GDPR statement.
SmartPluvia Studio Sp. z o.o., 18 Bukareszteńska St., Warsaw, Poland, NIP PL5252901188. Controller of your data. DPO contact: dpo@smartpluvia.studio.
(a) Registration — email, name, password hash. (b) Billing — company, VAT and address; card details are handled by the payment provider and never reach us. (c) Project — site coordinates, irrigation plans, BoMs. (d) Technical — IP, user-agent, session time, action logs in the audit log.
Contract (delivering services — registration, projects, exports). Legitimate interest (security, fraud detection, product analytics). Consent (cookie marketing). Legal obligation (financial reporting, GDPR breach notification).
Only the subprocessors listed in the DPA. We do not sell or share data with third parties for marketing. All subprocessors are DPA-signed. Railway (hosting), Cloudflare (DNS and object storage), Paddle and WayForPay (payments), Resend (email), AppSignal (monitoring). Full list — in the DPA.
Active account — until you delete it. Deleted account — 30-day grace, then hard delete except: financial records (5 years per Polish AML law), security audit logs (1 year), rolling backups (30 days).
Access (export in Settings). Rectification (Settings). Erasure (one click, 30-day grace). Portability (CSV/JSON export). Objection to processing (email DPO). Complaint — to the President of UODO (Poland) or the relevant supervisory authority in your member state.
Some subprocessors are established outside the EEA; those transfers rely on Standard Contractual Clauses. The current list, with each vendor's location and transfer mechanism, is in Annex III of the DPA. If it changes, we will notify you 30 days in advance.
Encryption at rest, TLS 1.3 in transit, per-account authorization, an admin audit log, and static and dependency analysis on every change. On incident — regulator notification within 72 h and affected users without undue delay. Details on the Security page.
Any changes — email notice 30 days before they take effect. Document version and date — in the footer of this page. Current version: A.13 · 28 April 2026.
Request access or deletion.
Easiest path — Settings → Privacy. Export or delete in one click. For a formal DSAR — write to the DPO; reply within 30 days.