Dazr Suite privacy notice

Last updated 28 October 2026 · For Dazr Suite at suite.dazr.eu and the apps of the Dazr plans: Docs, Sheets, Slides, Files, Mail, Calendar, Contacts, Teams, Desk, Projects, Time, Analytics and Forms.

If a translation of this page differs from the English version, the English version applies.

In short Your documents, files, mail and messages are yours. We store them in the EU so you can reach them from anywhere, and we do not use them for advertising or to train AI models. You sign in with your Dazr Identity account. The AI assistant is optional: it stays off unless you or your organisation turn it on with an AI provider of your choice.

Who is responsible

Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy, VAT IT 02801250065, is the controller for the personal data described in this notice. For anything about your data, write to privacy@dazr.eu.

Your account

Dazr Suite uses your Dazr Identity account. The Dazr Identity privacy notice covers your profile, sign-in and sessions.

Your files and documents

Content. The files you upload and the documents, spreadsheets and presentations you create, with their names, folders, sizes, dates and stars, and up to 10 earlier versions of each file.
Trash. Files you delete go to the trash and are deleted for good after 30 days, or sooner if you empty the trash.
Storage. Your account has 25 GB of storage on the free plan, and more on a paid plan. Documents you send with Dazr Sign count towards it.
Copies on your device. Docs, Sheets and Slides also keep a working copy in your browser’s storage on your device, so your work is safe if the connection drops. It stays on that device until you clear the browser’s data for the site.
Preferences. The apps remember settings such as recent colours, fonts and panel sizes in your browser’s local storage.

We use your content only to store it, show it to you (and, in an organisation space, to its members, and to the people you share a file with) and run the features you use. We do not use it for advertising, do not sell it and do not use it to train AI models. If you turn on the optional AI assistant, running it means sending what you ask it to work on to the AI provider you chose, as described under Optional AI assistant.

Organisation spaces

Every organisation in Dazr Identity has a shared space in Files. All its current members can see the files, versions, comments and activity in it. Depending on the organisation’s settings, members or only admins can upload and change files; only the owner and admins can delete files for good or empty the trash. A member who leaves or is removed loses access at once. The space has its own 25 GB of storage.

The space keeps a list of activity (who uploaded, renamed, moved or deleted what, and when; the latest 200 entries) and comments with their author’s name and email address. Files in an organisation’s space belong to that space: they stay when a member leaves or deletes their account, and are deleted when the organisation is deleted.

You can share a file with people by email, or with a link, as Can view or, for files in My files, as Can edit. Each person you add gets their own link by email, sent by Dazr with your name; replies go to you. With Can view, anyone who has the link can view and download that file in the browser, without an account, until the link expires or someone turns it off; nobody can change the file through such a link. Someone who signs in with Dazr Identity can make their own copy, which is saved in their own files and counts towards their storage.

With Can edit, the person you invited edits your file itself, live with you, after signing in with a Dazr Identity account that uses the email address you invited; a free account is enough. If you choose so, anyone signed in who has the link can edit instead. Their changes are saved to your file, with their name on the version, and count towards your storage. An editor reaches only that one file: they cannot see your other files, and cannot rename, move, delete or share it unless you allow editors to share. The file shows in their Shared with me list in Files, which they can clear; it does not count towards their storage.

For each link we keep who created it, the email address it was sent to, its role, when it was created and when it expires. For the people who manage the file we also keep an access log: when the file was opened or edited (each at most once every 10 minutes per person), downloaded or copied, and the Dazr account that did so when it was signed in. The log holds no IP addresses. Unless you turn it off for a file, we email you when a person opens or edits it for the first time, bundled into one email at most every 15 minutes. We use a recipient’s email address only to send them the link, to check that the person who edits is the one you invited, and to write the email in their language if they have a Dazr account.

Edit access ends at once when you change the person to Can view or remove them, when the link expires, when the file is moved to the trash or deleted, and when you delete your account: their next save is refused, and an open live session ends within two minutes.

A link stops working at once when it is turned off, when the file is moved to the trash or deleted, and, in an organisation space, when the person who created it leaves the organisation. The link, the recipient’s email address and the access log are deleted when the link is turned off or the file is moved to the trash or deleted, and otherwise 30 days after the link expires. To prevent abuse we count requests per IP address and emails per sender and per recipient address; these counters are deleted automatically within 24 hours. Legal basis: providing the service you asked for (Article 6(1)(b) GDPR) and, for the people you share with, the legitimate interest of you and us in delivering the file to them (Article 6(1)(f) GDPR).

When you use Dazr for an organisation

When an organisation uses these apps, it decides what goes in and who sees it. For that data the organisation is the controller and Dazr processes it on its behalf under the Dazr Suite data processing agreement. The sections below say what each app keeps.

Dazr Mail

Your mailbox. The messages you send and receive, with their attachments, folders and flags and the addresses in them, and your settings, rules, automatic replies, signatures and templates. Mail is stored on our own mail server at Hetzner in Germany, which also checks incoming mail for spam. It stays until you delete it. An address is never given to anyone else, also after its mailbox is deleted.
Your own domain. If you connect a domain, we keep the domain, its status and the results of the DNS checks. The mail server holds the DKIM keys that sign the domain’s mail.
Shared inboxes. A shared inbox belongs to its organisation. The organisation’s admins choose who opens it, and access ends at once when someone leaves the organisation or the list. A shared inbox or an extra mailbox that is removed can be restored for 7 days; then it is deleted.
Knock. Mail from someone who writes to you for the first time waits in Knocks until you let it in. To decide who comes straight in, Dazr Mail uses your Dazr Contacts, your colleagues, the people you let in or pinned, and the addresses you wrote to, which it reads from your sent mail. All of this stays with your mailbox.
Outside accounts. If you connect Gmail, Outlook or another mail account, its mail is copied into a hidden mailbox on our mail server and kept in step with that provider. The app password, or for Microsoft the sign-in token, is stored encrypted on the mail server only. Removing the account deletes the copy and the credentials at once; the mail stays at the provider.
Backups. The mail server is backed up every night, encrypted. Backups are kept for up to 12 months.

Dazr Calendar and Dazr Contacts

Calendar. Your calendars and events, with titles, times, places, notes, attendees and their answers, reminders, your working hours and availability, and the calendars people share with you. Invitations to people outside Dazr are sent by email with the event and its attendees. Colleagues see your free and busy times only as your settings allow.
Booking pages. Guests of a booking page see only the free times, never your events. A guest who books gives their name, email address and the answers your page asks for, such as their company or topic. The booking becomes an event in your calendar with the guest as attendee, and both of you get an email; the link to change or cancel it works for up to 400 days. Outside calendars you add by their secret address are read for busy times only, which we keep for 10 minutes.
Contacts. The people you add, with the details you enter, a photo and your groups. Your organisation’s directory comes from Dazr Identity; what colleagues see of your own card beyond your name and email address is what your privacy settings allow.

Dazr Teams: chat and meetings

Chat. Your conversations, channels and messages, with reactions, mentions, the files you share (as links to Dazr Files), video notes, your status and focus times, and private notes per chat. You talk with the members of your organisation and with people you invite by email; there is no directory of Dazr users. An invitation expires after 14 days. The messages of an organisation’s channels belong to the organisation.
Meetings. Audio, video and shared screens run through our own meeting server (LiveKit) at Hetzner in Germany while the meeting lasts, and are not stored. The meeting server receives the name shown in the meeting and a pseudonymous id, never your email address. We keep who may join, the lobby with the names and email addresses of guests waiting to be let in (for up to 8 hours), and a log of who joined and left and what hosts did (for 90 days).
Recordings. On Enterprise, a host can record a meeting, and everyone in it sees that it is being recorded. The recording is saved as an encrypted file in the host’s own files, or for a channel meeting in the organisation’s space; the unencrypted copy made while recording is then deleted. It stays until someone deletes the file, and counts towards storage.

Dazr Desk

Tickets. Mail to a shared inbox that an admin chose for a helpdesk workspace becomes a ticket, and so do messages sent through the workspace’s web form. The mail itself stays in Dazr Mail. The ticket keeps the customer’s name and email address, the people in copy, the subject, status, priority, assignee, tags, internal notes and its history.
Customers. Customers need no account. They get the replies and, if the workspace turns these on, an automatic receipt and, after a ticket is solved, one email asking how it went. Their rating (good or bad) and optional comment are kept on the ticket and in the reports; the link to give one works for 30 days.

Dazr Projects and Dazr Time

Projects. Issues with their descriptions, comments, attachments (stored in Dazr Files), assignees, boards, sprints and history, visible to the people of the project.
Time. On Enterprise, the time people log on issues, tickets or calendar events: the day, the minutes, a note, the client and whether it is billable. Everyone sees their own time; the organisation’s admins and the leads and admins of a project or helpdesk workspace see the time logged there.

Dazr Analytics

On Enterprise, Dazr Analytics shows an organisation daily counts and durations from its Dazr apps, such as tickets solved, meeting hours, hours logged and sign-ins. It keeps only these numbers, per day and per team, never the text of a message, a title or a file name. To count how many people took part in something, it keeps a short hashed id per person instead of a name. Numbers are team totals by default, groups of fewer than 5 people are hidden, and only owners, admins, read-only admins and people they give the Analytics viewer permission can open it; per person it shows only hours logged, helpdesk agents and security, and only to owners and admins. The daily numbers are deleted by themselves after 25 months.

Dazr Forms

Forms. The questions, settings and collaborators of each form, visible to its owner and to the people of the organisation the owner adds as collaborators.
Responses. The answers, the time and, for a quiz, the score. On a link for anyone, people need no account and we keep no name or email address unless the form asks for one; their IP address is only counted for a short time against abuse and is not kept with the response. On a link for the organisation, the person’s name and email address are kept with the response. Files people upload go to the form owner’s Dazr Files and count towards the owner’s storage.
Emails. If the owner turns it on, they get an email for each new response with the name of the form and the number of responses, never the answers.

Dazr Sign

Documents you send with Dazr Sign count towards your storage. What Dazr Sign keeps about documents, recipients and signatures is in the Dazr Sign privacy notice, and for organisations in the Dazr Sign data processing agreement.

Plans and payments

If you buy a plan, we keep the plan, your payments and your invoices. For a plan for yourself we also keep your name, your address and the country your IP address points to, so that we charge the VAT of the country you live in; for a company plan, the organisation’s billing details from Dazr Identity. Mollie processes the payments and receives the amount, a description and a reference to the order; your card details never reach our servers. We keep invoices and payment records for as long as tax law requires (10 years in Italy). Legal basis: the contract (Article 6(1)(b) GDPR) and our obligations under tax law (Article 6(1)(c) GDPR).

Optional AI assistant

The Dazr apps include an optional AI assistant. It is off by default and works only after it has been turned on and the AI terms accepted: by you, with your own account at an AI provider, or by the owner or an admin of your organisation, with the organisation’s account. You or your organisation choose the provider, for example Anthropic, OpenAI, Mistral or Google, or another service with a compatible interface, including one you run yourself. As long as the assistant is not turned on, none of your content is sent to an AI provider.

What is sent. Only when you ask the assistant to do something: your request and the content it needs for it, such as the text of the open document, the mail or events it reads for you and the results of the steps it takes. If you add a key for a web search service, the searches the assistant makes go to that service in the same way.
How it travels. In the web apps, every request goes through Dazr’s AI gateway (aigateway.dazr.eu), which runs on our own server at Hetzner in Germany. The gateway adds the key, passes the request to the provider and the answer back to you, holds the content in memory only while it passes it on, and does not store or log it. In Dazr OS, with a key kept on your device or a model on your own computer or network, requests go from your device straight to that provider without passing through Dazr; with your organisation’s key, Dazr OS also uses the AI gateway.
Your AI provider. The provider receives the content under the agreement between you, or your organisation, and that provider, and handles it under its own terms and privacy policy, which also decide where it processes the data and how long it keeps it. Dazr is not a party to that agreement and does not give the provider instructions; the provider is not a Dazr sub-processor. You, or your organisation, are responsible for that agreement and for choosing a provider and settings that fit your use, including where the data is processed.
Your key. The key is encrypted in your browser before it is sent and is stored, encrypted, only on the AI gateway. It cannot be read back: Dazr’s apps and the gateway show only the provider, the last 4 characters and a fingerprint, to you, to your organisation’s admins and to Dazr staff alike. The key is used only to send requests to the provider it belongs to.
What we keep. For each request the gateway records who made it, from which app, the model, the number of tokens, the estimated cost and the result, so that you and your organisation’s admins can follow usage and set limits. It never records the text of requests or answers, and records no IP addresses. These records are kept for 13 months. We also keep the assistant’s settings, such as whether it is on, the provider, any limits and when the AI terms were accepted.
No training. Dazr never uses your content, your requests or the answers to train AI models. Whether your provider may do so depends on your agreement with it.
Roles. For an organisation, the organisation is the controller of the content its members give the assistant, and Dazr processes it on the organisation’s behalf, as it does the rest of its content. For your own use, Dazr passes your requests on to provide the feature you turned on (Article 6(1)(b) GDPR). The AI provider is engaged directly by you or your organisation, not by Dazr.
Turning it off. You can hide the assistant or remove your key at any time in its settings; a removed key is deleted from Dazr at once and can no longer be used. The owner and admins of an organisation can turn the assistant off for the organisation and remove the organisation’s key.

Legal basis

We process your content and the data around it to provide Dazr Suite to you and, for an organisation space, to the organisation and its members (Article 6(1)(b) GDPR).

For the people you write to, invite, meet or share with, the guests of your booking page and the customers of a helpdesk, we process their names, addresses and messages because you, your organisation and we have a legitimate interest in delivering them (Article 6(1)(f) GDPR).

How long we keep it

Files stay until you delete them; deleted files stay in the trash for 30 days.
Each file keeps its last 10 versions.
Uploads that were never finished are removed after 2 hours.
Share links, the email addresses they were sent to and their access logs stay until the link is turned off or the file is moved to the trash or deleted, and at most 30 days after the link expires.
Emails about first opens and edits are sent within 15 minutes; what they list is deleted when they are sent, and after 7 days at the latest.
Mail stays until you delete it. A removed extra mailbox or shared inbox can be restored for 7 days, then it is deleted. The mail server’s encrypted backups are kept for up to 12 months.
Events, booking pages, contacts, chat messages, tickets, issues and time entries stay until they are deleted in the app. When an organisation is deleted, its channels with their messages, its helpdesk workspaces and tickets, projects, time entries, Analytics numbers and files are deleted within 30 days, and its shared inboxes once their 7 days to restore them are over.
Meeting lobbies are cleared after 8 hours and meeting logs after 90 days. Recordings are files and stay until they are deleted.
Rating links of Dazr Desk expire after 30 days, links to change a booking after 400 days, invitations to a chat after 14 days.
Analytics deletes its daily numbers after 25 months.
Forms and their responses stay until the owner deletes them. When an organisation is deleted, its forms and their responses are deleted within 30 days. When you delete your account, the forms you own are deleted with their responses; the responses you gave to other people’s forms stay with those forms, without your name.
When you delete your Dazr Identity account, your own files and their versions, your mailboxes, events, booking pages, contacts, chats, status, notes and settings are deleted, most of it at once and all of it within 30 days. The messages you wrote in chats and groups are deleted; the others see that a message was deleted. Messages in an organisation’s channels, and its tickets, issues and time entries, belong to the organisation: they stay, without your name.

Visiting our websites

Server logs. Our hosting provider records each request: IP address, browser (user agent), the address requested, status and time. We use these logs to run our services and keep them secure, and keep them for up to 30 days. Legal basis: our legitimate interest in operating secure websites (Article 6(1)(f) GDPR).
Page statistics. We count page views with Vercel Web Analytics. It sets no cookies and does not store IP addresses; we only see totals, such as how often a page was viewed. Legal basis: our legitimate interest in knowing which pages people use (Article 6(1)(f) GDPR).
No advertising or tracking. Our websites show no advertising and contain no third-party trackers, pixels or social media widgets. Fonts and scripts come from our own servers.
Spam protection. Before a public form is sent, your browser solves a small calculation (proof of work). It runs on your device and sets no cookie.

When you contact us

If you use the contact form or write to one of our addresses, we receive your name, email address, company (optional), the topic, your message and the page you sent it from. The form emails your message to our inbox and a copy to you. We use it only to answer you and follow up on your request, and keep it for up to 24 months after our last contact. Legal basis: steps you ask for before a possible contract (Article 6(1)(b) GDPR) and our legitimate interest in answering questions (Article 6(1)(f) GDPR).

Cookies and storage on your device

We use no advertising or analytics cookies, so there is no cookie banner. What we store is needed for the service or remembers a choice you made, so it needs no consent:

__Secure-dazr_id (cookie): keeps you signed in to Dazr Identity on the dazr.eu sites. It cannot be read by scripts and ends after 30 days, or when you sign out.
dazr_id_hint, dazr_id_ping (local storage): your name, email address and picture, so the page header can show who is signed in straight away, and a signal that keeps your open tabs in step when you sign in or out.
dazr_lang (cookie and local storage): the language you picked, so every Dazr site and app opens in it. The cookie holds only the language code, is shared by the dazr.eu sites and lasts one year.
Docs, Sheets and Slides (browser storage): working copies of your documents and your preferences, as described above.

Service providers

These companies process personal data for us, only on our instructions and under written contracts that oblige them to protect it:

Hetzner Online (Germany, Nuremberg) runs our own servers: the encrypted storage of your files and meeting recordings, the encrypted backups of our database, our mail server, which stores Dazr Mail mailboxes and sends our emails, the meeting server for calls in Dazr Teams, which passes audio and video between the people in a meeting and stores none of it, and the server for live editing, which passes changes and cursor positions between the people editing a file together. The live editing server keeps them in memory only while they are connected and stores nothing. Another of our servers there runs the gateway of the optional AI assistant, which passes requests on to the AI provider you chose and stores none of their content.
Vercel hosts our websites and server functions and counts page views.
Upstash runs the database (a key-value store) that holds accounts and records.
Mollie (Amsterdam) processes payments for paid plans.
Namecheap Private Email hosts our mailboxes, such as hello@dazr.eu and support@dazr.eu, where the messages you send us arrive.

Google and Microsoft are involved only if you choose to sign in with them, or to connect a mail account or calendar you have with them; the provider of any outside mail account or calendar you connect receives the requests Dazr makes for you.

The AI provider that you or your organisation connect to the optional AI assistant is not one of our service providers: you or your organisation engage it directly, under its own terms.

Where your data is stored

We store personal data on servers in the European Union. Vercel, Upstash and Namecheap belong to companies based in the United States. Where one of them can access personal data from outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses or, for companies certified under it, by the EU-US Data Privacy Framework.

How we protect your data

All traffic to our services is encrypted (HTTPS). Accounts, documents and files are encrypted with AES-256-GCM at the application layer, on top of our providers’ own encryption, with keys held on our servers. This is not end-to-end encryption: our systems can decrypt the data in order to provide the service, and only the few people at Dazr who run it can access them.

Your own files and each organisation’s space are encrypted with their own keys. The storage paths of files contain no names or other personal data.

Your rights

You can ask us for access to your personal data, a copy in a portable format, correction, deletion or restriction, and you can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.

You can download any file from Files at any time, and a whole mailbox as an .mbox file in Dazr Mail (Settings, Export your mail); the owners and admins of an organisation can do the same for its shared inboxes. Under Dazr Identity → Privacy & data you can download a list of your files and delete your account with all your files.

Write to privacy@dazr.eu for anything you cannot do yourself. We reply within 30 days.

You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live or work.

Changes to this notice

If we change this notice, we update the date at the top. Earlier versions are available on request.

Contact

Privacy and data requests: privacy@dazr.eu
Security: security@dazr.eu
General: hello@dazr.eu
Post: Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy