Privacy notice

Last updated: August 2026

DVendo PDF Viewer is a restricted administrative service for approved users to list, preview, and download committed operational PDF reports. This notice explains how the service processes information.

Information we process

Approved-user email addresses, owner or viewer roles, account status, and account administration timestamps.
Authentication and abuse-prevention information, including keyed fingerprints derived from email addresses and network addresses, one-time-code hashes, attempt counts, and session metadata. The application database does not store plaintext one-time codes or raw session tokens.
Security audit events for sign-in requests, successful sign-ins, and viewer access changes.
Committed report metadata, including internal identifiers, location, collector and refiller names, report timestamps, filenames, and PDF sizes.
Shared location-group names and location-to-group assignments, including record versions and the authorized account email and timestamp associated with creating or updating them.
Operational PDF files, which may contain information supplied by the report-generating system.

Google and Gmail data

The service authorizes one designated administrator Google account using basic account identity and Gmail send permission. Account identity is checked during authorization, and Gmail is used only to send one-time sign-in messages to approved users. These messages contain the recipient address, a six-digit code, its expiry notice, and security text.

The service does not request permission to read Gmail messages, contacts, Google Drive files, or mailbox contents. Google OAuth credentials are kept as server-side encrypted secrets and are not included in the browser application. DVendo's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How information is used

Information is used to authenticate approved users, prevent abuse, administer access, maintain security history, organize report locations in shared groups, list and search committed reports, validate stored PDF integrity, and provide PDF preview and download. Active approved owners and viewers can access all committed reports; only the owner can add or revoke viewers. Any active approved account can create, rename, delete, and assign shared location groups.

Service providers and disclosures

Google and Gmail process sign-in-message delivery. Cloudflare provides the Pages and Functions runtime, D1 database, private R2 object storage, and network security infrastructure. Gmail receives sign-in-message data but does not receive report metadata, location-group data, or PDF files from this service. Report access is limited to active approved users, viewer-account details are available to the owner for access administration, and shared group names, assignments, and change attribution are visible to authorized accounts.

Optional Google Drive PDF archive

When the archive feature is enabled, the owner can authorize Google accounts to receive copies of completed PDF reports already stored in Cloudflare. The archive uses limited Google Drive file access to create and verify report copies in an app-created folder. Original photos and supporting collection data are not separately uploaded to Google Drive.

Google account identifiers, email addresses, capacity information, folder and PDF file identifiers, backup status, and encrypted reusable authorization tokens are stored on the server. Tokens are not sent to portal viewers. Connected accounts are used in the owner's chosen order when capacity permits. The owner can pause an account or revoke its authorization through Google; this does not remove PDFs already copied there. Google stores and processes the archived PDFs under the connected account's settings. Archive information is used to provide and maintain the backup service.

The initial archive rollout keeps Cloudflare PDFs and disables automatic PDF retention deletion in that rollout environment. Original-photo cleanup is not enabled by this archive feature. Archive status records and Google PDFs have no fixed automated deletion period in this initial release.

Cookies, code validity, and retention

The service uses a secure, HTTP-only, same-site session cookie. One-time codes expire after 10 minutes and authenticated sessions after 8 hours. Signing out or revoking a viewer invalidates the relevant session.

Some expired authentication and rate-limit records are removed opportunistically after later authentication activity. Revoked allowlist records, security audit records, shared group and assignment records, report metadata, and PDFs do not currently have a fixed automated deletion period in this application. Gmail message retention is controlled by Google and the relevant mail accounts.

Security

The service uses keyed hashes and fingerprints for authentication records, hashed server-side session tokens, secure cookie attributes, authenticated same-origin APIs, private non-cacheable PDF responses, and stored-file size and ETag validation. No internet service can guarantee absolute security.

Your access and choices

The owner can approve or revoke viewer access. Any active approved account can change shared location groups and assignments. Deleting a group does not delete reports or locations; affected locations return to Ungrouped. Revocation immediately blocks active portal sessions but does not automatically erase the inactive allowlist record, historical security events, or attribution already stored on shared group records. Downloaded PDF copies are stored on the user's device and are outside the portal's direct control.

Contact

For privacy questions or requests concerning an approved account, contact dvendo.tech@gmail.com.