1. Controller
Tomáš Habr, Company ID (IČO) 05406536, Seifertova 499/59, 130 00 Prague 3, Czech Republic. Data protection contact: support@getselekt.com
2. Two roles — an important distinction
- Your account data (photographers and creators): we are the controller.
- The contents of your galleries — your clients' photographs, guest reviewer names: there you (the photographer) are the controller and we act as your processor under your instructions. The data processing agreement is part of the Terms of Service (Art. 6). Your clients should direct questions about their photos primarily to you.
3. What we process and why
| Category | Examples | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account | e-mail, name, avatar, language | account operation, sign-in | contract | until deletion + 30-day grace |
| Gallery content | photos, videos, titles, comments | providing the Service | contract (as processor) | until deleted by the user |
| Guests | entered name, ratings, selections, comments | feedback for the photographer | photographer's legitimate interest (as processor) | until gallery deletion |
| Usage | gallery counts, storage volume | enforcing plan limits | contract | account lifetime |
| Technical | IP in logs, error reports | security, stability | legitimate interest | logs ≤ 30 days, errors ≤ 90 days |
| Billing status | plan, subscription state | plan management | contract | account lifetime |
We never see or store card details — payments are processed by Paddle.com Market Ltd as an independent controller (see Paddle's privacy policy).
4. Recipients and sub-processors
| Service | Purpose | Data location |
|---|---|---|
| Supabase | database, authentication | EU (Frankfurt) |
| Cloudflare R2 | photo/video storage; backups | backups: EU jurisdiction; media: per account setting |
| Vercel | application hosting | EU (Frankfurt) — server functions |
| Upstash | abuse protection (rate limiting) | per account setting |
| Sentry | error reporting | EU |
| Paddle | payments (independent controller) | UK/EU |
Transfers outside the EU/EEA (e.g. US providers' support) are covered by an adequacy decision (EU–US Data Privacy Framework) or Standard Contractual Clauses.
5. Cookies
We use only essential (technical) cookies — the sign-in session (Supabase) and your language preference. No analytics or marketing cookies are deployed, which is why no cookie banner is shown (this document fulfils the information duty).
| Cookie | Purpose | Duration |
|---|---|---|
| sb-* | sign-in session | session / refresh lifetime |
| NEXT_LOCALE | chosen language | 12 months |
6. Security
Encrypted transport (HTTPS), row-level access control in the database (RLS), separated credentials, daily backups retained 14 days within the EU, security headers, request rate limiting. Only the operator has data access.
7. Your rights
Access, rectification, erasure, restriction, portability and objection — write to support@getselekt.com. You can delete your account directly in the app (Settings → Account; 30-day grace period). You may lodge a complaint with the Czech Data Protection Authority (ÚOOÚ, uoou.gov.cz).
8. Guest reviewers
Guests enter a name (of their choosing) at first interaction; it is shown next to their ratings and comments. The name is not public — it is visible to the photographer and others with access to that gallery.
9. Changes
Material changes will be announced in-app or by e-mail.