Privacy policy

1. Who we are and what this document is

This site (svoista.com and related domains) is owned and operated by: Svoista OÜ, Estonian business registry code 17575762, registered address: Tornimäe tn 5, Kesklinna linnaosa, 10145 Tallinn, Estonia. Phone: +37259843335, +380503865028, +380504404200. E-mail: hello@svoista.com, and privacy@svoista.com for privacy matters.

We are preparing to launch the Svoista app. Right now the site does two things: it takes your e-mail address so we can tell you about the launch, and it takes enquiries from brands. This policy describes honestly what data we process while doing so.

2. What data we collect and why

2.1. Waiting list. If you leave your address, we store:

• the e-mail address;
• the language you chose;
• the consent record with its date, time and the version of this policy;
• a technical confirmation token, and whether and when confirmation happened;
• which form it came from (the home page or the brands page).

Purpose: to send a confirmation e-mail (double opt-in) and, once confirmed, to tell you about the app launch. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw consent at any time, see clause 6.

2.2. Technical security data. When a form is submitted we store a hash of the IP address rather than the address itself, plus a timestamp. Purpose: protection against abuse and spam. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR.

2.3. Server logs. The hosting provider keeps standard access logs for up to 30 days, for security and fault diagnosis, on the basis of legitimate interest.

2.4. What we do NOT do on this site: we set no analytics or advertising cookies and no trackers, we use no third-party pixels, we do not pass your data on for advertising, and we take no automated decisions about you with legal effects.

3. Who we share data with

The following process data on our behalf and on our instructions:

• Google Cloud, servers in the europe-central2 region (Warsaw, Poland, EU): the site, the waiting-list database, the logs;
• Resend, EU region: the confirmation e-mail and the launch announcement only.

Where any recipient is located outside the EEA, the transfer takes place on the basis of the EU standard contractual clauses or an adequacy decision.

4. How long we keep it

• Unconfirmed addresses: the link is valid for 72 hours, after which the record is deleted automatically within 7 days.
• Confirmed addresses: until the launch announcement plus a further 6 months, or until consent is withdrawn, whichever comes first.
• Consent records: 3 years from the withdrawal or deletion of the address, as evidence that the processing was lawful.
• Security logs: up to 30 days.

5. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to receive a copy in a machine-readable format, and to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

How to exercise them: write to privacy@svoista.com from the address the request concerns. We answer within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For our operator that is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI, www.aki.ee, info@aki.ee). You may equally turn to the supervisory authority where you live or work.

6. Withdrawing consent and unsubscribing

Every e-mail we send contains an unsubscribe link. Unsubscribing means withdrawing consent: the address is removed from the list within 7 days.

7. Changes to this policy

A new version is published on this page with its date. Where the changes are material, for example the app launch adding new purposes of processing, we will ask for consent again or notify you by e-mail before they take effect.

Version of 14 August 2026: Svoista OÜ became the operator of the site. The previous version was published in the name of a sole trader in Ukraine. The change of operator also changed the supervisory authority (clause 5) and the mailboxes for enquiries.