Privacy notice

Controller and contact

Hajar Issa Yousef, Lippe Straße 24, 45663 Recklinghausen, Germany, info@dinnava.com. Use this address for privacy requests.

Data and purposes

We process your name, email, protected sign-in credentials and session data to provide your account and keep it secure (GDPR Art. 6(1)(b) and (f)). We process voluntary profile and company details, posts, group content, media and messages to provide the features you use (Art. 6(1)(b)). Other members see content according to its visibility settings; publicly released links can be viewed and forwarded without signing in. Your account email and profile birth date are not shown as public profile data.

If you choose “Sign in with Google”, Google sends us a unique account identifier, your name, email address and email-verification status. We use this information to sign you in, create an account after your confirmation, or link your Google account to an existing Dinnava account at your request. Google may also send a profile picture; we currently do not use or store it for sign-in. We do not request access to Gmail messages or Google contacts.

If you use the offered “Sign in with Apple” feature, Apple provides an account identifier, identity proof and, where supplied, your name and email address. With “Hide My Email”, we use Apple's relay address. We use these details to sign you in, create an account after your confirmation, link an account at your request, or reconfirm your identity before account deletion (GDPR Art. 6(1)(b) and (f)). Your Apple password is not sent to Dinnava. We store any necessary Apple refresh token encrypted on the server; account deletion removes the Apple link and initiates revocation with Apple. Failed revocation is retried asynchronously.

Optional app notifications

If you activate push notifications in the iPhone app and grant iOS permission, we associate a technical delivery token with your signed-in account and session. We store your choices for personal and, where authorized, administrator notifications together with technical registration and delivery information. The token and a generic notification are processed through Expo's push service and Apple's Push Notification Service (APNs). Push content includes no private message text and no profile or company names; details are available only inside Dinnava after sign-in. This feature is optional (GDPR Art. 6(1)(a)); necessary security and delivery checks support secure operation (Art. 6(1)(f)). You can disable push in the app's account settings; the delivery registration is then removed. Signing out or deleting the account removes the respective session or account binding. Removal may be retried after technical errors. Notifications already handed to a delivery provider cannot reliably be recalled. Expo and Apple may process delivery data outside the European Economic Area; you can request information about the applicable safeguards at info@dinnava.com.

You can also voluntarily activate push notifications in the Android app. We associate the delivery token and your notification preferences with your signed-in account and session. Android delivery uses the Expo push service and Google Firebase Cloud Messaging (FCM). The delivery request contains the token, a generic Dinnava notification and routing information, not the full private message or post text and no profile or company names. Technical registration and delivery information is processed to operate and check delivery. You can turn off push in the app's account settings or your device settings. Availability may currently be limited to an approved test account.

Optional search-engine visibility

Your personal profile is not released for this by default. If you separately enable “Show my profile in web search”, we provide a publicly accessible profile page containing your name, self-declared job title and country, and may list it in our search-engine sitemap (GDPR Art. 6(1)(a)). This choice is separate from the public homepage preview. Email, phone number, birth date, precise address and CV are not shown there. You can switch this off in your profile at any time; Dinnava then removes the public page and sitemap entry. Results or copies already held by external search engines may remain visible for some time. Private and undiscoverable profiles are not shown on this page.

Group owners may separately release a search-engine page for a public, discoverable group. Only the group name and description are shown, not member names or private posts. This setting is off by default and can be withdrawn in group management (GDPR Art. 6(1)(a)). On withdrawal or deletion, we remove the group page and sitemap entry; externally stored search results may remain visible for some time.

Owners of a saved company profile may separately enable its visibility in search engines. This setting is off by default and applies only to their own saved company. The public search page shows the company name, industry, country and owner-saved description; email, phone and other contact fields are not shown as separate fields. However, the description may contain details entered by the owner and should be reviewed for confidential information before enabling this option. The owner can withdraw the choice in the company profile at any time (GDPR Art. 6(1)(a)). We then remove the page and sitemap entry, though externally stored search results or copies may remain visible for some time.

Search, AI and external services

Search, website analysis and AI features process your input and the profile and company details needed for your request (GDPR Art. 6(1)(b)). Dinnava may send web-search queries to Tavily or Brave Search. The Google Gemini API may receive inputs and relevant excerpts from profiles or publicly available company websites for AI analysis. Uploaded images and videos are stored, processed and delivered through Cloudinary. Emails may be sent through the configured mail server. These services receive only the data needed for the relevant feature; an external company is not thereby a verified Dinnava member. Do not enter confidential or especially sensitive information into search or AI fields. External websites have their own privacy notices.

Processing outside Europe

Google, Cloudinary and search providers may process data outside the European Economic Area, particularly in the United States. Depending on the provider and data flow, transfers require an adequacy decision (such as valid EU-US Data Privacy Framework certification) or EU Standard Contractual Clauses with any necessary supplementary measures. You can request information about the safeguards that apply by emailing info@dinnava.com.

Optional statistics

Personal activity statistics are off by default. Only with your separate consent may authorized Dinnava administrators see your name with visit times, sections used and action counts for up to 90 days. This statistic does not include search text, messages, passwords or full URLs. You can withdraw in Account; the collected activity history is then deleted. Declining does not limit the platform (Art. 6(1)(a)). Separately offered general usage statistics also require a separate choice. Origin measurement is activated only by a fresh explicit choice in the updated statistics notice; an existing choice is insufficient. Its purpose is to report visits and successful account creation by source and campaign. It records allowlisted source/medium categories, server-issued campaign codes and identifiers of already-public posts or groups, associated with pseudonymous browser/session identifiers and the collection time. Retention is configured for 90 days; older records are removed at the next statistics cleanup. Full URLs, referrers, arbitrary UTM text and private invitation tokens are not stored in these statistics. Unknown or historical origin is not reconstructed. Withdrawal in the privacy settings also removes the collected origin history for that browser.

Cookies, hosting and retention

A necessary session cookie keeps you signed in for up to seven days; a short-lived cookie associates public search activity with your browser. Hosting and technical operation use Contabo and, for the current test address, a server on the STRATO network. Technically necessary server logs may process your IP address, request time and requested address (Art. 6(1)(f): secure operation and troubleshooting). Account data is generally retained until deletion, subject to legal obligations. Deletion removes account data and authored content from the active system; media removal may follow asynchronously. Protected backups are not rewritten immediately. According to the operator, they are retained for no more than 30 days and then deleted.

Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction, portability and object to processing. You may withdraw consent at any time for the future. Contact info@dinnava.com. You may also complain to a data protection supervisory authority.