Privacy Policy

Last updated: 15 February 2026

1. Data Controller

Xolo Go OÜ (issued by Ville Sakari Myllyniemi) is the data controller. Reg no: 14717109. VAT ID: EE102156920. Contact: support@dorafix.eu.

2. Data We Collect

Data	Purpose	Legal Basis	Retention
Email, name	Account management	Contract (Art. 6(1)(b) GDPR)	Until account deletion
Password hash	Authentication	Contract	Until account deletion
Uploaded files	Validation & repair	Contract	1 hour (auto-deleted)
IP address	Rate limiting, security	Legitimate interest (Art. 6(1)(f))	In-memory only
Payment data	Payment processing	Contract	Handled by Stripe

3. Data Processors

Processor	Purpose	Location
Stripe, Inc.	Payment processing	EU (Ireland) / US

We do not sell, rent, or share your personal data with any other third parties.

4. File Processing

Uploaded DORA reporting packages are processed server-side for validation and repair. Files are stored temporarily (default: 1 hour) and then permanently deleted. File contents are never used for training, analytics, or any purpose other than providing the Service.

5. Security

We implement appropriate technical measures including: bcrypt password hashing, JWT token authentication, HMAC-signed download URLs with expiry, TLS encryption in transit, non-root container execution, and automatic data expiry.

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict processing
Data portability — receive your data in machine-readable format
Object to processing based on legitimate interest
Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

To exercise these rights, email support@dorafix.eu. We respond within 30 days.

7. Cookies

The Service uses only essential localStorage for authentication tokens. We do not use tracking cookies, analytics scripts, or advertising trackers.

8. International Transfers

Payment data may be transferred to the United States by Stripe under their Standard Contractual Clauses. All other data is processed within the EU.

9. Children

The Service is not directed at persons under 16 years of age.

10. Changes

We will notify registered users of material changes via email at least 30 days before they take effect.

Contact

Xolo Go OÜ
Issued by: Ville Sakari Myllyniemi
Reg no: 14717109
VAT ID: EE102156920
Data protection inquiries: support@dorafix.eu