Privacy Policy

Last updated: April 2026

1. Who We Are

DAPITA LTD is a company registered in England and Wales (Company Number 16634395), with its registered address at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. We operate the DAPITA Core platform and related services at core.dapita.net, auth.dapita.net, baas.dapita.net, algo.dapita.net, and app.dapita.net.

Data Protection contact: security@dapita.net

2. What Data We Collect

When you use our website and services, we may collect:

• Account information: email address (encrypted at rest with AES-256-GCM), user ID, account type
• Authentication data: OAuth tokens, session tokens (stored as SHA-256 hashes, never in plaintext)
• Payment data: processed by Stripe — we never store card numbers, CVV, or full payment details
• Technical data: IP address, browser user agent, pages visited
• License data: license keys, installation IDs, server fingerprints

3. How We Use Your Data

We use your data to:

• Provide and maintain your account and licenses
• Process payments through Stripe
• Verify license validity and manage installations
• Send transactional emails (order confirmations, license renewals)
• Provide technical support
• Detect and prevent fraud or abuse

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described below.

4. Third-Party Services

• Stripe — payment processing. Subject to Stripe's Privacy Policy
• HashiCorp Vault — encryption key management (self-hosted, your keys never leave our infrastructure)
• Let's Encrypt — SSL certificate provisioning for customer installations

5. Data Storage and Security

Your account data is stored in PostgreSQL databases hosted on servers within the European Union. Email addresses are encrypted using AES-256-GCM with keys managed by HashiCorp Vault. Session tokens are stored as SHA-256 hashes. We employ field-level encryption, automatic key rotation every 90 days, and AppArmor security profiles for process isolation.

6. Self-Hosted Installations

When you install DAPITA Core on your own server, the data stored in your installation (products, customers, orders, messages) is entirely under your control. We have no access to your installation's database. The only data exchanged between your installation and our services is: license verification requests, plugin download requests, and optional BaaS/Algo API calls that you initiate.

7. Your Rights (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of your data (right to be forgotten)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise these rights, contact security@dapita.net. We will respond within 30 days.

8. Cookies

We use essential cookies only: session tokens for authentication and theme preferences. We do not use tracking cookies, analytics cookies, or advertising cookies on core.dapita.net.

9. Data Retention

Account data is retained as long as your account is active. Session data expires after 7 days. Payment records are retained for 7 years for tax compliance. If you delete your account, personal data is removed within 30 days, except where retention is required by law.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered users. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For privacy-related inquiries: security@dapita.net

For general inquiries: info@dapita.net

DAPITA LTD, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom