Privacy Policy

§1. Data controller

The controller of personal data collected through the studiova.app website is:

BH WANDEX
ul. Erazma Ciołka 8/210
01-402 Warsaw, Poland
VAT: PL5251917081
REGON: 012756421
E-mail: lukasz.czechowski@klubos.pl
Tel.: +48 508 510 642

STUDIOVA is a product of NextFlow Automation, a brand of BH WANDEX.

§2. Scope and purpose of data processing

1. Platform Users (studio owners): first name, last name, email address, phone number, for the purpose of providing subscription services, account management and invoicing. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2. Studio Clients: first name, last name, email, phone, date of birth, entered by the studio owner into their own instance. The studio owner is an independent data controller for this data; BH WANDEX processes it solely as a data processor under a processing agreement.

3. Technical data: IP address, session cookies, server logs, for security and diagnostic purposes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

4. Marketing communications: emails about platform updates: only with the User's consent.

§3. Cookies

1. The site uses cookies that are essential for operation (login session) and analytical (traffic statistics).

The site also counts anonymous visit statistics with our own script (r.js served from www.klubos.pl, operated by BH WANDEX): the page visited, traffic source, device and browser type, approximate country and city, clicks, scroll depth and time on page. IP addresses are not stored. Without accepting the banner the script stores nothing on the device; after acceptance it keeps a random visitor identifier in browser storage (localStorage) to tell new visits from returning ones. Legal basis: Art. 6(1)(f) GDPR (legitimate interest), the browser identifier only with consent. Statistics are kept for up to 12 months.

2. Users may disable cookies in their browser settings at any time, which may limit the functionality of the service.

3. Continued use of the site after closing the cookie banner constitutes consent to the use of cookies in accordance with this policy.

§4. Data transfers to third parties

Personal data may be transferred to the following sub-processors:

• Supabase Inc.: database and authentication (EU/US servers, standard contractual clauses)
• Vercel Inc.: application hosting (EU/US servers, standard contractual clauses)
• Stripe Inc.: subscription payment processing
• SMSAPI Sp. z o.o.: SMS delivery (servers in Poland)
• Resend Inc.: transactional email delivery

Data is not sold or transferred to other commercial entities.

§5. Rights of data subjects

Every person whose data is processed has the right to:

• access their data (Art. 15 GDPR)
• rectification of data (Art. 16 GDPR)
• erasure of data ("right to be forgotten") (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)
• lodge a complaint with a supervisory authority

Requests should be sent to: lukasz.czechowski@klubos.pl

§6. Data retention

1. User account data is retained for the duration of the subscription and 30 days after its termination.

2. Studio Client data is retained for the period determined by the studio owner, and no longer than 3 years from the last activity.

3. Technical logs are retained for 90 days.

§7. Security

Data is stored in an encrypted database (PostgreSQL on Supabase) with Row Level Security (RLS), TLS encryption in transit, and regular backups.

§8. Changes to this policy

This policy may be updated. Users will be notified of material changes by email. The current version is always available at studiova.app/en/privacy-policy.