Privacy Policy
Last updated: 18 October 2026
This Privacy Policy explains how Smart Exports Oy processes personal data when it provides Dorvio. Dorvio is a field-sales CRM available through mobile applications and the web at dorvio.ai.
Controller and contact
Smart Exports Oy, Business ID 3343221-3
Töölönkatu 35, 00100 Helsinki, Finland
contact@dorvio.ai
1. Roles and scope
For user account data and data about the use and administration of Dorvio, Smart Exports Oy is the controller.
For customer, prospect, place, and sales data that an organization enters into Dorvio ("Customer Data"), the organization using Dorvio is normally the controller. Smart Exports Oy processes that data as the organization’s processor to provide the Service. If you are a customer or contact of a Dorvio customer, please direct your privacy request to that organization first.
2. Personal data we process
We process the following categories of personal data:
| Category | Examples | Purpose |
|---|---|---|
| Account and organization data | Name, email address, password hash, organization, role, invitations, and account status | Create and secure accounts; manage access and provide support |
| Customer Data | Names, job titles, email addresses, phone numbers, addresses, place coordinates, notes, activities, pipeline records, services, quotes, work reports, contracts, signatures, and custom fields | Provide the CRM and Customer’s sales workflow |
| Files and media | Photos, files, filenames, file metadata, and PDF documents | Store and share attachments, quotes, reports, and contracts |
| Device and notification data | Push-notification token, device platform, and notification preferences | Deliver assignment notifications and device reminders |
| Location data | A device’s current location when the user actively requests it or adds a place; a place’s saved coordinates | Show the user on the map and create or edit a place location. We do not continuously track a device or track it in the background |
| Voice-note data | Audio recording, transcription, note text, and suggested fields when the user chooses the voice-note feature | Transcribe a sales note and suggest structured CRM fields |
| Usage and technical data | IP address and technical logs available to our service providers; pseudonymous identifiers, event names, roles, counts, error reports, and diagnostic data | Secure, operate, troubleshoot, and improve Dorvio |
| Communications | Messages sent to us and service emails such as invitations and password resets | Respond to requests and operate the Service |
We receive this information directly from users, from the organization that invites or administers them, automatically through use of the Service, and from the device features that a user actively permits or invokes.
3. Why we process data and the legal bases
Where Smart Exports is controller, we process account, service-administration, and technical data:
- to perform our agreement with the Customer or user, including account administration and support;
- to comply with legal obligations;
- for our legitimate interests in securing, maintaining, preventing misuse of, and improving the Service; and
- with consent where the law requires it, such as device permissions for notifications, microphone, photos, camera, or location. A user can withdraw device permissions in device settings; this does not affect processing before withdrawal.
For Customer Data, the Customer determines the purpose and lawful basis. Smart Exports processes it under the Customer’s instructions and to provide the Service.
4. Voice notes
If a user records a voice note, Dorvio sends the audio recording, selected language, and limited field labels and options to a third-party AI service. The service returns a transcription, cleaned note, and suggested CRM fields. The request instructs the service not to store the content for model improvement.
Voice-note output is a suggestion only. Users must review it before saving or acting on it. Do not record information that you or your organization are not authorized to share with the service. Its processing is also governed by its applicable terms and privacy documentation.
5. Recipients and service providers
We use service providers to operate Dorvio. Depending on the feature used, they may process the categories of data described above:
| Recipient category | Purpose |
|---|---|
| Cloud infrastructure, authentication, and file-storage providers | Database, authentication, file storage, account deletion, and service functions |
| Data-synchronization providers | Synchronize Customer Data to authorized users’ devices for offline use |
| Error-monitoring and diagnostics providers | Error monitoring, diagnostics, and product-usage events |
| Mapping and address-lookup providers | Map display and address lookup from a location when a user requests it |
| Email-delivery providers | Invitations and quote, work-report, and contract emails |
| App-distribution and notification providers | App distribution and push notifications |
| AI-processing providers | Optional voice-note transcription and suggested fields |
We may also disclose data when required by law, to protect rights or security, or as part of a merger, financing, reorganization, or sale of all or part of our business. We do not sell personal data, use it for targeted advertising, or track users across other companies’ apps or websites.
6. International transfers
Some providers may process data outside the European Economic Area. Where a transfer requires safeguards, we use the safeguards required by applicable law, such as an adequacy decision or standard contractual clauses. You may contact us for more information about the applicable safeguards.
7. Retention and deletion
We retain account data while the account is active and for as long as necessary to resolve support, security, legal, and accounting matters.
Customer Data is retained while the Customer uses Dorvio or until the Customer deletes it, subject to any applicable agreement and legal retention obligation. A user can delete their own account in the app. This removes the login, membership, and notification tokens. Data synced to that user’s device is removed, while Customer Data created by the user remains with the Customer without that user’s name where the Service’s data model permits.
We may retain limited data for longer where required by law, to establish or defend legal claims, or in secure backups for a limited period until those backups are overwritten.
8. Security
We use reasonable technical and organizational measures designed to protect personal data. These include authenticated access, role-based permissions, row-level access controls, encrypted network connections, password hashing by our authentication provider, and access controls for service providers.
No system is completely secure. If we become aware of a personal-data breach, we will take the actions and make the notifications required by applicable law.
9. Cookies and similar technology
The Dorvio web app uses essential cookies and similar storage to maintain authentication and language and theme preferences. We do not knowingly use advertising cookies or cross-site tracking. You can manage cookies through your browser, but disabling essential cookies may prevent the web app from working correctly.
10. Your rights
Depending on applicable law, you may have the right to request access to, correction of, deletion of, restriction of, or objection to the processing of your personal data; to receive a portable copy; and to withdraw consent where processing is based on consent. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Dorvio does not make such decisions.
To exercise rights concerning data for which Smart Exports is controller, contact contact@dorvio.ai. We may need to verify your identity before responding. For Customer Data, contact the organization that uses Dorvio, because it is normally the controller.
You may complain to the Office of the Data Protection Ombudsman in Finland at tietosuoja.fi.
11. Children
Dorvio is a business service and is not directed to anyone under 18 years of age. We do not knowingly collect personal data directly from children.
12. Changes to this policy
We may update this policy to reflect changes in the Service, our processing, or applicable law. We will publish the updated policy, revise the "Last updated" date, and provide additional notice for material changes when required or appropriate.
13. Contact
Questions, requests, and complaints about this policy or Smart Exports’ processing of personal data can be sent to:
Smart Exports Oy
Business ID 3343221-3
Töölönkatu 35
00100 Helsinki
Finland
contact@dorvio.ai