Who we are
Devora helps software companies give their support and engineering staff controlled, approved and recorded access to customer accounts. Devora is operated by Devora Labs Ltd, Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom, company number 17449784 (registered in England and Wales).
In this policy, "Devora", "we" and "us" mean that business. You can reach us about anything in this policy at help@devora.sh.
Our two roles
Data protection law treats us differently depending on whose data it is.
- Controller. We decide how to use data about visitors to devora.sh, people who sign in to Devora, billing contacts, people who contact us, and business contacts we reach out to. Most of this policy is about that data.
- Processor. When a customer uses Devora, it decides which of its own end users' accounts its staff may access and whether sessions are recorded. For that data we act on the customer's instructions as its processor (a "service provider" under some US state laws). Section 4 explains what that data is. The customer's own privacy notice governs it, and the customer is responsible for having a lawful basis and giving any required notice.
If you use a product built by one of our customers and want to exercise your privacy rights, please contact that company. If you contact us instead, we will pass your request to the customer and help it respond.
Data we collect as controller
Visitors to devora.sh
- Google Analytics runs only if you choose "Allow analytics" in the banner. It is set to anonymize IP addresses and not to store advertising data. You can change your choice at any time with "Analytics settings" in the footer.
- We remember your analytics choice and your light or dark theme in your browser's local storage.
- Our footer shows badges hosted by TinyShelf and Launch Llama. Loading those images sends a standard web request, including your IP address, to those sites.
- Cloudflare, which hosts the site, processes connection data such as IP addresses to deliver pages and protect the site from abuse.
People who sign in to Devora
- Account details: your name, email address, whether your email is verified, and identifiers from our sign-in provider, WorkOS.
- Workspace details: the organizations you belong to and your role, such as admin, approver or member.
- Activity in Devora: access requests you make or decide, including the reason you give, the scope and timing, sessions you start or end, and security events. We keep these as an audit record.
- Technical data: your browser's user agent is stored with any session recording you take part in. Our application database does not store IP addresses, although WorkOS and Cloudflare process them to sign you in and run the service.
- Product analytics (optional): if you turn on product analytics in your settings, PostHog receives usage events under a pseudonymous identifier. Automatic click capture is off. You can turn analytics off at any time.
Billing contacts
Polar runs our checkout and subscriptions. We store the billing email address, Polar customer, subscription and order references, and amounts paid or refunded. We never receive or store your full card details.
People who contact us
If you email us, we keep your message, your contact details and our reply so we can help you.
Business contacts
We may contact people at software companies about Devora in their professional capacity, for example on LinkedIn or by work email. For this we use your name, job title, employer, public professional profile and work contact details, which come from public sources such as LinkedIn and company websites or from data providers. Every message offers an easy way to tell us to stop, and we will not contact you again once you do.
Data we process for customers
When a customer's staff use Devora to access an end user's account, we process the following on the customer's behalf.
- End user identification: the user ID, and when the customer supplies them, the name, email address, avatar and up to 12 extra attributes the customer chooses to show in search results. We store the ID, name and email encrypted, with a keyed hash used for lookups, and we keep an encrypted copy of what the search result showed when access was requested.
- Access history: who requested access to which account, the reason, the scope and duration, who approved it, and when the session started and ended.
- Session recordings (optional, off by default): if the customer turns recording on, Devora records what the staff member's browser shows while viewing the end user's account, using a fully masked profile by default. Sensitive input fields are always masked. Each recorded tab stores its page address and title. Recordings are limited to 4 hours and 200 MB each.
- Activity timeline (optional): page views and clicks during the session and, if the customer enables them, browser errors and warnings and custom events.
- Temporary credentials: the customer's backend creates a short-lived sign-in credential for the session. We hold it encrypted only until the one-time handoff is used, then remove it. Unused handoffs expire and are deleted.
We use this data only to provide Devora to that customer, keep it secure, and meet our legal obligations. We do not use it for our own marketing and we do not sell it.
Why we use data
For data we control, our purposes and legal bases under UK and EU data protection law are:
| Purpose | Legal basis |
|---|---|
| Creating and running your account and providing Devora | Performance of our contract with you or your organization |
| Keeping audit records, securing the service and preventing misuse | Our legitimate interest in a secure, accountable service, and our legal obligations |
| Billing, invoices, tax and accounting | Performance of contract and legal obligation |
| Service emails such as approvals, billing and security notices | Performance of contract |
| Website analytics and optional product analytics | Your consent, which you can withdraw at any time |
| Answering questions and support requests | Our legitimate interest in helping people who contact us |
| Contacting business contacts about Devora | Our legitimate interest in telling relevant businesses about our product, with an easy opt-out |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Service providers
We share personal data only with providers that help us run Devora, under contracts that limit their use of it to our instructions. Our current providers are:
| Provider | What they do for us | Where |
|---|---|---|
| WorkOS | Sign-in, organizations and account directory | United States |
| Convex | Application database and backend processing | United States (N. Virginia) |
| Cloudflare | Hosting for our website, dashboard, documentation and recording service; storage for recordings, exports and audit checkpoints | United States storage; global delivery network |
| Polar | Checkout, subscriptions, invoices and sales tax | United States |
| Resend | Transactional email such as approval and billing notices | Ireland (EU) sending region; United States company |
| PostHog | Product analytics in the dashboard, only for users who opt in | United States |
| Website analytics on devora.sh, only after you allow it | United States | |
| Gojiberry | Managing our LinkedIn outreach to business contacts | France (EU); some providers outside the EU and UK under standard safeguards |
We may also disclose data when the law requires it, to protect people's rights or safety, or as part of a sale or reorganization of our business, in which case this policy continues to apply. We do not sell personal data and we do not share it for cross-context behavioral advertising.
International transfers
Our database and recording storage are in the United States, and several providers are based there. When personal data from the UK or the European Economic Area is transferred to the US or another country without an adequacy decision, we rely on appropriate safeguards: the EU-US Data Privacy Framework and its UK extension where the provider is certified, or standard contractual clauses with the UK addendum. You can ask us for details of these safeguards.
How long we keep data
Data we process for customers
Each customer workspace uses a retention profile. A plan cannot choose a longer profile than it includes, and recordings are only available on paid plans and trials.
| Profile | Recordings and activity | Request and session records | Security audit |
|---|---|---|---|
| Baseline | 30 days | 180 days | 365 days |
| Extended | 90 days | 365 days | 730 days |
| Enterprise | 365 days | 7 years | 7 years |
The history shown in the dashboard can be shorter than these periods. For example, the Free plan shows 7 days of history, while the underlying records follow the workspace's profile. Deletion runs automatically every hour. Recording files are deleted before their records.
Data we control
- Account and workspace data: while your account is active. When a user account is deleted, or an admin erases a workspace, we run an erasure job for that data.
- Billing records: for six years after the end of the financial year they relate to, as tax and accounting law requires.
- Website analytics: 14 months in Google Analytics.
- Business contact data: until you ask us to stop contacting you, and in any case no longer than 24 months after our last contact. We keep a minimal record of opt-outs so we do not contact you again.
- Emails with us: for as long as needed to deal with your request and keep a record of the conversation.
After an erasure, we keep a small record that the data was erased, without the data itself, for 400 days. This stops erased data from returning if we ever restore a backup.
Security
We protect personal data with measures that include encryption in transit, application-level AES-256-GCM encryption of customer identifiers and temporary credentials, signed audit records with daily integrity checkpoints, role-based approvals, time-limited and read-only access controls, masking for recordings, and short-lived, audited replay access. No system is perfectly secure, and we do not currently hold a SOC 2 certification. Read more on our security page.
If a personal data breach affects you or a customer we serve, we will notify the people and authorities that the law requires us to notify, and we will notify affected customers without undue delay.
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. You can always object to us contacting you about Devora, and we will stop.
To exercise a right, email help@devora.sh. We may need to verify your identity, and we will respond within one month, or within the time the law in your location allows. Residents of US states with privacy laws have similar rights, and we will not discriminate against you for using them.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office at ico.org.uk or to the data protection authority where you live or work.
Other information
- Children: Devora is a business service and is not meant for anyone under 18. We do not knowingly collect data from children.
- Links: our website and documentation link to other sites, which have their own privacy practices.
- Changes: we will update this policy when our practices change and show the date at the top. If a change is significant, we will tell account holders by email or in the dashboard before it takes effect.
Contact
Devora Labs Ltd, Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom. Email help@devora.sh.