DIOVISLegal
Privacy Policy
Last updated: 30 October 2026 · Version 1
Notice: Some individual provider, storage and contract details have not yet been conclusively confirmed. Public provider standards are expressly distinguished from verified settings of our own accounts.
1. Controller
- Controller
- Diovis e.U., proprietor Dean-Silviu Mitco
- Business address
- Eisenstraße 13, 4460 Losenstein, Austria
- Phone
- +43 664 9494891
- Website
- https://mitcodean.com
2. General information
We process personal data to operate the website, handle enquiries, provide demo features expressly used, organise appointments and protect our systems. The relevant processing depends on the features actually used and the data supplied.
Our retention principle is to use data for its purpose and delete it once that purpose ends, unless legal retention duties or other lawful retention grounds apply. External providers and their technical logs have separate rules.
3. Website access and hosting
The website is hosted by Hostinger. Access may involve an IP address, time, requested URL, browser/device information and security or error logs. This supports delivery, troubleshooting and abuse prevention. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a secure and functioning website.
Hostinger’s public DPA generally provides for deletion of customer data 30 days after termination, subject to service-specific terms. This is not a general lifetime for active server logs. The specific contracting entity, server region and log/backup arrangements for our account have not yet been conclusively confirmed.
4. Contact and contact form
The form requires a name, email address and message. Phone number and subject are optional. There is no separate company field; company information may be included voluntarily in the message. We use these details to respond and, where relevant, prepare an engagement. Depending on the enquiry, this relies on Article 6(1)(b) GDPR for pre-contractual steps involving the data subject, or Article 6(1)(f) GDPR for legitimate business correspondence.
Our server sends form messages through Resend to contact@mitcodean.com; the visitor’s submitted address is used as the reply address. Our business mailbox is provided by Hostinger Email. The application validates input and origin and uses a hidden field to help identify automated submissions. The delivery path does not provide a separate contact database.
Resend publishes 30-day email-content/log retention for Free/Pro/Scale, seven-day backups and deletion of remaining customer data within 90 days of account termination. Enterprise terms may differ. It states that storage is in the United States; selecting an EU sending region does not change this. Our actual plan and tracking/webhook settings remain to be confirmed.
Enquiry and mailbox data are deleted when their purpose ends under our retention principle. Specific mailbox, archive, forwarding and backup arrangements have not yet been fully documented.
5. Interactive AI demo
The demo processes the currently entered text, selected model and language. Our server sends the text and necessary analysis instructions to the OpenAI API. The available models are gpt-4.1-nano and gpt-5-nano. Results are held in the open demo’s state. Drawings and attachments are not uploaded or analysed; the displayed manual approval is a simulation.
Do not enter confidential information, third-party personal data or special categories of personal data. AI results may be incorrect or incomplete and require human review before business use.
The application uses store=false. OpenAI’s public documentation states that API data is generally not used for model training without opt-in, and abuse-monitoring logs may normally be retained for up to 30 days, subject to documented exceptions such as legal or necessary protection grounds. store=false does not mean no storage.
Our specific contracting/project assignment, data-sharing and retention settings, API region and transfer arrangements remain to be confirmed. The voluntary demo illustrates our services; the final document-specific assignment of its data protection basis remains open.
6. Abuse prevention and usage limits
Protected demo calls are limited to five attempts within a rolling 24-hour window per visitor and network identifier. A minimum interval and global/concurrent-use limits also apply. These protect availability and API budget; the basis is the legitimate interest in preventing abuse under Article 6(1)(f) GDPR.
Processing includes a signed visitor identifier, HMAC-pseudonymised visitor/network identifiers, attempt timestamps and technical reservations. This is not complete anonymisation; several users sharing a network connection may share a limit. The limiter does not store raw enquiry text.
The application supports local file storage and Upstash Redis; its code requires shared Redis storage and a verified IP-header configuration for public operation. Whether and in which region Upstash is used in production has not yet been conclusively confirmed.
The counting window is 24 hours. The roughly 24-hour Redis TTL is refreshed on writes and does not guarantee deletion of every record, log or backup after exactly 24 hours. Actual provider/backup periods remain to be confirmed.
7. Appointments through Calendly
Our booking link opens Calendly in a new tab. No Calendly widget is embedded in the reviewed website code. When you visit the external page, Calendly processes information supplied there; Diovis uses the booking details it receives to organise the appointment.
Calendly describes US data centres and standard contractual clauses in its DPA as a transfer mechanism. Active booking fields, calendar/meeting connections, account terms and actual retention remain to be confirmed. The legal basis depends on the booking purpose, particularly pre-contractual steps or the legitimate interest in business communication. You can alternatively contact us directly by email or phone.
Calendly storage and transfers · Calendly deletion functions
9. Recipients and international transfers
Relevant services include Hostinger for the website and business mailbox, Resend for form emails, OpenAI when using the demo, Calendly for appointments, and Upstash only where Redis is actually used. Additional recipients may arise from active mailbox, calendar, meeting or webhook connections; these remain to be fully assigned.
Public provider terms describe standard contractual clauses or other suitable transfer mechanisms depending on the service. This establishes neither an “EU only” guarantee nor proof of all individual account/contract settings. The specific legal entities, roles, sub-processors and transfer arrangements for our accounts are not yet fully confirmed.
10. Retention and deletion
Personal data is processed for its purpose and deleted when that purpose ends, unless legal retention duties or other lawful grounds, such as establishing or defending legal claims, apply. This principle covers our own enquiry, correspondence and appointment data.
Provider logs, backups and archives have separate terms. The provider standards above are not blanket Diovis retention periods. Account-specific log, mailbox, archive, backup and deletion procedures have not yet been fully documented. Cookie expiry or a counting window does not automatically delete all related data.
11. Your rights
Subject to applicable legal conditions and exceptions, your rights include:
- Access (Article 15 GDPR)
- Rectification (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Objection to processing based on legitimate interests (Article 21 GDPR)
- Withdrawal of consent for the future (Article 7(3) GDPR)
For privacy requests, contact contact@mitcodean.com.
12. Complaints
You may lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria.
13. Updates
This policy is adjusted when actual processing or legal requirements change. The published version is available in this website’s Privacy Policy.