Privacy policy

Who is responsible for the data

• Operator of the Dodano service: ФОП Ольга Іваненко.
• Email for data-related enquiries: olhadevone@gmail.com.

What data the web app stores

• Account: email, name, password hash (if you set one; we do not store the password itself), email confirmation and notification settings.
• Work data: projects, rooms, products and specification items (names, prices, quantities, shop links and photos, notes), client proposals and their revisions.
• Client decisions made through an approval link: the name provided by the client, decision, comment and time, as well as a hash of the IP address and browser type (user-agent) — to protect against abuse. We do not store the IP address itself.
• Extension API tokens: only the token hash, its name, first characters and last-used date.
• Technical data: an activity log in the workspace (who changed what), import history (page address and which fields were found), feedback you submit through the form, and server error logs.

Request rate limiting uses the IP address only in the server's working memory and is not recorded in the database.

Chrome extension

• The extension sends an open page only when you click its toolbar icon, the “Add to specification” item in the context menu or the Dodano button on the page (if you have allowed buttons on all sites or on this site). There is no background data collection, view tracking or browser history collection.
• After you click, the HTML of this page (as well as selected text and the address of the selected image, if you selected them) is sent only to the Dodano server whose address is specified in the extension settings. The server extracts the product name, price, photos and other fields from it; the HTML itself is not stored.
• Account connection: the “Connect Dodano” button opens a Dodano page where, after you click “Connect”, an API token is created and passed to the extension directly in your browser; the extension verifies it on your Dodano server and only then stores it. For this, the extension requests access to the Dodano address.
• The server address, the API token, the email and workspace name of the connected account, the last selected project and room, the one-click add toggle and the on-page button settings (sites with buttons, disabled sites, the "on all sites" mode, the pause) are stored locally in your browser (chrome.storage.local). A page captured via the context menu is kept in chrome.storage.session and deleted as soon as the extension window opens; the IDs of products added in one click are kept there until the browser is closed, so that the "Undo" button works.
• The extension does not use analytics, advertising, third-party fonts or a CDN, and does not contact other servers.
• Permissions: activeTab and scripting — to read the page after you click; contextMenus — the context-menu item; storage — to save settings. When installed, the extension does not gain access to any site.
• Buttons on the page: by default, they appear only on sites that you have enabled ("Buttons on {site}" in the extension window or the list of sites in its settings). The "Dodano for Chrome" page that opens after installation offers once to allow the extension to work on shop sites: after this click, Chrome requests optional access to all sites (optional host permissions), and enabling a site no longer requires a separate request. Without this permission, Chrome requests access to each site that you enable. Access alone does not enable the buttons: the button script works only on enabled sites, and on all sites only if you have enabled the "On all sites" mode in the extension settings.
• The button script searches for product cards locally, in your browser, and shows the “Add to project” button only where it finds product cards or product data. It reads and sends the product page to your Dodano server only after you click the button; nothing leaves the browser before then. You can disable buttons on a site, pause them everywhere or remove access in the extension window, its settings or on chrome://extensions.
• Browser relay: some shops block the Dodano server. In that case, you can click "Get via extension" in the add-item window — the extension will load this product page in your browser (with your cookies for that shop) and send its HTML to your Dodano server for extraction, as after clicking the icon. For this, the extension requests access to the Dodano address (so the Dodano site can reach the extension) and to the shop's site (a separate window with an "Allow" button); you confirm each new shop in this window, even if the extension is allowed on all sites; approved shops can be removed in the extension settings. The page is loaded only after you click on the Dodano site: without this, the extension reads nothing. If the shop does not provide the page directly, the extension opens it in a background tab for a few seconds and closes it immediately.

Why we use the data

• To provide the service: store your projects, show proposals to clients and record their decisions.
• For sign-in and security: sessions, sign-in links and protection against abuse.
• To send emails: sign-in links, email confirmation and notifications about client decisions (you can disable them in the settings).
• To respond to your enquiries and improve the service based on your feedback.

We do not sell data, use it for advertising or share it with third parties, except as described below.

Who receives the data

• Technical contractors — only to the extent necessary to operate the service: the hosting provider of the server on which Dodano runs and the email service through which emails are sent.
• State authorities — only in response to a lawful request required by Ukrainian law.

Product photos added by link are loaded directly from the shop's website into your browser.

Cookies and local storage

We use one cookie — zb_session. It is required to sign in to your account, lasts for up to 30 days and is inaccessible to page scripts. There are no advertising or analytics cookies.

On the approval page, the client's name is saved in their browser's localStorage so it does not need to be entered again.

How long we keep the data

• Account and work data — while the account exists.
• Sign-in sessions — up to 30 days; sign-in links from emails — 15 minutes.
• Database backups — up to 14 days.

To delete your account and all associated data, email olhadevone@gmail.com. We will delete it within 30 days; it will disappear from backups after their retention period ends.

Your rights

You can view and change your data in the app, delete projects and items, revoke API tokens in "Settings", export specifications in XLSX or CSV, and request access to, correction or deletion of your data in accordance with the Law of Ukraine "On Personal Data Protection".

A client who has left a decision through a link can contact the designer who sent the link or contact us: olhadevone@gmail.com.

Policy changes

The date of the current edition is shown at the top of the page. We will notify you of material changes on this page or by email.

Contacts

Data enquiries and deletion requests: olhadevone@gmail.com.