Privacy policy

Pre-release privacy draft. The retention schedule, provider safeguards and any health-related processing still need approval and verification before public launch. This notice does not claim that those checks are complete.

1. Controller and contact

VertyFlyte Technology, S.L. is responsible for the processing described here. Company details are in the legal notice. For a privacy request, contact vertyflyte@outlook.com or Support. This business inbox is not a designation of a data protection officer.

2. Information used by the app

The app uses account and contact details, a hashed password, verified email, delivery addresses and handoff notes; order items, references, receipts and payment status; support messages and attached photos; signed-in device information and notification tokens where enabled. Stripe handles card information. We receive payment references and limited card details such as brand and last four digits, not full card numbers.

Location access is requested when you choose a location feature, such as setting an address. The customer app does not track your location in the background. Mapbox provides maps and address search and receives network and query information needed for those features. Permissions on your device and a lawful data-processing basis are separate matters.

Delivery preferences or order content may reveal health information. Please do not send diagnoses, prescriptions or medical records through delivery notes or website forms. Any intended health-data processing needs a documented basis under both ordinary and special-category data rules, appropriate safeguards and clear information before it is offered. That release assessment remains pending.

3. Website forms and preview

• Launch list: your email, optional first name and consent record are used for the launch notifications you request. A confirmation link verifies your subscription before launch news is sent. Unsubscribe using the link in the email or contact us. The notification categories must match what you agreed to receive.
• Support: your name, email, subject and message are used to address the request and communicate with you. Include an order reference when needed, rather than unnecessary sensitive information.
• Business interest: the business name, category, area, contact details and message are used to respond about possible participation. Submitting interest does not create a vendor contract.
• Applications: your contact details, city, selected role, message, professional link and PDF CV are used to assess the application and communicate with you. Applying for a current role and joining a future talent pool are different purposes and must be explained separately. Avoid including identity documents, health details or other unnecessary sensitive information in your CV.
• Security and hosting: hosting logs and abuse-prevention data can include IP address, browser and requested resource. Cloudflare Turnstile may process browser signals when a configured anti-spam check is needed. These measures must be reflected in the verified provider and retention inventory.
• Interactive demo: fictional shop and order data run in the browser. Starting it can load Mapbox resources, exposing your IP address and viewed map area to Mapbox. It places no real order and takes no payment.

4. Storage and optional analytics

Essential browser storage supports sign-in, basket, preferences and security features where used. Optional website analytics are currently disabled in the website configuration. If enabled later, they must wait for valid consent and stop after withdrawal. You can open Cookie settings in the footer; the cookie notice explains the current choice and storage inventory. App diagnostics and map telemetry need their own verified consent and release configuration.

5. Purposes and legal bases

Account, order and delivery processing is used to perform the requested service; contact about a prospective vendor or job relationship can involve steps requested before a contract. Legal obligations can require transaction and tax records. Security and proportionate support handling may rely on legitimate interests, with a documented balancing assessment. Optional launch news and analytics rely on consent that can be withdrawn. Separate future talent-pool processing and special-category information require an appropriately documented basis.

6. Recipients and transfers

Only the information needed for fulfilment is shared with the provider and rider involved in an order. Relevant service providers can include Stripe for payments, Mapbox for maps, Resend for email, Render for backend hosting, Vercel for website hosting, and Cloudflare for configured abuse prevention. Google is relevant only if website analytics are deliberately enabled with consent. Authorities receive information where the law requires it. We do not sell personal data.

Provider roles, processing locations and international-transfer safeguards must be verified for the actual agreements and configuration. Where data leave the EEA, an applicable adequacy decision or suitable safeguards, such as standard contractual clauses, are required. A provider's name alone does not establish a valid transfer mechanism. You can ask for information about the applicable safeguards using the contact above.

7. Retention and deletion

The detailed retention schedule is pending approval and verification. The intended criteria are the time needed for the stated purpose, legal record-keeping duties, unresolved orders or disputes, security needs and a bounded backup lifecycle. Account information, support records and attachments, launch lists, applications, location-related data, logs and deletion-request evidence must each have a documented period or criteria before launch. We do not claim that an unspecified schedule has been implemented.

A deletion request verifies identity and identifies the relevant records. It does not cancel orders or guarantee immediate erasure of records held for a valid legal obligation or claim. Any retained categories and relevant reasons must be explained when responding. Optional diagnostic reports have an existing technical expiry of 30 days, but scheduled cleanup and monitoring still require qualification.

8. Your rights

You can request access, correction, erasure, restriction, portability where applicable, or object to processing, and withdraw consent without affecting earlier lawful processing. We may need proportionate identity checks. We normally respond within one month; where the law permits an extension, we explain it within that first month. You may complain to the Agencia Española de Protección de Datos (AEPD) or another competent supervisory authority.

Request account and associated-data deletion without installing or signing into the app. Email verification submits a review request and provides a reference; it is not confirmation of completed deletion. You may also contact our business inbox. Do not email passwords, verification codes or identity documents.

9. Security, children and updates

We use security controls appropriate to the service, including authenticated access and limited access to support records. No service can promise absolute security. Ordering accounts are intended for adults aged 18 or over. Contact us if you believe a child has supplied personal data. Material changes to this notice receive a new version and appropriate information before new processing is introduced.