Domi Gate Privacy Notice
Last updated October 4, 2026
The short version
- A door call is live video and audio. It is never recorded and never stored on our servers.
- The entrance panel records short clips on motion and around a ring. They stay encrypted on the panel at the door and delete themselves after about 48 hours.
- If nobody answers your door call, the residents of that apartment only can watch a short clip of who rang. Once watched, it can be replayed for 30 minutes and no longer.
- Your door PIN is stored only as a one-way hash. Nobody, including your building manager and including us, can read it back. A tag’s number and a guest QR code are kept on our server so your building manager can manage them; the entrance panel itself only ever holds a keyed hash of them.
- There is no advertising, no analytics, and nothing is sold or shared for anyone else’s purposes.
Who is responsible
Domi Gate is a door-entry system operated by the manager or owner of the building it is installed in. That operator decides what is collected and why, and is the data controller for their building. They are the people to contact first about your own data, and their details are on the notice at the entrance.
We, eXtremeEmbedded, Skopje, North Macedonia, supply and run the software and the server it talks to, on the operator’s instructions. We are a data processor. Reach us at privacy@domigate.com.
The server is Domi Gate’s server in the EU (Hetzner, Germany), operated by eXtremeEmbedded.
What is collected, and how long it is kept
| What | Why | Where it lives | How long |
|---|---|---|---|
| Your name, email address and apartment | So the entrance panel can call your apartment and so you can sign in | Server (EU) | While you are a resident of the building |
| A push token for your phone | The only way to make your phone ring when someone is at the door | Server (EU) and Google’s push service | Until the app is reinstalled or removed |
| Call history: who was called, when, whether it was answered | So you can see missed calls, and so the operator can investigate a problem | Server (EU) | Kept for now; the operator sets a limit |
| Live call video and audio | Seeing and speaking to the person at the door | Relayed between the two devices. Never recorded, never stored | Not retained at all |
| Motion clips: short video of movement at the entrance | Security: what happened at the door | Encrypted on the entrance panel only | About 48 hours, then deleted automatically |
| Missed-call clips: the walk-up and ring when a call is not answered | So the household can see who called on them | Encrypted on the entrance panel. A temporary copy passes through the server only when someone actually watches it | Deleted at once if the call is answered or dismissed; otherwise about 48 hours. After the first viewing it can be replayed for 30 minutes only |
| Door codes (PIN), guest QR codes and entry-tag numbers | Opening the door without a phone, including when the internet is down | A PIN is stored as a one-way hash only, never the code itself. A tag’s number and a guest QR code are kept so a building administrator can manage and reprint them; entrance panels only ever receive a keyed hash of either | Until revoked, expired or used up |
| Access events: that a door was opened, by which credential, when | Security and accountability | Server (EU) | Kept for now; the operator sets a limit |
| Phone model and app version | Diagnosing why a phone did not ring | Server (EU) | While the app is installed |
The system stores no location data, no contacts, no photos from your phone, and no biometric data. Face recognition is not part of this system.
Who else sees it
- Your building’s managers, for administering residents, credentials and the equipment.
- Other residents of your own apartment, for that apartment’s missed calls. Nobody in another apartment can see them; this is enforced by the server, not just hidden in the app.
- Hosting (Hetzner, Germany): the servers the system runs on, operated by eXtremeEmbedded.
- Google (Firebase Cloud Messaging): carries the signal that wakes your phone for a call. It carries a reference, not names and not video.
- Cloudflare: DNS for the domain, and forwarding of mail sent to our @domigate.com addresses to our mailbox.
Nothing is sold, and nothing is shared for advertising, profiling or anyone else’s purposes.
Your rights
You can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Ask your building manager, who arranges it with us, or write to privacy@domigate.com from the address your account uses. Both the export and the deletion are performed and logged on our side.
Deleting your account and your data
Ask your building manager to remove you, or write to privacy@domigate.com from the address your account uses and we will arrange it with them. Your login, your push token and your door credentials are deleted and your codes stop working. A record that a door was opened at a given time is kept without your name attached, because a building’s security log has to remain trustworthy.
In the EU/EEA you may also complain to your national data protection authority. In North Macedonia that is the Agency for Personal Data Protection; in Kosovo, the Information and Privacy Agency.
Security
- Everything between the app, the entrance panel and the server travels over TLS.
- Recordings are encrypted on the entrance panel; the database on the panel is encrypted too.
- Door PINs and account passwords are stored only as Argon2id hashes. Tag numbers and guest QR codes reach the panels only as keyed hashes.
- Opening a door remotely is authorised by the server for one single use, and every unlock is written to an audit log.
- The missed-call player blocks screenshots and screen recording.
Children
The app is for residents of a building and is not directed at children. A parent may of course install it for a family member who lives there.
This website
This website is static. It sets no cookies, uses no analytics or advertising, and embeds nothing from third parties: the fonts, the images and any video are served from our own server. There are no forms; contact is by email or phone, and email to our addresses is forwarded by Cloudflare to our mailbox. Nothing is sent to us until you send it.
Our web server keeps standard access logs (IP address, time, page, browser type) for about two months, for security and troubleshooting; the token a resident’s phone uses is removed before the line is written.
The language switcher changes the address of the page and stores nothing. The install page for residents reads the invitation code from the part of the link that your browser never sends to a server. The “Get it on Google Play” button leads to Google, which has its own notice, only when you tap it.
Changes
If this notice changes materially, the date at the top changes and your building manager is told. The current version always lives at this address.
This notice covers the Domi Gate resident app, the entrance system it belongs to, and this website. Contact: privacy@domigate.com.