Privacy Policy | Drovakor

1. Who we are

Drovakor operates this website (the “Site”) and provides Orvik Analytics, Orvik Flow, Orvik Suite and the Drovakor scheduling service (“Scheduler”) — together the “Products”. In this policy “we”, “us” and “Drovakor” refer to Drovakor; “you” refers to a visitor to the Site or a user of the Products.

2. What this website collects

Information you give us

Forms. When you request a demo, start a trial, purchase, or leave a message, we collect what you enter: name, work email, company, team size, product interest and any message. This is delivered to Drovakor to respond to your request.
Chat. When the website chat is connected to an assistant backend, the messages you type are sent to that backend to answer you and, if you ask for a person, to continue the conversation with a human. When the chat is not connected, nothing you type is processed by a model; a “leave a message” note is delivered like a form.
Payment details. This Site never collects card or bank details. Payment happens on a billing provider’s secure checkout — reached from this Site once self-service billing launches, or by a payment link sent by email until then.

Information collected automatically

Server logs. Standard request logs (IP address, user agent, requested page, timestamp) are kept briefly for security and abuse prevention, including rate limiting of form submissions.
Site analytics. By default this Site sends no analytics to third parties and sets no analytics cookies. If first-party, cookieless event collection is enabled, we record which pages and actions were used without identifying you. If a cookie-based analytics provider is enabled, it runs only after you consent; see the Cookie Policy.
Functional cookie. Using the chat or AI-demo features may set an opaque identifier cookie so that a conversation or demo session can be continued. It contains no personal data. See the Cookie Policy.

3. What the Products collect

Account and organization data. Your name, email, role and organization membership. Sign-in is handled by our identity provider (WorkOS); Drovakor does not store your password.
Customer data you enter. Today, Analytics holds the roster, activity entries, configuration, meetings, coaching and follow-up records your organization enters in the browser’s local storage on the device where they are entered — there is no server copy of that data yet, and the built-in backup export is the copy you control. Organization identity, membership and the vertical catalog are stored server-side, isolated per organization. Workspace data is moving to the server-side store progressively; this policy will be updated when it does. The current Flow build likewise keeps flows, prospects, mail and sending configuration in the browser; it has no server persistence yet. This data belongs to your organization.
Prospect data in Flow. Prospects your organization enrols in flows are personal data of third parties for which your organization is responsible. Drovakor processes it on your organization’s instructions to run the flows you build.
Scheduling data. Scheduler stores the meeting types, availability rules and bookings your organization sets up, and the details a person enters to book a meeting (such as name, email and an optional note).
Operational logs. Application and security logs needed to run and protect the service.

4. Google Calendar and Google user data

Scheduler can connect to a Google Calendar only when you explicitly authorize it, by choosing to connect a Google account and approving the access Google shows you on its consent screen. Nothing is read from or written to your Google account before you do, and you can withdraw that access at any time.

What we access, and why

With your authorization, Drovakor uses Google Calendar data only to:

read your availability — the free/busy times of the calendars you choose, so that only times you are actually free are offered for booking;
list the calendars you can access (read-only), so you can choose which ones count towards your availability and which one receives bookings;
create, update and cancel scheduling events on the calendar you choose, when a meeting is booked, rescheduled or cancelled through Scheduler;
create a Google Meet link for a booked meeting, when the meeting type you configured asks for one.

We also receive the email address of the connected Google account, to show you which account is connected. We request only the access these features need.

How we use it — and how we don’t

Google Calendar data is used only to provide the scheduling functionality you or your company requested in Scheduler.
We do not use Google Calendar data for advertising, and we do not sell it.
We do not transfer it to others except as necessary to provide or improve those user-facing scheduling features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
People at Drovakor do not read it, except with your permission, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or when it has been aggregated and anonymized for internal operations.
We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models.

Drovakor’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How it is stored

The access credentials Google issues for your connection are encrypted before they are stored. Busy times are read to calculate availability; the events Scheduler creates stay on your Google Calendar as ordinary calendar events.

How to disconnect Google Calendar

In Scheduler, open Calendars and choose Disconnect on the Google connection. Drovakor revokes its access with Google and erases the stored credential. Events already created stay on your calendar; new bookings are no longer written to it.
Or remove Drovakor’s access from your Google Account at any time: Google Account → Security → Third-party apps with account access.

5. AI features

The Products contain AI features. They are optional and labelled, and we describe them conservatively:

Analytics — AI coaching notes. Works only when a manager adds their own Anthropic API key in Admin Settings. The key is stored on that device, is never sent to Drovakor’s servers, and is stripped from backup files. When used, the reviewed call’s details are sent to Anthropic under your own key and Anthropic’s terms.
Flow — writing assistance. Offers Manual, Orvik AI, or Your AI (a provider you connect). A provider receives the bounded writing context and the text being edited — not the workspace, other users’ data, or other prospects.
Website assistant and AI demo. When connected, your chat messages and demo questions are processed by the website assistant backend to answer you. We do not make claims here about model training; if a provider’s terms permit training on inputs, we will configure the integration to opt out where that option exists and say so on the Security & Trust page.

We do not sell personal data. We share it only with providers that help us run the Site and the Products, under contracts limiting their use:

Identity: WorkOS (sign-in).
Database and hosting for the Products: managed PostgreSQL and application hosting providers.
Calendars you connect: Google (Google Calendar and Google Meet), only as described in section 4.
Billing: when self-service billing launches, a billing provider processes payments and stores payment details; Drovakor does not. Until then, payment links are sent by email through that provider.
Website delivery of form submissions: a transactional email provider or a webhook endpoint controlled by Drovakor, depending on configuration.
Abuse prevention: an optional challenge provider (Cloudflare Turnstile) when enabled.
Analytics: only if enabled, as described in the Cookie Policy.

We may also disclose data where required by law or to protect the rights, safety and security of Drovakor, our customers or others.

7. Retention

Form and chat submissions: kept as long as needed to respond and, if you become a customer, as part of the customer relationship.
Server-side product data (identity, organization, scheduling, and workspace data once it is stored server-side): kept for the life of your organization’s account and deleted on verified request after the account ends, subject to backups that expire on their own schedule and to legal retention duties. Device-local Analytics data stays under your control on your device.
Google Calendar connection: the stored credential is erased when you disconnect; data received from Google is kept only as long as the scheduling features need it.
Server logs: kept briefly for security purposes.

8. Your rights and deleting your data

Depending on where you live, you may have rights to access, correct, delete or export your personal data, to object to or restrict processing, and to complain to a supervisory authority. If you are a prospect whose data an organization entered into Flow, that organization is the controller; we will help them respond.

To request deletion of your data — including any Google Calendar connection and the data received through it — email privacy@drovakor.com from the address associated with your account, or tell us which account or booking the request concerns. We will verify the request, confirm what will be deleted, and aim to complete it within 30 days, except where the law requires us to keep something. Disconnecting Google Calendar (section 4) stops all further access immediately and does not need a request.

We do not knowingly collect personal data from children under 16. The Site and Products are for business use.

9. Contact and changes

Privacy questions and requests: privacy@drovakor.com. You can also use the contact form or the chat launcher, and they reach a person at Drovakor directly.

We will post changes to this policy on this page with a new effective date. Material changes to how we use data you have already given us will be notified to account holders.