Flavo Privacy Policy
This is a translation. In case of discrepancies, the Polish version prevails.
Last updated: 26 October 2026
This policy covers the data Flavo processes as a controller: visitors to flavoapp.com, people who sign up for a trial, customers (rental companies) and their contact persons. Renters' data in the panel is managed by the rental company; we process it on the rental company's behalf (section 8).
1. Who the controller is
The data controller is "JMI" Sp. z o.o., ul. Warszawska 10, 08-500 Ryki, Poland, KRS 0000492912, NIP 5060112320, REGON 061631569, the owner of the Flavo brand. For anything to do with your data, write to support@flavoapp.com.
Data protection at Flavo is the responsibility of Natalia Jaguś. Write to her at support@flavoapp.com. We have not formally appointed a data protection officer, because the law does not require us to.
2. What data we collect and where it comes from
- Visits to flavoapp.com: the server and our hosting provider process technical connection data (IP address, time, browser) to keep the site running and protect it from abuse. We do not use analytics or advertising cookies, and we have no tracking pixels or session recording.
- Trial sign-up (form on flavoapp.com): first name, rental company name, email, phone (if you provide it), fleet size and the chosen plan. Your request goes to our inbox and to our customer panel, and we send a confirmation to your email address.
- Onboarding form (
panel.flavoapp.com/start/<key>, a link we send to the customer): company details (name, registration number, VAT number, address, phone numbers, email addresses, websites and profiles), details of team members we will create accounts for (full name, role, email, phone), materials for the panel and website (fleet, price lists, rules, logo, photos, texts), and, when the contracts are accepted: the full name, job title and email of the person accepting, the date and time, IP address and browser. - Contact and support: data from emails, WhatsApp messages and requests in the Help tab (name, email, phone, message content).
- Contract and billing: company details and details of the person representing the company, invoicing details, payment history. Card payments for the subscription are handled by Stripe; we never see your card number.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to enquiries, running the trial, entering into and performing the contract with the rental company | GDPR Art. 6(1)(b) (contract and steps taken before entering into it); for the company's contact persons: GDPR Art. 6(1)(f) (our legitimate interest in keeping in touch with our customer) |
| Keeping a record that the contract was concluded (acceptance in the onboarding form) | GDPR Art. 6(1)(f) (proving that the contract was concluded and pursuing claims) |
| Technical support | GDPR Art. 6(1)(b) and (f) |
| Invoices and accounting | GDPR Art. 6(1)(c) (legal obligation) |
| Security of the website and panel, establishing and pursuing claims | GDPR Art. 6(1)(f) |
We do not send a newsletter. We only write to customers about the service.
4. Who processes data on our behalf
We work with trusted providers who process data on our behalf:
- Vercel (hosting of flavoapp.com and the panel, servers in Frankfurt),
- Neon (database on AWS servers in Frankfurt),
- Google Workspace (@flavoapp.com email),
- Resend (sending system emails),
- GitHub and Dropbox (nightly database backups, encrypted before upload; Dropbox keeps them for 30 days and does not know the password),
- inFakt (invoicing and accounting),
- WhatsApp (Meta), if you message us on WhatsApp,
- Stripe (card payments for the subscription).
Some of them are based in the USA. In that case, data is transferred under the EU-US Data Privacy Framework or standard contractual clauses.
5. How long we keep it
- Data from a trial that did not lead to a contract: 12 months from the end of the trial.
- Data from the onboarding form: for the duration of the contract, or, if no contract was concluded, 12 months from the last change.
- Record of contract acceptance: for the duration of the contract and 3 years after it ends.
- Customer and contact person data: for the duration of the contract and 3 years after it ends (limitation period for claims).
- Invoices and accounting records: 5 years from the end of the year in which the tax payment deadline passed.
- Support correspondence: for the duration of the contract and 3 years after it.
- Server logs: no longer than 30 days.
6. Cookies
flavoapp.com only uses cookies that are needed for the site to work. The panel (/admin) uses a login session cookie (valid for up to 7 days) and browser storage for offline work. If we ever turn on visitor statistics, we will only do so with your consent and will describe it here.
7. Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable form, and object to processing based on legitimate interest. Write to support@flavoapp.com and we will reply within one month. You can also lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl) or with the data protection authority in your country (in Iceland: Persónuvernd).
8. Renters' data in the Flavo panel
If you book a car with a rental company that uses Flavo, that rental company is the controller of your data. Flavo stores and processes it on the rental company's behalf, under a data processing agreement. For questions about this data, please contact the rental company first; if you write to us, we will pass your message on to the rental company.
9. Changes
We will announce any significant changes to this policy on this page, and we will also email our customers about them.