Privacy policy

1. Who is responsible for your data

The controller of the data described in this policy is RH COMMODITIES SRL, with its registered office at I.C. Brătianu 3, 077045 Chitila, Ilfov, România, registration code (CUI) 25651780, Trade Register number J2009001332239 (Berry, we). For any question about your data, or to exercise your rights, write to support@qr-iva.com. We have not appointed a data protection officer, because the law does not require one for our activity; the same address handles all privacy questions.

This policy applies to the Berry app and website. It explains our processing under Regulation (EU) 2016/679 (the GDPR) and Romanian Law No. 190/2018.

2. In short

• We do not sell your data, and we use no advertising or analytics tools that track you.
• Your email address is never shown to other users. Others see you as "Vecin #1234" ("Neighbour" in Romanian) or the name you choose.
• Saved places (Home, Work…) are rounded to about 100 m and only you can see them.
• Alerts, their photos and the point chosen on the map are public, because that is how they help find the animal.
• Photos are checked to make sure they contain no location metadata (EXIF).
• Data is stored in the European Union (Frankfurt).

3. Data we process

Your account

• Account data: email address, display name, chosen language, account creation date, the dates you accepted the terms and the privacy policy and gave consent to location and notifications.
• Passkeys: if you choose to sign in with a passkey, we keep the public key, the device name and when it was last used. Your fingerprint or face never leaves your device.
• Security data: sign-in sessions (device, browser, IP address), kept by our authentication provider, and technical and error logs.

Locations

• Saved places: up to 3 places (for example Home, Work, Parents), with each one's label and radius. Coordinates are automatically rounded to a grid of about 100 m before they are saved. We do not track your live location and never collect it in the background.
• The place of an alert, sighting or park: the point you choose on the map. It is public.
• Address searches: the text you search for is sent through our server to the geocoding service (Nominatim); your IP address is not passed on to it.

What you post and send

• Alerts (lost, found, danger): species, description, photos, place and time, chosen radius, the alert's status and any Boost.
• Sightings ("I saw it"): place, time, photo and note. The alert's owner sees the sighting, but your identity is not shown publicly.
• Chat messages: the content of conversations, dates and participants.
• Reviews, parks, votes ("Confirm", "It's gone") and reports made by you or about your content.

Your pets (Protection subscription)

• Pet profile: name, species, photos, description and the public link of the QR tag (the QR page does not show your identity).
• Health booklet: microchip number, vaccinations, deworming, vet visits and uploaded documents (photos or PDF). These are private and only you can see them, unless you choose to show the "Booklet" screen to someone. Information about your pet's health is not a special category of data under the GDPR, but a microchip number can be linked to you through pet registries, so we treat it as personal data and keep it private.

Notifications

• Your device's push subscription (the technical address of the push service and the encryption keys) and your preferences (for example whether you receive danger alerts).
• Delivery log: which notification was sent to which user and when, so we never send the same alert twice and send a Boost's repeat notifications only to those who have not opened the alert.

Payments

• When you buy a Boost or the Protection subscription, the payment is processed by Stripe. We receive your Stripe customer identifier, the product bought, the amount, the payment and subscription status, the billing period and the country used to calculate VAT. You enter your card details directly with Stripe; we never see or store them.

Other cases

• Waitlist: your email address and city or neighbourhood, if you signed up.
• Partner form: business name, category, city, contact person, email, phone and message.
• Correspondence with us: the messages you send us and our replies.

4. Why we use data, and our legal bases

• To provide Berry (account, sign-in, alerts, matching alerts with your places, chat, sightings, pet profiles, QR, health booklet, reminders, service emails): performance of our contract with you (Article 6(1)(b) GDPR).
• Saved places and push notifications: your consent (Article 6(1)(a) GDPR), asked for explicitly in the app. You can withdraw it at any time in Profile or in your browser settings; withdrawing location consent deletes your saved places.
• Payments, invoicing and accounting records: performance of the contract and our tax and accounting obligations (Article 6(1)(b) and (c) GDPR).
• Community safety (moderation, reports, limiting abuse and spam, fraud prevention, security logs): our legitimate interest in keeping the service safe (Article 6(1)(f) GDPR) and our obligations under Regulation (EU) 2022/2065, the Digital Services Act (Article 6(1)(c) GDPR).
• Waitlist: your consent.
• Partner form: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• Improving the service: aggregated statistics that identify no one (legitimate interest).
• Defending our rights in a dispute and answering lawful requests from authorities: legitimate interest and legal obligation.

We do not send you marketing messages without your consent. We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing. The automatic matching between an alert and your places (by distance) is used only to send notifications.

You need to give us your email address to create an account; without it we cannot provide the service. Location and notification consents are optional: without them you can still use Berry, but you will not receive alerts near your places.

5. What is public and what is not

Public (visible to anyone, including without an account, and indexable): active alerts, their photos and description, the point chosen on the map, the date, the author's display name where shown, parks, reviews (with the display name), guides and partners. A pet's QR page shows only information about the pet. Sightings added to an active alert (place, time, photo and note) are also public, without the identity of the person who added them. The point on the map is shown exactly where you place it, so for your safety choose a nearby landmark rather than your home address.

Private: your email address, saved places, messages (seen only by the participants), the health booklet, payment history, your push subscription and the identity of people who add sightings.

We do not read chat conversations, except when a conversation is reported to us (we then see the messages relevant to the report) or when the law requires it. Notifications about new messages do not contain the message text.

6. Who receives data

We use providers that process data on our behalf under data processing agreements:

• Supabase, Inc. – database, authentication, file storage and the functions that send notifications; data is hosted in the European Union (Frankfurt, Germany). Supabase, Inc. is a US company; its support staff may access the data only where needed, under the safeguards described in section 7.
• Vercel, Inc. – hosting of the app and website: the functions that process requests run in the European Union (Frankfurt, Germany), and the content delivery network caches only public pages and files at locations worldwide. Vercel keeps technical request logs (including IP addresses) for a short period.
• Stripe Payments Europe, Ltd. – payment and subscription processing and VAT calculation. For fraud prevention and its own legal obligations, Stripe also acts as an independent controller under its own privacy policy.
• Resend, Inc. – sending service emails, once this is enabled. Until then, sign-in codes are sent by Supabase's email service.
• Your browser's push services – Google (Firebase Cloud Messaging), Apple, Mozilla or Microsoft – deliver notifications to your device; they are operated by the maker of your browser, not on our instructions. Notification content is encrypted from us to your device, so these services cannot read it; they see only your device's technical address and the time of delivery.

We also use independent map services:

• OpenFreeMap provides the map images, with OpenStreetMap data. Your browser downloads the images directly from OpenFreeMap, which therefore sees your IP address and the map area displayed.
• Nominatim (OpenStreetMap Foundation, United Kingdom) turns searched addresses into coordinates. Requests go through our server, so Nominatim receives only the search text.

We may also disclose data to authorities when the law requires it or upon a lawful request, to our professional advisers (under confidentiality) and to a possible successor of the Berry business, with the same safeguards.

7. Transfers outside the European Economic Area

The database and files are stored in the EU. Some providers (for example Supabase for support access, Vercel, Resend, Stripe – which shares data with Stripe, Inc. in the United States – or the push services) may process some data outside the EEA, including in the United States. These transfers rely on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies, and the United Kingdom for Nominatim) or on the standard contractual clauses approved by the European Commission. You can ask us for a copy of the safeguards at support@qr-iva.com.

8. How long we keep data

• Account, profile and saved places: while the account exists. Saved places are also deleted when you withdraw location consent.
• Alerts and sightings (including expired or closed ones, which are no longer public): while the account exists, so you can see and reopen them. You can ask us at any time to delete a specific alert.
• Alert photos: together with the alert. Photos uploaded but never published with an alert are deleted by a weekly clean-up, at least 24 hours after the upload. Please note: because they are public, a photo may remain reachable through its direct link until the account is deleted.
• Messages: while the account exists. If a participant deletes their account, their messages remain visible to the other participant, without the author's identity ("Deleted user").
• Pet profiles and health booklet: while the account exists, including after the subscription ends (they are locked, not deleted, and come back if you subscribe again).
• Notification delivery log: 90 days.
• Push subscriptions: until you unsubscribe or the push service tells us the address is no longer valid.
• Abuse-limiting data (one-way hashed keys): 2 days.
• Security data: sign-in sessions until you sign out or they expire; technical and error logs for a short period set by our providers (usually a few days to a few weeks).
• Our provider's sign-in log (including the IP address): 90 days, then deleted automatically.
• Consent records for Boost and for the immediate start of Protection (when you asked for the immediate start) and withdrawal or cancellation requests: together with the payment records, as proof of your consent and request.
• Partner form and correspondence: as long as needed to handle your request; if no partnership follows, partner requests are deleted within 12 months of our last contact.
• Technical events from Stripe: 90 days after processing. Invoices and accounting records: for the period required by Romanian accounting law (Law No. 82/1991), currently up to 10 years.
• Waitlist: until 30 days after the launch invitation, unless you create an account, or until you ask us to delete it.
• Reports (including those sent through the public form: name, email and explanation), moderation decisions and the log of administrative actions: 24 months after the decision or the report, then deleted automatically; longer only if an authority or a pending complaint requires it. If you delete your account, we keep them without your name or email, under a one-way encrypted identifier (and, for blocked accounts, an encrypted fingerprint of the email address), to stop a blocked account from coming back and to answer complaints; the basis is our legitimate interest.
• Backups: deleted data disappears from the database provider's backups in their normal overwrite cycle.

9. Deleting your account

You can delete your account under Profile → Delete account or by writing to support@qr-iva.com. When you do:

1. 1we cancel any active subscription with Stripe, with no further payments;
2. 2we delete your alerts' photos and your pets' photos;
3. 3we delete your account, profile, saved places, alerts, sightings, pets and health booklets, push subscriptions and delivery logs;
4. 4we keep, without your name or email, only the moderation records (reports, blocks and decisions) under an encrypted identifier, for the period in section 8;
5. 5your messages remain in other people's conversations, but without your identity;
6. 6we confirm the deletion on screen in the app; an email confirmation will be added once our email service is available.

We keep only what we are legally required to keep (for example invoices) or what is needed to establish or defend a legal claim.

10. Your rights

Under the GDPR you have the right:

• to access your data and receive a copy of it;
• to have inaccurate data rectified;
• to have your data erased (the "right to be forgotten");
• to restrict processing;
• to data portability, in a structured, commonly used format;
• to object to processing based on our legitimate interest;
• to withdraw your consent at any time, without affecting earlier processing.

Many of these you can use directly in the app: edit or delete saved places, turn off notifications, withdraw location consent and delete your account. For the others, write to support@qr-iva.com from your account's email address. We may ask you to confirm your identity. We answer within one month; this can be extended by two more months for complex requests, in which case we will tell you.

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, postcode 010336, email anspdcp@dataprotection.ro, www.dataprotection.ro, or with the data protection authority of the EU country where you live or work.

11. Children

Berry is intended for people aged 16 or over. We do not knowingly collect data from children under that age. If you learn that a child under 16 has created an account, write to us and we will delete it.

12. How we protect data

Data is encrypted in transit (HTTPS) and at rest. In the database, each user can access only their own private data (row-level security rules). Saved places are rounded, photos are checked for location metadata, and push notifications are encrypted all the way to the device. Access by our team is limited to authorised people, and administrative actions are logged. No system is completely secure; if a personal data breach occurs that may affect you, we will inform you as the law requires.

13. Changes to this policy

We may update this policy. The date at the top shows the version in force. We tell you about important changes by email or in the app.