How Delivvo collects, uses, stores, and protects personal data across the product, client portals, and public forms.
This Privacy Policy explains how Delivvo collects, uses, stores, shares, and protects personal data when you use our website, dashboard, private client portals, public forms and pages, the Cutroom desktop application, and related services. It applies to the businesses that hold Delivvo accounts and the team members they invite, to the clients and leads those businesses deal with through Delivvo (including people who fill in a business's inquiry form), to Cutroom licence holders, and to visitors to delivvo.io.
This policy is written to reflect Delivvo's current product and operating model. Because Delivvo serves users in multiple regions, this policy is intended to account for the UAE Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data (the "UAE PDPL"), the EU General Data Protection Regulation ("GDPR"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
Scope and roles
When Delivvo collects and uses personal data for account creation, authentication, product operations, support, billing administration, security, and the measurement of our own website and advertising, Delivvo acts as a controller or business for that information.
When a business uses Delivvo to collect inquiries through its forms, keep leads and client records, take bookings, share files, send quotes, proposals, contracts or invoices, manage communications inside a project portal, and send data to apps it connects, Delivvo generally acts as a processor or service provider on behalf of that business. In that situation, the business decides what data to collect, why to use it, and how long to keep it. If you are a client, a lead, or someone who filled in a business's form, and you have questions about that data, you should first contact the business you dealt with.
Cutroom. Cutroom is our desktop video editor, sold at delivvo.io/cutroom as a one-time purchase. It is a separate product from the Delivvo platform and carries its own Cutroom Licence Agreement, which is the contract for the software itself. This Privacy Policy is what that agreement points to for personal data, and it covers Cutroom in full. For everything we hold about a Cutroom licence, Delivvo is the controller. Cutroom is also something you buy from us outright, so for that sale we are the seller, the same as we are for a Delivvo subscription. Neither has anything to do with the money your clients pay you, which we never touch. See Cutroom licensing data below for what the software sends us, which is licensing traffic and nothing else.
Personal data we collect
We collect different categories of personal data depending on how you use Delivvo.
Information you provide directly
If you create a Delivvo account, we may collect:
your name
email address
password or authentication credentials. If you sign in with Google, Google tells us your email address and name; we do not receive your Google password
business name
profile details such as tagline, website, discipline, logo, or avatar
business details you enter for your documents, such as address, country, and tax or registration numbers
plan selections, onboarding answers, and support requests
If an account owner invites you to join their team, we collect your name, email address, the role you are given, your place in the team structure (who you report to, and who covers for you when you are away), the tasks given to you or by you, and a record of the actions you take in that account. The account owner, and the people they allow, can read that record in the account's audit log.
When you accept our Terms and this Privacy Policy, we record the version you accepted, the time, and the IP address. When a client first opens a portal and accepts its terms, we record the same for that client.
If you are invited to a client portal, we may collect:
your name
email address
optional company name, country, phone number, preferred language, or notes provided by the business or by you
information you enter into messages, approvals, remarks, uploads, contracts, proposal responses, or intake responses
If you contact support, use a "Report this" button on an error, request a demo or an Enterprise quote, ask for a refund, or execute a DPA, we may collect the information you provide in those requests, including business contact details and correspondence records. An error report also carries the page you were on, the time, and a reference to the matching error in our logs.
Inquiry forms and leads
When you fill in an inquiry form that a business publishes through Delivvo, we store, for that business:
your answers, including the contact details you enter and any files you attach
the language the form was shown in, the page and website it was opened from, the named link you used (for example the link a business posted on one social platform), and any campaign tags in the link (for example utm_ values)
your browser's User-Agent string and a salted one-way hash of your IP address. We do not store the IP address itself with your answers
the result of our automatic checks for spam and abuse, and an automatic estimate of how likely the inquiry is to turn into work. These help the business sort its inquiries; they do not decide anything about you on their own
The business can add notes, move the lead through its board, and send you messages, some of them automatically. Emails the business sends you from Delivvo, and your replies to them, are kept on your lead record in the business's account so its team can follow the conversation. Your replies reach us through a reply address on in.delivvo.io; we keep the text of the reply and do not keep its attachments. These emails are not encrypted the way project messages are (described below). Where Cloudflare Turnstile is switched on for a form, Cloudflare checks your browser to tell people from bots before the form is sent.
Bookings
When you book time with a business through its booking page, we store, for that business, your name, email address, phone number if asked, your answers to its questions, the time and time zone you chose, and a salted one-way hash of your IP address (used to stop booking spam). If the business asked for a deposit or full payment, the payment goes through its own gateway as described below. We send you the confirmation and reminder emails the business set up, and a link to change or cancel the booking.
If the business connected Google Calendar or Microsoft Outlook, the booking is added to its calendar, with a meeting link from Google Meet, Zoom, or Microsoft Teams where it chose one. To offer only free times, Delivvo reads the busy times on the connected calendar of the person you are booking with. It reads when they are busy, not what their other events are about.
Connected apps and integrations
A business can connect other services to its Delivvo account. When it does, Delivvo sends those services the data the connection needs, on the business's instruction:
Google and Microsoft calendars: bookings and meetings are written to the calendar, busy times are read, and changes made in the calendar are read back. Zoom, Google Meet, and Microsoft Teams: a meeting is created and its link is shared with the invitees.
Slack: a short line about an event (for example a new lead or a paid invoice) with a link into Delivvo, sent to a channel the business chooses, or to a team member's own Slack when that person turns it on.
QuickBooks, Xero, and Zoho Books: the invoices, clients, credit notes, payments, and refunds the business sends to its accounting app, and the paid status read back from it.
The API, webhooks, and automation tools (for example Zapier, Make, or n8n through Sign in with Delivvo): the records and fields the business allows, sent to systems the business controls or chooses.
The sign-in tokens, keys, and webhook addresses for these connections are stored encrypted. Each of these services handles the data it receives under its own terms and privacy notice, as a provider the business chose. Delivvo does not use these connections for its own purposes.
Project and file data
Delivvo is designed to host business workflow data. That means we may store:
project titles, descriptions, deadlines, milestones, and status fields
client and lead records created by businesses
contracts, invoices, credit notes, proposals, deliverables, and comments
files uploaded by businesses or client users, including metadata such as file name, size, upload time, and project association
approval records, signature names, timestamps, and related workflow history
for accounts with a team: the team structure, who owns or can see which records, and a log of changes made in the account
Project messages
Delivvo runs a two-way message thread on every project so a business and its clients can communicate inside the workspace instead of email. Message bodies are end-to-server encrypted: the text is encrypted with AES-256-GCM before it is written to our database, using a key that lives in our server environment configuration and never in the database itself. Anyone with read access to the database table (including ourselves running operational queries) sees ciphertext only. The plaintext is decrypted in memory at the moment a request is served and is shown only to signed-in people allowed to see that project: the account owner, the team members whose role gives them access to it, and the client who is a participant in it.
We do not read your messages for advertising, model training, content moderation, or analytics. We do not share them with any third party. Our admin tools have no screen that lists or searches message content. A person we authorise can see a thread only in two ways: through the read-only, audit-logged support view described under Administrator access below, which shows an account as its owner sees it, or by a deliberate operational action involving the encryption key, which we take only where required by law (for example, a valid court order) or where it is strictly necessary to investigate abuse of the service.
Email notifications for new messages do not include the message body. They tell the recipient that a new message arrived and link to the portal where the encrypted body is decrypted for reading. This keeps the content out of the email-delivery pipeline (Resend) and out of the recipient's mailbox.
Message bodies remain encrypted until the corresponding project, the business's account, or the user account is deleted; at that point the message rows are deleted alongside their parent records on the timelines described in Data retention below.
Contract signing audit trail
When a client signs a contract through a Delivvo signing link, we capture additional fields server-side at the moment of signing as part of the legal audit trail described in our Terms of Service:
the typed name and, when supplied, the drawn signature image
the signing timestamp in coordinated universal time (UTC)
the IP address from which the signing request was submitted
the User-Agent string presented by the signer's browser
a best-effort approximation of country, region, and city derived from the IP address through a third-party IP-geolocation lookup
a SHA-256 fingerprint computed over the contract content, the signer's typed name, the IP address, and the signing timestamp
When a business signs its own contract, we record the signing person's typed name and, when supplied, drawn signature image, the time, the IP address, and the browser User-Agent. When a client accepts or declines a proposal, we record the name they type, the time, the IP address, the browser User-Agent, and any reason they give for a decline.
Each signer also ticks a box agreeing to sign electronically; we store the exact words they agreed to, the version of that wording, and the time. Around the signature we keep a record of what happened to the contract: when it was sent or sent again and to which email address, when the signing link was opened (at most once every five minutes, with the IP address and the browser User-Agent), when changes were asked for or the contract was voided, and when a signed copy was emailed and to whom. When a contract is signed, we email each signer a copy of the signed PDF and of this record, and we keep a SHA-256 fingerprint of each file we send so the business can check a copy later. The business can also upload a file to compare it with those fingerprints; we read the file to compute its fingerprint and do not keep it.
We collect this information to provide a meaningful evidence record that a contract was signed, by whom, and from where, and to allow after-the-fact detection of edits to the contract content. The audit trail is rendered as part of the signed PDF, retained alongside the contract for the lifetime of the contract record on Delivvo, and disclosed to: (a) the business that owns the project, meaning the people in its account who can see that contract, (b) the client who signed, where they have authenticated access to the relevant portal, and (c) the people we authorise to run Delivvo, when they need access for support, security, or compliance reasons. Because the signed PDF carries the details of every signature on it, each side can see the other side's signing details, including the IP address.
Approximate geolocation is not represented as authoritative. It is derived from the IP address and may be incorrect. The IP address itself is the legal anchor for location and is what we record as canonical.
The legal basis for capturing this audit trail is our legitimate interest (and yours) in maintaining a meaningful evidentiary record of consent to signed agreements, and the performance of the contract between you and Delivvo. Where you are an EU/UK data subject acting in your individual capacity, our interest is balanced against your right to object. We will not process the audit trail for any purpose other than dispute resolution, security, fraud prevention, and the operation of the signing flow itself.
Document verification
When someone checks a document at delivvo.io/verify (or at a business's own portal address), we read the code they type and show the public summary described in our Terms. We do not store who checked a document by code alone; requests are counted per IP address for a short time to stop abuse.
When the client or the business on a document asks for the original, we send a one-time code to the email on the document (for the client) or the account email (for the business). We keep a record of that request: the document's code, which side asked, the email the code went to, the IP address, and when the code was confirmed. The code itself is stored only as a keyed hash and expires after 10 minutes; the access it opens lasts 30 minutes. Each download of an original is recorded with the email, which side downloaded it, the time, the IP address, and the browser User-Agent, and the business can see it in its account. We keep these records for as long as we keep the document they relate to, because they show who received a copy. A request whose code was never confirmed is deleted after 30 days.
A file someone adds to compare with the kept copy never leaves their device: their browser computes its fingerprint and sends only that.
Billing and subscription data
Delivvo uses Stripe to process subscription payments, custom-plan billing, and related transactions. When you subscribe to a paid plan or are otherwise charged, we may collect and store:
plan, subscription status, trial status, renewal dates, and billing references
invoices, amounts, and payment status data
customer IDs and subscription IDs from Stripe
We do not store full card numbers or other raw payment credentials on our own systems. Card data is collected and processed by Stripe under Stripe's own privacy and security practices.
If you buy a Cutroom licence, that is a one-time purchase from us rather than a subscription, and we are the seller. The payment itself is taken on Stripe's own hosted checkout page, where Stripe collects your card details and, where the card requires one, a billing address, under its own privacy notice. What we keep is the email address on your account, Stripe's checkout-session and payment identifiers, and the licence we issue against your account. We do not store your card number or your billing address.
Technical and usage data
We automatically collect limited technical and operational data when you use Delivvo, such as:
IP address or approximate network information
browser type, device type, operating system, and language settings
timestamps for logins, portal access, file activity, and workflow events
server logs, error logs, and audit trails
cookie or session identifiers used to keep you signed in or remember preferences
when you sign up, the country and city the network reports for your connection, which we keep on your account
We also count visits to our own website and app with a first-party counter that sets no cookie. For each page view it records the page, the referring site, the device type, the country and region reported by the network, and a visitor code made from your IP address and browser with a key that changes every day, so a visit cannot be linked to you from one day to the next. The IP address itself is not stored. Raw visit records are deleted after 90 days; only daily totals are kept after that.
When something breaks in your browser or on our servers, an error report goes to Sentry, our error-monitoring provider. We remove email addresses, IP addresses, cookies, and sign-in headers from those reports before they are sent. For errors in the browser, the report can include a short recording of the screen around the error, with all text masked and all images and media blocked.
We use this data to operate the service, maintain security, investigate abuse, and improve performance.
The list above describes the website, the dashboard, the client portals, and public forms and pages, meaning the things you reach through a browser. The Cutroom desktop application is a different piece of software and sends us different data. It is covered on its own below.
Advertising and measurement
We use the Meta (Facebook) Pixel and Meta's Conversions API to measure our own advertising and to show our ads to people likely to want Delivvo. The Pixel loads on the pages of our website and app, only after you choose "Accept all" on our cookie banner, and never on the pages businesses share with their clients through Delivvo (inquiry forms, booking, signing and proposal pages), and sets Meta's own cookies (see the Cookie Policy). It never loads on payment pages or inside client portals. For each page view, the Pixel and a matching message from our server send Meta the page address, your IP address, your browser's User-Agent string, and Meta's cookie identifiers. When you sign up, start a trial, buy a subscription, or send our Enterprise contact form, we also send Meta a one-way hash of your email address and of your account identifier and, for a purchase, the amount and currency. If you arrived from a Meta ad, we keep Meta's click identifiers on your account so a later purchase can be matched to that ad. Meta processes this information under its own terms and privacy policy.
Where we switch on Google Analytics, Google receives similar page-view information on the same pages and sets its own cookies.
We do not give Meta or Google the content you store in Delivvo, such as your clients, files, messages, documents, or form answers.
Cutroom licensing data
Cutroom runs on your computer. Your footage, your projects, and your exports stay there. We do not upload, receive, view, or store your media, and we never see the API keys you give the app for third-party AI or stock-media providers, because those are encrypted on your own device and are never sent to us. What does reach us is licensing traffic, limited to what a licence needs in order to work:
the email address on your account
an opaque fingerprint of each computer you activate, which identifies a machine to us without describing it
your licence key, its status, the plan, and the version of the app
the time of each activation and of each later licence check
the IP address and approximate location (country and city) of each activation and licence check
what the app reports about its own integrity, which is how we learn that a copy of the software has been modified
your acceptance of the Cutroom Licence Agreement: the version you accepted, the time you accepted it, the drawn signature you sign it with, an identifier for the device you signed on, the IP address and approximate location (country, region, city) you accepted it from, and the User-Agent string of the app or browser you accepted it in
The location is approximate. It is derived from the IP address by the network that serves our site, not by a separate lookup service, and it identifies a city and a country, never an address or a person's whereabouts. We record it only for licence holders who have accepted version 1.2.0 or later of the Cutroom Licence Agreement, which is the version that first discloses it. If you accepted an earlier version and have not accepted that one, your licence checks are recorded with no location on them at all.
We do not keep a record of every check. The app checks in regularly, and we write a record only when the check carries something new: a machine we have not seen, a different country, a different network, or a change in what the app reports about itself. Every activation writes one. When nothing changes, we write at most one record a day for each computer.
We use this data for one purpose, which is to tell whether a single licence is being used by more than one person. That is what section 3 of the Cutroom Licence Agreement does not allow, and it is the only thing these records are read for. Our checks may flag a licence for a person to review. A flag does not affect your use of the software: nothing is blocked, paused, slowed, or withheld because a licence has been flagged, and no automated process revokes anything. Suspending or revoking a licence is always a decision a person makes.
Buying Cutroom does not create a Delivvo workspace for you, and it does not put you on any Delivvo plan. If you never open the platform, we hold nothing about you beyond what is listed here and the purchase record described above.
How we use personal data
We use personal data for the following purposes:
to create, maintain, and secure user accounts
to authenticate businesses, their team members, and invited client users
to host project portals, public forms, and proposal pages, and display project content to authorized users
to send transactional emails such as login links, one-time passcodes, invoice reminders, portal invites, team invites, support responses, and product notices
to send, on a business's behalf, the emails it sends its clients and leads through Delivvo, including automatic replies it switches on
to generate contracts, quotes, invoices, credit notes, receipts, statements, PDFs, signatures, and approval records
to take bookings, keep connected calendars in step, and create meeting links
to send data to the services a business connects (calendars, meeting apps, Slack, accounting apps, webhooks, the API, and automation tools), on that business's instruction
to enforce plan limits, storage caps, and abuse-prevention controls, including automatic checks on form submissions
to issue Cutroom licences, verify them when the app checks in, and tell whether one licence is being used by several people
to respond to support tickets, disputes, and legal requests
to comply with applicable law, defend our rights, and maintain audit records
to improve product quality, reliability, and security
to count visits to our site and measure our own advertising, as described under Advertising and measurement
We do not use the product data you store in Delivvo to build advertising profiles about you, and we do not sell your personal information for money.
You can switch most notification emails on or off in your account's notification settings. If you no longer want announcements or product news from us, ask through the Support button and we will stop sending them to you. Transactional and service emails (such as login links, one-time passcodes, invoice reminders, portal invites, security notices, billing notices, and support responses) are necessary to operate your account and keep coming. Automated emails a business sends to its leads carry a link to stop them; that stop applies to that business's automated emails.
Legal bases for processing
Depending on your location and the context, Delivvo relies on one or more of the following legal bases:
Contractual necessity. We process personal data as needed to provide Delivvo, maintain accounts, operate project portals, and perform our obligations under our Terms or another contract with you.
Legitimate interests. We process data where necessary for security, fraud prevention, service reliability, abuse prevention, product administration, and internal analytics that do not override applicable rights.
Consent. We rely on consent where required, such as when you voluntarily provide certain optional information or where local law requires consent for particular processing.
Legal obligation. We may process data to comply with tax, accounting, law-enforcement, court-order, sanctions, consumer-protection, or data-protection obligations.
For users in the UAE, Delivvo intends to process personal data consistently with the UAE PDPL. For users in the EU or EEA, Delivvo intends to process personal data consistently with the GDPR. For California residents, Delivvo provides the notices in this policy to satisfy applicable CCPA disclosure requirements.
Delivvo's operator is DELIVVO COMPUTER SYSTEM DEVELOPMENT (in Arabic: دلفو لتطوير نظم الحاسب الآلي), a sole establishment licensed in Abu Dhabi, United Arab Emirates (licence no. CN-6512437, unified registration no. 101-2026-200103343). It is the controller for the personal data this policy describes as ours, and the UAE is its place of establishment for purposes of this policy. The same entity operates Cutroom. You can reach it through the support form at delivvo.io/contact.
When a business's client pays an invoice, the payment is processed by the gateway the business connected to its own account (for example Stripe, PayPal, Tap, Telr, PayTabs, Checkout.com, MyFatoorah, Moyasar, or N-Genius). For those payments Delivvo is not the merchant of record, takes no percentage, and does not store raw card data. Those data flows are governed by the respective gateway's own privacy notice. The only money that is ours is what you pay us directly: your Delivvo subscription, and a Cutroom licence if you buy one. Stripe charges both of those on our behalf, and for them we are the seller.
Cookies and similar technologies
Delivvo uses cookies and similar technologies to operate the service, remember your preferences, and measure our own advertising. They include:
sb-access-token and sb-refresh-token for signed-in sessions, including the sign-in that a Cutroom purchase runs through
portal_session for client portal access after one-time code verification
dlv_workspace to remember which workspace you are viewing, for people who belong to more than one
delivvo_locale to remember whether you read the site in English or Arabic
cookie_consent to remember the choice you made on our cookie banner
delivvo_impersonate, an admin-only cookie set during an active, audited support session in which a person we authorise views an account to provide support
dlv_gate, dlv_view_plan, and dlv_view_role, admin-only cookies that let a person we authorise into the site while it is closed for maintenance and preview a plan or role on their own account
cookies set by Meta's Pixel (such as _fbp and _fbc) and, where we switch it on, by Google Analytics (such as _ga)
Your theme, your display currency, and some interface states (for example a collapsed sidebar, or the email address you typed on a payment page) are saved in your browser's local storage, which stays on your device. An inquiry form you have started keeps your answers in that browser tab until you send it or close the tab.
When a client pays an invoice through a portal, a gateway's card form (for example Stripe's) may be loaded into the page, and the gateway sets its own cookies for fraud prevention, under its privacy notice rather than ours. The Cutroom desktop application is not a browser and sets no cookies.
Development-only cookies may also exist on local or demo environments, but they are not intended for production users.
For more detail, including how long each cookie lasts, please see our Cookie Policy.
How we share personal data
We share personal data only where necessary to operate Delivvo, comply with law, or protect rights and safety. We may share personal data with the following categories of recipients:
service providers and infrastructure vendors that host, authenticate, store files, deliver email, process payments, monitor errors, or support the service
advertising partners (Meta, and Google where we switch on Google Analytics), limited to the information described under Advertising and measurement
providers of the AI assistants we use to help run support and administration, limited to what a task needs, as described under Administrator access
professional advisers such as lawyers, auditors, or insurers where needed for legitimate business purposes
law enforcement, regulators, courts, or other third parties when required by law or to protect Delivvo, our users, or the public
a buyer, investor, or successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections
We do not sell personal data for money.
Current subprocessors
Delivvo currently relies on a limited set of subprocessors and infrastructure providers. These may include:
Supabase for database hosting and authentication. Delivvo's current Supabase stack is configured in the ap-southeast-1 (Singapore) region.
Cloudflare for file storage (Cloudflare R2, in a Western Europe location), including every file businesses and clients upload, archived document PDFs, logos, and our nightly database backups; for delivering file downloads; for receiving email sent to our reply and forwarding addresses on in.delivvo.io (Cloudflare Email Routing), which is how a lead's reply to a business reaches Delivvo; and, where it is switched on for a form, for Cloudflare Turnstile bot checks on public forms.
Vercel for application hosting and content delivery. Our application servers run in Vercel's Singapore region. Vercel's network is also what tells us the approximate country and city behind a request, from the IP address, for the display currency you are shown, the country and city recorded at signup, our visit counter, and the Cutroom records described above. That is a property of the connection we already have, not a lookup sent to anyone else.
Resend for email delivery.
Stripe for the money you pay Delivvo directly: subscription billing, custom-plan billing, and one-time Cutroom licence purchases. Stripe is not used to process payments between businesses and their clients unless a business connects its own Stripe account, and Delivvo takes no part of those.
ipapi.co for best-effort geolocation in the contract-signing audit trail, and only there. We look up the signing IP address once, at the moment a contract is signed.
Sentry for error monitoring and application performance diagnostics.
Google for "Sign in with Google" and, where we switch it on, Google Analytics.
Meta for advertising measurement, as described under Advertising and measurement.
GitHub for running our nightly database backup job, which passes the backup through GitHub's servers on its way to Cloudflare.
OpenAI and Anthropic, whose AI assistants we may connect to our admin tools, as described under Administrator access.
Delivvo's Supabase project also hosts a small, unrelated application built by the same operator. Each application keeps its data in its own database schema, with row-level security on every table, so neither application's users can reach the other's records. The two share Supabase's authentication layer, which is how Supabase is designed to work: if you happened to hold an account in both, your login record would be the same row. Nothing else crosses between them. No Delivvo project, file, message, invoice, or client record is available to that application or to the people using it.
Payments that a business's clients make flow through the payment gateway the business connects to its own account (for example Stripe, PayPal, Tap, Telr, PayTabs, Checkout.com, MyFatoorah, Moyasar, N-Genius, or a manual method such as IBAN, Wise, or Payoneer). Those gateways act as independent controllers or processors of the payer's data under their own privacy notices. Delivvo is not the merchant of record, does not hold those funds, and takes no percentage of them.
The same goes for the services a business connects itself, described under Connected apps and integrations above: Google and Microsoft calendars, Zoom, Slack, QuickBooks (Intuit), Xero, Zoho Books, and automation tools such as Zapier, Make, or n8n. They are providers the business chose, not Delivvo's subprocessors, and data reaches them only when a business connects them.
We may update our provider list from time to time as the product evolves. If we add materially new providers that affect how data is handled, we will update this policy.
International transfers
Because Delivvo uses cloud providers and serves users in multiple jurisdictions, personal data may be processed in countries other than the country where the user is located. This includes the UAE, Singapore (our database and application servers), the European Union (our file storage), the United States, and other locations where our providers operate.
When applicable, we take steps intended to support lawful transfers, such as using contractual commitments, vendor data-processing terms, and other safeguards appropriate to the transfer and the roles of the parties. If you are in the EU or EEA, you may contact us for additional information about relevant transfer safeguards.
Data retention
We retain personal data for as long as necessary for the purposes described in this policy, including to provide the service, maintain account continuity, support the work between businesses and their clients, comply with law, resolve disputes, and enforce our agreements.
As a general rule:
account and workspace data is kept while the account remains active
activity-log history is retained according to the account's plan: 7 days on Free, 30 days on Solo (and the earlier Starter plan), 1 year (365 days) on Pro, and 3 years (1095 days) on Team, Business, Enterprise, and Custom (and the earlier Agency plan). A daily job enforces this, and a downgrade takes effect on the next run
uploaded files are retained for the life of the project and account, subject to the storage caps that apply to the account's plan
leads stay in the business's account until the business deletes them. A deleted lead, and a lead marked as spam, is removed for good after 30 days, and a test lead after 7 days
the record of each email we sent (recipient, subject, and delivery status, never the message body of a project message) is kept for 365 days, and payment event history for 365 days
the record of events sent to a business's webhooks and connected apps, with each delivery attempt, is kept for 30 days
files attached to an inquiry form that was never sent are deleted after 24 hours
the record of each acceptance of our Terms and Privacy Policy, and of a portal's terms (who accepted, which version and its exact wording, when, the IP address and the browser), is kept for 10 years after the account or client record is closed, because it is the proof of what was accepted. It can't be changed or deleted in that time, even on a deletion request, because the law lets us keep data we need to establish, exercise or defend legal claims (including the UAE Personal Data Protection Law and the GDPR)
error logs are kept for up to 90 days, and raw visit records for 90 days
if you ask to delete your account, you have 30 days to change your mind. After that, a daily job deletes the account and the personal data in it from our active systems, unless we must retain some records longer for legal, tax, fraud-prevention, or security reasons
the archive copies of signed contracts, sent invoices, credit notes, and receipts (described in our Terms) are kept after the project, client, or account they came from is deleted, so that later dispute, disclosure, and tax-record requests can be answered. They are kept for at least ten years from the day each one was finalised. No one can delete them before then, not the business and not Delivvo, unless a court or the law orders it. A business can download all of its archived documents, with spreadsheets of its invoices, credit notes, receipts and payments, at any time from the archive ("Export all documents"); the download link works for 7 days and the file is then deleted
Delivvo invoices, refund notes and the payment records behind them (for money you pay us, never money your clients pay you) are kept for at least five years, and up to seven where UAE tax law requires, even after the account is deleted. They hold your business name, account email, country and the amounts, and nothing else
database backups are kept for 30 days
records of actions taken by people we authorise to run Delivvo are kept with no fixed deletion date, because they are how we answer for what was done
support records, audit trails, and limited backup copies may remain for a reasonable period where necessary for business continuity or compliance
For Cutroom:
the trail of activations and licence checks, meaning the IP address and approximate location recorded against each one, is deleted after 180 days. The same daily job enforces this, by age alone. We do not extend it for a licence we happen to find interesting
the licence itself, and the record of each computer activated against it, are kept while the licence exists. That per-machine record holds the machine's fingerprint and the last IP address and approximate location we saw it check in from, and it is not aged out at 180 days the way the trail is. Deleting the licence deletes both
the record of your acceptance of the Cutroom Licence Agreement is kept while the licence exists, because it is the proof that you agreed to it
Retention may vary depending on the nature of the data, the requests of the account owner, and the legal obligations that apply.
Security
We use administrative, technical, and organizational measures intended to protect personal data. These measures include encrypted transport over HTTPS, access controls, role restrictions, password protection, audit logging, and security monitoring. Files are stored privately and are reached only through short-lived signed links that our server issues after checking that the person asking may see the file. Business logos are the exception: they are public, because they appear in emails and documents. Where supported by our infrastructure providers, data is also encrypted at rest.
No method of transmission or storage is perfectly secure. For that reason, while we work to protect personal data, we cannot guarantee absolute security. Users are also responsible for protecting account credentials, using strong passwords, and controlling access to project information on their side.
Payment gateway credentials
When a business connects a payment gateway (for example Stripe, PayPal, Tap Payments, Telr, PayTabs, Checkout.com, MyFatoorah, Moyasar, or N-Genius), the gateway's API keys, secret keys, and webhook signing secrets are encrypted at the application layer using authenticated symmetric encryption (AES-256-GCM) before they are written to our database. The decryption key lives only in the runtime service's environment configuration; it is not stored in the database, not surfaced through any administrative interface, and not retrievable through queries that bypass the runtime helper. Delivvo personnel do not have a workflow that returns plaintext gateway credentials.
The Payments feature does not cause Delivvo to process or hold any client funds. Payment instrument details (card numbers, bank-account numbers, etc.) entered by a business's clients are submitted directly to the chosen gateway through that gateway's hosted UI or its embedded SDK; Delivvo does not see, store, or transmit those details. The gateway is responsible for processing them in accordance with its own privacy policy, security obligations, and PCI/applicable regulatory regime.
What Delivvo does record about a payment is limited to the metadata necessary to keep the business's invoice in sync with the gateway: the business to which the payment belongs, the invoice it relates to, the gateway used, the gateway's transaction or charge identifier, the amount, currency, and resulting status (succeeded, failed, refunded, etc.) as reported by the gateway. We do not store full payment instrument numbers, CVV codes, or banking account numbers in any context.
For payment links (public URLs that allow a business's clients to pay a stated amount without first signing in to a portal) Delivvo additionally captures the email address the payer supplies on the payment form so that we can match the resulting transaction back to the right link, surface a status receipt, and let the business reconcile incoming payments. The payer email is treated like any other client contact field under this policy.
For recurring invoices, Delivvo stores the schedule itself (start date, cadence, end condition, line items) and the per-cycle invoice records that the schedule produces. The actual charge for each cycle is processed by the gateway and produces the same metadata described in the preceding paragraph.
For saved client payment methods, where the gateway supports retaining a payer's payment instrument for future use, Delivvo stores only the gateway-issued customer identifier and any opaque token the gateway returns to reference the saved method; the card number, expiry, CVV, and equivalent banking details remain at the gateway and are governed by the gateway's privacy and security practices.
For refunds and disputes, Delivvo records the existence and lifecycle of each refund attempt or dispute (status, amount, reason code, gateway identifiers, and resulting effect on the related invoice) so the business's activity log and accounting view stay accurate. Delivvo does not store the supporting documents a business uploads to a gateway to contest a dispute; those flow through the gateway's own evidence-submission interface where applicable. A business can download an evidence pack for a payment, built on request from what its account already holds (the payment, the invoice, the project's signed contracts with their signing records and partly masked IP addresses, the project timeline, and recent messages with the client). Delivvo builds it for the business's download only, does not keep a copy, and never sends it to a gateway.
When a client pays by bank transfer or another manual method, the client can upload a proof of payment (an image or a PDF). It is stored with the invoice in the business's account, is visible to the business, and counts toward its storage.
Administrator access
People we authorise to run Delivvo use an admin console to support accounts, prevent fraud and abuse, and meet our legal duties. What each of them can do depends on the permissions we give them. The console shows account details, the plan and its usage, the team and its invitations, the account's own audit log, the email log, form and lead settings with counts of inquiries, bookings and calendar connection health, the connected apps and keys by name (never their secrets), payment metadata, and document details such as numbers, totals, statuses, and signing records. It does not show the text of messages, and it has no tool that returns plaintext gateway credentials, webhook signing secrets, or any payment-instrument data covered by the preceding subsection.
Opening an individual document (viewing it on screen, downloading its PDF, or exporting a contract's signing record, which shows each signer's IP address) is recorded in an internal audit log under the administrator's identity, together with minimal metadata about the document. Opening an invoice, credit note, or quote, a proposal's response record, or a contract's signing record from the admin documents screens also needs a typed reason. No administrator can delete an archived contract, invoice, credit note, or receipt. Admin actions that change something inside an account (for example pausing a form, revoking an API key, or resending a team invite) need a written reason, are recorded in the same log, and also appear in the account's own audit log signed "Delivvo support".
To help with a support request or investigate a problem, a person we authorise can open a support view of an account. It is read-only, needs a written reason, ends after at most 4 hours, and its start and end are recorded in the audit log. During it they see the account as its owner sees it, including projects, files, documents, and message threads.
We may connect AI assistants (from OpenAI or Anthropic) to our admin tools to help us handle support and administration. Each connection only has the access we grant it, actions that affect customers wait for a person to approve them, and the providers process what the assistant reads under their business terms.
Your privacy rights
Depending on where you live, you may have some or all of the following rights, subject to applicable conditions and exceptions:
access personal data we hold about you
know what categories of data we collect, the sources of that data, the purposes for using it, and the categories of recipients to whom it is disclosed
request correction of inaccurate or incomplete personal data
request deletion of personal data
request restriction of processing, or object to certain processing
withdraw consent where processing is based on consent
request portability of personal data in a usable format
appeal or complain to a supervisory authority or regulator, where available
If you are a California resident, you may also request information about the categories of personal information collected, disclosed for business purposes, corrected, or deleted during the previous 12 months. Delivvo does not sell personal information for money. We use Meta's advertising tools as described under Advertising and measurement; you can block the Meta Pixel with your browser's cookie settings or a content blocker.
Delivvo does not use sensitive personal information for purposes that would require a special California right-to-limit workflow beyond what is reasonably necessary to provide the service.
How to exercise your rights
To submit a data access, correction, deletion, portability, or other privacy request, use the Support button at the bottom of any page on delivvo.io. Account holders can also download a copy of their account data themselves at any time from their account settings, without contacting Support, using the self-service data export. That export covers your Delivvo workspace: your profile, projects, clients, contracts with their signing records, invoices, proposals, activity, leads with their form answers and timelines, forms, bookings and booking types, your catalogue, your team conversations, and the details of your files (the files themselves you download from your dashboard). Leads also have their own spreadsheet export on the Leads page, and every archived document can be downloaded with "Export all documents". The account export does not include Cutroom licensing records, so if you want those, ask us through the support link on delivvo.io/cutroom and we will provide them. You can also ask to delete your account from your account settings. We may ask for additional information to verify identity and confirm that the requester is entitled to make the request. Where Delivvo acts only as a processor or service provider for a business, we may direct the request to the relevant account owner or ask you to contact them directly.
We aim to respond within the time required by applicable law. In many cases that will be within 30 days, though some requests may take longer if legally permitted and reasonably necessary.
Children's data
Delivvo is designed for business use and is not directed to children. We do not knowingly collect personal data from children under 18. If you believe a child has provided personal data to Delivvo, contact us and we will take appropriate steps to investigate and, where appropriate, delete the data.
Changes to this policy
We may update this Privacy Policy from time to time to reflect product changes, legal developments, or operational requirements. If we make a material change, we will revise the "updatedAt" date and may also provide notice through the product or by email where appropriate.
Contact
For privacy requests or questions about this policy, use the Support button at the bottom of any page on delivvo.io.