Privacy Policy | Juvelaro

1. Controller

The controller of personal data is Justinas Cikanavičius, sole trader certificate No. 779673, address: Druskininkai, Lietuva, email: info@juvelaro.com.

2. Data we collect

Account data: email or username and password. The password is stored only in encrypted form – nobody, including the Provider, can see it.
Registration and billing data: company name or full name, company code or sole trader certificate / business licence number, VAT code, contact person, billing email, phone, address and country.
Login data: a login session identifier and the time of last activity, so that an account is used on one device at a time. When registering with a username, a one-way (hashed) digest of the IP address is stored – it is used only to limit the number of registrations and prevent abuse.
Activity log: who did important actions in the system and when (e.g. changed a price, issued an invoice).
Suggestions: ideas and bug reports you send.
Payment data: payments are handled by Stripe. We do not see or store card details – we only receive the payment status and Stripe customer and subscription identifiers.

3. Your customers’ and staff data

Companies enter their business data in the system: products, sales, buyers’ names and contacts, staff details, repair photos and, where the law requires it (e.g. high-value sales or precious metal purchases), identity document details.

Your company is the controller of this data and the Provider is the processor. The Provider processes it only to provide the Service and for no other purpose.

4. Why we process data

To provide the Service and perform our contract with you.
To meet legal obligations (e.g. accounting).
On the basis of legitimate interest, to keep the system secure and prevent misuse.

5. Where data is stored

Supabase – database, logins and files. Data is stored in the European Union (Ireland).
Vercel – website hosting. It serves the website pages; your business data is not stored there.
Stripe – payments (once payments are switched on).

Where data is transferred outside the European Economic Area (e.g. to Vercel or Stripe group companies in the USA), this is done under the Standard Contractual Clauses approved by the European Commission. We do not sell data or share it for advertising.

6. How long we keep data

For as long as the account is active.
Data of a suspended account is not deleted. We delete it only at your request or after telling you by email in advance.
After an account is closed, data is deleted within 30 days.
Invoices issued by the Provider and other accounting records are kept for 10 years, as required by the Lithuanian Law on Accounting.

7. Cookies and browser storage

The website does not use cookies, analytics or advertising trackers. Your browser stores only necessary settings: the login session, chosen language and company, menu layout, label size and scan sound. You can delete them at any time in your browser settings.

8. Your rights

Access your data and get a copy.
Have inaccurate data corrected.
Have data deleted or its processing restricted.
Object to processing based on legitimate interest.
Receive your data in a structured format and move it to another provider.

To use these rights, write to info@juvelaro.com. We reply within one month. If you believe your data is processed unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

9. Security

The connection to the website is encrypted (HTTPS), passwords are stored only in encrypted form, and access to data is limited by company and staff permissions. Important actions are recorded in the activity log.

10. Changes

We tell you about material changes to this policy by email and in the system. The current version is always published on this page.