Privacy Policy

Last updated: 20 December 2025

This Privacy Policy describes how Solvity s.r.o. ("Solvity", "we", "us") processes personal data in connection with the UbiBoard application and related services (the "Service"). The Service requires user identification to function, and core features depend on the processing of personal data. This Policy explains what data is processed, for what purposes, on what legal bases, how long it is retained, and what rights apply under EU law.

1. Data Controller

Solvity determines the purposes and means of processing personal data required to operate the Service.

2. Categories of Personal Data

The following categories of personal data are processed:

• Account data: email address, name, optional birthdate. The email address is required and used as the login identifier. The birthdate is optional, user-provided, not verified, and used only for profile personalization.
• Community and content data: documents, images, messages, contacts, codes, and other materials uploaded or generated by users within communities.
• Billing data: billing address and Stripe customer identifiers. Payment card data is processed exclusively by Stripe and never stored on Solvity systems.
• Technical and diagnostic data: device metadata, IP address, session events, crash reports, and operational logs collected via Firebase Analytics and Crashlytics to maintain service stability and security.
• Notification data: push notification tokens used to deliver service-related messages.

3. Purposes of Processing

Personal data is processed for the following purposes:

• creation and management of user accounts
• authentication and access control
• operation of communities and membership management
• storage and delivery of user-generated content
• subscription management and billing
• service security, diagnostics, and reliability
• compliance with legal and accounting obligations

4. Legal Bases for Processing (GDPR)

Processing is based on the following legal grounds:

• Contract (Article 6(1)(b)): account creation, authentication, community participation, subscription management, and storage of user-generated content.
• Legitimate interests (Article 6(1)(f)): service security, diagnostics, analytics, crash reporting, fraud prevention, and system integrity.
• Legal obligation (Article 6(1)(c)): retention of invoices, accounting records, and compliance with statutory duties.

5. Processors and Infrastructure

The Service relies on the following processors:

• Google Firebase (Authentication, Firestore, Storage, Hosting, Messaging, Analytics, Crashlytics, AppCheck, Cloud Functions)
• Auth0 (user authentication)
• Stripe (payment processing and subscription management)

These services are configured for EU data residency where available. Data is transmitted exclusively over HTTPS.

6. Analytics and Diagnostics

Firebase Analytics and Crashlytics are used on web and mobile versions of the Service to monitor performance, stability, and errors. These tools may process IP addresses and device-related data. No advertising features or ad personalization are enabled. Analytics data is used solely for operational purposes and not for marketing.

7. Communities and User Responsibility

Communities are created and managed by users. Community administrators determine membership, permissions, and the visibility of content. Administrators decide which individuals gain access to community data and may act as independent data controllers for personal data processed at the community level.

Solvity does not control administrator decisions and is not responsible for personal data exposure resulting from administrator actions.

8. Data Retention

Personal data is retained only as long as necessary to operate the Service or comply with legal obligations.

• Account and community data is deleted upon user or community deletion, with a possible residual period of up to 30 days for recovery.
• Business and accounting records are retained for legally required periods.
• Backups and logs follow standard retention cycles of the underlying infrastructure providers.

9. User Rights

Users have the right to access, rectify, erase, restrict, or object to the processing of their personal data, and the right to data portability where applicable. Requests can be submitted via support@ubiboard.io. Data exports are provided manually upon request in a commonly used electronic format.

10. Right to Lodge a Complaint

Users have the right to lodge a complaint with a supervisory authority. In the Czech Republic, this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

11. Children

The Service is not directed at children. No age verification is performed. Personal data of minors may be processed where a minor is added to a community by a responsible adult or administrator. No processing is intentionally targeted at minors.

12. Security Measures

Appropriate technical and organizational measures are implemented to protect personal data, including encrypted transmission, access controls, and least-privilege principles. Security incidents are handled in accordance with applicable legal requirements.

13. Data Breaches

In the event of a personal data breach, notifications to users and authorities will be made where required by applicable law.

14. International Transfers

Data is primarily processed within the European Union. Where processing outside the EEA occurs incidentally via subprocessors, appropriate safeguards such as standard contractual clauses are relied upon.

15. Policy Changes

This Privacy Policy may be updated from time to time. Continued use of the Service after publication of an updated version constitutes acceptance of the revised Policy.