Privacy Policy

Last updated: 15 February 2026

1. Data Controller

Xolo Go OÜ is the data controller. Reg no: 14717109. VAT ID: EE102156920. Contact: support@dorafix.eu.

2. Data We Collect

Data	Purpose	Legal Basis	Retention
Email, name	Account management	Contract (Art. 6(1)(b) GDPR)	Until account deletion
Password hash	Authentication	Contract	Until account deletion
Uploaded files	Validation & repair	Contract	1 hour (auto-deleted)
IP address	Rate limiting, security	Legitimate interest (Art. 6(1)(f))	In-memory only
Payment data	Payment processing	Contract	Handled by Stripe

3. Data Processors

Processor	Purpose	Location
Hetzner Online GmbH	Server infrastructure and temporary file storage	Germany (EU)
Stripe, Inc.	Payment processing	EU (Ireland) / US
Google LLC (Google Fonts)	Web font delivery; receives your IP address when a page loads	US

We do not sell, rent, or share your personal data with any other third parties.

4. File Processing

Where your file is processed depends on the file and the action:

In your browser. CSV and XBRL files are validated locally by the in-browser engine, provided that engine has finished loading. Those files are not transmitted to us.
On our servers. ZIP packages are always validated server-side, and every repair is performed server-side regardless of file type. A DORA Register of Information package is normally a ZIP, so in ordinary use your file is transmitted to us.

Server-side files are processed on Hetzner infrastructure in Germany, stored temporarily (default: 1 hour) and then permanently deleted. File contents are never used for training, analytics, or any purpose other than providing the Service.

5. Security

We implement appropriate technical measures including: bcrypt password hashing, JWT token authentication, HMAC-signed download URLs with expiry, TLS encryption in transit, non-root container execution, and automatic data expiry.

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict processing
Data portability — receive your data in machine-readable format
Object to processing based on legitimate interest
Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), the supervisory authority for the data controller named in section 1, or with the supervisory authority of your own country of residence

To exercise these rights, email support@dorafix.eu. We respond within 30 days.

7. Cookies

The Service uses only essential localStorage for authentication tokens. We do not use tracking cookies, analytics scripts, or advertising trackers.

8. International Transfers

Payment data may be transferred to the United States by Stripe under their Standard Contractual Clauses. All other data is processed within the EU.

9. Children

The Service is not directed at persons under 16 years of age.

10. Changes

We will notify registered users of material changes via email at least 30 days before they take effect.

Contact

Xolo Go OÜ
Reg no: 14717109
VAT ID: EE102156920
Data protection inquiries: support@dorafix.eu