Legal

Privacy Policy

What the website collects, why, who processes it, how long it is kept and how to exercise your rights.

Effective 8 November 2026 · Last updated 8 November 2026

1. Who we are

This policy explains how DaVero AI LLC (DaVero AI), of 2100 N Greenville Ave, Ste 217, Richardson, TX 75082, United States (DaVero AI, we, us) handles personal information collected through daveroai.com (the website).

For that information we are the controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR, and the business under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).

This policy covers the website only. Personal information we handle when delivering services to a client is governed by our agreement with that client.

2. Information we collect

The website has no accounts, no analytics and no advertising. We collect personal information in two ways.

When you use the contact form

Required: your name, work email address, company and a description of the workflow you want help with.
Optional: the business platform you use and your business domain.

The form also sends a token recording when the form was loaded, used only to detect automated submissions. We do not receive anything you type until you submit the form.

When you visit any page

Request data that every website receives: your IP address, the page requested, the time, your browser's user agent and the referring page. Our hosting provider processes this to deliver the website and protect it.
When you submit the contact form, your IP address is also used to limit how many messages can be sent from one address (see section 3).
If our bot check is switched on, Cloudflare Turnstile collects signals from your browser and device (for example browser characteristics and how the page was interacted with) to tell people from automated programs.

We do not ask for, and ask you not to send, special category data (such as health information) or financial account details through the form.

3. How we use it and our legal bases

Purpose	Information	Legal basis (GDPR / UK GDPR)
Read and reply to your enquiry, and discuss a possible engagement	Contact form fields	Legitimate interests in responding to business enquiries; steps you ask us to take before entering into a contract
Block spam and abuse of the contact form	IP address, form token, Turnstile signals, a one-way fingerprint of your email and message	Legitimate interests in keeping the website and our inbox secure
Deliver and secure the website	Request data, including IP address	Legitimate interests in operating a secure, working website
Meet legal obligations and handle legal claims	Any of the above, where relevant	Legal obligation; legitimate interests in establishing or defending legal claims

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 8).

Automated checks. The contact form runs automated checks before a message is sent: a hidden field only programs fill in, the time since the form loaded, limits per IP address (5 messages per 10 minutes and, where shared limits are enabled, 20 per day), content rules (for example HTML code or a message made mostly of links), a repeat check for the same email and message within 10 minutes and, if enabled, Cloudflare Turnstile. A message that fails some of these checks is not delivered. These checks have no legal or similarly significant effect on you. If you think a genuine message was blocked, email [email protected].

We do not sell personal information, share it for cross-context behavioural advertising, or use it to profile you.

4. Who processes it for us

We share personal information only with service providers that process it on our instructions:

Provider	What it does	Information
Vercel Inc.	Hosts the website and runs the contact form endpoint	Request data, including IP address; contact form submissions in transit
Resend (Plus Five Five, Inc.)	Sends each contact form submission to our inbox by email	Contact form fields
Cloudflare, Inc. (Turnstile), when enabled	Bot check on the contact form	IP address and browser and device signals
Upstash, Inc. (Redis), when enabled	Stores short-lived rate-limit counters and repeat-message fingerprints shared across servers	IP address; a one-way fingerprint of your email and message
Microsoft Corporation (Microsoft 365)	Hosts the inbox that receives enquiries	Contact form fields and our correspondence with you

We may also disclose information to professional advisers, to a buyer or successor if our business is reorganised or sold, or where the law requires it.

5. International transfers

Our service providers are based in the United States and may process information there and in other countries. When personal information from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards: an adequacy decision (including the EU-US Data Privacy Framework and its UK and Swiss extensions where the recipient participates) or the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards at [email protected].

6. How long we keep it

Information	Kept for
Enquiries and our correspondence	Kept indefinitely as part of our business records, unless you ask us to delete them; we then delete them unless the law requires us to keep them
Per-IP rate-limit counters	Up to 10 minutes, and up to 24 hours for the daily limit when shared limits are enabled
Repeat-message fingerprint	10 minutes
Turnstile signals	Processed by Cloudflare for the check, under Cloudflare's own retention terms
Hosting request logs	Under our hosting provider's log retention settings

7. Security

The website is served only over HTTPS and sets strict browser security headers. The contact form endpoint accepts same-origin requests only, caps request size, validates every field and keeps no database: a submission is passed straight to our email provider, Microsoft 365. No method of transmission or storage is completely secure. See our Security page for more, including how to report a vulnerability.

8. Your rights

EEA and UK

You have the right to access your personal information, have it corrected or erased, restrict or object to its use, and receive it in a portable format. You may also complain to your data protection supervisory authority; in the UK this is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

California and other US states

Depending on where you live, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its sale, sharing for targeted advertising or profiling. We do none of those three. In the last 12 months we collected identifiers (name, email address, IP address), professional information (company, platform, domain) and internet activity (request data), from you and your device, for the purposes in section 3, and disclosed them only to the service providers in section 4. We do not collect sensitive personal information. We will not discriminate against you for exercising your rights.

How to exercise them

Email [email protected] and tell us which right you want to exercise. We may ask for information to verify your identity, and we will respond within the time the law requires (one month under the GDPR and UK GDPR, 45 days under the CCPA, each extendable where the law allows). You may use an authorised agent; we may ask the agent for proof of authority. If we decline your request, we will explain why and, where the law provides it, how to appeal.