Effective from 29 Oct 2026
What data SUISO stores, why, who has access to it and how you get or delete it.
The data controller is budevolno.cz s.r.o., company ID 29810701, Bílov 159, 743 01 Bílov. Contact for anything about your data: hello@suiso.app.
Account data: email (with sign-in with Apple this may be a private relay address from Hide My Email), name (if you fill it in or Google sends it), your Google or Apple account identifier when signing in with them, the date and version of your consent to the terms, app language.
Journal content: tanks and their parameters, entries, water tests, tasks, routines, equipment, plants and livestock, notes, photos and captions, questions to the Advisor and its answers.
Tank sharing: the email of the person you share a tank with read-only. We store it so they can see the tank after signing in; it is deleted when you remove the share.
Payments (only for a paid plan or credits): the Stripe customer and subscription IDs, the plan, the status and end of the paid period, and credit purchases. Your card number and other payment details never reach us – you enter them directly with the seller (Link / Stripe).
Purchases in the iOS app (only when you buy something through the App Store): from Apple we receive signed transaction data – the transaction and original transaction IDs, the product, price and currency, the dates of purchase, renewal, expiry and any refund, the auto-renewal status and the environment (the live App Store or the Sandbox test environment). We attach your SUISO account ID to the purchase so the plan goes to the right account. We do not receive your name, address or card details from Apple.
“Write to us” messages: the message text, the page you write from, the app language and browser type.
Translations: when an entry, task or Advisor answer is shown in a language other than the one it was written in (e.g. on the public page, for a shared tank or after changing the language), we store the machine translation so it is not translated again.
Technical data: the sign-in cookie and server request logs (IP address, time, browser) at the hosting provider for the time necessary for security and operation.
Optionally: a push notification address (only when you turn reminders on). In the iOS app this is the device token from the Apple Push Notification service, its environment and the app version; we delete the token when you turn notifications off in Profile or sign out.
Instagram (only when you connect an account): the Instagram account ID and username, the access token and its expiry – the token is stored encrypted and only on the server. For posts shared through SUISO we store their ID, link and caption in the tank journal. We do not read other Instagram content (posts, followers, messages).
YouTube (only when you connect a channel): SUISO uses the YouTube API Services. From Google we receive the ID and name of the channel you pick when connecting, plus access tokens – we store them encrypted and only on the server. We use the permission to read your YouTube account only to get the channel name and to check that uploaded videos still exist; we do not read other videos, comments or statistics. Your device sends the video with its title, description and chosen visibility straight to YouTube, only when you tap Upload; for the uploaded video we store its ID and link in the tank journal. Your device remembers the chosen visibility (browser local storage).
We use data from Google APIs (sign-in with Google, YouTube) only for the features described above. SUISO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use it for advertising or to train AI models, do not sell it and do not transfer it except to providers needed to run these features; humans read it only with your consent, for security or where required by law.
Traffic measurement: Vercel Web Analytics records the page viewed (without tank or entry identifiers), the referrer, country, device and browser type. It uses no cookies and stores nothing on your device, cannot tell visitors apart for longer than one day and does not store IP addresses. Besides pages it also counts steps such as signing up, creating a tank or buying a subscription, in aggregate – without your email, name or other personal details. We collect no advertising data.
Service emails: sign-in and verification links and the weekly summary “A week in your tank” (what is due in your tanks, the last water change and water test) – on Saturday morning when you have it turned on, or when notifications are off. You can turn the weekly summary off in Profile or with the “Unsubscribe” link in every email. The email is put together from your journal; no AI writes it.
Running the account and journal and sharing a tank with another user on your instruction – performance of a contract (Art. 6(1)(b) GDPR).
Paid plans and credits (on the web and through the App Store) – performance of a contract (Art. 6(1)(b)) and legal obligations, mainly accounting and tax (Art. 6(1)(c)).
Security, abuse prevention, server logs, aggregate traffic measurement and handling “Write to us” messages – the operator’s legitimate interest (Art. 6(1)(f)).
Push reminders, the Instagram and YouTube connections, the public tank page – your consent expressed by turning the feature on (Art. 6(1)(a)); you can turn it off at any time.
Advisor (AI) – performance of the contract; tank data and photos are sent to the model provider only when you ask a question, or for the daily insight and weekly summary if your plan includes them.
Machine translation into the reader’s language – performance of the contract (Art. 6(1)(b)) and, for the public page and shared tanks, a legitimate interest in readers understanding them (Art. 6(1)(f)). The text being translated is sent to the same model provider (Anthropic), without any other data about you.
Processors – work with the data only on our instructions:
Independent controllers – handle the data under their own policies:
A tank you share can be read by the person you shared it with; the public page by anyone with the link.
Outside the EU: Supabase, Vercel, Anthropic, Resend, Cloudflare, Google, Meta, Link and Stripe are based in the USA, Unsplash in Canada. Transfers to the USA are covered by the EU–US Data Privacy Framework or the EU standard contractual clauses, transfers to Canada by the European Commission’s adequacy decision. We never sell data.
For as long as the account exists. After you delete the account all data is removed immediately, including stored translations and “Write to us” messages, and from provider backups within 30 days. Deleting a tank also removes its photos and translations. Server logs are deleted automatically within days. Payment records are kept by the seller (Link / Stripe, for purchases in the iOS app Apple) for as long as the law requires.
The public tank page disappears as soon as you turn it off or delete the account.
The Instagram connection (ID, username and token) is deleted as soon as you disconnect the account in Profile, revoke SUISO’s access in your Instagram settings (Meta sends us a deletion request and shows you a code to check its status) or ask at hello@suiso.app. Records of shared posts stay in the tank journal until you delete the tank or the account; the posts themselves are managed by Instagram.
The YouTube connection (channel ID and name, tokens) is deleted as soon as you disconnect the channel in Profile – we also revoke the access at Google, and links to videos uploaded through SUISO disappear from the journal (the entries stay). You can also revoke access in your Google account settings (security.google.com/settings/security/permissions); we check every week that the connection is still valid and delete the data within 30 days of revocation. We refresh the channel name and video links from YouTube at least every 30 days. The videos themselves are managed by YouTube – disconnecting or deleting your SUISO account does not remove them from YouTube.
Send requests to hello@suiso.app; we reply within 30 days.
We use only essential cookies and browser storage, no marketing or analytics – traffic is measured without cookies, hence no cookie banner:
The connection is encrypted (HTTPS), photos are stored in private storage and accessed with signed links of limited validity. Database data is protected by row-level permissions – each account sees only its own.
When processing changes we update this policy and the effective date above. We announce material changes in the app.