Consolidated draft · 20 October 2026
Privacy, explained clearly.
Who is responsible?
David Ricardo Alonso Gomez de la Fuente is the person responsible for DAVALON enquiries, based in Poland. Contact: davidalonso@davalon.dev. DAVALON is a project name; it does not identify a registered company or make registration or tax claims.
What information is involved?
For email enquiries, share your name, reply address and a short description of your project. When enabled, the form asks for name, email, project type and message; current website and material links are optional. Do not send passwords, payment details, identity documents or sensitive information. There are no file uploads.
The online form is not enabled and does not send data. Direct email passes through your provider and our Zoho mailbox.
The Calendly link opens an external booking page for a 20-minute call. It collects your name, email, chosen time and time zone, with an optional message. Google Calendar receives appointment details and checks occupied times; Google Meet provides the call. DAVALON does not enable recording, transcription or an AI notetaker.
Why we use it
To answer your question, discuss your website needs, prepare the small initial preview you request and arrange a conversation. Sending an enquiry or booking a call does not create a paid service contract.
We use the steps you request before a contract as the basis where Article 6(1)(b) GDPR applies, and legitimate interests under Article 6(1)(f) for answering business representatives and protecting the service against abuse. We do not use enquiry details for automated marketing, profiling or automated decisions. Any legally required records would be handled under the applicable obligation, with a separate retention period.
Human contact, no active AI assistant
The AI assistant is not enabled in this public version. Questions and contact fields are not sent to an AI service. You can contact DAVALON directly by email.
Separate permission for sales follow-up
When the form is enabled, you can review your enquiry and optional follow-up choice before sending them through Web3Forms to Zoho. There is no automatic transcript or submission from a chat.
Answering your enquiry does not require sales permission. The checkbox is optional and unchecked. If you accept, your specific consent (Article 6(1)(a) GDPR) allows up to two manual sales follow-ups about DAVALON website services. This delivery sends no follow-ups or automated messages. The request records UTC date, origin, language, text version, permission text and granted/not-granted state.
Withdraw by emailing davidalonso@davalon.dev. David records withdrawal date/state and stops follow-ups; this does not prevent answering the enquiry or affect the lawfulness of earlier processing. Form origin/date describe the submission, not proof of identity. Contracted clients require a separate policy.
Providers and transfers
The commercial site is prepared for hosting and protection on Cloudflare. This version does not use the private preview’s Access login or enable public analytics, advertising trackers or embedded calendars.
Web3Forms and hCaptcha are the configured providers for the future enquiry form. While disabled, their script is not loaded and enquiries are not transmitted to them. Enabling it requires checking configuration, privacy and delivery.
Zoho handles our mailbox and replies. DAVALON uses the Zoho EU service at mail.zoho.eu. Zoho’s privacy terms describe its service processing and safeguards; this does not mean every subprocessor or support operation is confined to the EU.
Calendly is an external link, not an embed. Visiting its page is subject to its own cookies and privacy choices. It describes processing in the US and other locations and transfer safeguards. Google Calendar and Google Meet handle the connected calendar and call under Google’s privacy policy, which describes international processing and safeguards. DAVALON loads no Calendly or Google calendar script on this site.
Public analytics disabled
This version does not enable Google Analytics or measurement cookies. The private preview’s QA configuration is separate and does not enable tracking on the public site. Contact does not require analytics consent.
Retention and deletion
For enquirers without a contract, the proposed policy is to remove the enquiry and permission record from active Zoho correspondence 90 days after the enquirer's last real interaction. Outgoing sales follow-ups do not restart that period. David handles review/deletion manually; no automatic deletion is installed. Call enquiries are coordinated with Calendly, Google Calendar and meeting emails. Clients and legally necessary records require a separate policy; provider backups are not promised immediate deletion.
This new Web3Forms form is configured to permanently delete future submissions after seven days. The setting was saved and rechecked on 10 October 2026. History visibility is separate from storage; provider backups and legal exceptions follow its DPA. For an earlier deletion request, DAVALON will use the provider’s deletion process and explain any lawful retention exception.
The Zoho mailbox cleanup interval for Spam and Trash is set to 30 days. Cleanup can depend on message age; Zoho then describes a further 30-day server recovery period. DAVALON’s 90-day period is a manual handling procedure, not automatic deletion or a promise of instant removal from provider backups. Calendly and Google may retain backup, security or legally necessary records under their own policies. Deletion requests are coordinated across the providers involved.
Your choices and rights
Email davidalonso@davalon.dev to ask about your information, correct it, request a copy or ask for deletion, restriction or objection where applicable. We may need proportionate information to verify a request. Rights are subject to the applicable law; necessary records and provider recovery periods can affect deletion.
Where applicable you can withdraw consent for processing based on consent, and complain to a supervisory authority, including Poland’s UODO. We respond to data-rights requests without undue delay and normally within one month, explaining any lawful extension.
The Cedar Home Cleaning example is fictional. Its demo creates only an on-screen summary and sends or saves no cleaning requests.
Accounts and work in the portal
Access uses email, credentials managed by Supabase Auth, verification, sessions and invitation or recovery links. We do not ask you to send passwords in messages, files or email. Your profile stores the personal details you supply.
The portal processes requests, scope, saved drafts, references, private materials and files, proposals, quotes and acceptance records; it also processes change requests, comments, assignees, priorities and activity with author and time. Administration has private internal notes and audit records. Permissions separate each client’s projects.
Session cookies and CSRF controls are necessary for access. Temporary drafts by purpose and card may exist during the session; saving a draft on the server does not publish it. Files have technical checks and antivirus scanning; these do not guarantee detection of every sensitive item. Do not upload identity documents, passwords or unnecessary sensitive data.
Portal and payment providers
netcup provides the private portal VPS. Managed Supabase provides Auth, database and private file storage; the future production project will be separate. Resend sends access emails through Supabase Auth SMTP. Zoho handles the contact mailbox. Cloudflare manages the domain/DNS and private preview protection; final commercial hosting is confirmed at installation.
Stripe processes Checkout, payment methods and Customer Portal. DAVALON retains references, amounts, currency, consents, dates and verified states needed to manage payments and renewals; it does not receive the full card number or security code. TEST does not charge real money and LIVE remains disabled. Card details are entered at Stripe.
Technical TEST backups are encrypted before leaving the VPS and automatically stored in a private Cloudflare R2 bucket with EU jurisdiction; an isolated restore of a recent backup has been verified. Additional offline custody of the key remains pending. Operational alerts through Resend must not include client content, passwords or tokens. This does not yet verify production backups or promise immediate deletion from every backup or guaranteed recovery.
hCaptcha is prepared to protect production registration/login/recovery against abuse; it is not considered verified until the real service is configured and checked. Providers receive data needed for their functions and may use subprocessors or international processing. Exclusive EU residency or unverified safeguards are not promised.
Purpose, retention and requests
Data are used to handle your pre-contract requests, provide the agreed service, protect it, evidence changes and manage payments and applicable obligations. Intended bases are pre-contract steps/contract, applicable legal duties and legitimate interests in security and traceability; the final assessment is reviewed before contracting. Creating an account does not activate AI commercial decisions or general marketing campaigns.
The 90-day period for enquiries that do not become a client relationship, described in this notice, does not automatically extend to accounts, projects, files, acceptance records, audit or payment documents. Their retention matrix and legal exceptions remain pending; we do not invent a period or treat account closure as immediate deletion. Backups and providers have cycles distinct from active records.
For access, correction, export, deletion, objection or restriction where applicable, email davidalonso@davalon.dev. DAVALON coordinates requests with the providers involved and explains applicable legal and technical limits. Commercial exit delivers agreed content and files, not provider accounts or shared tools.
Provider policies
Provider reference documentation does not itself establish production configuration or email reception. Provider retention periods differ from DAVALON’s procedures.