The short version: Domovleno collects only what we need to run the Service. We never sell your data. Client payments run through your own payment provider (mono, LiqPay or Stripe) and settle to your account — we never see card numbers or hold funds. You (and your clients) can have data exported or permanently deleted at any time. We process personal data under the Law of Ukraine "On Personal Data Protection" No. 2297-VI and follow GDPR principles for everyone, everywhere.
2. Who is responsible
For our own account holders' data (your name, email, business details), the controller is Individual Entrepreneur MALINOVSKYI ROMAN OLEKSIIOVYCH (ФОП Маліновський Роман Олексійович), registered in Ukraine (full requisites in the Public Offer Agreement). For the personal data of your clients that you manage in Domovleno, you are the controller and Domovleno is your processor — we handle that data only on your instructions, as set out in our Data Processing Agreement. This policy explains both roles.
3. What we collect
We collect three categories of information:
- Account information — your name, email, business name, and password (stored hashed, never in plain text). If you sign in with Google, we receive your name and email address from Google. Payment details for card transactions are handled by our payment processors (mono or Stripe); we never see or store card numbers.
- Customer Data — the bookings, client records, messages, and payment metadata you create in Domovleno. You control this; we process it on your behalf.
- Usage data — basic logs (IP address, browser, pages visited, errors) and product analytics so we can run the Service, keep it secure, and fix problems.
4. How we use it
We use your information to:
- Provide, maintain, and improve the Service.
- Send transactional email, SMS, and — where you connect a messaging channel (Telegram, Viber, Facebook Messenger, Instagram) — messenger messages on your behalf (booking confirmations, reminders, and the messages you configure). Messenger conversations with your clients are stored in your account so you can answer them from one inbox.
- Support billing and the online payments you take from your clients.
- Communicate with you about your account and the Service — including onboarding tips for account holders in their first weeks and monthly product updates. Every such email has a one-click unsubscribe link; transactional email (password resets, receipts) is sent regardless.
- Detect and prevent abuse, fraud, and security incidents.
- Comply with legal obligations.
5. Who we share with
We share data only with vendors ("sub-processors") that help us run the Service, each bound to GDPR-grade processing terms:
- mono (JSC "UNIVERSAL BANK"), LiqPay (JSC CB "PrivatBank") & Stripe — online card payments. Client payments connect to your own merchant account; Domovleno subscription payments are processed by mono.
- Resend — transactional email delivery.
- Twilio — SMS delivery.
- Telegram, Rakuten Viber, and Meta Platforms (Facebook Messenger, Instagram) — message delivery when you connect the corresponding messaging channel. Message content passes through the platform you connected, under its own terms; we store the channel credentials you grant encrypted and use them only to send and receive your messages.
- PostHog — product analytics and session replay (see "Analytics" below).
- Google Ads and Meta Platforms (Facebook, Instagram) — recipients of server-side conversion events if you came to us from one of our ads: the advertising click identifier, the IP address and browser of the signup request, never your name, email or phone (see "Analytics", "Signup attribution"). They act as independent controllers under their own terms, not as our sub-processors.
- Anthropic (Claude) — the AI provider behind our optional AI features (the admin AI Assistant, brand generation, and retention-opportunity ranking). Data is sent to Anthropic only when you use one of these Pro features; see "AI features" below for exactly what each one sends.
- Cloud hosting and infrastructure providers — servers, storage, and backups.
The full, current sub-processor list is set out in our Data Processing Agreement. We never sell your personal data to anyone, ever.
6. AI features
Some optional, Pro-tier features use a third-party AI provider, Anthropic (Claude), to generate suggestions. These features are off by default and only send data to Anthropic when you actively use them. When they are not in use, nothing is sent to any AI provider. What each feature sends:
- AI Assistant (admin copilot) — to answer a question or prepare a change you ask for, it sends the relevant slice of your business data for that request. Depending on what you ask, this can include client names, email, phone, appointment and service details, notes, and reviews. It is used only to produce your answer; your chat history is stored in your account so you can reopen it, and you can delete a conversation at any time.
- Brand generation — when you generate a brand from a website, it sends that website's address, its title and description, the colours and fonts detected on it, your own brand description, and your site logo image. It uses these only to suggest a brand colour, font, and style you can review before applying.
- Retention-opportunity ranking — to help you prioritise which lapsed clients to win back, it ranks opportunities using only anonymous, numeric signals (an internal reference id, days since last visit, recent visit count, average spend, how long they've been a client, and how many service categories they've used). It does not send client names, contact details, or notes.
Automated processing. The retention-opportunity ranking above is a form of automated profiling: it scores and orders your clients by their likely value so the highest-priority win-back opportunities surface first. It only ranks and prioritises — it never sends a message, changes a booking, or makes any decision with a legal or similarly significant effect on a person on its own; you decide what to act on. If you are a client of a business that uses Domovleno, you can object to this profiling for direct-marketing purposes by contacting that business.
AI provider terms. Our AI provider is Anthropic PBC (USA). Under Anthropic's commercial terms: (1) Anthropic does not use your data to train its models; (2) API inputs and outputs are automatically deleted from Anthropic's systems within 30 days of processing — longer only where the law requires it or a usage-policy violation is detected; (3) processing takes place in the USA under Anthropic's Data Processing Addendum (DPA), which incorporates the EU Standard Contractual Clauses. These terms apply to all of Domovleno's AI features.
7. Payments
When you take payments from your clients, card processing is handled by your connected payment provider — mono, LiqPay or Stripe — under a merchant arrangement tied to your business. Funds settle directly to your account; Domovleno never holds or receives your clients' money and never sees full card details. We store only payment metadata (amount, status, and the processor's reference) so the payment can be shown against the right booking. Card details are handled by the processor under its own privacy terms. Your Domovleno subscription itself is billed via mono (monobank acquiring): we store only an encrypted card token issued by mono — never your card number.
8. Analytics
We use PostHog (EU-hosted) for product analytics, so we can understand how features are used and fix usability problems. Each surface is treated differently. On the marketing site, analytics is cookieless and anonymous — page counting that stores nothing on your device. In the admin app, analytics (including session replay) runs for signed-in account holders with input masking — text you type into fields (such as client names, notes, and any payment inputs) is masked and not captured. On public booking pages, analytics only runs after the visitor accepts a consent banner, is limited to booking-funnel steps, and session replay is excluded entirely — your clients making a booking are never recorded.
Signup attribution. We want an honest picture of where real businesses find us and which ads work, without putting cookies or pixels on the site. So when you create an account, we store, together with your business record, where that visit began: the site you came from (its address only, e.g. google.com, never the page on it; for a visit from an AI assistant, the page address without its parameters), the page of our site you landed on and the page where you clicked the signup button, the utm tags if the link carried any, and the browser of the signup request. If you arrived from one of our ads on Google or Instagram / Facebook, we also store the advertising click identifier the platform appended to the link (gclid, gbraid, wbraid or fbclid) and the IP address of the signup request. Only the first touch is kept and it is never overwritten. We tell the ad platform that click came from (Google Ads or Meta) two facts: that the signup happened and, later, that your business received its first real online booking. Only that identifier, the IP address and the browser go with it — never your name, email or phone. We do not send your email even in hashed form; should we ever start (for better matching), we will update this section first. Visitors who never sign up are not affected: nothing is stored on the device or the server. Legal basis: our legitimate interest in understanding where our customers come from and in measuring our own advertising (GDPR art. 6(1)(f); art. 11 of Law No. 2297-VI). The data lives as long as your account does and is deleted with it; on request to support@domovleno.com we delete it sooner.
9. Cookies
We use a small set of first-party cookies: session cookies for sign-in, a support cookie used only when you ask us to troubleshoot your account, and a language-preference cookie. Product analytics may set its own cookies where enabled. See our Cookies policy for the full list.
10. Your rights
Under the Law of Ukraine "On Personal Data Protection" No. 2297-VI (Article 8) and GDPR you have the right to:
- Access — see what we have about you.
- Correct — fix any inaccuracies.
- Delete — have your data permanently removed.
- Port — export your data in a machine-readable format.
- Object — to certain processing, including direct marketing.
- Withdraw consent — where processing is based on consent.
Account holders can export their data and delete their account from the app. If you are a client of a business that uses Domovleno, that business controls your data — they can export or erase your record from within Domovleno, and we will help them do so. To exercise any right, contact the business you booked with, or reach us via our contact page and we'll route it correctly. We respond within 30 days. You also have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини) or your local supervisory authority, or to apply to court.
11. Data retention
We keep account data while your subscription is active and for 30 days after you close your account, then permanently delete it. Backups roll off after 30 additional days. Logs are kept for 90 days.
12. Security
All traffic is encrypted in transit, passwords are stored hashed, access to production data is role-based and audit-logged, and we keep regular encrypted backups. See our Security page for the full picture.
13. International transfers
Some of our sub-processors may process data outside your country. Transfers of personal data outside Ukraine are made under Article 29 of Law No. 2297-VI: to states ensuring adequate protection of personal data (EU/EEA states and parties to Council of Europe Convention 108), and to other countries — including the USA, where some of our sub-processors are located — on the basis of contractual safeguards agreed with each such sub-processor and/or the data subject's unambiguous consent. Where personal data leaves the EU/EEA, we rely on GDPR safeguards such as Standard Contractual Clauses. This includes our AI provider (Anthropic, USA) when you use an AI feature: transfers rest on Anthropic's Data Processing Addendum incorporating the EU Standard Contractual Clauses, and API inputs and outputs are deleted from Anthropic's systems within 30 days (see "AI features"). Details about processing locations are available on request.
14. Children
Domovleno is not directed to anyone under 18. We don't knowingly collect data from children. If you believe we have, please contact us.
15. Changes
Material updates to this policy are notified by email at least 30 days in advance.
16. Accounting & consulting services
When this section applies: if you ordered «Старт під ключ», «Аудит ФОП», «Супровід» or another service under the separate accounting services offer.
- What we process: full name, tax number (РНОКПП), passport or ID-card details, registered address, contacts, ФОП details (tax group, КВЕД codes, registration date), bank account details and statements, amounts and dates of payments and fiscal receipts in the Service, correspondence with us, and documents you hand over for reporting. We never ask for or store your electronic signature keys (КЕП), passwords or access codes.
- Why and on what basis: performance of the contract (providing the services), legal obligations (retention of primary documents), legitimate interest (defence against claims).
- Who has access: the Domovleno accountant; a partner accounting firm as a subcontractor — only for your tasks and under a confidentiality agreement; banks, the State Tax Service and other authorities — only on your instruction or where the law requires it.
- How long we keep it: documents related to tax calculation and reporting — at least 1095 days from the filing of the reporting they relate to (Article 44.3 of the Tax Code of Ukraine); other data — up to 3 years after the services end, unless the law requires longer.
- Your rights: access, rectification, a copy, deletion after the retention periods expire, and withdrawal of consent where processing is based on consent.
- Your clients' data (names, phones, bookings) we continue to process as a processor on your instruction under the DPA; the accountant needs payment amounts and dates for bookkeeping, not your clients' personal data — access is limited to exactly that.
17. Contact
For any privacy question or request, email support@domovleno.com or reach us via our contact page — it goes straight to the team.