Privacy Policy
This policy explains what personal data Uncurl collects, why, where it is stored and what rights you have. The controller of your data is [Company name] d.o.o., [Street and number], [Postcode] [City], Croatia, OIB [OIB]. Contact us about privacy at hello@uncurl.app.
1. The short version
- We collect your quiz answers and email address to build and send your plan.
- Some answers describe where you feel discomfort. We treat these as health data and store them only with your explicit consent.
- Your data is stored in the European Union. We never sell it.
- We never share your quiz answers with advertising platforms.
- You can ask us to see, correct or delete your data at any time.
2. What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Quiz answers: age range, daily sitting time, areas of discomfort, how often you notice it, workspace, available time, preferred time of day, goal, and whether certain symptoms apply to you | To build your personal routine and show safety advice | Your explicit consent (Art. 9(2)(a)) for health-related answers; taking steps at your request before a contract (Art. 6(1)(b)) for the rest |
| Email address | To send your plan and give you access to the Service | Contract (Art. 6(1)(b)) |
| Record of your consent (time and wording) | To prove we have your consent | Legal obligation (Art. 6(1)(c)) |
| Campaign tags in the link you followed (utm_source, utm_campaign and similar), browser type | To understand which ads and pages work, and to keep the Service secure | Legitimate interests (Art. 6(1)(f)) |
| Messages you send us | To answer you | Legitimate interests (Art. 6(1)(f)) |
Payments. If you subscribe, Paddle.com collects your payment details as our Merchant of Record and acts as an independent controller for that data under its privacy policy. We receive your name, email, country, subscription status and invoice details, never your full card number.
3. Cookies and tracking
Today the Service uses only what is strictly necessary to work. We do not use advertising or analytics cookies. If we add them, we will ask for your consent first, and they will never receive your quiz answers.
4. Who processes your data for us
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database (quiz answers, email, consent record) | EU (Ireland) |
| Vercel | Website hosting; server code runs in the EU (Ireland) | EU, global content delivery network |
| Cloudflare | Domain name system and forwarding of email sent to our address | Global |
| Google (Gmail) | Receiving and answering your emails | Global |
| Paddle | Payments, invoices, taxes, refunds (independent controller) | UK, EU, US |
Each provider is bound by a data processing agreement. Where data may be accessed outside the EU, transfers are covered by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. How long we keep it
- If you take the quiz but do not subscribe: up to 12 months, then we delete it.
- If you subscribe: for as long as your subscription is active and up to 12 months after it ends, so you can come back to your plan. Ask us and we will delete it sooner.
- Consent records: as long as we hold the data they relate to, and up to 3 years after, to show we had consent.
- Invoices are kept by Paddle for as long as tax law requires.
6. Automated plan building
Your plan is put together automatically from your answers. This only decides which exercises you see and in what order; it has no legal or similarly significant effect on you.
7. Your rights
You can ask us to:
- give you a copy of your data, or send it to another service in a common format;
- correct data that is wrong;
- delete your data;
- restrict or object to how we use it;
- withdraw your consent at any time. This does not affect what we did before, but we will stop using your health-related answers and delete them.
Write to hello@uncurl.app from the email address you used. We reply within one month. You can also complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or to the data protection authority where you live.
8. Security
Data is encrypted in transit and at rest. Only our server can read the database; it cannot be accessed from the browser. Access for our team is limited to what each person needs.
9. Children
The Service is for adults aged 18 and over. We do not knowingly collect data from children.
10. Changes
We will update this page when what we do with data changes, and email you before any change that affects you significantly.