Privacy

Who we are

Vedetta is an early-stage product operated by Nikola Buchkov, Beli Brezi, Butolya str. 20, 1680 Sofia, Bulgaria — the data controller for the information described here. You can reach us at hello@vedetta.eu. We are small enough not to need a data protection officer, so that email reaches the person who wrote the code.

What we collect, and on what basis

Under the GDPR every use of your data needs a legal basis. Here is ours, purpose by purpose.

• Running the service.Your email address, your property's pin location, its name, and your alert settings — the minimum needed to watch a property. Basis: performance of our contract with you. Without a pin there is nothing to monitor, so this is not optional.
• Sending alerts and service email. The same data, used to work out what to send you and where. Basis: performance of our contract.
• Taking payment. Handled by Stripe. We never see or store your card details. Basis: performance of our contract, and a legal obligation for the payment records themselves.
• The founder list. If you join it, your email address, the country your second home is in, and your answer to our founder-pricing question. Basis: your consent, which you can withdraw at any time by replying to any message or emailing us.
• Keeping the service up and unabused. We count sign-in and sign-up attempts per email address and per IP address so that nobody can flood them. Basis: our legitimate interest in a service that stays available — an abused email channel gets us marked as spam, and alerts then fail silently.
• Understanding whether the site works. Cookieless, EU-hosted analytics — see the next section. Basis: our legitimate interest in knowing which pages do their job.
• Measuring our advertising. The Meta pixel, and only if you accept it. Basis: your consent.

We never sell your data, and we do not use it to make automated decisions about you.

Analytics and the Meta pixel

We use PostHog, hosted in the EU, to see how the site performs. Until you make a choice it runs cookieless: it stores nothing on your device and builds no profile of you, though it does see your IP address in the process, as any web request does.

Only if you accept in the cookie banner do we load the Meta pixel to measure our advertising, and only then does PostHog store anything on your device. If you decline, both stop — the pixel never loads and PostHog stops collecting altogether. The banner never appears inside your account; no marketing trackers run there at all.

You can change your mind at any time, and it is as easy as saying yes was: Cookie settings — or use the same link in the footer of any page.

Who else handles your data

Our processors: Supabase (EU) for the database and sign-in, Vercel for the website, Railway (EU) for the monitoring service, Resend for email, Stripe for payments, Sentry (EU) for error monitoring, PostHog (EU) for analytics, and — only if you accept marketing cookies — Meta for advertising measurement. Each handles your data on our instructions, under a data processing agreement.

Our error monitoring is deliberately blind: it is configured to receive no IP address, no cookies and no web addresses you visited — only the name of the code that failed.

Two services are contacted by your browser rather than by us, so they see your IP address directly. When you place your property pin, the map tiles come from OpenFreeMap, and the address search is answered by Photon, run by Komoot — so what you type into that search box reaches them. Neither receives your email address, your account, or anything you have saved.

Where your data lives

Your account, your properties and your alert history are stored in the European Union.

Some of the companies above are headquartered in the United States. Where your data reaches them outside the EU, that transfer is covered by the European Commission's standard contractual clauses, and by the EU–US Data Privacy Framework where the company is certified under it. You can ask us for the details for any one of them.

How long we keep it

• Your account, properties and alerts: until you delete your account. Deleting it from your dashboard removes them immediately — not on a schedule.
• The founder list: until you ask us to remove you, or 24 months after we last heard from you, whichever comes first.
• Abuse counters: deleted automatically after two days. They are the only place we hold an email address without an account behind it, which is exactly why they are swept.
• Payment records: kept by Stripe for as long as tax and accounting law requires them.

Your rights

Over the data we hold about you, you have the right to: get a copy of it; correct it if it is wrong; have it deleted; restrict what we do with it; object to processing we base on our legitimate interests; and receive it in a portable, machine-readable form. Where we rely on your consent, you can withdraw it at any time without affecting what we did before you did.

The fastest route to deletion is your dashboard, which removes everything immediately. For anything else, email hello@vedetta.eu and we will answer within one month. We will not charge you for it.

If you think we have got this wrong, you can complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov blvd., 1592 Sofia, Bulgaria, kzld@cpdp.bg, cpdp.bg. You may also complain to the authority in the EU country where you live. We would rather you told us first, but that is your choice, not a condition.

Changes to this policy

If we change it materially, we will email account holders before the change applies. The date at the top always tells you which version you are reading.