Secure by design · You stay in control

Dina Data Wallet

Privacy Policy

This notice explains how Dina Data Wallet processes personal data and uploaded documents under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Effective 11 August 2026English version
Privacy in plain language

Dina encrypts stored document content, does not use it to train AI models, and deletes original uploads after 24 hours by default.

01

Controller and privacy contact

The controller determines why and how personal data is processed in Dina. Use the details below for privacy requests and questions about this notice.

[LEGAL ENTITY OR CONTROLLER NAME][FULL POSTAL ADDRESS]North Rhine-Westphalia, GermanyEmail: [PRIVACY CONTACT EMAIL]

Data protection officer, if appointed: [DPO CONTACT DETAILS, IF APPLICABLE]

Dina's software development and operations teams act on the controller's instructions. They do not independently decide how user documents may be used.

02

Why Dina processes personal data

Dina helps people store and understand administrative documents and keep track of important actions and deadlines. We process personal data only for defined service and security purposes, including to:

  • create and manage accounts, profiles, and secure sessions;
  • receive and store PDF, JPG, and PNG documents selected by users;
  • perform optical character recognition (OCR), document analysis, translation, and plain-language summarisation;
  • extract document types, senders, dates, deadlines, amounts, payment details, and required actions;
  • provide reminders, notifications, and document history;
  • support German, English, Persian/Farsi, Turkish, Arabic, Russian, and Urdu interfaces and processing preferences;
  • operate, secure, troubleshoot, and prevent misuse of the service; and
  • record consent and respond to privacy or support requests.

03

Categories of data we process

Account and profile

Name, email address, password hash, preferred language, country, city, mobile number, date of birth, and address.

Technical and session data

IP address, browser or device information, language preference, session identifiers, timestamps, and security or request logs.

Document content

Files you upload and the personal data they contain. Documents may include information about other people or sensitive data, such as health information.

Processing results

OCR text, summaries, translations, extracted fields, confidence information, deadlines, reminders, and processing status.

Choices and communications

Consent records, account-deletion requests, settings, and any information you include when contacting Dina.

Dina uses a strictly necessary session cookie to keep users signed in securely. The current service does not use advertising cookies or sell personal data.

05

Service providers and international transfers

Personal data is shared only where necessary with contracted categories of service providers, such as hosting, database, encrypted object-storage, infrastructure, support, and optional error-monitoring providers. They may process data only for the agreed service and subject to applicable data-protection terms.

For live processing, document pages are sent through OpenRouter to the selected Google Gemini model provider for OCR. Extracted text and the selected output language are sent through OpenRouter to a provider serving the selected Google Gemini model for analysis. Each request requires a zero-data-retention endpoint. Dina does not enable prompt or output logging and does not permit uploaded documents, text, or results to be used to train AI models.

AI processing may involve recipients outside the European Economic Area. Where a destination is not covered by an adequacy decision, the controller requires an appropriate GDPR transfer safeguard, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where necessary. Safeguard details can be requested through the privacy contact above.

Data may also be disclosed where required by law or necessary to establish, exercise, or defend legal claims.

06

Retention and deletion

Dina keeps personal data only for as long as needed for the purpose for which it was collected, to provide an active account and its requested features, or to meet legal, security, and dispute-handling obligations. The retention decision takes account of the data's sensitivity, purpose, volume, risk, and applicable legal duties.

By default, Dina automatically deletes each original uploaded file 24 hours after upload. Until then, the authenticated owner can view it from the document details page. OCR text, analysis results, deadlines, and reminders remain available after the original is deleted so Dina can continue providing the requested service.

Users can turn off automatic original-file deletion in account settings. When it is off, originals remain until the user deletes the document or turns automatic deletion back on; overdue originals are then eligible for deletion. Disabling the setting cannot restore a file already deleted. Users can also permanently delete an entire document from their workspace at any time. That removes its stored original, OCR and analysis results, deadlines, reminders, and associated encryption-key material from the active system. An account-deletion request can be submitted from the profile.

Some limited records may be retained where law requires it or where they are needed to demonstrate consent, protect the service, or resolve a legal claim. Access to any such record is restricted.

07

Technical and organisational security

Dina uses layered safeguards appropriate to the processing risk:

  • HTTPS/TLS protects data while it is transmitted;
  • uploaded files and document-content fields are encrypted at rest with AES-256-GCM and per-file encryption keys;
  • passwords are stored as Argon2id hashes and sessions use secure, HTTP-only cookies;
  • document access is scoped to the authenticated owner, and admin interfaces do not expose document files, OCR text, or analysis content; and
  • access, logging, and operational controls are designed to prevent unauthorised use and accidental disclosure.

Access by authorised technical personnel is limited to what is necessary to operate, secure, or repair the service. No method of internet transmission or storage can be guaranteed completely free from risk.

08

Your data-protection rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction of processing, and data portability. You may object to processing based on legitimate interests and withdraw consent at any time for future processing.

Send a request to [PRIVACY CONTACT EMAIL]. Dina may request information needed to verify identity before acting on a request. You also have the right to complain to a data-protection supervisory authority. In North Rhine-Westphalia, this is the State Commissioner for Data Protection and Freedom of Information NRW (LDI NRW).

09

AI-assisted processing and human review

Dina uses OCR and AI to produce summaries, translations, and structured information. These outputs are probabilistic and may be incomplete or incorrect. Users must review the original document, especially before acting on legal, medical, tax, financial, or administrative information.

Dina does not use the analysis to make decisions that produce legal or similarly significant effects for users. It provides information and organisational assistance; the relevant authority, organisation, professional, or user makes the underlying decision.

10

Policy updates and contact

This policy may be updated when Dina's processing, providers, safeguards, or legal obligations change. The current version and effective date will remain available on this page. Where a material change requires renewed consent, Dina will request it before the affected processing continues.

Questions, requests, or complaints can be sent to [PRIVACY CONTACT EMAIL] or to the controller's postal address listed in section 1.