Privacy policy
Last updated: 28 October 2026
This policy explains what personal data Soevra processes, why, and what your rights are. It applies to the Soevra app on iPhone, and later to the website soevra.eu and the Android app.
Accounts, public pages and the report form arrive in a later release. Until then the app keeps your answers on your device, and the sections about them apply from the day each feature ships.
Soevra is for businesses. Most of what we store is about a cloud service, not about a person. We do process some personal data, mainly the email address of the person who signs in for a business.
Who is responsible
SEDOVI Development B.V. is the controller of your personal data.
- Address: Columbiastraat 22, 3207 NE Spijkenisse, the Netherlands
- Email: developer@sedovi.nl
- Chamber of Commerce (KvK): 42084959
We have not appointed a data protection officer. The law does not require one for Soevra. Send any privacy question to developer@sedovi.nl. A person reads and answers it.
Whose data we process
- People who sign in for a business. We call them representatives.
- People who report a page.
- People who email us.
- People who visit our website.
If your business trades under your own name, the public page shows that name. The basis is the same legitimate interest as for any business page, and you can unpublish the page at any time.
What data we process
| Data | Where it comes from |
|---|---|
| Your email address | You, when you sign in |
| A user id that our system creates for your account | Our system |
| One-time sign-in codes | Our system. We email them to you. |
| Session and device data: sign-in tokens, the time of sign-in, IP address, and the type of device or browser | Your device, when you use Soevra |
| Your business name, the details of your services, and your answers to the questionnaire | You |
| The score and SEAL level we calculate from your answers | Our system |
| If you report a page: your name, your email address, and what you write in the report | You |
| If you email us: your email address and what you write | You |
| If you visit our website: your IP address, the pages you request, and the time, while our server answers. We keep no logs of visits. | Your browser |
If you give us your own name, we do not publish it. Your public pages show your business, not you.
When we offer passkeys and you add one, we also store its public key. The private key stays on your device.
You need an email address to create an account. Without it you cannot sign in. Everything else you give us is up to you, but we need your answers to calculate a result.
Why we use it, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create your account, send sign-in codes, keep you signed in | Email address, user id, codes, session and device data | Performing our contract with you, Article 6(1)(b) GDPR |
| Calculate your result and show it to you | Answers, business and service details | Performing our contract with you, Article 6(1)(b) GDPR |
| Publish the latest result of each assessed service on a public page, and keep dated versions | Answers, business and service details, result | Our legitimate interest, Article 6(1)(f) GDPR. The interest is giving buyers a public, dated view of what each business declared about its own services, and being able to show later what was declared and when. |
| Keep dated versions for five years after a page is unpublished or an account is closed | Business and service details, answers, results and their dates. Not your email address or other data about you as a person. | Our legitimate interest, Article 6(1)(f) GDPR, and Article 17(3)(e) GDPR. The interest is being able to show what a business declared and when, and to defend legal claims about a page. Under Dutch law such claims can be brought for five years. |
| Keep Soevra and your account secure, and stop abuse | Session and device data, security logs | Our legitimate interest, Article 6(1)(f) GDPR. The interest is protecting accounts and the service against misuse. |
| Serve the website and keep it secure | IP address, pages requested, time | Our legitimate interest, Article 6(1)(f) GDPR. The interest is running a website that works and detecting attacks. |
| Handle reports about pages and send our reasons | Reporter's name, email and report, the business's account details | Our legal obligation under the Digital Services Act, Articles 16 and 17, which is Article 6(1)(c) GDPR |
| Handle objections to our decisions | The objection, the decision it concerns, and the contact details of the person who objects | Our legitimate interest, Article 6(1)(f) GDPR. The interest is correcting our own mistakes and treating businesses and reporters fairly. |
| Answer your emails | Email address and message | Our legitimate interest in answering you, Article 6(1)(f) GDPR. When you write about your account, performing our contract, Article 6(1)(b) GDPR. |
| Answer orders from authorities | Whatever the order covers | Our legal obligation, Article 6(1)(c) GDPR |
We do not ask for consent for anything, so there is no consent to withdraw.
Where we rely on our legitimate interest, you may object. See "Your rights" below.
Our software calculates a score and level for a cloud service, from your answers. That is not a decision about you as a person. We make no automated decisions about people as meant in Article 22 GDPR.
Who receives your data
We do not sell your data. We share it only with the service providers below, who process it for us under a contract. Each of them must protect your data at least as well as this policy says, and may use it only on our instructions.
- Hetzner Online GmbH in Gunzenhausen, Germany, runs our server in its datacenter in Nuremberg. That server holds our database and sign-in, and runs the app's API and our website. Hetzner also keeps daily backups of the server. Hetzner is our processor under its data processing agreement.
- STRATO GmbH in Berlin, Germany, sends our emails, such as sign-in codes and replies about reports. Emails come from noreply@soevra.eu.
- STRATO also hosts the mailbox developer@sedovi.nl, so it receives the emails you send us.
- STRATO stores a nightly copy of our database. We encrypt the copy before it leaves our server, with a key only we hold, so STRATO cannot read it.
Everyone can see a published page, without signing in. A published page shows the business name, the name of the service, the latest score and SEAL level, the date and the method version. It does not show the individual answers or who signed in.
If you report a page, we do not tell the business who you are, unless we must name you to explain our decision. The law allows that only where strictly necessary.
We may also share data with authorities when the law requires it.
Transfers outside the European Economic Area
We store all data in Germany, and our service providers are German companies. We do not transfer your data outside the European Economic Area.
How long we keep it
| Data | How long |
|---|---|
| One-time sign-in codes | 10 minutes |
| Your account, if you stop using it | We delete it after 24 months without sign-in. We email you 30 days before we do. |
| Your account, if you close it | We delete it when you close it |
| Published versions of your answers and results | As long as the page exists, and five years after you unpublish it or close your account. When you close your account we delete your email address and other data about you as a person straight away. |
| Security logs | 12 months |
| Website visits | We keep no logs of them |
| Reports about pages and our decisions | 24 months after we close the case |
| Emails with us | 24 months after the last message in the conversation |
We may keep data longer if we need it for an ongoing report, dispute or legal claim, or if the law requires it. We keep it only for that purpose and only for as long as needed.
Your rights
You have the right to:
- see the personal data we hold about you (Article 15 GDPR);
- have it corrected (Article 16);
- have it deleted (Article 17);
- have its processing limited (Article 18);
- receive it in a common, machine-readable format (Article 20); and
- object to processing based on our legitimate interest (Article 21).
Article 22 gives you rights about automated decisions. We do not make such decisions about people.
To close your account and delete its data, use the delete option in the app. For anything else, email developer@sedovi.nl. To protect your data, we may ask you to confirm the request from the email address of your account. We answer within one month. If a request is complex, we may need two more months, and we will tell you why.
Complaints
If you think we handle your data wrongly, please tell us first at developer@sedovi.nl. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at https://autoriteitpersoonsgegevens.nl. You may also complain to the authority in the EU country where you live or work.
Cookies and tracking
We use no tracking, no analytics and no advertising. We do not sell or share data for advertising.
On the website, we store your sign-in session in your browser so you stay signed in. That is strictly necessary for the service, so we do not ask for consent. We set no other cookies and use no other storage in your browser.
The iPhone app collects no data for tracking. It contains no advertising or analytics code. If you allow it in your iPhone settings, Apple may share crash reports from the app with us. Apple's own privacy policy covers that.
Security
We protect your data with encryption between your device and our server, encrypted backups, and access rules in our database that limit each account to its own data. Our database cannot be reached from the internet, only through the app's API. Only people at SEDOVI who need access for their work can see account data.
Changes to this policy
We may change this policy. If a change is significant, we email account holders before it takes effect and show the new policy in the app and on our website. The date at the top shows when we last changed it.