Privacy Policy

The controller responsible for the processing described here is Rokas Stulga, a natural person providing the Service in their own name, contact address Pylimo g. 19, Lapainios k., LT-56301 Kaišiadorių r. sav., Lithuania.

For any matter concerning personal data, including the exercise of your rights under Section 10, write to info@veete.app. We have not appointed a Data Protection Officer, as the scale and nature of our processing do not require one under Article 37 GDPR; the address above reaches the person responsible for data protection.

This Policy covers the Veete website, web application, account system, subscription billing and support channels. It does not cover third-party websites that we link to, or the independent processing carried out by our payment provider in its own capacity as controller (see Section 6). Where you use Veete on behalf of a company or a client, you are responsible for having a lawful basis to enter any personal data of third parties (for example a client’s address) into the Service; we process such data on your instructions as described in this Policy.

We process only the data needed to operate the Service. We do not buy, enrich or resell personal data.

Account data

Email address, display name, a salted one-way hash of your password (we never store or see the password itself), account identifiers, sign-in timestamps and the language of your browser. You provide these when you register.

Project data

The gardens and plots you design: object placement, dimensions, materials, plant choices, labels, the prices and labour rates you enter, notes, tasks, meter readings, change history and the project name. Project data may include a site address or a plan drawing you upload, which can identify a location.

Attachments

Files you attach to a project on a paid plan (photos, PDFs, spreadsheets and documents), together with their file names, sizes and types. Only file types on our allow-list are accepted.

Billing data

Your plan, billing interval, trial and renewal dates, subscription status, the Stripe customer and subscription identifiers, and invoice records. We never receive or store card numbers; you enter them directly with Stripe.

Support data

When you use “Report a problem” or email us: your name, email address, the message, the page you were on and, if you leave the box ticked, technical diagnostics (browser, screen size, application version). No project data is included in a report unless you paste it in.

Technical and security data

IP address, browser type and version, device type, request timestamps, referring page and error logs, generated automatically by our hosting and database providers when you use the Service, and a hashed, daily-rotated form of your IP address used to rate-limit the problem-report form.

Data stored on your device

Your sign-in session token, interface preferences, and, when you use the planner without an account, the gardens themselves. This data stays in your browser and is not transmitted to us until you sign in and choose to save to your account. See Section 11.

We do not process special categories of personal data (Article 9 GDPR), and we ask you not to enter such data into the Service.

Each processing operation rests on one of the legal bases in Article 6(1) GDPR:

Providing the Service

Creating and securing your account, storing and synchronising your projects, producing estimates and exports, sending transactional emails (confirmation, password reset, billing notices). Legal basis: performance of a contract, Article 6(1)(b).

Subscription billing

Applying plan limits, processing payments and renewals through Stripe, issuing invoices. Legal basis: performance of a contract, Article 6(1)(b), and compliance with accounting and tax law, Article 6(1)(c).

Security and abuse prevention

Authenticating sign-ins, rate limiting, detecting and blocking automated abuse, investigating incidents and protecting against data loss through backups. Legal basis: our legitimate interest in keeping the Service and its users safe, Article 6(1)(f). You may object under Section 10; we will then assess whether compelling grounds override your objection.

Support and communication

Answering problem reports and enquiries and telling account holders about material changes to the Service or these terms. Legal basis: performance of a contract, Article 6(1)(b), and our legitimate interest in responding to people who contact us, Article 6(1)(f).

Service improvement

Reviewing aggregated, non-identifying usage figures and error reports to fix faults and prioritise features. Legal basis: legitimate interest, Article 6(1)(f). We do not build individual profiles.

Website analytics — only with your consent

Counting visits and page views, and which pages lead people to sign up or subscribe, through Google Analytics, so we can see what is useful and what is not. This runs only after you click “Accept” in the cookie banner, and stops as soon as you withdraw. Legal basis: your consent, Article 6(1)(a) GDPR, and for the cookies themselves Article 5(3) of the ePrivacy Directive as implemented by Article 61(3) of the Law on Electronic Communications of the Republic of Lithuania.

Legal obligations and claims

Retaining records required by law and establishing, exercising or defending legal claims. Legal basis: Article 6(1)(c) and 6(1)(f).

We do not use personal data for advertising — Google Analytics runs with its advertising features switched off — we do not send marketing emails, we do not sell data, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects (Article 22 GDPR). Should we ever wish to send product news, we will ask for your consent first and every message will carry an unsubscribe link.

Almost all personal data comes directly from you, when you register, design, upload or write to us. Stripe returns your subscription status and identifiers to us after a payment. Our hosting and database providers generate technical logs automatically. We do not obtain data about you from data brokers or social networks.

We share personal data only with the service providers below, each bound by a data processing agreement under Article 28 GDPR and acting on our documented instructions, unless stated otherwise:

Supabase, Inc.

Database, authentication, file storage and server functions. Your account, projects and attachments are stored in the London, United Kingdom (AWS eu-west-2) data-centre region of our Supabase project.

Stripe Payments Europe, Ltd. and Stripe, Inc.

Subscription payments and invoicing. Stripe is an independent controller for the payment data you give it directly and processes it under its own privacy policy, available at stripe.com/privacy.

Hostinger International Ltd.

Web hosting for veete.app and the transactional email service through which confirmation, reset and support messages are sent. Hostinger records standard access logs.

Google Ireland Limited

Google Analytics 4, only if you consent. Google acts as our processor under the Google Ads Data Processing Terms. We have switched off Google signals, advertising personalisation and data sharing with Google for its own purposes. Google Analytics 4 does not log or store IP addresses. It receives the pages you view, the referring site, your approximate location derived from your IP address, device and browser type, and the events listed in Section 4, linked to a random identifier in a cookie, never to your name or email.

Cloudflare, Inc.

Where enabled, the Turnstile bot check on the problem-report form. Turnstile evaluates browser signals to distinguish people from scripts and does not set tracking cookies.

Public authorities and advisers

Courts, regulators or law-enforcement bodies where we are legally required to disclose data, and our professional advisers under duties of confidentiality, where necessary to protect our rights.

If Veete is ever acquired or merged, personal data may be transferred to the successor, who will be bound by this Policy until it is amended in accordance with Section 13.

Account and project data are stored in our Supabase project’s data-centre region in London, United Kingdom (AWS eu-west-2). Transfers to the United Kingdom rely on the European Commission’s adequacy decision for the UK (Decision (EU) 2021/1772). Some providers, notably Stripe, Google and Cloudflare, are headquartered in the United States and may process limited data there; such transfers rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Standard Contractual Clauses adopted by the Commission (Decision (EU) 2021/914), supplemented where necessary by additional safeguards. You may request a copy of the relevant safeguards at info@veete.app.

Account and project data

For as long as your account exists, then deleted within 30 days of account closure.

Attachments

Until you delete them or the project, or your account is closed; then deleted with the account.

Backups

Rolling encrypted backups are retained for up to 30 days, after which deleted data is no longer recoverable.

Billing records

Invoices and payment records for 10 years from the end of the financial year in which they were issued, as required by the Law on Accounting of the Republic of Lithuania and tax legislation.

Support correspondence

24 months after the matter is closed, so that we can refer back to it if the issue recurs.

Security and access logs

Up to 12 months, unless an incident requires longer retention for investigation.

Problem-report rate-limit hashes

The salt rotates daily; hashes are unusable after 24 hours and purged within 7 days.

Analytics data (with consent)

Event-level data in Google Analytics is deleted after 14 months; aggregated reports without identifiers may be kept longer.

Data on your device

Until you sign out, clear your browser storage, or the browser evicts it.

Where a legal claim is pending or reasonably anticipated, we may retain the relevant data until the claim is resolved.

We apply technical and organisational measures appropriate to the risk, in line with Article 32 GDPR, including:

• Encryption in transit (TLS 1.2 or higher, HSTS) on every connection between your browser and our providers.
• Passwords stored only as salted bcrypt hashes; sign-in attempts and password-reset emails are rate limited.
• Row-level security in the database, so that a query can never return another person’s projects even if the application were to misbehave.
• Server-side validation of every saved project and of the type and size of every uploaded file.
• Least-privilege access: production credentials are held by the minimum number of people and are rotated on departure.
• Encrypted backups, dependency vulnerability monitoring and security headers (Content Security Policy, frame denial).

No system is perfectly secure. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and the supervisory authority within 72 hours, as Articles 33 and 34 GDPR require. You can help by using a unique password and by telling us at info@veete.app if you suspect your account has been accessed by someone else.

Subject to the conditions in the GDPR, you have the right to:

• Access the personal data we hold about you and receive a copy (Article 15).
• Rectify inaccurate or incomplete data (Article 16). You can change your password at any time through “Forgot your password?”; to change your name or email address, write to us.
• Erase your data (Article 17). Ask us to close your account and we delete your account and project data within 30 days, subject to the retention obligations in Section 8. Individual projects and attachments can be deleted in the planner at any time.
• Restrict processing in the circumstances set out in Article 18.
• Port the data you provided to us in a structured, machine-readable format (Article 20). Every project can be exported from the planner at any time.
• Object to processing based on legitimate interests (Article 21).
• Withdraw consent at any time where processing relies on consent, without affecting the lawfulness of prior processing.

To exercise a right, email info@veete.app from the address registered to your account, or describe how we can verify your identity. We respond within one month, extendable by two further months for complex requests, in which case we will tell you why. Requests are free unless manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. Our lead authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, 10312 Vilnius, Lithuania, ada@ada.lt, vdai.lrv.lt. We would appreciate the chance to address your concern first.

Veete sets no advertising cookies and does not embed social-media widgets. Analytics cookies are set only if you accept them in the cookie banner; until you choose, Google Analytics is not even loaded. You can change your answer at any time through the “Cookie settings” link at the foot of every page, and withdrawing deletes the analytics cookies from your browser.

_ga

Google Analytics, only with consent. A random identifier that tells one visitor from another. Expires after 2 years.

_ga_<ID>

Google Analytics, only with consent. Keeps the state of the current visit. Expires after 2 years.

The Service also stores the following in your browser because it cannot work without them; under Article 5(3) of the ePrivacy Directive, strictly necessary storage of this kind does not require consent:

Session token

Keeps you signed in between page loads and refreshes your session. Removed on sign-out.

Cookie choice

Remembers whether you accepted or declined analytics, so the banner is not shown on every page.

Interface preferences

Render quality, panel layout, whether you have seen the welcome tour, the last project opened.

Local projects

When you use the planner without an account, your gardens are saved only in this storage.

Anti-abuse state

When Turnstile is enabled on the problem-report form, Cloudflare may set a short-lived challenge cookie scoped to that widget.

Clearing your browser’s site data for veete.app signs you out and removes any locally stored gardens.

The Service is not directed at children. You must be at least 16 years old, or the age at which you can validly consent to information-society services in your country if higher, to create an account. We do not knowingly collect personal data from children; if you believe a child has provided us with data, contact us and we will delete it.

We review this Policy at least annually and whenever our processing changes. Amendments take effect when published on this page, with the “last updated” date revised. For material changes, such as a new purpose, category of recipient or transfer mechanism, we will notify account holders by email at least 14 days before the change takes effect. Earlier versions are available on request.

Rokas Stulga, Pylimo g. 19, Lapainios k., LT-56301 Kaišiadorių r. sav., Lithuania. Data protection enquiries: info@veete.app. General enquiries: info@veete.app.