Privacy Policy
What personal data Doboti processes, why, who helps us, how long we keep it, and your rights under the GDPR.
Doboti keeps your invoices, expenses, bank statements and the monthly archive for your accountant. That is financial data, about you and about the people you do business with, so we treat it with care. This policy explains what personal data we process, why, who helps us, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR).
1. Who we are
Doboti is run by:
SANDU C. MIRCEA PFA
Str. Sfântul Petru Tei nr. 44-46, et. 1, ap. 3, Sector 2, București, Romania
Trade Register no. F40/550/2019, CUI (VAT ID) RO40773137
Email: support@doboti.com
In this policy “Doboti”, “we” and “us” mean this operator. We are established in Romania and subject to Romanian law and the GDPR.
We have not appointed a Data Protection Officer (DPO). Our processing does not meet the conditions of Art. 37 GDPR that make one compulsory. For any privacy question, write to support@doboti.com.
2. What this policy covers
- the Doboti app at app.doboti.com, including the Inbox addresses at in.doboti.com;
- this website, doboti.com;
- the connection that lets AI assistants you authorise work with your companies (our MCP server at app.doboti.com/mcp).
3. Two roles: your account, and your business data
Doboti processes personal data in two different roles.
We are the controller for the data we need to run your account: your name and email address, how you sign in, your plan, the security log, analytics, and the messages you send us. Sections 4 to 15 describe this processing.
We are your processor for the business data you keep in Doboti: your clients and suppliers, the people named on your invoices, receipts and bank statements, your accountant’s address, and the mail that arrives in your Inbox. You, or the company you work for, decide what goes in and why, so you are the controller of that data. We process it only to run Doboti for you, on the terms in Section 11 of our Terms of Service. If someone asks us about data that you keep about them, we pass the request to you.
4. Data we collect and why
| Data | Why | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Name, email address, password (stored only as a one-way hash), two-step sign-in secret and backup codes | Creating your account and signing you in | Contract (6(1)(b)) |
| Sign in with Google: your name, email address and Google account identifier | Letting you sign in with Google, if you choose to | Contract (6(1)(b)) |
| Sessions: the IP address and browser of each signed-in device | Keeping you signed in and showing you where you are signed in | Contract (6(1)(b)) |
| Companies and members: the companies you belong to and your role in each | Showing each member what their role allows | Contract (6(1)(b)) |
| Business data: company details, clients, invoices, expenses, receipts, bank statements, Inbox mail, Month close archives and the files you upload | The service itself. We process this as your processor (Section 3) | Your instructions as controller (Art. 28 GDPR) |
| e-Factura connection: the access tokens ANAF gives us when you connect your company, stored encrypted | Sending your invoices to ANAF and reading their answers | Contract (6(1)(b)) |
| Oblio import: the API key you give us, used once for the import | Copying your clients and invoices from Oblio | Contract (6(1)(b)) |
| Billing data: plan, subscription status, Stripe customer and subscription IDs, and who in the company pays | Running the Pro plan, and keeping our own accounting records | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Trial: when your trial month starts and ends | Giving each person one trial month | Contract (6(1)(b)) |
| AI assistant connections: the assistant’s name, the companies you allowed, the access and refresh tokens, and the actions that wait for your approval | Running a connection you authorised (Section 7) | Consent (6(1)(a)), withdrawn when you revoke the connection |
| Security log: sign-ins, failed sign-ins, changes to passwords, members and roles, file downloads and links sent. It holds IDs and action names, never file names or the content of a document | Protecting your account and investigating abuse | Legitimate interest (6(1)(f)) |
| Activity counts: which action ran in which company, with IDs only, never names or amounts | Knowing which parts of Doboti are used, and helping you when you ask for support | Legitimate interest (6(1)(f)); you can object (Section 14) |
| Analytics on doboti.com and app.doboti.com: page views and a few events, without cookies and without any person or company ID (Section 9) | Knowing which pages are useful | Legitimate interest (6(1)(f)) |
| Account emails: verification, password reset, security notices, invitations, trial and billing notices | Running the service you use | Contract (6(1)(b)) |
| Messages you send us | Answering you | Contract (6(1)(b)) or legitimate interest (6(1)(f)) |
| Technical data: IP address, browser and request times, processed by our hosting provider | Delivering pages, stopping abuse, keeping the service secure | Legitimate interest (6(1)(f)) |
We do not sell personal data. We do not use it for advertising, and we have no advertising pixels on our pages. We never receive or store your card details: Stripe handles payments.
5. What leaves Doboti, and only when you ask
Some features send data outside Doboti. Each one runs only when you, or a member of your company, start it.
- e-Factura. When you send an invoice, it goes to ANAF, the Romanian tax authority, through the SPV system. ANAF is a public authority that receives the invoice under Romanian law. It is not our processor.
- Invoices by email. When you send an invoice to a client, we email it from invoices@send.doboti.com, with your address as the reply address.
- Month close. When you send a month to your accountant, we email them a link to the archive.
- Invitations. When you invite a member, we email them an invitation.
6. Reading documents with AI
Doboti reads invoices, receipts and bank statement PDFs so you don’t have to type them. We do this with AI models that run on Cloudflare (Workers AI), inside the same provider that hosts Doboti. The document goes to the model only to read it, and the model’s answer is checked against the document’s own text.
We do not send your documents to other AI companies, and we do not use your data to train AI models. Readings can be wrong, so check them before you rely on them. We do not use AI to make decisions about you that have legal or similarly significant effects (Art. 22 GDPR).
7. AI assistants
You can connect an AI assistant, such as Claude or ChatGPT, to Doboti over the Model Context Protocol (MCP). This is off by default, and nothing is shared until you connect an assistant yourself.
When you connect, you sign in to Doboti and choose which companies the assistant may reach. The assistant acts as you, with your role in each company. It cannot see or change company details, bank accounts or e-Factura settings.
Some actions wait for your approval in Doboti before they run: anything that sends something out of Doboti (an invoice by email, an invoice to ANAF, a month to your accountant) and any permanent delete. The assistant can never approve them for itself.
Who receives this data. The assistant’s provider, such as Anthropic or OpenAI, receives everything Doboti returns to the assistant. You chose that provider. It is not our processor, and it handles that data under its own privacy policy.
What we keep. What the assistant creates or changes is ordinary business data in your company. We count each tool call by its name only. We do not log what the assistant sent us or what we returned. Revoke a connection at any time in the app, and it stops at once.
8. The Inbox
Each person gets their own Inbox address. Doboti accepts mail there only from addresses that you verified. Mail from any other address is refused and not read. Doboti reads each accepted document to find the company it belongs to, files it, or keeps it for you to review. A mail with no attachment is saved as a PDF of its text.
The Inbox is a Pro feature. On a company without Pro, mail is kept for 30 days without being read, and deleted after that unless you upgrade. Refused mail is deleted after 30 days.
9. Analytics and cookies
Analytics. We count page views with Umami, on our own server. Umami uses no cookies and does not follow you to other websites. In the app, we remove every ID from the address before a page view is sent, and we never send your name, your email address or your company. We count a few events, such as a completed sign-up, without any detail about you.
Cookies. We use only strictly necessary cookies: the session cookie that keeps you signed in, and short-lived cookies used while you sign in. Under Romanian Law 506/2004 and the ePrivacy Directive these need no consent, so we show no cookie banner. We use no advertising, social media or cross-site tracking cookies.
10. Who at Doboti can see your data
For support and operations, we can see account-level information: your name, your email address, the companies you belong to, their plan, and when you were last active. We see activity as counts, not as content.
We do not look at your business data (invoices, expenses, statements, mail, files) unless you ask us to help with a problem, or we must investigate abuse or a security incident. Then we look only at what the problem needs.
11. Service providers
These providers process personal data for us, only on our instructions and under data processing terms.
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare | Hosting the app and this website, the databases, file storage and backups, sending and receiving email, AI document reading, network security | EU data storage; global network for traffic |
| DigitalOcean | Hosting our analytics server (Umami) | EU (Amsterdam, Netherlands) |
| Stripe, through Stripe Managed Payments | Checkout, subscriptions, invoices and the billing portal | United States / EU |
| Sign in with Google, if you use it | United States |
Payments. Pro plans are sold through Stripe Managed Payments. Sold through Link, LLC (“Link”), a Stripe affiliate, is the reseller for your purchase: it collects the payment, handles taxes and issues the invoice. For the payment data it collects (card, billing address, tax ID), Link and Stripe are independent controllers under their own privacy policies. We receive only your subscription’s status, plan, invoices and the customer ID.
Recipients that are not our processors. ANAF, when you send invoices through e-Factura (Section 5). Oblio, when you import from it with your own API key. The AI assistant provider you connect (Section 7). The clients and accountant you email from Doboti.
We may change providers over time. This list always shows the current ones.
12. International transfers
Some of the providers above are based in, or may process data in, the United States. Transfers to the US rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission’s Standard Contractual Clauses in other cases, as Chapter V GDPR requires.
13. How long we keep data
- Account and business data: for as long as your account and your companies exist. You can delete a company, or your whole account, in the app’s settings.
- Before you delete: Romanian law asks businesses to keep accounting documents for years. That obligation is yours, not ours. Export your data first; once deleted, we cannot give it back.
- Deleted data: we delete it from the app at once and remove its files and backups within 24 hours. Our hosting provider keeps database history for 30 days for recovery, so deleted data is gone for good after at most 30 days.
- Backups: daily, encrypted with each company’s own key, kept for 30 days.
- Inbox mail: as long as you keep it. On a company without Pro, 30 days. Refused mail, 30 days.
- Security log and activity counts: 365 days.
- Our billing records: as long as Romanian tax and accounting law requires, even after you close your account.
- AI assistant connections: until you revoke them, or until the assistant stops using them.
- Sessions: until you sign out or the session expires.
When you leave a company that has other members, the data you added stays in that company, because it belongs to the company.
14. Your rights
Under the GDPR (Arts. 15 to 22) you have the right to:
- Access (Art. 15): get a copy of the personal data we hold about you.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17): ask us to delete your personal data.
- Restriction (Art. 18): ask us to limit how we use your data in certain cases.
- Portability (Art. 20): get the data you gave us in a structured, machine-readable format. Doboti’s export does this for your companies.
- Object (Art. 21): object to processing based on our legitimate interest, including activity counts and analytics.
- Withdraw consent (Art. 7(3)) at any time, without affecting what happened before.
- Complain to a supervisory authority (Section 16).
Write to support@doboti.com. We may ask you to confirm who you are first. We answer within one month (Art. 12(3) GDPR). For a complex request we may take up to two more months, and we tell you so within the first month.
If you are a client or supplier of a Doboti user and your data is in their invoices or statements, that user is the controller. Write to them first. If you write to us, we pass your request to them.
15. Security
- All traffic is encrypted with HTTPS/TLS.
- Each company’s data is kept apart from every other company’s. Its sensitive fields, files and backups are encrypted with AES-256-GCM under a key that belongs to that company only.
- Passwords are stored only as one-way hashes. You can turn on two-step sign-in.
- Files are stored privately and served only to members of their company, or through short-lived links that a member creates.
- The security log records sign-ins and sensitive changes.
- Actions from an AI assistant that send data out or delete it for good wait for a person’s approval.
If a personal data breach happens, we tell ANSPDCP within 72 hours where Art. 33 GDPR requires it, and the people affected without undue delay where the breach is likely to put their rights at high risk (Art. 34 GDPR). If the breach touches data we process for you, we tell you without undue delay so you can meet your own obligations.
16. Supervisory authority
You can complain to a data protection authority, in particular in the EU country where you live or work. Ours, in Romania, is:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral Gheorghe Magheru 28-30, Sector 1, 010336, București, Romania
dataprotection.ro, anspdcp@dataprotection.ro
We’d like the chance to fix a problem first, so please consider writing to us at support@doboti.com.
17. Changes to this policy
We update this policy when Doboti changes. If a change materially affects how we use your data, we tell you by email or in the app before it takes effect. The date at the top shows the latest version. See also our Terms of Service.