Legal
Privacy Policy
Effective 28 September 2026 · Draft for early access; a reviewed version replaces this before general availability.
This policy describes what DevSewa collects about account holders and about the end-users of applications built on DevSewa, and how it is used. DevSewa is the processor for your end-users’ data and the controller for your account data.
1. Account data
Name, e-mail address, optional phone number, password hash, MFA enrolment and sign-in events. Used to operate your account, secure it and contact you about the Service.
2. Application data
Application names, tenant slugs, allow-lists, policies, sender domains, key prefixes and hashes, secret names and encrypted values, vault file metadata, and an audit log of administrative actions. Used solely to provide the Service to you.
3. End-user data
When your users sign in through DevSewa, the identity engine stores their credentials, verification state and session data in a collection isolated to your application. Mail recipients and delivery events are stored by the mail engine attributed to your tenant. Vault files are stored encrypted; DevSewa cannot read their contents.
4. What we do not do
- We do not sell data or share it with advertisers.
- We do not use your end-users’ data for any purpose other than serving your application.
- We do not log secret values, passwords, one-time codes or file contents.
5. Sub-processors
The Service runs on infrastructure operated by DevSewa and its fleet partners in Nepal and the EU. A current list of sub-processors is available on request.
6. Retention
Account and application data is kept while the account is active. After closure, audit logs are retained for 12 months and vault ciphertext is purged according to the schedule in the Terms.
7. Your rights
You can export or delete your account data by writing to us. For end-user requests, your application is the point of contact; DevSewa supports deletion, including hard deletion for erasure obligations.
8. Security
See the Security page. Report incidents to security@devsewa.com.
9. Changes
We will announce material changes in the console and by e-mail at least 14 days before they take effect.