Privacy policy

Updated 30 October 2026.

1. Who we are

Dirigo is provided by CodeAPIness SHPK, tax ID (NIPT) M12305008A, at Rruga "Sotir Çaçi", Njësia Bashkiake nr. 3, Tirana, Albania ("we"). For any question about personal data: privacy@dirigo.tv.

Dirigo is a service for businesses. For the customer business's account and billing data we are the controller. For the content a business puts on its screens, and for the data of its staff who use the panel, we are a processor, under the data processing agreement.

2. What data we hold

• Account: name, email address, role and the locations you can access. We store your password only as a hash, never as text.
• Business: name, billing email, locations (name, address, opening hours, time zone), screens, plan and invoices.
• Devices: device identifier, model, system, app version, free storage, the status the device sends every minute, what it plays (proof of play), the audio output and the name of the Bluetooth speaker. A screenshot is taken only when you ask for one in the panel.
• Google Drive: the address of the connected Google account, the chosen folder, the metadata of the files you pick (name, type, size, checksum, modification date) and the token that lets us read them, encrypted. We do not store the contents of the files.
• Instagram: the id, username and profile picture of the connected Instagram account, the metadata of the posts you pick (id, type, date, size, checksum, video length) and the token that lets us read them, encrypted. We do not store the posts' images or videos. A caption is stored only when you make a TV post from it, as the text you publish on your screens.
• Uploads: small images and PDFs you upload directly, and the voice announcements you record or upload.
• Session: one cookie that keeps you signed in to the panel. We use no analytics, tracking or advertising cookies.

3. What we use it for

Only to provide Dirigo: to show and play your content on your screens, show you their status, email you alerts when a screen goes offline, bill you and help you when you write to us. We do not sell the data, do not use it for advertising and do not use it to train artificial intelligence models.

4. Data from Google and Instagram

Dirigo asks only for the drive.file permission. With it, Dirigo sees only the files and folders you pick yourself in Google Picker, not the rest of your Drive.

• Screens download the files directly from Google, with tokens that expire quickly. Our servers neither store nor pass on your files.
• The owner and admins can preview a file in the panel; the browser fetches it directly from Google.
• None of us reads your data from Google, except when you ask us to for support, for security, or when the law requires it.
• We do not transfer data from Google to third parties, except to provide Dirigo, and we do not use it for advertising.
• You can disconnect Drive at any time in the panel: we revoke the permission at Google and delete the token. You can also remove it at https://myaccount.google.com/permissions.

Dirigo's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Data from Instagram

You connect an Instagram professional account through Meta's own login, and choose the account to share. Dirigo uses it only to read your posts, so you can pick which ones play on your screens.

• Meta's consent screen also lists permission to manage messages, because Meta bundles it with the Instagram API. Dirigo never reads, sends or stores messages.
• Only the posts you pick reach your screens, and screens download them directly from Instagram. When you pick a post, our server reads it once to measure its size, checksum and length, and keeps nothing of it.
• The owner and admins can preview a post in the panel; the browser fetches it directly from Instagram.
• None of us reads your Instagram data, except when you ask us to for support, for security, or when the law requires it. We do not use it for advertising.
• You can disconnect Instagram at any time in the panel: we delete the token. Also remove Dirigo in Meta Business Settings, under Integrations, Connected apps; then Meta tells us to delete what we hold, and we do.

5. Who processes it for us

• Hetzner Online GmbH (Germany): servers and database.
• Cloudflare, Inc.: DNS, traffic protection, storage of uploads and voice announcements, receiving email.
• Sendinblue SAS (Brevo) (France): sending email.
• Google: the connection to your Google Drive, which is your own account.
• Meta Platforms Ireland Ltd.: the connection to your Instagram account, which is your own account.

Cloudflare may also process data outside the European Union; we then rely on the European Commission's standard contractual clauses.

6. How long we keep it

• The status devices send: 30 days, after which only the time online per day remains.
• Screenshots: 24 hours.
• Account, locations, screens and proof of play: while the subscription is active.
• After an account is closed we delete it within 30 days. Backups are deleted within 30 days.
• Invoices: as long as Albanian accounting law requires.

7. Your rights

You can ask for access to your data, its correction, erasure, restriction of processing or its transfer to another service, and you can object to processing. Write to privacy@dirigo.tv; we answer within 30 days. If you are an employee of a customer, you can also turn to them.

You can complain to the Albanian Commissioner for the Right to Information and Personal Data Protection: https://www.idp.al.

8. Security

Connections use HTTPS only. Google and Instagram tokens are encrypted with a key that is not stored in the database. Each customer's data is kept apart from the others both in the code and in the database. Device credentials are rotated regularly and can be revoked from the panel.

9. Children

Dirigo is for businesses and is not directed at anyone under 16.

10. Changes

When we change this policy, we change the date at the top. For important changes we email you before they take effect.

11. Contact

privacy@dirigo.tv, or by post: CodeAPIness SHPK, Rruga "Sotir Çaçi", Njësia Bashkiake nr. 3, Tirana, Albania.