How we handle your data

Who the controller is

The controller of your data is the operator of the Pullora project. You can write to us any time at support@pullora.eu. We reply in Czech or English.

Pullora does not run a marketplace or any sales yet. When we launch it, we will extend this policy with the processing that comes with it and let you know before that happens.

What we store about you

When you join the waitlist, we store three things:

• the email address you entered,
• the role you picked (collector, seller, investor),
• the time you signed up.

Nothing else. No name, no postal address, no tracking of what you do on the website.

We also store a fingerprint of your IP address, not the address itself. It only stops the form from being spammed with a thousand signups from one place. The fingerprint is one-way, the IP cannot be worked out from it, and it becomes meaningless after a few minutes.

Why we need it

So we can send you two emails: a confirmation right after you sign up and an invite when Pullora launches.

The legal basis is your request: by signing up you asked for both messages yourself. We never pass your address on or sell it.

News by email

We send news (an occasional email about what is new in Pullora) only to app users who agree to it when they create an account or turn it on later in the app. Joining the waitlist does not sign you up for news. Without your consent you get no news and no ads.

The legal basis is your consent. We record when you gave it. You can withdraw it any time with one click on the Unsubscribe from news link in every such email, or by writing to support. After you unsubscribe we send you no more news.

Who receives the data

Three providers work for us and process data only on our instructions:

• Supabase: the database that holds the waitlist, and account sign-in,
• Resend: the service that delivers our emails,
• Cloudflare: bot protection for sign-in (Turnstile).

We pass your address to no one else.

How long we keep it

At most 12 months after Pullora launches, then we delete the address. If you ask us to delete it sooner, we do it straight away.

How to unsubscribe

Just reply to any of our emails or write to support@pullora.eu. We delete your address and won't contact you again. We ask for nothing in return and don't redirect you anywhere.

Account security

When you sign in to your Pullora account, in the app or on auth.pullora.eu, we record with the sign-in:

• the device: whether it was the app, or a browser and operating system, without version numbers,
• the network: a shortened IP address, for IPv4 only the first two numbers (for example 185.12.x.x), for IPv6 the first three groups,
• the time of sign-in.

We do not look up a city or country from the IP address and do not send it to anyone for that.

It serves one purpose only: when a new device signs in to your account, we email you so you can act if it wasn't you. We also email you after every password change. Sign-in alerts arrive at most once every 6 hours.

If you have a code sent to your email at sign-in instead of using an authenticator code, we store only a fingerprint of the code (not the code itself), the sign-in it belongs to and the number of attempts. The code is valid for 10 minutes and we delete old code records as we go, at the latest when the sign-in they belong to ends.

The legal basis is our legitimate interest in protecting your account. We delete the sign-in history after 180 days. We remember the devices and networks you sign in from while you use them and delete them 180 days after the last sign-in from them.

Bot protection

Sign-in, registration and password reset are protected by Cloudflare Turnstile. It checks in the background that a person is filling in the form and only rarely asks you to click. For this, Cloudflare processes your IP address and technical details about your browser and device. We only receive the result, store nothing from it and do not use it for tracking.

The legal basis is our legitimate interest in protecting accounts against automated attacks. Cloudflare is based in the USA and transfers data under the EU-U.S. Data Privacy Framework.

Your rights

You can ask for access to your data, its correction, deletion, restriction of processing or a copy in a machine-readable format. Write to support@pullora.eu.

If you disagree with how we handle your data, you can contact the Czech data protection authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, Prague 7, Czechia.

Visitor statistics

We count anonymous page views with Vercel Web Analytics: the page address without anything after the question mark, the type of device and the country. It stores no cookies, saves nothing in your browser, builds no profile of you and does not track you across websites.

That is why the measurement runs right away without asking for consent: the cookie rules are about storing and reading data on your device, and that does not happen here. You can turn it off any time: in the bar that pops up on your first visit, or later with the Cookie settings link in the footer. We save your choice so the website doesn't keep asking.

If your browser sends the Global Privacy Control signal, we treat it as turning the measurement off.

What the website stores in your browser

Only what is necessary: your sign-in, so you don't have to enter your password after every click, your choice about measurement and the website language when you choose Czech or open the English version. All of it applies to every Pullora address (pullora.eu, auth.pullora.eu and app.pullora.eu), so you don't have to sign in or decide on each one separately.

Until you choose a language, the website guesses it from your browser language and, if needed, from the country you connect from (our hosting provider Vercel tells the country from the IP address). This is used only to pick the language and we store none of it.

When you join the waitlist, your browser remembers that you are on it, together with a shortened email (such as j•••@gmail.com), so the form shows the confirmation next time. The full address is not stored in the browser. You can remove it with the "Use another email" link by the form or by clearing the website data in your browser.

Changes

When the scope of the service changes, mainly with the launch of the marketplace, we will update this policy and publish the new version here. For significant changes we will let you know at the email we have on the waitlist.