Privacy policy

Updated 27 October 2026.

1. Who we are

Dirigo is provided by CodeAPIness SHPK, tax ID (NIPT) M12305008A, at Rruga "Sotir Çaçi", Njësia Bashkiake nr. 3, Tirana, Albania ("we"). For any question about personal data: [email protected].

Dirigo is a service for businesses. For the customer business's account and billing data we are the controller. For the content a business puts on its screens, and for the data of its staff who use the panel, we are a processor, under the data processing agreement.

2. What data we hold

• Account: name, email address, role and the locations you can access. We store your password only as a hash, never as text.
• Business: name, billing email, locations (name, address, opening hours, time zone), screens, plan and invoices.
• Devices: device identifier, model, system, app version, free storage, the status the device sends every minute, what it plays (proof of play), the audio output and the name of the Bluetooth speaker. A screenshot is taken only when you ask for one in the panel.
• Google Drive: the address of the connected Google account, the chosen folder, the metadata of the files you pick (name, type, size, checksum, modification date) and the token that lets us read them, encrypted. We do not store the contents of the files.
• Uploads: small images and PDFs you upload directly, and the voice announcements you record or upload.
• Session: one cookie that keeps you signed in to the panel. We use no analytics, tracking or advertising cookies.

3. What we use it for

Only to provide Dirigo: to show and play your content on your screens, show you their status, email you alerts when a screen goes offline, bill you and help you when you write to us. We do not sell the data, do not use it for advertising and do not use it to train artificial intelligence models.

4. Data from Google

Dirigo asks only for the drive.file permission. With it, Dirigo sees only the files and folders you pick yourself in Google Picker, not the rest of your Drive.

• Screens download the files directly from Google, with tokens that expire quickly. Our servers neither store nor pass on your files.
• The owner and admins can preview a file in the panel; the browser fetches it directly from Google.
• None of us reads your data from Google, except when you ask us to for support, for security, or when the law requires it.
• We do not transfer data from Google to third parties, except to provide Dirigo, and we do not use it for advertising.
• You can disconnect Drive at any time in the panel: we revoke the permission at Google and delete the token. You can also remove it at https://myaccount.google.com/permissions.

Dirigo's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

5. Who processes it for us

• Hetzner Online GmbH (Germany): servers and database.
• Cloudflare, Inc.: DNS, traffic protection, storage of uploads and voice announcements, receiving email.
• Sendinblue SAS (Brevo) (France): sending email.
• Google: the connection to your Google Drive, which is your own account.

Cloudflare may also process data outside the European Union; we then rely on the European Commission's standard contractual clauses.

6. How long we keep it

• The status devices send: 30 days, after which only the time online per day remains.
• Screenshots: 24 hours.
• Account, locations, screens and proof of play: while the subscription is active.
• After an account is closed we delete it within 30 days. Backups are deleted within 30 days.
• Invoices: as long as Albanian accounting law requires.

7. Your rights

You can ask for access to your data, its correction, erasure, restriction of processing or its transfer to another service, and you can object to processing. Write to [email protected]; we answer within 30 days. If you are an employee of a customer, you can also turn to them.

You can complain to the Albanian Commissioner for the Right to Information and Personal Data Protection: https://www.idp.al.

8. Security

Connections use HTTPS only. Google tokens are encrypted with a key that is not stored in the database. Each customer's data is kept apart from the others both in the code and in the database. Device credentials are rotated regularly and can be revoked from the panel.

9. Children

Dirigo is for businesses and is not directed at anyone under 16.

10. Changes

When we change this policy, we change the date at the top. For important changes we email you before they take effect.

11. Contact

[email protected], or by post: CodeAPIness SHPK, Rruga "Sotir Çaçi", Njësia Bashkiake nr. 3, Tirana, Albania.