Privacy policy

Denis Shelaev, NIF Z1356139H. Carrer de Francesc Planas i Casals 57, 08911 Badalona, Barcelona, Spain. info@dotrama.com.

Spanish law requires a commercial website to identify its operator.

One policy for everything DOTRAMA: this website, the DOTRAMA account, the DOTRAMA app and the connection of your hub to our cloud.

The account, the app and the cloud connection are not yet open to the public. They are described here in advance, and this text will be reviewed again before they open.

Just visiting sets one cookie, dotrama_locale. It records which language you chose, so the site opens in that language next time. It holds a two-letter language code and nothing else — no identifier, no profile, no history.

If you sign in to your account, two more cookies keep the sign-in secure. None of them is used for analytics or advertising. Each one is listed on the cookies page.

Like any web server, ours writes a line in a log for each request: your IP address, the time, the address requested, the page you came from, and your browser's identification string. Under European law an IP address is personal data.

These logs exist to keep the site running and to notice attacks. They are not used to build a profile of you, and they are not shared. How long a line lives has to be told carefully, because until this week what this page said was not true. It said a new log is started every day and fourteen are kept. The rule saying exactly that was on our server all along — but the program whose job is to carry such rules out had never been installed on it, so not one line had been deleted since the server was set up at the end of August. We found that ourselves on 3 November and installed the missing program the same day. It turns the log over for the first time on 5 November; the lines written before then are removed in order, and the last of them go on 19 November. From that day the sentence we had printed becomes true, and this explanation can go: a line lives two weeks and at most a day longer.

Two more things about our server, now that we are on the subject. The first is the one that concerns you: visiting this site writes the line described above and nothing anywhere else — your visit does not reach the server's own system journal at all. What that journal does hold is attempts to break into the server: the address each attempt came from, both for people trying passwords on it and for packets its firewall turned away. There are hundreds of thousands of those lines, and almost none of them belong to anybody reading this page. They are kept for 90 days and at most a day longer, and we chose that period on 3 November: it is longer than the two weeks above because this is the journal you look back through after you have found something, and a fortnight is how long it takes not to notice. We would rather say all this than leave the paragraph above looking as though it covered everything the server writes down.

If you use the configurator and upload the plan of your home, the file is read by your own browser. It is not transmitted to our server, it is not stored anywhere by us, and it disappears when you close the tab.

The same applies to the markers you place on it and the numbers you enter. The plan your hub keeps is a different matter — see “Your hub”.

To create an account we need your email address and a password. A name is optional. The password is kept by our sign-in server only as a one-way hash: nobody at DOTRAMA can read it.

You can also add a passkey and sign in with it instead of typing that password. The passkey is made by your phone or laptop and never leaves it. What reaches our sign-in server is only its public half: a number that can check a signature but cannot make one, and from which the key itself cannot be worked out. Your face or your fingerprint is not part of what we receive — your own device uses them to unlock its own key, they are never sent anywhere, and we never see them. Of each passkey we keep that public half, the technical identifiers your device issues with it, the moment it was added and the name you give it. The passkey is tied to dotrama.com and does nothing on any other site. A passkey you no longer want can be removed from your account on the Security page, and every passkey goes with the account itself when it is deleted at the end of the thirty days. What we cannot remove is the other half of it: that one lives in your own keychain — iCloud, Google Password Manager, Windows Hello — and only you can take it out of there. A passkey has no expiry date of its own: it lives until one side or the other removes it.

If you give a name, it travels the other way as well — from us to your hub, so that the hub's own screen can greet you by it. This is the only thing that goes in that direction: everything else on this page travels from your home to us. Two consequences are worth stating. The name shown at home is always the name of whoever the hub belongs to, so a member of the household standing at the panel sees the owner's name and not their own. And your name is then held on a device standing in your home: nothing comes back to us along this path, the name is removed from the hub when the hub is unlinked from your account, and leaving the name empty means nothing is sent and the screen simply says Welcome Home.

For each sign-in we keep when it started, when it was last active, and whether it came from the app or from this website — so you can see your sign-ins and end the ones you do not recognise. We do not work out your city or country from your IP address.

When you sign in on this website, the sign-in is kept on our server in encrypted form. Your browser holds only a random identifier.

When you link a hub, we record that it belongs to your account.

So that the app can show your home while you are away, the hub sends our cloud a copy of its current state: the names of rooms and devices, whether each device is online, and its current readings — open or closed, temperature, battery level. Each new copy replaces the previous one. Recent changes are kept for 24 hours so the app can catch up; the results of commands you send, such as switching a socket, for 7 days.

Your hub sends our cloud what it knows about your home: the devices you have added, what kind each one is, which model each one is and who made it, their readings and battery level, the controls, settings and actions the hub offers for them — down to what a press would send and the words the hub would show for a door that is open or shut — and which room and floor each one stands in. The readings are worth naming one by one, because the word hides what is in it: whether a door or a window is open, whether a socket is switched on, temperature, humidity, movement, smoke, a water leak, soil moisture, light and battery. And for each room, apart from the devices standing in it: whether it is occupied right now, and when movement was last seen in it. That last pair is the heaviest thing on this page. It is the answer to «is anybody home», and we would rather write it down here than leave you to work it out from a screen that shows your rooms as they stand. The model and the maker's name travel for one reason: so that the screens you use away from home draw your devices the way your hub draws them at home — your door sensor shown as that sensor, and not as a shape that stands for any sensor at all. It is worth saying plainly what that costs, because it is not nothing: it tells us which equipment stands in your home, and which makers you chose. A list of equipment describes the person who chose it, not only the things, and the brands in a home can suggest what it cost to fit out. We do not use it to advertise anything to you, we do not share it, and it is erased with everything else described here. Of everything on this page it is the only thing we hold so that a picture looks the same in three places, rather than because something would stop working without it. What identifies a device on the radio network inside your home — its network address, how strong its signal is, and the hub's own diagnostics about it — stays on the hub and is not sent to us. We keep the current state, not a journal: the history of readings stays on the hub. A detailed graph cannot be opened from away at all for now — there is no way for us to ask your hub for one, and when there is, this page will say so. It is stored encrypted with a key kept apart from the database, shared with our other mirrored documents, erased together with your account or when you unlink the hub, and shared with nobody.

If you connect a kitchen appliance of your own — a dishwasher or an oven, through the maker's own service — what it reports travels as well: which programme is selected and which one is running, how far along it is, when it is due to finish, whether its door is open, and whether it would accept being started from away. This says more than it looks: a dishwasher that runs at nine and an oven used at seven describe a household's day, not just a machine's. It travels because the screens you use away from home show it, we keep the current state and not a history of programmes, and it is erased with everything else described here. Connect nothing, and none of it exists.

The floor plan of your home is also kept in our cloud: rooms and walls, the names of rooms, where each sensor sits on the plan, and the things you have put on it yourself — the fireplace, the fridge, a plant, a lamp. For each of those we keep what kind of thing it is, the name you typed for it, where it stands, which room it is in, and which of your devices watch it or switch it. The name is your own words, and a list of names describes a household: «Nursery lamp» says more than «lamp». It travels because the plan is the same plan in all three places, and a thing without its name is a shape you would have to guess at. Without it the plan could not be shown in the app or here while you are away. What you have set up for those things travels as well, because the screens away from home are meant to be the same screens: their schedules, what they should do when you are at home or when it gets dark, the temperatures you chose, whether they switch off with the house and whether they take part in saving energy, how each one is switched at all — by its socket, by a remote, or by the two together — the watch kept on a fridge, being told when the wash is done, being reminded if something has been left on longer than the hours you chose and whether it should then switch itself off, the buttons you taught an infrared remote and which of them is the one for drying, and the names you gave them for the voice assistant. Say plainly what that adds up to: a schedule describes a day. «Nursery lamp» tells you a child lives in the house; the hours it switches on tell you when that child sleeps. With the scenarios you set we also keep their log — including the days you marked yourself away, and the stretches when the house stood empty. Of everything on this page that log is the closest thing to a diary, and it is here for one reason: you asked for the same home on every screen, and a scenario you cannot see or change from away is not the same home. What a remote actually sends — the codes it learned — never leaves your hub, not even to its own screen: what travels is the names of the buttons, which thing each remote serves, and whether it has a key for on and off. It is erased exactly like the rest of the plan, and stored encrypted with a key kept apart from the database — the same key as our other mirrored documents, not one of its own. It is shared with nobody, with one exception you will meet below: the name of an object travels in an alert that comes from a scenario, by email or Telegram, if you switched those on. What still never leaves your home is the ability to change your network from away, and your home Wi-Fi password. The settings of your network themselves do travel, and the paragraph on them says what they are; the password of the hub's own setup network is a separate case, and the paragraph on it says so. The plan itself is stored encrypted with a key of its own, kept as a file outside the database. It is not shared with anyone, and it is erased together with your account. The address and the position of your home are not part of the plan itself; the paragraph below says what we hold of them.

Two things about that encryption, said plainly, because the word invites a conclusion we cannot support. Alongside those main copies we keep a short snapshot of how your home stands right now — the names of your rooms and of your devices, and their latest readings — together with the events behind your alerts. The screens you watch and the alerts themselves work from that snapshot, and it is stored in the database without a key of its own: a copy of the database would show those names. And when you change the plan or a setting from away, the command travels as a copy of its own and waits with us up to seven days before it goes, in plain form, with whatever room and object names it carried. The snapshot, the events and those seven-day copies are all erased together with your account and when you unlink the hub, whichever comes first — with one command excepted, the one that tells the hub it has been released, and it carries nothing but that and the time.

If you add cameras of your own, your hub tells our cloud which ones there are: the name you gave each one, the room it hangs in, the floor and the spot on the plan where it stands, which way it looks, how wide it sees and how far, whether it is switched on, when its settings were last changed, whether your hub has the program that shows pictures at all, and one word about why there is no picture when there is none — that it is still starting, that nobody answers at the camera's address, that the camera refused the hub, or that it sends video a browser cannot show. Say plainly what that adds up to: it is a map of what is watched in your home, and the direction, the width and the range together draw the very patch of your home that is under a camera's eye. «Nursery» tells as much as a lamp's name does. It travels for the reason the rest of this page gives: the Cameras screen away from home is meant to be the same screen as at home. What never travels with it: the picture itself; the camera's address on your home network, its port and the path of its stream; the user name and password you typed into it — not even the fact that a password is set; and the key that opens its stream. There are no fields for those, so there is nothing to send. Adding a camera and changing its settings stay on the hub, in your home. Watching one will not change that either: when watching from away is built, the picture will travel from your hub to the screen you are looking at, as the paragraph on watching a camera describes.

A few more of your own settings travel for the same reason — so that the screens away from home are the same screens. The thresholds your home judges by: after how many minutes a room counts as empty, over how long a window it decides whether anybody is there, from what wattage a device counts as switched on, what counts as dark, what counts as damp air in a room, and what counts as dry or damp soil for a plant. Beside each number travels the range we allow for it — the smallest, the largest and the one we start from — which says nothing about your home, only about the product. Whether you asked for a monthly report on your electricity, on which day of the month, and where it should be sent. And for a voice speaker: its name, its model, whether it is reachable, whether it can play a sound and which sounds it has, whether its microphone is switched off, and the wake word you chose. What stays at home is the speaker's address on your network, the key it uses, its hardware address and its port — those are network settings. To be straight about it, keeping that at home is our decision rather than something you asked for, and we would rather say so than let it look like your choice.

If you traced your plan from a file — a PDF, a DXF, or a photograph of a paper plan — the file itself stays on your hub. It never reaches us: there is no way for it to, and nowhere here to put it. What travels is the drawing of the walls that your hub made from it, the same outline you see on the screen. That matters in both directions. A file drawn by an architect or sent by an estate agent often carries more than what you see on the page — other floors, the name and contact details of whoever drew it, notes and revisions, sometimes the address of the building — and none of that comes to us, because the hub takes the lines and leaves the rest. Words already drawn as shapes in the file travel as shapes, since by then they are lines like any other. And there is nothing for you to choose here: a plan drawn by hand and a plan traced from a file end up as the same kind of outline in our cloud. The outline is stored encrypted with a key of its own, erased together with your account or when you unlink the hub, and shared with nobody.

Your hub also sends our cloud the profile of your home: the name you gave it, the street address you typed in, the position you marked on the map, the address that came back if you looked one up by typing it, how many floors it has, the time zone it is in, which of your sensors is the one standing outdoors, and the photo of your home if you added one. This is the most personal thing we hold, and it is here for one reason: the screens you use away from home are the same screens as at home, and these screens show it. It is stored encrypted with a key of its own, kept as a file outside the database. It is shared with nobody, it is never used to advertise anything to you, and it is erased together with your account or when you unlink the hub. None of these fields is required: leave them empty on the hub and everything else in your home works exactly as before.

If you add a photograph of your home, the picture itself is kept in our cloud, along with what kind of file it is, how large it is, and when you last changed it. What you called the file on your own device is not sent: what you name your files is not our business. A photograph taken with a phone usually carries, written inside the file itself, where and when it was taken — and «where» is the position of your home. Your hub strips those entries out before the picture travels, and our cloud checks that they are gone and refuses the picture if they are not — including a picture with anything added after the image ends. What that check reads is what the file says about itself, not the picture: it goes through the file's own table of contents rather than looking at the pixels. This is one of the few promises on this page you can check yourself, with a photograph of your own. The picture is kept until you delete your account or unlink the hub, and is then erased; that erasure is not something that can be switched off.

Your hub also sends us seven short summaries about life at home: which hours of the week there is usually movement — and, for the hour it is now, whether your home and each of its rooms are usually empty at this time — how much electricity the home draws when nothing is in use, and the same for each appliance by name — which room it is in, what it draws at rest and on average, and whether that is creeping up, how quickly the soil dries out for plant sensors — with the names of the plants you wrote next to each one — an hour-by-hour picture of the week — what the home uses in each hour of it, and how damp the soil is at each hour, averaged over the last four weeks — for each room, how long the air touching its coldest surface has been humid enough for mould to begin, and two more weeks hour by hour: how damp the air has been, and how much light there was — the light one marked as outdoor when the sensor stands outside. That last one carries, for each room: the verdict itself, how many sensors watch it, how many hours have been observed, the hours of damp over the last day and the last week, averages over the day, the week and the month, and the worst reading seen. With them travel the two thresholds the hub judges by — what it counts as a cold surface and as damp air — and how many hours an outdoor thermometer was supplying readings. The readings themselves stay on the hub, with one exception: for a plant sensor the current soil reading travels as well, and with it the last two weeks of it, averaged every six hours, and when it was last watered. Two of these say more about you than they look. The hour-by-hour picture describes the rhythm of your week: when the home wakes, when it cooks, when it stands empty. And the damp count is about the fabric of your home rather than about you, but airing a room shows up in it, so it carries a trace of when somebody was there. We would rather you read this here than work it out later. They are summaries, not a log — the detailed history behind them stays on the hub, and the hub sends a new summary a few times a day at most; what you see is the latest one it managed to work out. Without them the Statistics screen could not be shown while you are away. They are stored encrypted with a key of their own, erased together with your account or when you unlink the hub, and shared with nobody.

Your hub also tells us how it is doing: how busy its processor and memory are, how much space is left on its card, its temperature, how long it has been running, what time its own clock says, and whether it can reach the internet and us. With it comes the model of the machine and the software it runs: the operating system, the kernel and the Casamart version. This is what you see at the top of the panel and on its About screen. The clock travels so that you can see from away when your hub's own time has drifted — a real fault, and one that nothing else would show you. It says nothing about your rooms or your sensors. It is erased together with your account, or when you unlink the hub.

Your hub also tells us how its software is doing: which version is installed, which one is offered to it, whether an update is running and how far it has got, and the reason if one failed or was refused. Without it the Updates screen could not be shown from away, and we could not tell that a hub is stuck on an old version — which is how security fixes quietly fail to arrive. It says nothing about your home.

Your hub also tells us how it is connected: which network adapters it has, whether each one is up, the name of the Wi-Fi network it has joined, and the addresses it holds on your home network — its own, its router's, the name servers it uses, and the hardware addresses of its adapters, together with the make, model and serial number of the adapters themselves and the name of the hub's own setup network. With it comes the fingerprint of the certificate your hub shows to browsers on your home network — a short hash of a public certificate, the same one it presents to anyone who opens it, so that this site can tell you whether the hub you are looking at is really yours. This is what the Network screen shows you when you are away. No password is part of it: neither your home Wi-Fi password nor the one for the hub's own network, which is kept apart — and showing that one to you is not built yet, as its own paragraph says. It is erased together with your account, or when you unlink the hub. The fingerprint of the hub's certificate is the exception and stays with us: it is not about you but about the machine, it changes only when the hub sends a new one, and it is what lets this site tell you whether the hub you are looking at is really yours.

One thing leaves your home without passing through us at all, and it is worth knowing where our promises stop. If you connect your Bosch or Siemens appliances — an oven, a dishwasher — your hub talks to Home Connect, their own service, directly, signing in with your own account there; the keys to it stay on the hub and we never hold them. What your hub asks for is the list of appliances on that account, what each one is doing, which programme is running, and the stream of events. What it sends is two commands and no others: stop the programme that is running, and switch the appliance off. There is no command in the hub to start anything. The permission the hub asks for at Bosch is wider than those two, and it is fairer to say so than to let you assume otherwise: it is their permission for controlling an oven or a dishwasher, and on their side it would allow a programme to be started. We do not use that part. So what keeps your oven from being started from here is our software, not their permission — and that is a smaller promise than the one you might have read into the sentence before this. Every request carries the number Bosch itself gave that appliance, and Bosch sees the time and the address your home is on, as any service sees a request; your rooms, your names for things and everything else on this page stay out of it. What comes back — the appliance's name, its brand, model and type, whether it is connected, how its door stands and how long it has left — reaches our cloud only as one more card among your devices, like any other. And the part we would rather say than let you assume: because we are not in that conversation, we cannot promise you anything about what Home Connect does with what it learns. That is between you and them, under their privacy policy, not ours.

A camera in your home is watched from your hub, not from our cloud. Watching from away is not built yet: away from home you see the list of your cameras, not their pictures. What follows is how it will work when it is built — the shape of it is settled, and you should be able to read it before it arrives rather than after. On the day it works, this warning goes and the rest stays. When you open a camera from away, the picture will travel straight from your hub to the screen you are watching on, and our cloud will do nothing but introduce the two sides to each other.

Some home routers will not allow that direct connection. When yours is one of them, the picture will be relayed through our server instead — and you will not be able to tell in advance whether it will be, because it depends on your router and not on anything you choose. Even then the picture will be sealed between your hub and your screen with keys that only those two hold, and our relay will pass the sealed packets along without being able to open them.

No camera opens without a key that you set on the hub itself. That key never reaches us: it is in none of our databases and in none of our logs. Without it nobody can watch your camera, and that includes us — this is how the hub is built, not a rule we promise to keep.

There is one step that key cannot protect, and we would rather write it down than let you discover it. The page on which you will type the key is served by us. Someone who could change what our servers send could take the key as you type it. No key prevents that; only code we do not serve can. Our app does not show cameras yet, so for now there is no such way — when it does, this paragraph will say so.

We keep no video at all. Nothing of the picture is stored in our cloud or in our logs. Recordings, if your camera makes them, stay on the camera's own card.

A record of the connection will stay with us: which camera was watched, when, and from what address. That is not the picture, but it is a note of when you looked into your own home — so it will be kept for 14 days and then deleted. Today there is no such record at all, because there is nothing yet to watch.

The small map on your home's card is not ours, and neither is the map you open to find your address. Your hub fetches it, piece by piece, from OpenStreetMap — a public map service run by other people. We do not run it, we do not pay it, and we have no say in what it keeps.

From the pieces your hub asks for, that service can tell which small patch of the world you are looking at. That patch is where your home is. It sees this together with the internet address your home uses. If you look up an address by typing it, the words you typed go to Nominatim, the search side of the same project.

The request leaves from your hub, not from your browser. So the service sees the internet address of your home and nothing else: not your account, not your name, not the device you are looking from, and not the plan you have drawn. Pieces already fetched are kept on the hub, so opening the map again usually asks for nothing new.

In your account on this site the map is fetched a third way, and it is the one that tells the map service least. The pieces are asked for by our server, not by your hub and not by your browser. So the service sees a request from us: not the internet address of your home, not the address you are using at that moment, not which of our customers asked, and not that a person was involved at all. It still sees which patch of the world was wanted, because that is what a map request is, and no arrangement can hide it. We ask for the pieces only while somebody has that screen open; we do not fetch maps of your home at any other time.

This is the one place where something about your home leaves it to somebody who is not us. It is the price of a card that shows your home on real streets, and you should know you are paying it. You do not pay it unless your home has a position on the map: without one the card has no map on it, the window for finding an address is never opened, and nothing is asked of OpenStreetMap at all. What is missing is the way back. Once a position is set, the hub's panel has no button that removes it, and we would rather name that than let you look for one. We are asking for the button. Until it is there, write to support@dotrama.com and we will tell you where it stands.

Each hub has its own Wi-Fi network for setup. Its password is printed on the hub's sticker, or it is the one you set yourself. It is not the password of your home Wi-Fi.

In case the sticker is lost, we keep a copy of that password, encrypted with a key of its own. Showing it to you is not built yet: when it is, it will be shown to the owner alone, after the account password is entered again, and every viewing will be recorded and sent to the owner by email. Until then the copy is held and shown to nobody — outside the factory, that is: while a hub is still there, reprinting its label shows that password to the people doing the printing, because that is their work. Once a hub has shipped, that door is shut by the hub's own state.

Alerts reach your phone through Firebase Cloud Messaging, a service of Google. On an iPhone they will go to Apple's own notification service instead, by a road that is built but has never carried anything: the app for iPhone is not out yet, so today every alert that leaves us goes to Google and none to Apple. When the iPhone app arrives, nothing on this page changes except that the Apple road starts being used. They receive an identifier of the app on your phone and the text of the alert: what happened, in words; the rooms it happened in — up to three by name and the rest as a number; and the name you gave your home when you linked the hub, for example “Water leak — Kitchen, at Home”. It is the name given when the hub was linked — the form offers «Home» and you can type your own. A home cannot be shared with anybody yet, so that name is the one person's who linked it. If you never gave one, the hub's serial number goes instead. Alongside the text they also receive technical identifiers of the alert and of the hub. The address of your home and its position on the map are never part of it.

You choose where each level of alert reaches you: a notification on your phone, an email, or Telegram — except that a critical alert always goes to your phone, and that one cannot be switched off. That choice is kept with your account, and you can change it in your account here, in the app, or on the hub itself.

If you connect Telegram, the same alerts go there as well, and they say the same as an email: what happened, every room it happened in — all of them, not the first three as on a phone screen — the name you gave your home (or the hub’s serial number, if you never gave one), when it happened, the name of the object when the alert comes from a scenario, and, when the alert is about one sensor, the name you gave that sensor. A full list of rooms says more than one room does: it is a sketch of your home’s layout. Telegram is not ours: it is a messaging service run by another company, outside the European Union, and we have no agreement with it about how it handles what we send to it. The address of your home and its position on the map are never part of it.

You connect it yourself, and there are two ways to do it: a code of six characters that you send to our bot as an ordinary message, or a link we show you once. Both work for ten minutes and then stop working, both work once, and using one kills the other. We keep neither the code nor the link — only a fingerprint of each, enough to recognise it when it comes back to us, and made with a key kept outside the database, so a copy of the database alone does not give anybody the code. The bot you will be talking to is @DotramaAlarmBot: check the name before you press anything, because a bot with a similar name is the cheapest way for someone to put themselves in our place. Once connected, we keep the number Telegram uses for your chat, so that alerts have somewhere to go; where we show you which chat is connected, we show that number shortened. One chat for each account.

The name of a room, the name you gave a sensor, and the name you gave your home are facts about it, and sending them to a service we do not control is your decision, not ours: this channel stays off until you switch it on. You can disconnect it in your account here, in the app, or on the hub, and blocking the bot in Telegram disconnects it as well. However it ends, we delete the number of your chat and keep only a note that the connection existed and when it ended. That decision of yours is the only thing this transfer rests on — there is no arrangement with Telegram behind it, the way there is with Apple and Google.

How long the history of alerts is kept is being settled at the moment: today nothing removes it automatically, and we will state the period here as soon as it is set. What is settled is the other end of it: the alerts from a hub are erased when you unlink that hub from your account, without waiting for any period, and all of them are erased when the account is deleted.

Along with them we keep whether your hub's siren is switched on and how many sirens it has, so you can see that when you are not at home.

The hub can send us a diagnostic report: software versions, whether its own services are running, free memory and disk, and how its connection behaves. You decide whether it does, and by default it sends nothing. The switches are on the hub's own screen and in your account here, so you can change your mind from wherever you are. One thing is worth knowing about them: of everything you can switch in your account, this is the only switch that gives something to us rather than to you — and the page it sits on is served by us. What that means is set out under «Code we serve, and code we do not» on the security page.

These reports say nothing about your rooms and nothing about your sensor readings, and no street address is part of them. The detailed setting adds the position of your home on the map — that is why it is a switch of its own, and why it is off until you turn it on. They are kept for a year and then deleted.

We send only service emails: confirming your address, resetting your password, telling you that a Telegram chat has been connected to your alerts, or that your account is about to be deleted. Alerts by email come the same way, and they are on by default for critical and medium alerts — you did not ask for them, and you can switch them off. Until you do, the full list of rooms below goes to our email service with every such alert. An email says what happened, every room it happened in — all of them, not the first three as on a phone screen — the name you gave your home, when it happened, the name of the object when the alert comes from a scenario, and, when the alert is about one sensor, the name you gave that sensor. A full list of rooms says more than one room does: it is a sketch of your home's layout. It is there because an email has room for it and cutting it short would hide part of what happened; if you would rather it did not travel, switch the email channel off and keep the alert on your phone. The names are your own words and travel as you wrote them: a sensor you named after someone carries that person's name into your mailbox, and into Telegram if you connected it. Worth knowing when you choose a name. No newsletters and no advertising.

They are sent through Brevo, an email service based in France. Your address reaches it so that the message can be delivered.

There is also a form on our contacts page, for when writing a letter is not convenient. What it sends is what you typed: your address, your name if you gave one, your question, and which language the page was in. It travels through Brevo, the same service that carries our other emails, and it arrives in our mailbox as an ordinary letter — we do not put it into any database of ours, and it lives there as letters do. The form asks nothing else about you: no account is needed to use it, because a person whose hub will not let them in may have no account to sign in with.

The app does not send crash reports today. If we add them, this page will say which service receives them and what they contain before the first report is sent.

Some actions are recorded to protect your account: ending sign-ins, linking or releasing a hub, renaming a home, changing what your account says about you, issuing an emergency reset file for a hub, changing alert settings, connecting or disconnecting Telegram, and asking for your account to be deleted or calling that off. A record says what happened, when, from which account and from which of the three ways in — this site, the app or the hub; it never holds a password. How long these are kept is being settled at the moment: today nothing removes them automatically, and we will state the period here as soon as it is set. You cannot look through them yourself — there is no screen for that anywhere, and we would rather say so than let you assume otherwise. If you want to know what they hold about you, write to info@dotrama.com and we will tell you; that is your right under the GDPR, and this is how it is exercised here.

Resetting a hub to factory settings wipes the hub itself. It tells us nothing, and it does not erase your home from our cloud — worth knowing before you hand a hub on, because most people expect the opposite. What erases your home here is unlinking the hub from your account: there is a button for it in your account on this site and in the DOTRAMA app, and when you press it everything described on this page goes, the history of alerts with it. That clears our side, and it does not clear the hub. Your plan, your rooms, your devices and their history stay on the hub itself; whoever holds it next opens its panel at home and sees your home there, and once they link it, the hub sends your home up into their account. What the hub does let go of by itself when the link ends is its copy of your alert settings, the row saying a Telegram chat was connected to them, and your name. Everything else needs the hub wiped, and the hub can now do that itself: in its panel, under About, a button puts it back to how it left the factory. It runs only from inside your home network, never from your account here, and it asks for the registration code from the label first. It takes your home with it — the plan, the rooms, the devices and their history, the scenarios, the journals, the panel password and the Wi-Fi network the hub had joined — and it leaves the hub's own identity, its link to our cloud, and the serial number and code on the label to sign in with again. Two things it does not do, and both matter here: it tells us nothing, so a wiped hub is still linked to your account until you unlink it; and we have not yet watched it run on a hub in use, nor walked the way back in afterwards. The reset file on a USB stick is the other road, and it still needs a hub built to read a stick, which no hub in anybody's hands is. Deleting your rooms, objects and plan by hand does not empty it either: the history of readings, the log of your scenarios, the record of devices you removed and what your devices learned about each other all stay, and no screen removes a home as a whole. So if you are handing a hub to somebody else, write to info@dotrama.com before you do — not because there is no way to wipe it any more, but because we have not walked that way ourselves yet, and we would rather go through it with you than hear afterwards how it went. What stays with us after an unlinking is the record of the equipment, not of your home: the hub itself, the versions it runs, the fingerprints of its certificates, the copy of its own setup-network password, who has owned it, and the records kept to protect accounts. A hub that was never unlinked stays linked to you and nobody else can link it; if you have bought a hub whose previous owner is out of reach, write to info@dotrama.com and we will deal with it by hand.

You can ask us to delete your account at any time. The page «Deleting your DOTRAMA account» on this site sets out step by step what happens, what is erased and what is kept — it opens without signing in, for the day you cannot. There is a button for it in your account on this site, under Security, and in the DOTRAMA app, under Settings; both ask you to confirm your password first. You can also ask by writing to info@dotrama.com from the address the account uses — that way works beside the buttons, and it is the only one left when you cannot get into the account at all. A request made that way is carried out by hand: there is no button on our side for it, so we set the same thirty-day date on your account ourselves and write back to tell you the date. Once asked, you have 30 days to change your mind: press Cancel on the screen that shows the date, or simply sign in again. After that the account is erased, together with the links to your hubs and the history of alerts. The copy of each hub's own Wi-Fi password stays: it belongs to the hub, not to the account — the factory wrote it when the label was printed, and it is what gets whoever owns that hub back in if the label is lost. For seven days after that the answers your hub gave to commands from your account are still here, and one kind of answer carries a picture of your home as it was at that moment; then they go as well. Your hubs stay yours until the day it happens.

Encrypted copies made before the deletion disappear as they expire: the sign-in database is copied daily and only the last 30 copies are kept. Copies of the main database are being reworked at the moment — today they are kept on our server without a fixed lifetime. We will state that lifetime here as soon as it is set.

Our servers are rented from HOSTKEY, in the Netherlands. Encrypted copies of the databases are made every night and kept on the same server. A copy older than thirty days is deleted — except that the last ten are kept whatever their age, so that a job that stopped running cannot end with the last way back being deleted. There is no copy anywhere else: a second place is work for after the first release, and this page will name it when there is one.

Google delivers alerts to Android phones, through its Firebase Cloud Messaging, and Apple will deliver them to iPhones once the iPhone app is out; both may process data outside the European Union. Nothing has gone to Apple so far, because there is no iPhone app yet, but it is named here rather than left out of the list it belongs in. Such transfers rely on the standard contractual clauses approved by the European Commission. Home Connect, the service of BSH Hausgeräte, is not on this list and receives nothing from us: your hub speaks to it directly if you connect your appliances, as the paragraph on that explains.

If you connect Telegram, alerts also leave for Telegram, which is run outside the European Union and with which we have no data protection agreement. That transfer rests on your switching the channel on.

• no analytics on this website
• no advertising or tracking cookies
• no third-party scripts, widgets or embedded content on this website
• fonts are served from this domain, so no font provider learns that you were here
• no sale of personal data and no use of it for advertising

Account, hub, alert and email data are processed because you asked for the service: performance of a contract, article 6(1)(b) of the GDPR.

Server logs, security records and backups rely on our legitimate interest in keeping the service secure and working: article 6(1)(f) of the GDPR.

Sending alerts to Telegram rests on your consent, article 6(1)(a) of the GDPR, and the transfer outside the European Union on that same explicit consent, article 49(1)(a). Withdrawing it is disconnecting the channel.

Under the GDPR you may request access to your personal data, its correction or erasure, restriction of processing, portability, and you may object to processing. Write to info@dotrama.com.

Much of this you can do yourself: change your name, end sign-ins you do not recognise, and delete your account.

If you believe your data is handled improperly, you may complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.

When this text changes materially, the new version replaces this one on this page and the date below changes. Last updated: 24 September 2026.