This Privacy Policy explains how Selvyo sp. z o.o. ("Selvyo", "we", "us") collects, uses, shares, and protects Personal Data when you:
If you are an End User of an application that integrates the Selvyo API or SDK, please also read the privacy notice of the operator of that application — they are the Controller of your data and we act as their Processor under a Data Processing Agreement.
Selvyo plays two distinct roles under the GDPR, depending on the data involved:
| Role | When it applies | What this Policy covers |
|---|---|---|
| Controller | Website visitors, prospects, account administrators of our business customers, recipients of our marketing or support communications, job applicants. | This Privacy Policy applies in full. |
| Processor | End Users of our customers' applications whose food images, text queries, or pseudonymous identifiers are transmitted to our API or SDK. | This Policy describes our practices for transparency. The legally controlling document is our Data Processing Agreement (DPA) with the customer, and the End User's primary point of contact is the customer (Controller). |
| Purpose | Personal Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Operating the website, dashboard, and Services; account authentication; provisioning and billing | 4.2 (account); 4.1 (technical) | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, abuse mitigation, rate-limiting, audit logging | 4.1 (technical), 4.2 (account) | Legitimate interest (Art. 6(1)(f)) — securing the Services; balancing against your rights |
| Customer support, response to inquiries | 4.2, 4.4 | Performance of a contract or legitimate interest |
| Tax, accounting, and statutory record-keeping | 4.2 (billing) | Legal obligation (Art. 6(1)(c)) — Polish tax and accounting law |
| Privacy-friendly product analytics (aggregate) | 4.1 (events, no cross-site IDs) | Legitimate interest (Art. 6(1)(f)) — improving the Services without intrusive profiling |
| Marketing communications | 4.1 (newsletter signup), 4.2 (admins who opted in) | Consent (Art. 6(1)(a)); withdrawable at any time |
| Service-related transactional emails (billing, security, ToS/Privacy changes, outages) | 4.2 | Performance of a contract or legitimate interest (Service operation) |
| Recruitment | 4.4 (applications) | Pre-contractual measures (Art. 6(1)(b)); consent for retention beyond the role |
| Defense and exercise of legal claims, compliance with regulators, court orders | Any applicable | Legal obligation; legitimate interest |
Where we rely on legitimate interest, we conduct a balancing assessment and you have the right to object (see Section 10).
Selvyo uses a deliberately minimal cookie footprint. We do not run advertising cookies, retargeting pixels, or cross-site trackers.
| Category | Examples | Purpose | Consent | Typical lifetime |
|---|---|---|---|---|
| Strictly necessary | Session, CSRF token, authentication, load-balancer affinity, language preference | Required to operate the website and dashboard; without them the site does not function. | No consent required (ePrivacy exemption). | Session or up to 12 months |
| Privacy-friendly analytics | Plausible (cookieless) and/or self-hosted PostHog (first-party) | Aggregate visitor counts, page views, traffic sources. No cross-site tracking, no advertising identifiers, IP truncated. | Where local law treats this as exempt (Plausible cookieless), no consent required. Where local law requires consent (e.g., first-party cookies via PostHog), opt-in via cookie banner. | Up to 12 months |
| Functional | Theme/dark-mode, accepted-cookie-preferences flag | Remembering your preferences. | Implied / consent-aware. | Up to 12 months |
| Marketing / advertising | None used | — | — | — |
You can manage your preferences via the cookie banner at any time at the cookie-preferences link in the website footer, or via your browser settings (Do Not Track signals and Global Privacy Control are honored where technically feasible).
We share Personal Data only as follows:
eu-central-1 (Frankfurt).We do not:
Personal Data is primarily processed within the European Economic Area (EEA), in AWS region eu-central-1 (Frankfurt, Germany).
Where Personal Data is transferred outside the EEA (for example, when our LLM Sub-Processor processes a request on a US-region endpoint, or when our payment processor transmits data to its US affiliate), we rely on one or more of the following safeguards under Chapter V GDPR:
You can request a copy of the relevant transfer mechanism by emailing sergiydf2025@gmail.com (commercially sensitive terms may be redacted).
We retain Personal Data only for as long as needed for the purposes for which it was collected, or as required by law.
| Category | Retention period |
|---|---|
| Food images submitted via the API/SDK | Up to 24 hours after inference completion, then deleted. |
| Operational logs containing Personal Data (request metadata, IP) | Up to 30 days, then deleted or anonymized. |
| Security logs (access, audit trails) — anonymized where possible | Up to 12 months. |
| Account and administrator data | For the duration of the account, plus 30 days following termination for export, then deleted (subject to legal-hold exceptions). |
| Billing and invoice records | 5 full calendar years from the end of the year of issuance (Polish tax and accounting law). |
| Contracts and DPA documentation | 10 years after the contract ends (limitation periods for commercial claims under Polish law). |
| Marketing consents and opt-out evidence | 3 years after withdrawal of consent or end of relationship. |
| Job applications | Up to 6 months after the role is filled, unless you consent to inclusion in a talent pool (then up to 24 months). |
| Cookies and analytics events | As shown in Section 6. |
If you are in the EEA, UK, or Switzerland, you have the following rights, subject to conditions and exceptions in applicable law:
To exercise rights, email sergiydf2025@gmail.com. We will respond within one month (extendable by two months for complex requests under Art. 12 GDPR). We may need to verify your identity before acting on a request. Where we act as a Processor for an End User's Personal Data, we will forward your request to the relevant Controller (the operator of the application you used).
We use an opt-in model for marketing emails:
The Services use AI models to generate food-recognition output. These models produce statistical estimates and do not make decisions about you that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
We do not use Personal Data to train, retrain, fine-tune, or evaluate AI models, except (i) with the relevant Controller's explicit, written, opt-in consent, or (ii) on data that has been irreversibly anonymized. We have contractually disabled training-on-customer-data with our LLM Sub-Processor.
If you have questions about how an output was produced or wish to contest it, contact us at sergiydf2025@gmail.com.
The Services are intended for use by businesses and adults. They are not directed to children under 13 (or under 16 in jurisdictions that apply that higher age threshold under Article 8 GDPR). We do not knowingly collect Personal Data from children. Our customers are contractually required not to deploy the Services in applications directed to children under the applicable age threshold, including under COPPA (United States) and Article 8 GDPR.
If you believe a child has provided Personal Data to us, contact sergiydf2025@gmail.com and we will promptly delete it.
We implement technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. These include:
No security measure is perfect. If you become aware of a vulnerability or incident, please contact sergiydf2025@gmail.com (or sergiydf2025@gmail.com).
We may update this Policy from time to time. We will indicate the "Last Updated" date at the top. For material changes, we will give reasonable advance notice — by email to account administrators or by a prominent banner on the website — at least thirty (30) days before the change takes effect, where feasible. Continued use of the Services after the effective date constitutes acceptance.
You have the right to lodge a complaint with a Supervisory Authority. Our lead authority is:
You may also lodge a complaint with the supervisory authority of the EU/EEA Member State of your residence, place of work, or place of the alleged infringement.
This Section provides supplemental disclosures for residents of California and other U.S. states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states that adopt analogous rights). It applies in addition to the rest of this Policy.
| Category (CCPA §1798.140) | Examples | Collected? | Sources |
|---|---|---|---|
| Identifiers | Name, work email, IP address, account ID | Yes | Directly from you; automatically from your device |
| Customer records (§1798.80) | Billing address, payment-method token, VAT ID | Yes | Directly from you; payment processor |
| Commercial information | Plan purchased, usage volume, billing history | Yes | Directly from you; generated by the Services |
| Internet/network activity | Pages viewed, dashboard actions, error events | Yes (privacy-friendly analytics) | Automatically from your device |
| Geolocation (precise) | — | No | — |
| Sensory data (audio/video) | Food images (processed as Processor on behalf of our customers) | Yes — as Processor only | From the customer's application |
| Professional/employment | Job title, employer (account admins, job applicants) | Yes | Directly from you |
| Inferences | Aggregate, non-individual product analytics | Limited / aggregate | Derived from interaction data |
| Sensitive personal information | Account credentials (in transit). No SSN, no precise geolocation, no contents of private communications. | Limited to credentials | Directly from you |
As described in Section 5.
As described in Section 7 (sub-processors, professional advisers, authorities, corporate transactions).
We do not sell Personal Information for monetary or other valuable consideration, and we do not share Personal Information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and analogous state laws. We honor Global Privacy Control (GPC) and similar opt-out preference signals.
Subject to applicable law and identity verification, you have the right to:
To exercise these rights, email sergiydf2025@gmail.com with the subject line "US Privacy Rights Request". You may use an authorized agent — we will require evidence of authorization. We will respond within the period required by applicable law (typically 45 days, extendable).
We do not offer financial incentives or price differences in exchange for Personal Information.
As described in Section 9.
United Kingdom. Where the UK GDPR and the Data Protection Act 2018 apply, references in this Policy to the GDPR include the UK GDPR, and references to a Supervisory Authority include the UK Information Commissioner's Office (ICO, ico.org.uk). UK Restricted Transfers rely on the UK International Data Transfer Addendum to the EU SCCs or the UK IDTA where applicable.
Switzerland. Where the Swiss Federal Act on Data Protection (FADP) applies, references to the GDPR include the FADP, references to a Supervisory Authority include the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), and EU SCCs are interpreted in light of the FDPIC's adaptations.