Privacy policy
Provisional text, not yet reviewed by a lawyer. The fields in square brackets will be filled in before launch. If the English and Romanian versions differ, the Romanian version prevails.
Here you can find out what data Velluno uses, why, who else sees it and how you control it.
Who is responsible for your data
The data controller is SunVolt Energy UAB, company code 307557122 (Register of Legal Entities of Lithuania), with its registered office at Beržų al. 1, Laumėnų k., Samylų sen., Kauno r. sav., LT-53118, Lithuania. Write to us at support@velluno.ro with any question about your data.
What data we use
- Your account: your email address. If you sign in with Apple or Google, we receive your email (Apple can hide it) and, if you choose, your name. If you sign in with Apple, we also keep an access code from Apple, only so we can revoke it when you delete your account.
- Data for requests, optional: your full name and postal address. We use them only to fill in cancellation requests.
- Subscriptions: the provider, amount, currency, frequency, the payment, contract end and free trial end dates, the contract number (optional) and the status of the cancellation request, with the dates on which you told us you sent it or that the payment stopped.
- Bills: the photo is read on your phone. Only the text reaches our server, and your phone first hides your personal ID number (CNP), IBAN, card number, phone number and email in it. We don't keep the bill text, only the fields you confirm.
- Emails you forward: we read them to find the bill and we don't keep them. We keep the sender, the subject and the fields read until you confirm or reject them. PDF attachments don't reach the AI model.
- Technical log: when a bill was read, from which source and whether it worked, without its content. We use it for the daily limit and for statistics.
- Clicks on offers: we record them with a code derived from your account (pseudonymous), not with your account identifier. They are deleted with your account.
- Premium: whether you have a subscription and until when. Payment is processed by Apple or Google; we don't see your card details.
- Push notifications: your phone's notification identifier and, for each subscription, until when your phone has reminders scheduled, so the morning alerts sent by the server don't repeat. Only if you allow notifications.
- Google Calendar, only if you connect it: your Google account email, the events in your primary calendar for the chosen day and a few days after (title, time, organizer, attendees with email, whether it repeats) and an access code from Google, stored encrypted, on the server only. We don't request descriptions, locations, attachments or meeting links from Google. Events aren't stored on the server; only those in your plans stay on your phone, until you delete them or your account.
How we read bills
The bill text goes through an AI model (Claude, by Anthropic) so we can find the provider, the amount and the dates. Before sending it, we automatically hide the personal numeric code (CNP), IBAN, card numbers, phone numbers and email addresses. Names and addresses can't be recognized reliably by automatic means, so they may remain in the text.
We always show you the result so you can check it. Nothing is saved without your confirmation.
Your Google Calendar data
Velluno writes to your calendar only what you approve, step by step: moving meetings you organized and the "Unavailable" block. We don't change meetings organized by others and we don't delete anything.
The reason you give for a time slot ("time for family") stays on your phone, in the Personal space. It doesn't reach our server or Google.
You can remove access at any time: in Velluno (Settings → Connections → Disconnect Google) or in your Google account (myaccount.google.com/permissions). When you delete your Velluno account, we also remove access at Google.
Velluno's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google Calendar data for ads, we don't sell it, and we don't use it to train AI models.
Why and on what legal basis
- To provide the app (account, sync, reading bills, preparing requests, Premium): performance of the contract with you (Art. 6(1)(b) GDPR).
- Notifications: your consent, which you can withdraw at any time in your phone settings (Art. 6(1)(a)).
- Security, limits against abuse and aggregate statistics, without data that identifies you: our legitimate interest (Art. 6(1)(f)).
Who else receives data
We use service providers that process data only on our instructions, under a contract:
- Supabase: the database, authentication and server functions, in the European Union (Frankfurt).
- Anthropic: reading the bill text, after the data above is hidden. Servers in the US.
- Postmark: receiving forwarded emails. Servers in the US.
- RevenueCat: keeping track of the Premium subscription. Servers in the US.
- Expo: delivering push notifications. Servers in the US.
- Apple and Google: sign-in, if you choose it, and the Premium payment.
- Google: when you move a meeting you organized, Google sends attendees its usual update. The "Unavailable" block is private and has no attendees.
Transfers outside the EU
For service providers in the US, transfers are based on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, as applicable. [To be confirmed for each provider when the data processing agreements are signed.]
How long we keep data
For as long as you have an account. When you delete your account, your data is removed from the database immediately. The hosting provider's backups are deleted automatically after [number of days in the Supabase plan].
What we don't do
- We don't sell your data.
- We don't use it for advertising and we have no advertising trackers.
- We don't ask for access to your bank account or to your mailbox.
- We don't send requests on your behalf.
Your rights
You have the right to see your data, correct it, delete it, take it with you, object to its processing or ask for its processing to be restricted. You export your data and delete your account yourself, in Settings. For anything else, write to us at support@velluno.ro; we reply within 30 days.
If you are not satisfied with our reply, you can file a complaint with the data protection authority of the country where you live (in Romania: the National Supervisory Authority for Personal Data Processing, ANSPDCP, www.dataprotection.ro) or with the one in Lithuania, where the company is based (State Data Protection Inspectorate, vdai.lrv.lt).
Age
Velluno is for people aged 18 or over, because it manages contracts and payments.
Changes
If we change anything important, we tell you in the app before it applies.