy Policy

Last updated: 12 October 2026

Data controller: DOBIFY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Twardowskiego 19, 05-070 Sulejówek, KRS 0001204127, NIP (tax ID) 8222420250, [contact@dobify.dev](mailto:contact@dobify.dev)

This Privacy Policy explains how DOBIFY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ collects, uses and protects your information when you use our website and services. We are the controller of this data. Our address and registration numbers are at the top of this page. For anything about your personal data, email [contact@dobify.dev](mailto:contact@dobify.dev).

## 1. Information we collect

We collect the information you give us directly, for example when you fill out a form, request an audit or contact us. This may include your name, email address, phone number and company name. Only if you agree, we also collect information about how our website is used: analytics without cookies (section 7) and advertising measurement with cookies (section 8).

## 2. How we use your information

We use what you send through the form or by email to reply to your enquiry, run the free audit and prepare a quote. The legal basis is taking the steps you ask for before we sign a contract (Art. 6(1)(b) GDPR). If you write on behalf of a company, it is also our legitimate interest in corresponding with that company (Art. 6(1)(f) GDPR).

Once we sign a contract, we process the data to perform it (Art. 6(1)(b) GDPR), to issue invoices and keep our accounts (Art. 6(1)(c) GDPR) and to defend against possible claims (Art. 6(1)(f) GDPR).

We send marketing messages only if you ask for them or agree to them.

Giving us your data is voluntary. Without your name and email address, though, we cannot reply to your enquiry.

How long we keep the data:

- an enquiry that did not lead to a contract: up to 12 months after our last contact
- data related to a contract: for as long as it runs, then until claims under it are time-barred
- invoices and accounting records: for 5 years from the end of the year in which the tax payment was due (Polish tax law requires this)

## 3. Information sharing

We do not sell your personal information. We share it only with providers who help us run our business:

- OVH SAS (Roubaix, France): our main servers in France, which run the website, the form, our automations and the solutions we build for clients
- Hetzner Online GmbH (Gunzenhausen, Germany): a secondary server in Germany
- Apple Distribution International Ltd. (Cork, Ireland): email (iCloud)
- PostHog Inc.: website analytics, only with your consent (section 7)
- Google Ireland Limited: advertising measurement, only with your consent (section 8), and the Gemini API in the comment assistant (section 6)

Form enquiries go to our automation server at OVH. Data in the solutions we build for clients stays in tools we run ourselves on OVH and Hetzner servers in the European Union.

Some data may leave the European Economic Area:

- Google may transfer data to Google LLC in the USA. Google LLC takes part in the EU-US Data Privacy Framework, which the European Commission has found to give adequate protection.
- Apple stores iCloud data mainly with Apple Inc. in the USA, under standard contractual clauses approved by the European Commission.

## 4. Data security

We take reasonable security measures to protect your information. No way of sending data over the internet is 100% secure, though, so we cannot guarantee absolute security. If you find a bug or a security vulnerability, report it to [contact@dobify.dev](mailto:contact@dobify.dev).

## 5. Your rights

You have the right to:

- access your data and get a copy of it
- have it corrected
- have it deleted
- restrict how we process it
- receive the data you gave us in a portable form, where we process it based on consent or a contract
- object to processing based on our legitimate interest
- withdraw your consent at any time. This does not affect processing that happened before you withdrew it.

To use these rights, email [contact@dobify.dev](mailto:contact@dobify.dev). We reply within one month.

You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

We do not make decisions about you based solely on automated processing, including profiling.

## 6. Facebook and Instagram data we process for our clients

Dobify runs an [AI comment assistant](/en/solutions/ai-comment-assistant/) that replies to and moderates comments on the Facebook Pages and Instagram accounts of the businesses we work for. For this data, the business is the controller. Dobify processes it on the business's behalf, under a data processing agreement.

What we process:

- the text of the comment
- the author's public name
- the author's Facebook or Instagram user ID
- the IDs of the comment and of the post it was left under
- the text of the replies we send, in public or as a private message

We use this data only to reply to and moderate comments on the business's behalf. We do not sell it, we do not use it for advertising, and we do not combine data from different clients.

Two processors help us do this: Google, whose Gemini API writes the text of the replies, and OVH SAS, which hosts our automation server in France.

We delete this data automatically 30 days after we handle the comment, or when our work for that business ends, whichever comes first.

To ask us to delete data about you, email [contact@dobify.dev](mailto:contact@dobify.dev) with your profile name and a link to the comment, or contact the business whose post you commented on. We reply within 30 days. The [data deletion instructions](/en/data-deletion/) walk through it step by step.

## 7. Website analytics (PostHog)

We use PostHog to understand how visitors move through this website: which pages they read, where they come from and which buttons they click. The provider is PostHog Inc. (San Francisco, USA). We use PostHog Cloud EU, which stores the data on servers in Frankfurt, Germany.

PostHog loads only after you click "Accept" in the banner. It runs in cookieless mode and stores nothing on your device: no cookies, no local storage and no session storage.

What we collect:

- the pages you view and the page you came from (the referrer)
- your browser, operating system and device type
- how fast pages load
- clicks on links and buttons, and the fact that a form was sent, without what you typed into it

To count visitors without cookies, PostHog's servers combine your IP address and browser details with a random value that changes every day, and turn them into a code that cannot be reversed. PostHog deletes the daily value once that day's data has been processed. The IP address is removed before the data is stored, so we do not know your location. We do not build visitor profiles, we do not try to identify you, and we do not record sessions.

The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). You withdraw it the same way as consent to advertising measurement (section 8). PostHog keeps the collected events for 12 months and then deletes them.

## 8. Advertising measurement (Google Ads)

We advertise on Google and measure which ads lead to visits and audit requests. For this we use the Google tag for Google Ads, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

The Google tag loads only after you click "Accept" in the cookie banner. Once loaded, it sets cookies and sends Google information such as the address of the page, the identifier of the ad click that brought you here, and details of your browser and device. Google Ads cookies (such as _gcl_au) expire after 90 days. Google removes part of the IP address from its advertising logs after 9 months and cookie information after 18 months. Google may transfer this data to the USA (section 3).

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: click "Cookie settings" at the bottom of any page and choose "Reject". Withdrawing consent does not affect measurement made before you withdrew it. We save your choice in your browser's local storage so that the banner does not ask again on every page.

## 9. Server logs

The server that hosts this website keeps technical logs of requests: the time, the page requested, your browser type (User-Agent) and the page you came from (the referrer). It does not write your IP address or ad click identifiers (such as gclid) into them, so an entry cannot be linked to you. We use these logs to keep the website secure and running and to count visits from search engine crawlers.

Before a request reaches the website, it passes through a reverse proxy on our server at OVH. Its technical logs may contain your full IP address. We use them only to protect against attacks and to fix failures, based on our legitimate interest (Art. 6(1)(f) GDPR).

Both kinds of logs have a fixed size limit: once it is reached, the oldest entries are deleted automatically.

## 10. Contact us

If you have questions about this Privacy Policy, email us at [contact@dobify.dev](mailto:contact@dobify.dev).

---

How Dobify handles your data: what we collect, why we collect it, how long we keep it, who we share it with, and the GDPR rights you can exercise at any time.

Source: https://dobify.dev/en/privacy-policy/