Privacy Policy
Version 1.10 · Effective: 02 November 2026
Policy update
Version 1.10 explains our planned public-artifact security review and simplifies our existing disclosures. This release also updates the Terms of Service to Version 1.2 and the Data Processing Agreement to Version 1.2, together with the Acceptable Use Policy, Cookie Policy and Security Statement. Existing customers transition on the effective date above following 14 days' notice; new customers accept the revised documents at signup.
The update adds public-artifact security review and TypeSafe as a planned provider, while replacing implementation details with clearer descriptions of our practices. The Acceptable Use Policy, Security Statement and Cookie Policy also replace some fixed operational commitments with descriptions of current practice that may change. The Terms narrow the AI-model restriction to training and fine-tuning and remove the requirement to opt in to every other AI use. Those uses remain subject to our disclosed purposes, data protections and applicable consent requirements. The DPA adds an exception to its 30-day deletion commitment for sent transactional email content, which expires within 45 days of sending. Existing consent choices, disclosed retention periods and data-protection rights remain in place. Read about security review.
| Data controller | Displaydev OÜ, Ankru 8-23, Tallinn, 11713, Estonia |
| Privacy contact | privacy@display.dev |
| Primary regulation | EU General Data Protection Regulation (GDPR) |
| Data collected | Account, organization, billing, usage, referral, communications and security data, as described in §1 |
| Service providers | Hosting, storage, analytics, payments, email, scheduling and security providers listed in §5 |
| Key user rights | Access, rectification, erasure, restriction, portability, objection, supervisory authority complaint |
| Retention | Depends on the data and purpose; see §10 |
| Data selling | We do not sell personal data |
Introduction
This Privacy Policy explains how Displaydev OÜ ("Displaydev", "we", "us", "our"), a company registered in Estonia (EU), collects, uses, stores, and shares personal data when you use display.dev and its associated services (collectively, the "Service").
Displaydev OÜ is the data controller for personal data processed for its own purposes under this policy. Where we process personal data in your artifacts on your organization’s behalf, the Data Processing Agreement governs that processing.
We are subject to the EU General Data Protection Regulation (GDPR) and, where applicable, other national data protection laws. If you have questions or wish to exercise your rights, contact us at privacy@display.dev.
1. What Personal Data We Collect and Why
We collect only the data necessary to provide and improve the Service.
| Data category | What we collect | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Account data | Full name, email address, account creation timestamp | Create and manage your account; authenticate you | Contract — Art. 6(1)(b) | Until account deleted, then purged within 30 days |
| Account session and security data | Session identifiers, IP address, device and browser information, sign-in method, and session timestamps | Authenticate and secure your account; let you review and end active sessions; notify you of new sign-ins | Contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f) | Until the session expires, is ended, or the account is deleted; security-email content is retained by Postmark for 45 days from sending |
| Organisation data | Organisation name, URL slug, email domain | Provision your organisation; associate members | Contract — Art. 6(1)(b) | Until organisation deleted, then purged within 30 days |
| Referral data | Opaque personal or organisation referral code; inviting organisation ID; the sharing member's first name and organisation name shown to a referral-link visitor; the referred organisation ID; reward eligibility, availability, and use | Personalise a referral invitation; preserve first-touch attribution; determine and apply organisation-owned referral rewards | Contract – Art. 6(1)(b) when you participate; legitimate interest – Art. 6(1)(f) to prevent duplicate or fraudulent rewards | Referral cookie: 30 days unless consumed earlier; personal code: while the membership is active; organisation code and attribution: until the organisation is deleted; unused reward authority: until use or organisation deletion; used reward and invoice evidence: 7 years after use |
| Usage events | Product activity, such as publishing and managing artifacts, organizations and account settings | Understand how the product is used; improve features; detect abuse | Legitimate interest — Art. 6(1)(f) | Account lifetime |
| Billing data | Subscription plan, billing tier, payment status and, when you supply them through Stripe Checkout or Billing Portal, billing address, billing name, and tax ID. Payment card details and these billing details are handled exclusively by Stripe and never stored on our servers | Process payments; calculate and collect applicable taxes; enforce plan limits | Contract — Art. 6(1)(b) | 7 years (Estonian Accounting Act obligation) |
| Page views and navigation (in-app, signed-in users) | URLs visited inside the authenticated product; page-leave events | Measure engagement; improve UX | Legitimate interest — Art. 6(1)(f) | Account lifetime |
| Page views and navigation (display.dev marketing site) | URLs visited on display.dev; page-leave events | Measure engagement; improve UX | Consent — Art. 6(1)(a), collected only if you accept the cookie banner | 2 years (only for visitors who accepted) |
| Session replay (in-app, signed-in users) | Recordings of interactions with the app, including clicks, scrolling, page content and browser diagnostics. Form input values are masked before transmission | Diagnose user-facing issues; understand product friction | Legitimate interest — Art. 6(1)(f) | 30 days |
| Session replay (display.dev marketing site) | As above, recorded only when you accept the cookie banner | Diagnose marketing-site UX issues | Consent — Art. 6(1)(a), collected only if you accept the cookie banner | 30 days |
| Guest access events | Email address of guest viewers who authenticate via one-time code; identifier of the artifact accessed | Gate access to private artifacts | Contract — Art. 6(1)(b) | Account lifetime |
| Artifact view counts | Aggregate view count per artifact per day — no viewer identity is stored | Show publishers how their content is performing | Contract — Art. 6(1)(b) | Account lifetime |
| Security and audit logs | Administrative actions: member invites, permission changes, SSO configuration | Security monitoring; compliance | Legitimate interest — Art. 6(1)(f) | Account lifetime |
| Public-artifact security review | Public artifact content, security findings and review decisions; content may contain personal data supplied by its publisher | Detect and investigate phishing, credential theft, malware and abuse; protect users and the Service | Legitimate interest – Art. 6(1)(f) where we act as controller; documented service-security instructions under the DPA where we act as processor | Source follows the artifact lifecycle; review records follow the associated version; provider retention is described below |
| Operational telemetry | Pseudonymous request and resource identifiers, service diagnostics, response status and timing, and redacted errors. We exclude names, email addresses, credentials, customer hostnames, artifact names, and artifact content | Operate, diagnose, secure, and improve the reliability of the Service | Legitimate interest — Art. 6(1)(f) | 90 days |
| Signup attribution | Your optional answer about how you found us, campaign information, referring site, landing page and first-visit time. No full URLs, query strings, or ad click IDs | Understand which channels bring new customers; decide where to focus launch and distribution work | Legitimate interest — Art. 6(1)(f); the question itself is optional and skippable | Until organisation deleted, then purged within 30 days |
| Lifecycle-marketing data | User ID, email address, derived first name, organisation name for member onboarding, onboarding and artifact-publication events, workflow state, and delivery, bounce, complaint, and unsubscribe status | Send and operate product activation emails after eligible onboarding and person-attributed artifact-publication actions | Legitimate interest — Art. 6(1)(f); you may unsubscribe from every activation email | Until account deletion. An unsubscribed contact remains present only to preserve suppression until deletion |
Where we rely on legitimate interest (Art. 6(1)(f)), the processing is proportionate and limited to what is necessary. Data is aggregated where possible. You retain the right to object at any time (see Section 4).
Public artifact security review
We plan to use automated tools and human review to detect and investigate phishing, credential theft, malware and other abuse in public artifacts. This planned review excludes private and organization-restricted artifacts.
For this purpose, we may share public artifact content and necessary technical information with the security providers listed in §5. Content may include personal data supplied by its publisher. We limit the data shared to what the review needs; account credentials and viewer submissions are not included. Findings support human review. We may also check the accuracy and effectiveness of these security checks. Our Terms prohibit using Customer Content to train or fine-tune AI models, including by our providers.
We restrict access to review data and retain it as described in §10. Planned providers are used only after the required notice and contractual safeguards are in place. This planned review is not yet active.
Where we act as controller, our legitimate interest is protecting users and the Service from abuse. Where we process content on your organization's behalf, the DPA applies. You may object to processing or request review of a decision at privacy@display.dev.
2. How We Collect Personal Data
Directly from you — when you create an account, set up an organisation, configure billing, contact support, or otherwise interact with the Service.
Automatically inside the authenticated product — when you use the signed-in Service, we collect the session and security data needed to authenticate and protect your account. We also collect usage events, page views, and device/session information through our analytics tooling (PostHog) on a legitimate-interest basis.
On the display.dev marketing site — only with your consent — PostHog is not loaded until you click Accept in our cookie banner. If you decline, we do not initialise PostHog or send PostHog analytics events. Google’s limited cookieless measurement is described in the Cookie Policy. You can change your choice at any time from the Cookie settings link in the footer.
Through signup attribution – we use a first-party cookie to remember how you arrived and combine that context with your optional signup answer. This data is used for product analytics, not advertising, and shared only with our analytics provider. The cookie expires after 30 days or when you answer or skip the question. Declining analytics consent prevents it and clears any existing copy on your next page load. See the Cookie Policy §5.
From public artifacts – we may review content already stored on the Service and derive security findings for the purpose described above.
Via social login — if you sign in with Google or Microsoft, those providers share your name and email address with us to create or authenticate your account. Google and Microsoft act as independent data controllers for their own authentication services and are not sub-processors of display.dev.
Through referral links – an eligible link may display the sharing member's first name and organization name. A necessary cookie preserves the first qualifying referral for up to 30 days. If you create a new organization, we record the referral to administer rewards. See the Cookie Policy and referral terms.
Through product email workflows – we share account details and relevant onboarding and publishing activity with Loops to operate activation emails and respect unsubscribes. We do not send artifact content, artifact names, artifact URLs, comments, credentials or per-contact tracking links.
From third parties — Stripe provides payment-related status signals (e.g. subscription renewal success or failure). We do not purchase or receive personal data from data brokers.
3. Cookies and Tracking
| Cookie / tracker | Purpose | Type | Consent required? |
|---|---|---|---|
| Session cookie (HTTP-only) | Maintains your authenticated session after login | Strictly necessary | No |
| PostHog analytics (in-app, identified users) | Tracks product usage for identified (logged-in) users | Analytics | No (legitimate interest; opt-out available) |
| PostHog analytics (display.dev marketing site) | Tracks page views and navigation on the marketing site | Analytics | Yes — opt-in via cookie banner |
| PostHog session replay (in-app, identified users) | Records in-app sessions (inputs masked) for diagnostics and UX research | Analytics | No (legitimate interest; opt-out available) |
| PostHog session replay (display.dev marketing site) | Records marketing-site sessions (inputs masked) | Analytics | Yes — opt-in via cookie banner |
dsp_acq (display.dev + app.display.dev) | Remembers first-visit acquisition context (campaign parameters, referrer hostname, landing path) until the post-signup attribution question is answered or skipped; 30-day maximum | First-party attribution | No — but declining analytics consent prevents it and deletes any existing copy |
dsp_ref (api.display.dev) | Preserves the first eligible inviting organisation while a referred visitor creates a genuinely new organisation; contains only a signed organisation identifier and expiry, never a member ID, name, or raw referral code | Strictly necessary referral attribution | No — set only after an eligible referral link is opened; 30-day maximum and cleared after successful organisation creation |
dsp_consent (display.dev + app.display.dev) | Mirrors your cookie-banner Accept / Decline choice so our servers can honor it | Strictly necessary | No |
Google Analytics 4 — _ga, _ga_<streamId> (display.dev + app.display.dev) | Distinguishes visitors and sessions for aggregate traffic reporting | Advertising and measurement | Yes — opt-in via cookie banner |
Google Ads — _gcl_au (display.dev + app.display.dev) | Links an account signup back to the Google ad click that led to it | Advertising and measurement | Yes — opt-in via cookie banner |
Reddit Ads pixel — _rdt_uuid (display.dev + app.display.dev) | Links an account signup back to the Reddit ad that led to it | Advertising and measurement | Yes — opt-in via cookie banner |
LinkedIn Insight Tag — li_fat_id (display.dev + app.display.dev) | Conversion tracking, retargeting, and analytics for LinkedIn ads. LinkedIn also sets cookies in its own context; see the Cookie Policy §7 | Advertising and measurement | Yes — opt-in via cookie banner |
Meta pixel — _fbp, _fbc (display.dev + app.display.dev) | Conversion tracking, retargeting, and analytics for Meta ads. _fbp is set for every consenting visitor; _fbc only when you arrive from a Meta link carrying a click identifier | Advertising and measurement | Yes — opt-in via cookie banner |
Analytics on display.dev (PostHog) is loaded only after you accept via our cookie banner. If you decline, we do not initialize PostHog or send PostHog analytics events. You can change your choice at any time from the Cookie settings link in the footer.
Advertising measurement. We buy ads on Google, Reddit, and LinkedIn, are adding Meta, and we use the tags above to see which ads led to an account being created. Identifier-based advertising and measurement run on display.dev and app.display.dev only after you accept the cookie banner. Google’s remaining cookieless measurement is described in the Cookie Policy. The signal these tags send carries no name, email address, or artifact content: only that a signup happened and which login method was used. We do not upload customer lists or hashed email addresses to any ad platform, and we run no ad measurement on dsp.so. Google, Reddit, LinkedIn, and Meta act as independent controllers for the attribution they perform on their own platforms.
Apart from the tags listed above, we set no advertising or cross-site tracking cookies. You can manage cookies through your browser settings. Disabling the session cookie will prevent you from logging in.
The cookies and browser-storage keys used across display.dev and dsp.so are described in our Cookie Policy.
3a. Aggregate analytics on dsp.so
We operate a separate public-artifact origin, dsp.so, where published artifacts are served to viewers. On that origin we run no third-party client-side analytics. We do record three streams of server-side telemetry, without setting cookies on your browser:
- Aggregate view counts — per-artifact, daily view buckets, so publishers can see how many people read their content. No viewer identity is stored.
- Publish-to-claim funnel — for publicly-claimable artifacts we use limited, pseudonymized visitor data to measure whether viewers claim the URL. IP addresses are hashed before storage, and this data is not used for behavioral profiling.
- Operational telemetry — pseudonymous service diagnostics and redacted errors used to diagnose and secure delivery, with the exclusions described in §1 and a 90-day retention period.
All three are processed on a legitimate interest basis under GDPR Art. 6(1)(f): pseudonymised inputs, capped scope, no behavioural profiling. You have the right to object (see Section 4). For cookies and storage keys used on dsp.so, see the Cookie Policy.
4. Your Rights Under GDPR
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure — request deletion of your personal data, subject to our retention obligations (e.g. billing records retained for 7 years by law).
- Right to restriction of processing — request that we limit how we use your data while a dispute is resolved.
- Right to data portability — receive your personal data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interest (Art. 6(1)(f)). We will stop processing unless we can demonstrate compelling legitimate grounds.
- Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint — contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority in your EU member state of residence.
To exercise any right, contact us at privacy@display.dev. We will respond within 30 days.
4a. Rights for US State Residents
If you are a resident of California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (CDPA), or Utah (UCPA), you have rights under your state's privacy statute that parallel the GDPR rights in §4:
- Right to know — request the categories of personal data we collect, the sources, purposes, and the sub-processors we share it with (see §5).
- Right to delete — request deletion of your personal data, subject to the retention obligations in §10.
- Right to correct — request correction of inaccurate data.
- Right to opt out of sale or sharing — we do not sell personal data. We do use the Google, Reddit, LinkedIn, and Meta advertising tags described in §3, which some of these statutes treat as "sharing" for cross-context behavioural advertising. Those tags run only if you accept our cookie banner, and declining (or switching to Decline later from Cookie settings in the footer) is your opt-out. You can also email privacy@display.dev to opt out.
- Right to limit use of sensitive personal information – we do not request sensitive personal information for public-artifact security review. If a publisher includes it in public source, it may be encountered during review; we restrict access and address it through the applicable deletion, incident and rights-request procedures. You may contact us to exercise any applicable right to limit its use.
- Right to non-discrimination — exercising any of these rights will not change your service or pricing.
To exercise any right, email privacy@display.dev. We respond within 45 days as required by CCPA; for complex requests we may extend by a further 45 days and will notify you.
5. Sub-processors and Data Sharing
We use the providers below for the stated purposes under appropriate data-processing agreements. Planned providers receive personal data only after the required notice and safeguards are in place. We do not sell personal data.
| Processor | Data shared | Purpose | Location | Transfer mechanism |
|---|---|---|---|---|
| TypeSafe AI, Inc. (planned) | Public artifact content and necessary technical information, which may contain personal data | Security and abuse analysis; no model training | United States; supporting sub-processors globally | Standard Contractual Clauses (SCCs) |
| Neon | User accounts, org data, viewer access events, billing records, audit logs | Primary database | United States | Standard Contractual Clauses (SCCs) |
| PostHog | User ID, email, usage events, page views | Product analytics | EU (eu.posthog.com) | — (EU region; no third-country transfer) |
| Stripe | Billing contact details, including billing address, billing name, and tax ID; subscription status | Payment and tax processing | United States | Standard Contractual Clauses (SCCs) |
| Cloudflare | Artifact bodies, normalized recipient emails, creator IDs, derived search indexes, aggregate artifact view counts, and CDN cache | Customer-content storage, derived search indexing, CDN, and artifact delivery | Global | Standard Contractual Clauses (SCCs) |
| Fly.io | All data processed by the API | Application hosting | United States (Ashburn, VA) | Standard Contractual Clauses (SCCs) |
| Postmark | Recipient email addresses and transactional email content, including authentication, invitation and account-security notices | Transactional email (sign-in OTPs, guest invites, account notifications) | United States | Standard Contractual Clauses (SCCs) |
| Loops (Loops Labs, Inc.) | User ID, email address, derived first name, organisation name for member onboarding, lifecycle events, workflow state, and delivery/unsubscribe data | Product activation and lifecycle-marketing emails | United States | Standard Contractual Clauses (SCCs) |
| Better Stack | Pseudonymous operational logs and error reports described in §1 | Service monitoring, incident diagnosis, and security operations | European Union (Germany) | — (EU region; no third-country transfer) |
| Cal.com (Cal.com, Inc.) | Only what you enter into the booking calendar on /book-a-call: your name, email address, the time you choose, and any notes you add. Nothing else, and nothing from your account | Scheduling a founder call when you choose to book one | United States | Standard Contractual Clauses (SCCs) |
Advertising platforms. Google, Reddit, LinkedIn, and Meta are not sub-processors. When you accept our cookie banner, the tags described in §3 let each platform set its own cookie in your browser and attribute a signup to an ad click. Each acts as an independent controller for that processing under its own privacy policy (Google, Reddit, LinkedIn, Meta); we send them no name, email address, customer list, or artifact content. Declining prevents consent-based advertising storage and tracking; the Cookie Policy describes the remaining cookieless measurement.
We may also disclose personal data to legal authorities if required by applicable law, court order, or governmental regulation, or if we believe in good faith that disclosure is necessary to protect our rights or the safety of others.
6. International Data Transfers
Displaydev OÜ is based in Estonia (EU/EEA). Some sub-processors are located in or process data in the United States or other third countries outside the EU/EEA. Where we transfer personal data to third countries, we rely on EU Standard Contractual Clauses (SCCs) as the transfer mechanism. You may request a copy of the applicable SCCs by contacting privacy@display.dev.
7. Data Security
We apply industry-standard technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. This includes encryption of data in transit and at rest, access controls on production systems, and security monitoring of administrative actions.
No system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@display.dev.
8. Children's Privacy
The Service is not directed at children under the age of 16 and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it promptly. Contact us at privacy@display.dev if you believe we have inadvertently collected such data.
9. Third-Party Links
The Service may contain links to third-party websites or services. This Privacy Policy applies only to display.dev. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies.
10. Data Retention
| Data category | Retention period |
|---|---|
| Account and organisation data | Duration of account/organisation, then purged within 30 days of deletion |
| Active session records | Until the session expires, is ended, or the account is deleted |
| Transactional email content held by Postmark | 45 days from sending |
| Lifecycle-marketing contact, workflow, delivery, and unsubscribe data held by Loops | Until account deletion; an unsubscribed contact is retained in suppressed form until deletion |
| Usage events and in-app page views | Account lifetime |
| Session replay recordings | 30 days |
| Billing records | 7 years (Estonian Accounting Act obligation) |
| Referral data | Personal code while the membership is active; organisation code and attribution until organisation deletion; unused reward authority until use or organisation deletion; used reward and invoice evidence for 7 years after use |
| Guest access events | Account lifetime |
| Artifact view counts (aggregate) | Account lifetime |
| Security and audit logs | Account lifetime |
| Public-artifact security-review records held by Display | While the associated artifact version is retained |
| Security-review requests processed by providers | Only as long as needed for the security service or required by law, under the applicable data-processing agreement |
| Operational telemetry held by Better Stack | 90 days |
Data subject to a fixed retention period is deleted or anonymised once that period elapses. Data retained for the lifetime of your account is deleted within 30 days of account closure.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will provide a prominent notice within the Service 14 days before the change takes effect. Disclosures for a new optional program may instead take effect when you deliberately participate, provided no referral information is disclosed externally and no attribution begins before participation, and the notice remains available for 14 days. If an immediate change is required to stop unlawful or incorrect processing, it may take effect on publication and the notice will remain available for 14 days afterward. Continued use of the Service after the effective date constitutes acceptance of other updated policy terms.
12. Contact
Displaydev OÜ Ankru 8-23, Tallinn, 11713, Estonia
We aim to respond to all requests within 30 days. For complex requests, we may extend this period by a further two months and will notify you accordingly.