Privacy Policy

§1. Data controller

The controller of personal data collected through the studiova.app website is:

BH-Wandex
ul. Ciołka 8 / 210
01-402 Warsaw, Poland
VAT: PL5251917081
REGON: 012756421
E-mail: lukasz.r.czechowski@gmail.com
Tel.: +48 508 510 642

§2. Scope and purpose of data processing

1. Platform Users (studio owners): first name, last name, email address, phone number — for the purpose of providing subscription services, account management and invoicing. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2. Studio Clients: first name, last name, email, phone, date of birth — entered by the studio owner into their own instance. The studio owner is an independent data controller for this data; BH-Wandex processes it solely as a data processor under a processing agreement.

3. Technical data: IP address, session cookies, server logs — for security and diagnostic purposes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

4. Marketing communications: emails about platform updates — only with the User's consent.

§3. Cookies

1. The site uses cookies that are essential for operation (login session) and analytical (traffic statistics).

2. Users may disable cookies in their browser settings at any time, which may limit the functionality of the service.

3. Continued use of the site after closing the cookie banner constitutes consent to the use of cookies in accordance with this policy.

§4. Data transfers to third parties

Personal data may be transferred to the following sub-processors:

• Supabase Inc. — database and authentication (EU/US servers, standard contractual clauses)
• Vercel Inc. — application hosting (EU/US servers, standard contractual clauses)
• Stripe Inc. — subscription payment processing
• SMSAPI Sp. z o.o. — SMS delivery (servers in Poland)
• Resend Inc. — transactional email delivery

Data is not sold or transferred to other commercial entities.

§5. Rights of data subjects

Every person whose data is processed has the right to:

• access their data (Art. 15 GDPR)
• rectification of data (Art. 16 GDPR)
• erasure of data ("right to be forgotten") (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)
• lodge a complaint with a supervisory authority

Requests should be sent to: lukasz.r.czechowski@gmail.com

§6. Data retention

1. User account data is retained for the duration of the subscription and 30 days after its termination.

2. Studio Client data is retained for the period determined by the studio owner, and no longer than 3 years from the last activity.

3. Technical logs are retained for 90 days.

§7. Security

Data is stored in an encrypted database (PostgreSQL on Supabase) with Row Level Security (RLS), TLS encryption in transit, and regular backups.

§8. Changes to this policy

This policy may be updated. Users will be notified of material changes by email. The current version is always available at studiova.app/en/privacy-policy.