Devoix Internal
Čeština English

Privacy policy

Effective 22 September 2026

This policy explains what personal data Devoix Solutions s.r.o. processes in Devoix Internal (the “app”), why, and what your rights are. It covers the web app at app.devoix.cz, the client portal, and our native apps for Apple devices.

1. Who is responsible

The data controller is Devoix Solutions s.r.o., Company ID (IČO) 29126657, registered office Verdunská 711/5, Bubeneč, 160 00 Praha 6. Contact for anything in this policy: info@devoix.cz.

2. What the app is

Devoix Internal is the internal system of a software studio. Our team uses it to run client projects, proposals, contracts, invoices and team chat. Our clients use its portal to follow their projects. Accounts exist only by invitation; there is no public sign-up.

3. The data we process

  • Account data: name, e-mail, phone, password (stored only as a hash), language, profile photo, job title, bio, presence status, notification preferences, and private notes you write for yourself (visible only to you).
  • Client and project data: contact people and company details (including public data from the Czech business register, ARES), proposals, contracts, invoices and payments, project plans, tasks, time records, files, tickets and review comments.
  • Communication: chat messages, attachments and link previews; for audio and video calls, who took part and when. Calls are not recorded.
  • Technical data: sign-in sessions, when you were last active (to show whether you are online), push notification tokens of your devices, and error reports when something breaks.
  • Google Calendar data, only if you connect your calendar. Section 4 describes it in full.

4. Google user data

Connecting Google Calendar is optional and only available to members of our team. You connect it from your profile, and you can disconnect it there at any time.

What we access

  • Your Google account e-mail (scopes openid and email), to show which account is connected and to invite you to events at that address.
  • Events on your primary calendar (scope https://www.googleapis.com/auth/calendar.events). We read events from yesterday until 30 days ahead: title, start and end, whether the event is all-day, marked busy or free, private, or an out-of-office or focus-time block, your RSVP, and its Google Meet link.
  • Creating events: we create an event in your calendar only when you press “Create event” in the app, with the title, time and guests you chose. Google then sends the invitations. We do not edit or delete your existing events.

How we use it

  • To show you your current and next event, with a join link.
  • To set your status in the app while an event is running (“In a meeting”, “Focusing”, “Out of office”), and to hold back notifications during it according to your settings. You can switch this off.
  • To show colleagues who are scheduling a meeting with you that you are busy at a given time. They see only the time, not the event.
  • Event titles are shown to colleagues only if you turn on “Show my meeting titles to colleagues”. Events you marked as private in Google are never shown to anyone else.

How we store, share and delete it

  • Access tokens are stored encrypted. The copy of your events is stored in our database and refreshed every few minutes; events older than a day are removed on the next refresh.
  • Our nightly database backups can contain the copy of your events as it was that night. Backups are rotated automatically, so after you disconnect, those copies disappear as the backups expire.
  • We do not sell Google user data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not share it with anyone except as described above (your colleagues in the app) or when the law requires it.
  • People at Devoix Solutions s.r.o. do not read your calendar data, except with your permission, to investigate a security problem, or to comply with the law.
  • When you disconnect, we revoke our access at Google and delete your tokens and the copy of your events immediately. You can also revoke access in your Google account under Third-party apps & services.

Devoix Internal’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Why we process data (legal bases)

  • To perform a contract with our clients and with team members (Art. 6(1)(b) GDPR): running projects, the portal, invoices and the tools our team works with.
  • To meet legal obligations (Art. 6(1)(c)): accounting and tax records.
  • Our legitimate interest (Art. 6(1)(f)): keeping the app secure and working, and internal communication.
  • Your consent (Art. 6(1)(a)): connecting Google Calendar. You can withdraw it at any time by disconnecting.

6. Who else handles the data

We use these providers only as far as each one is needed:

  • the provider hosting our servers, which run the app, its database and file storage;
  • our e-mail delivery provider, for invitations and notifications;
  • Apple (Apple Push Notification service), to deliver notifications to your devices;
  • Google, if you connect Google Calendar;
  • an error-monitoring service, which receives technical details when the app fails.

Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or on standard contractual clauses.

7. How long we keep data

  • Account data while your account exists. When an account is deleted, its data is removed, except records we must keep by law.
  • Invoices and accounting records for the periods required by Czech accounting and VAT law (up to 10 years).
  • Project data for the duration of our cooperation and the warranty period, and after that as long as we need it to defend legal claims.
  • Backups are rotated automatically; deleted data disappears from the last backup within two years.
  • Google Calendar data as described in section 4.

8. Cookies

The app uses only the cookies it needs to work: your sign-in session, protection against forged requests, and your choice of light or dark theme. We use no analytics or advertising cookies.

9. Security

Connections are encrypted (HTTPS), passwords and tokens are stored hashed or encrypted, access inside the app is limited by role, and clients can see only their own projects.

10. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time. Write to info@devoix.cz. You can also lodge a complaint with the Czech data-protection authority, the Úřad pro ochranu osobních údajů.

11. Changes

We will update this policy when the app changes the way it handles data. The date at the top shows the current version; we will tell users in the app about significant changes.