Privacy Policy

1. Data controller

The controller of the personal data of Velunta users (web and mobile app) is Bajeczne Balony Oleh Serhiienko, NIP (tax ID) 6832090873, ul. Ciesielskiego 6, 31-589 Kraków, Polska (“we”, the “Provider”).

For anything related to personal data, write to bajecznebalony.krk@gmail.com.

2. Who this policy covers

This policy describes how we process the data of people who create and use a Velunta account (workspace owners and team members).

Data that users enter about their clients, suppliers and other people (e.g. in orders) is processed by us on behalf of the workspace as a processor. The workspace owner is the controller of that data; the rules are set out in the Data Processing Agreement.

3. What data we process

• Account data: email address, name, password (stored only as an encrypted hash).
• Workspace data: name, business contact details, branches, team members and their roles.
• Content entered into the app: orders, tasks, clients, purchases, deliveries, notes and attachments (photos, PDF files, links).
• In-app notifications and invitations.
• Acceptance of documents: the accepted versions of the Terms, Privacy Policy and Data Processing Agreement, with the date of acceptance.
• Technical data: IP address, browser and device type, request times — kept in server logs for security and to run the service.
• Error reports: when an error occurs in the app, we send Sentry a technical description (error message and location, browser, system) and the technical ids of the account and workspace. Before sending, we remove email addresses, phone numbers and content entered into the app; we do not record the screen.
• Visit statistics: aggregated, anonymous page view data (no cookies, no identification of individuals).

4. Purposes and legal bases

• Creating and running your account and providing the Velunta services — Art. 6(1)(b) GDPR (performance of a contract).
• Security, abuse detection and fixing errors — Art. 6(1)(f) GDPR (legitimate interest).
• Aggregated usage statistics to improve the service — Art. 6(1)(f) GDPR.
• Contact, support requests and complaints — Art. 6(1)(b) and (f) GDPR.
• Recording the acceptance of the Terms and Privacy Policy — Art. 6(1)(f) GDPR.
• Billing and tax obligations (once paid plans are introduced) — Art. 6(1)(c) GDPR.

Providing account data is voluntary but necessary to use Velunta. We make no decisions based solely on automated processing and do not profile users.

5. How long we keep data

• Account data — until the account is deleted.
• Workspace content — until it is deleted by a user, or the workspace or account is deleted.
• Once deleted, data is removed from the database immediately. Backups and technical logs kept by infrastructure providers are overwritten within a cycle of no more than 30 days.
• Billing data (once paid plans are introduced) — for the period required by tax law (usually 5 years from the end of the tax year).
• Correspondence — for as long as needed to handle the matter and to establish or defend any claims.

6. Who processes data for us

We use trusted providers that process data only on our instructions:

These providers are based in the USA. Database and attachment data is stored in the EU (Frankfurt). Where data may be transferred outside the European Economic Area, this is based on a European Commission decision (EU-US Data Privacy Framework) or Standard Contractual Clauses. We do not sell data or share it for marketing.

7. Cookies and browser storage

Velunta does not use cookies — neither our own nor advertising or analytics cookies. In browser storage (localStorage / sessionStorage) we keep only what the app needs to work:

• sb-…-auth-token — your sign-in session (the account cannot be used without it),
• balonplan:language — the chosen language,
• balonplan:theme — the chosen theme (light / dark),
• velunta:accountDeleted — a one-time note after deleting an account (removed immediately).

Visit statistics are collected by Vercel Web Analytics without cookies and without persistent device identifiers. Because we only use strictly necessary mechanisms, we do not show a cookie consent banner. You can clear browser storage at any time in your browser settings (this signs you out).

8. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy,
• rectify your data,
• erasure (“right to be forgotten”),
• restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

To exercise your rights, write to bajecznebalony.krk@gmail.com. We will reply without undue delay and within one month at the latest.

9. Deleting your account and exporting data

You can delete your account yourself in the app: Settings → Account → “Delete account”. Step-by-step instructions (readable without signing in) are on the How to delete your account page.

A workspace owner can download all workspace data as CSV or JSON: Settings → Account → “Export data”.

10. Security

Connections are encrypted (HTTPS/TLS), database data and files are encrypted at the provider, passwords are stored as cryptographic hashes, and access to each workspace's data is protected by database-level security rules (Row Level Security). Attachments are kept in private storage available only to workspace members. Operations that need administrative privileges are performed only on the server.

11. Changes to this policy

We may update this policy, e.g. when adding features or providers. Each version has a number and an effective date. We will inform you about significant changes in the app and ask you to review the new version.