Privacy Policy

1. Data Controller

Veltera Nova EOODCompany ID (EIK): 208750785

Address:Sofia 1000Triaditsa districtGotse Delchev residential complexbl. 235entrance Iapt. 146Bulgaria

Email:office@velteranova.com

2. What personal data we collect

Depending on how you use the platform, we may process the following categories of data:

Passwords are never stored in readable form.

Before storage, all uploaded images mandatorily and without exception undergo automatic removal of EXIF metadata (GPS coordinates, device model, and other unnecessary information).

Payment data

Payments are processed entirely by Stripe.

We only receive the information necessary for a successful payment, subscription status, and transaction identifiers.

3. What we use personal data for

We process data solely for the following purposes:

We do not sell your personal data.

4. Legal basis for processing

Depending on the specific processing activity, we rely on the following grounds under Art. 6 GDPR:

5. Automated processing

Gardener Help uses an automated Decision Engine that analyzes the images and descriptions you submit and generates an informational assessment and recommendations.

The Decision Engine does not make a decision on your behalf — the output is advisory information, and the decision on whether and how to act remains entirely your own.

To the extent this processing could fall within the scope of Art. 22 GDPR, we guarantee your right to request human intervention, to express your point of view, and to contest the result of the analysis by contacting us at office@velteranova.com.

The analyses, recommendations, and assessments generated by the Decision Engine constitute informational assistance and do not constitute professional agronomic, veterinary, medical, legal, or other licensed expert opinion. The final decision on what action to take remains entirely with the user.

6. Who we share data with

We do not sell your personal data.

We only use data processors necessary for the operation of the service.

We have a data processing agreement (DPA) in place with each of the listed providers under Art. 28 GDPR. All providers process data solely to deliver their respective service.

The logic, protocols, and knowledge base of the Decision Engine are proprietary to Veltera Nova EOOD. To perform the AI analysis itself, the Decision Engine uses Google LLC (provider of the Gemini AI model) as a data processor.

As the platform evolves, we may engage additional data processors where necessary to provide, support, or protect the service. In the event of such changes, this policy will be updated where required by applicable law.

7. International transfers

The providers Stripe, Resend, Sentry, Google LLC, Railway, and Vercel are established outside the European Economic Area (United States).

In these cases, we rely on appropriate safeguards under Chapter V of the GDPR — Standard Contractual Clauses (SCCs) and/or certification under the EU-U.S. Data Privacy Framework, where the provider is certified.

A copy of the applicable safeguards can be provided upon request at office@velteranova.com.

For all international transfers, we rely exclusively on transfer mechanisms permitted under Chapter V of Regulation (EU) 2016/679 (GDPR).

8. Retention periods

Upon expiry of the applicable period, data is deleted or irreversibly anonymized, unless applicable law requires a longer retention period.

9. Your rights

Under the GDPR you have the right to:

We will respond to every request without undue delay and no later than one month, per Art. 12 GDPR.

Requests may be submitted to the email address indicated in this policy. We may request additional information to verify the identity of the requester where necessary to protect personal data.

10. Right to lodge a complaint

If you believe we are processing your personal data unlawfully, you have the right to file a complaint with:

Commission for Personal Data Protection (CPDP)

Address:2 Prof. Tsvetan Lazarov Blvd.1592 SofiaBulgaria

Website:https://www.cpdp.bg

11. Cookies

We use:

These cookies cannot be disabled.

Analytics and marketing cookies

Used only after explicit consent has been given.

You can change your choice at any time via the cookie settings.

12. Security

We use modern technical and organizational measures, including:

Technical logs are used solely for diagnostics, information security, abuse prevention, and platform maintenance. They are not used for automated profiling of users.

12a. Personal data breaches

In the event of a personal data breach, we will take action in accordance with Art. 33 and Art. 34 GDPR, including notifying the competent supervisory authority and affected individuals where required by law.

13. Data of persons under 18

The platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from individuals under 18.

If we determine that we have received personal data in violation of this requirement, we will take immediate steps to delete it.

14. Use of data for AI training

Currently, submitted images, descriptions, and analyses are not used to train or fine-tune AI models without your explicit consent.

Should the possibility of using data to improve AI models be introduced in the future, this will only be carried out after prior, freely given, specific, and informed consent from the user.

15. Changes to this policy

We may periodically update this policy.

In the event of material changes, we will notify users via the platform or by email, where required by law.

The date of the last update is always published at the beginning of this policy.

16. Contact

If you have questions about the processing of your personal data, or to exercise your rights, you can contact us:

Veltera Nova EOODoffice@velteranova.com

All requests regarding the exercise of your GDPR rights may be sent to the email address indicated above.