Privacy policy
Last updated: 15 October 2026.
This policy explains which personal data Drin processes, why, for how long, and what your rights are, under the General Data Protection Regulation (EU 2016/679, “GDPR”) and Greek Law 4624/2019.
1. Who is responsible
For the website’s data and business accounts, the controller is: Drin (test details), 1 Test Street, 105 57 Athens, VAT 000000000, email test@example.com (“we”).
The data of each business’s customers (names, phone numbers, appointments, etc.) is entered by the business itself. For that data the business is the controller and we act as processor on its behalf, under the Data Processing Agreement. If you are a customer of a business that uses Drin, please contact that business first about your rights; we will help it answer you.
2. What data, and why
| Data | Purpose | Legal basis |
|---|---|---|
| User’s email, sign-in codes (stored hashed, expire in 10 minutes), passkeys (public key only) | Account and secure sign-in | Performance of a contract (art. 6(1)(b)) |
| If you sign in with Google: your name, email address, profile picture and Google account ID (see section 3) | Signing you in, and showing your name and picture in the app | Performance of a contract |
| What you add to your profile: name, photo, phone, role, a short description | Showing who you are to colleagues in the same business | Performance of a contract |
| Business details (name, type, phone, settings) | Running the service | Performance of a contract |
| Contact-form messages (name, business, email or phone, message) | Replying to you | Legitimate interest / pre-contractual steps |
| IP address, during a visit | Protection against abuse (rate limits) and security | Legitimate interest (art. 6(1)(f)) |
| Technical logs | Finding errors, security | Legitimate interest |
| Actions of Drin’s administrators on accounts (who, when, what) | Accountability and security | Legitimate interest |
We do not sell data, use it for advertising, or carry out automated decision-making or profiling.
3. Signing in with Google
You can sign in with your Google account instead of a code by email. When you do, Google shares with Drin only your name, email address, profile picture and Google account ID (the “openid”, “email” and “profile” permissions). Drin does not ask for, and has no access to, your Gmail, contacts, calendar, Drive or any other Google data.
- How we use it: only to sign you in, to link your Google sign-in to the Drin account with the same email address, and to show your name and picture inside the app (for example in the top bar and to colleagues in the same business).
- What we store: your name, email, picture and Google account ID with your account, and the sign-in tokens Google issues, kept only to complete and keep your sign-in. You can replace or remove the picture on your “My account” page at any time.
- Sharing: we do not sell, share or transfer data received from Google to anyone, use it for advertising, or use it to train AI or machine-learning models. It is stored only on our hosting provider (section 4), as described there.
- Google’s policy: Drin’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Withdrawing access: you can remove Drin’s access at any time from your Google Account at myaccount.google.com/permissions, and ask us to delete your account and all its data at test@example.com. We delete it within 30 days.
4. Where it is stored, and who processes it for us
- Cloudflare, Inc. (hosting of the app and website, database). The database is on infrastructure inside the EU. Requests pass through Cloudflare’s global network; where data is transferred outside the EEA, the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework apply.
- Resend, Inc. (sending email: sign-in codes and, if the business chooses, email reminders), once enabled. Transfer to the USA under Standard Contractual Clauses / DPF.
Viber, WhatsApp and SMS messages are not sent by Drin: the business sends them from its own device and account. Drin only prepares the text.
5. How long we keep it
- Account and business data: for as long as the account exists. After it ends or is deleted, within 30 days, unless the law requires otherwise (e.g. tax records).
- Sign-in codes: 10 minutes. Sign-in sessions: up to 30 days.
- Contact-form messages: up to 12 months after the last contact.
- Technical logs: for a limited period, under the hosting provider’s settings.
6. Cookies and local storage
- Website: uses no cookies and no analytics or advertising tools.
- App: uses only one strictly necessary sign-in cookie, without which you cannot stay signed in, and stores your language choice on your device. These need no consent (art. 4(5) of Greek Law 3471/2006).
If non-essential cookies (e.g. analytics) are ever added, we will ask for your consent first.
7. Security
Encryption on every connection (HTTPS), sign-in without passwords (one-time code or passkey), strict separation of each business’s data, rate limits against abuse, and a record of every access by a Drin administrator to a business account.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and to withdraw consent where consent is the basis. Write to test@example.com; we reply within one month.
You may also complain to the Hellenic Data Protection Authority (www.dpa.gr, 1-3 Kifisias Ave, 115 23 Athens).
9. Changes
If anything material changes, we will announce it in the app or by email before it applies.