Privacy policy

How Valtela handles personal data. Effective September 14, 2026.

Who is responsible

Operator: Jáchym Jahoda, company number 21971561, Bukovany 99, 696 31 Bukovany, Czech Republic, Trade Licensing Register, Kyjov Municipal Office. Contact: hello@valtela.com. We have no data protection officer; requests about personal data are handled in writing at that e-mail. The operator is based in the European Union, so the EU's General Data Protection Regulation applies to everything below.

Visitors to this website

This site uses no cookies, no analytics, no advertising code and no tracking, and collects no personal data about visitors. That is why there is no cookie banner: there is nothing to consent to. We keep no access log that records a visitor's IP address per page.

An IP address is used only to defend against abuse: the running program counts requests per address in memory so nobody can flood the message box or the server. None of that is linked to anything you sent, and none of it leaves our server.

The enquiry form

When you send the form on the home page we process your business name, your city, your e-mail address, your phone number if you gave one, and your message. We use them only to reply to you. They are not stored in any database on this website; they are sent as one e-mail to the operator and live only in his mailbox, where he keeps them for as long as the enquiry is open and deletes them afterwards. The legal basis is our legitimate interest in answering someone who wrote to us.

The demo card's message box

Blue Fern Coffee is a demonstration. It is not a real business and there is no real owner. A message you send from the demo card is e-mailed to the operator so he can see that the demonstration works, and is not published, not stored in a database and not used for anything else. Do not send anything through it that you would not want read.

Guest messages, once you are a customer

When a guest writes to a business through the card in the application a customer signs in to, we process the message text and the optional contact (phone or e-mail). The contact is voluntary: the message sends without it, but the owner then has no way to reply.

The business the message belongs to decides why it is processed; we process it on the business's behalf under section 18 of the terms of service. The message is kept for 90 days from sending and then deleted automatically. The owner of that business sees it and nobody else; we do not use it for marketing, sell it, or link it to anything.

Reviews from the Google listing, once you are a customer

For the businesses we serve we read the public Google listing every day and store a reading: the rating, the review count, and the reviews Google shows publicly at that moment. Reviews are published on Google by their authors; we only read them from the business's public listing, because the business needs to know what happens on its own listing and cannot watch it by hand every day.

• The author's name and the review text are deleted 30 days after we first saw the review.
• What stays is a fingerprint (hash) of the author's name and the publication time, by which we recognise the review, plus the star count and the dates we first and last saw it. That is how we notice a review has disappeared without keeping its content.
• When our rules flag suspicious activity we assemble an evidence file for the owner that day. It quotes the reviews concerned as we saw them, belongs to the business, and does not change afterwards.

We obtain this data from the public listing, not from the author. A review's author has the rights listed below, including the right to object; write to us and the record is deleted.

Signing in to the application, once you are a customer

This section applies to the application a customer signs in to, not to this website. For sign-in we process an e-mail and a password stored as a hash, and for a seller also a name and the agreed commission. We keep them for the life of the agreement and delete them within 30 days after it ends. Sign-in relies on one technical cookie that the application cannot work without.

Invoicing

If you become a customer, an invoice carries your billing details. We keep invoices for as long as accounting law requires us to, independently of the agreement.

Who receives the data

We do not sell, rent or hand data to advertising networks, and we do not profile anyone. Besides the intended recipient (the operator, for an enquiry or a demo message; the owner of the business, for a guest message once you are a customer), only these processors, which run our infrastructure, reach it:

• the hosting provider that runs the server this website runs on;
• Amazon Web Services, sending e-mail through Amazon Simple Email Service.

This website loads no font, no analytics and no third-party script, and sets no cookie at all. We hand data to an authority only when the law obliges us to.

How we protect it

• The site runs only over encrypted connections.
• Passwords in the application, once you are a customer, are not stored; only a bcrypt hash is, from which the password cannot be recovered.
• Every form that writes something has to prove which page it came from; a request planted from another site is refused, and both the enquiry form and the demo message box carry a honeypot field and a per-address rate limit.
• Deletion is automatic where stated above: guest messages after 90 days, review authors and texts 30 days after they were caught, once you are a customer.

Automated decisions

We make no automated decisions and do no profiling with legal or similarly significant effects. The rules that flag suspicious activity decide nothing about anyone: they prepare a file a person reads, and the owner files any report themselves.

Your rights

You may ask for access to your data, its correction, deletion, restriction of processing, portability, and you may object to processing based on a legitimate interest. Write to hello@valtela.com; we answer a deletion request within thirty days. If it concerns a message you sent to a business, that business is responsible for it and we pass your request on. You may also complain to the Czech data protection authority (uoou.gov.cz).

Changes

We may change this page when what we do changes. The effective date of the current version is at the top.