Privacy Policy

AutoDelta ("we", "us") operates the autodelta.app website. This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our service, and the choices you have associated with that data. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data controller

Controller: Tibor Bomba, sole trader (OSVČ) registered in the Czech Republic, IČO: 29522064.

Postal address: Česákova 424/6, 182 00 Praha, Czech Republic.
Contact: privacy@autodelta.app.

2. What we collect

• Account: email, name, hashed authentication state (managed by Supabase Auth).
• Subscription: Stripe customer + subscription ID. Card data is held by Stripe; we never see it.
• Product: alert rules, watchlist entries, notes you create.
• Technical: server logs (e.g. IP address, request timestamps) generated by our hosting providers and retained briefly for security and abuse prevention. We do not use third-party analytics or advertising trackers.

3. Legal basis

We process your data on the basis of (a) performance of the contract between us (delivering the service you subscribed to), (b) legitimate interest in security and abuse prevention, and (c) your consent for optional marketing communications.

4. Sub-processors

• Supabase (EU region) — auth and database hosting.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Vercel — application hosting.

5. Retention

We retain account data for as long as your account is active. When you delete your account, we erase your personal data from our live systems immediately. Residual copies held in our providers' encrypted backups are overwritten on their normal backup-rotation cycle (typically within 30 days). Limited billing and transaction records may be retained where required by law (accounting and tax obligations).

6. Your rights

Under GDPR you have the right to access, rectify, erase, and port your personal data, and to object to processing. Email privacy@autodelta.app and we'll respond within 30 days.

You also have the right to lodge a complaint with a data-protection supervisory authority. Our lead authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz). You may also contact the supervisory authority in your country of residence.

7. International transfers

Your data is primarily processed within the EU/EEA. Some of our sub-processors (notably Stripe and Vercel) may process data on infrastructure located in the United States. Where personal data is transferred outside the EEA, that transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) and equivalent safeguards provided under each sub-processor's data-processing agreement.

8. Cookies

We use first-party cookies strictly necessary for authentication (session refresh) and CSRF protection. No advertising cookies, no third-party trackers in the dashboard.