Privacy Policy

Authentication & Identity

Davomo uses Clerk as our authentication provider. When you create an account or sign in, Clerk collects your email address, name, profile picture, and OAuth tokens from Google or Apple (depending on your sign-in method). Authentication sessions are maintained using JWT tokens stored in httpOnly cookies.

Payments

Payment processing is handled by Stripe. When you subscribe to a paid plan, Stripe collects your payment card details and billing address directly. Davomo does not store your card numbers or sensitive payment information on our servers. Stripe's handling of your payment data is governed by the Stripe Privacy Policy.

Video & Media Processing

Videos and media files you upload are stored in Cloudflare R2 (US region). When you use AI-powered features, your media may be sent to third-party services for processing:

• OpenAI — for AI captions and smart trim analysis
• AssemblyAI — for speech transcription

Rendered video exports are also stored in Cloudflare R2. These services process your media as needed to deliver the requested features and do not retain your content beyond the processing period.

Social Platform Connections

When you connect social media accounts (TikTok, Instagram, YouTube, or Facebook), we store encrypted OAuth tokens to enable publishing on your behalf. Publishing a video requires sharing your video content with the respective platform. You can disconnect any platform at any time from your account settings, which revokes the stored tokens.

Analytics & Error Tracking

We use Sentry for crash reporting and error tracking. Sentry collects error context, device information, and IP addresses when errors occur. We apply PII filtering to minimize personal data sent to Sentry. We do not currently use any third-party analytics or advertising trackers.

Data Storage & Infrastructure

Your data is stored across the following infrastructure, all hosted in US regions:

• PostgreSQL on DigitalOcean — account data, projects, timelines, and metadata
• Redis on DigitalOcean — session data and temporary cache
• Cloudflare R2 — uploaded media files, rendered exports, and thumbnails

Data Retention

• Account data — retained until you request deletion
• Exported videos — retained for 30 days after export, then automatically deleted
• Audit logs — retained for 1 year for compliance purposes
• Media files — deleted when the associated project is deleted

Your Rights (GDPR/CCPA)

You have the following rights regarding your personal data:

• Right to access — download your data via "Download My Data" in Settings
• Right to deletion — delete your account via Settings > Security
• Right to portability — export your data in JSON format
• Right to opt-out — manage email preferences at /unsubscribe

We do not sell your personal data. We do not use your data for advertising purposes.

Subprocessors

The following third-party services process data on our behalf:

Contact

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected].