Legal · Dobi by Veyra
Privacy Policy
In short
- You can ask to see, correct or delete your data. Email george@veyraconsult.com and a real person will help.
- We collect only what we need to sell, run and support Dobi.
- We never sell personal data. Our website only uses advertising cookies if you accept them.
- This policy covers our website visitors, enquiries, buyers and client account users.
- Met Dobi on another company's website or app? That company controls your data. Please contact them first (section 9). If you can't reach them, we'll pass your request on.
- We keep contract and invoice records for 6 years, as tax law requires.
- If you are unhappy, please tell us so we can put it right. You can also complain to the ICO, the UK data protection regulator.
This summary is not the full policy. Please read the sections below for detail.
1. Who we are
1.1Dobi is provided by Veyra Ltd ("Veyra", "we", "us"), a company registered in England and Wales.
1.2For the personal data described in section 3, we are the controller. You can contact us about privacy at george@veyraconsult.com.
1.3We have not appointed a Data Protection Officer, as the law does not require us to. Privacy questions are handled personally by a director.
2. What this policy covers
2.1This policy covers personal data about:
- visitors to our Dobi website;
- people who enquire, book a call or otherwise contact us (leads);
- people who buy Dobi for their business, and their billing contacts;
- our clients' team members who use the Dobi Portal; and
- people who contact us for support.
2.2It does not cover data about people who use Dobi on our clients' websites and apps ("end users"). For that data, our client is the controller and we act only on its instructions. See section 9.
3. What we collect and why
3.1The table below shows what we collect, why, and the lawful basis we rely on.
| Who | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Website visitors | Technical data that comes with any web request, such as IP address, browser type and pages requested, handled by our hosting provider. | To deliver the website and keep it secure. | Legitimate interests (running a secure website). |
| People who chat with Dobi on our own website | What you type to Dobi, Dobi's replies, the page you were on, how you reached our site (for example a search engine or a link), your device and browser type, rough location (country or city) from your connection, and an email if you choose to leave one so we can reply. | To answer your questions about Dobi, fix problems you report, reply if you asked us to, and improve our website. | Legitimate interests (helping visitors and improving our product); consent for any email you choose to leave. |
| Enquiries and call bookings | Name, email, phone number, company, the time you book, and anything you tell us. | To reply, hold the call, and follow up about Dobi. | Legitimate interests (responding to business enquiries), or steps before a contract. |
| Buyers and billing contacts | Name, business name and address, work email, phone, plan bought, invoices and payment history. Card details are handled by Stripe; we do not see full card numbers. | To take payment, issue invoices, send renewal reminders, and manage the contract. | Contract. Legal obligation (tax and accounting records). |
| Portal users | Name, work email, log-in details (passwords are stored hashed), role, and records of Portal activity such as settings changed. | To give you access to the Portal, keep it secure, and support you. | Contract (with your employer). Legitimate interests (security and support). |
| Support contacts | Your name, email, and the content of your messages. | To help you and improve our support. | Contract, or legitimate interests (helping our clients). |
| Business marketing | Work email, name and company. | To send occasional news about Dobi to business contacts. You can opt out at any time using the link in each email. | Legitimate interests, and consent where the law requires it. |
| Product statistics | Aggregated, anonymised figures about how Dobi is used across clients. These do not identify any person or any client. | To run and improve Dobi. | Not personal data once anonymised. Creating them: legitimate interests. |
3.2We do not make decisions about you based only on automated processing that have legal or similarly significant effects.
3.3We do not sell personal data. If you accept advertising cookies on our website, Google receives data about your visit so we can measure which of our ads work (consent). We do not use client or end-user data for advertising.
4. Where we get it from
Mostly from you. We may also get your details from your colleague who sets up your business's account or adds you to the Portal, and from Stripe when you pay.
5. Who we share it with
5.1We share personal data only as needed with:
- our service providers, such as hosting, database, email and payment providers. They are listed on our Sub-processors page;
- Google, which serves the font our pages use (Google Fonts) and so receives your IP address when a page loads, and, only if you accept advertising cookies, measures our ads through Google Ads;
- our professional advisers, such as accountants and lawyers;
- authorities, courts or regulators, where the law requires it; and
- a buyer of, or successor to, all or part of our business, or a company in our group, who will be bound to protect it in the same way.
6. International transfers
Some of our providers are based in, or may access data from, the United States. When personal data leaves the UK, we protect it using UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (where the provider is certified), or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement. You can ask us for details at george@veyraconsult.com.
7. How long we keep it
| Data | How long |
|---|---|
| Enquiries and call bookings that do not lead to a sale | 24 months after our last contact |
| Portal user accounts | While the client's subscription lasts. After it ends, the log-in stays open for 30 days so you can export your data. Your name and email then stay with our billing records for 6 years, as the law requires |
| Support messages | While the client's subscription lasts, then deleted with the client's other data, 60 days after it ends |
| Invoices, payment and contract records | 6 years after the end of the financial year they relate to, as HMRC requires |
| Marketing opt-outs | Kept for as long as needed so that we do not contact you again |
| Website request logs | A short period set by our hosting provider |
8. Your rights
8.1You have the right to:
- ask for a copy of your personal data;
- ask us to correct it if it is wrong;
- ask us to delete it;
- ask us to restrict how we use it;
- object to how we use it, including for marketing;
- ask us to move it to another organisation, where this applies; and
- withdraw consent, where we rely on consent.
8.2Some rights have limits. For example, we must keep invoices for tax purposes.
8.3To use any right, email george@veyraconsult.com. We may ask you to confirm your identity. We will reply within one month. There is usually no charge.
9. If you met Dobi on another company's site
9.1Businesses use Dobi as a guide on their own websites and apps. Often they rename and restyle it. If you used Dobi there, that business is the controller of your data. We process it for them, on their instructions, under a data processing agreement.
9.2Who to contact. Please contact that business first. Its privacy notice should explain how it uses Dobi and how to reach it. If you cannot find out who it is, or cannot reach it, email us at george@veyraconsult.com with the website or app address. We will pass your request to the business without undue delay.
9.3What Dobi may collect there, depending on the business's settings:
- a random device and session identifier kept in your browser;
- pages you view, the labels of buttons and links you tap, and tour progress;
- Dobi settings you choose, such as reading aids or voice;
- questions you ask Dobi and its answers;
- feedback you choose to give (Happy or Not happy, an optional comment and an optional email);
- bug reports you choose to send, which may include page errors and failed request addresses; and
- technical data that comes with any web request, such as IP address.
9.4What Dobi never reads: what you type into fields on the page, such as passwords, card numbers or form inputs.
9.5AI. Your questions are sent to an AI provider to generate answers. Dobi's answers come from AI and can be wrong. Please don't share sensitive personal information with Dobi.
10. Security
We protect personal data with measures such as encryption in transit (TLS), our providers' encryption at rest, access limited to those who need it, and separation of each client's data. No system is completely secure, but we work to keep risks low and to act quickly if something goes wrong.
11. Cookies and storage
Our website stores a few settings in your browser for the page to work. We only use advertising cookies if you accept them in our cookie banner. See our Cookies and Storage Notice.
12. Children
Our website and Portal are for businesses. They are not aimed at children, and we do not knowingly collect children's data through them.
13. Complaints
13.1If you are unhappy with how we handle your data, please tell us first at george@veyraconsult.com so we can try to put it right.
13.2You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.
14. Changes to this policy
We may update this policy. We will post the new version here with a new version number and date. If a change materially affects our clients, we will always tell them first, by email, at least 30 days before it takes effect.