Controller and contact: Lukáš Voloch, Laborecká 1845/1, 066 01 Humenné, Slovak Republic; business ID 51196450; tax ID 1122639408; info@casvilo.com, +421 948 129 124.
Data and sources. We process account and language details, sign-in and security information, project and collaboration content, uploaded files and metadata, support communications and, on purchase, plan, payment and validity records. Uploaded content may contain people, addresses or location information. An invited person's email and shared content may come from an owner or authorised participant.
| Purpose | Legal basis |
|---|---|
| Account, storage, sync, collaboration, export and service support | Contract or requested pre-contractual steps; authorised collaboration may also involve legitimate interests regarding other participants' details |
| Payments, receipts and mandatory records | Contract and applicable legal obligations |
| Security, abuse prevention, incidents and legal claims | Legitimate interests in a secure service and protecting rights, limited to what is necessary |
| Optional marketing | Separate consent where this feature is offered |
Necessary details enable the account and selected functions; without them the corresponding service cannot be supplied. Marketing is optional. Operational and security messages are sent for their service purpose rather than as advertising.
Retention. Account and active-project data is retained during service until removed or its purpose ends. Premium expiry does not delete the account; excess-photo exports are protected for at least 90 days and automatic deletion is currently disabled. Confirmed account-deletion requests are processed within 30 days. Accounting records remain for the statutory period; dispute evidence remains until resolution and relevant time limits expire, with unnecessary identifiers removed. Logs and backups have restricted access and are retained only for necessary security, recovery or a legal reason, then removed under their retention cycle. Backups are not used to restore deleted accounts for ordinary use.
Device and rights. Cookies or similar storage support sign-in, preferences and offline data. This version uses no advertising-tracking SDKs and does not sell personal data. Remove local data through browser settings or by uninstalling; unsynchronised files may be lost. You may request access, correction, erasure, restriction and applicable portability, object to legitimate-interest processing and withdraw consent without affecting prior lawful processing. We normally respond within one month and explain any lawful extension. You may complain to a competent supervisory authority, particularly where you live, work or an infringement occurs; in Slovakia, the Office for Personal Data Protection, dataprotection.gov.sk.
Website visits, required data and decisions
When you visit, the host processes technical request data, including IP address, time, requested page and browser details, to deliver the page, diagnose problems and protect the service (legitimate interest, GDPR Article 6(1)(f)). The page cannot be delivered without technical data. Language is optional; its storage is explained on Cookies and storage. Account data is required to provide the contracted service (Article 6(1)(b)); legally required records rely on Article 6(1)(c). You choose optional fields and attachments according to the feature used.
We do not make automated decisions with legal or similarly significant effects or profile you for that purpose. We do not sell personal data. The website has no advertising or analytics tracking. The marketing website does not process payments or activate mobile notifications; features of the separate app are described below.
Recipients and transfers
The service uses Supabase (authentication, database and files; primary project region Frankfurt) and Websupport (hosting and operational email). Links below provide Supabase’s subprocessor list and DPA, including services outside the EEA. The Frankfurt region alone does not exclude support or subprocessor transfers. Supabase’s DPA includes standard contractual clauses for relevant transfers. Request information on specific recipients and a copy of relevant safeguards at info@casvilo.com.
Other people in content and business use
We may also receive your name, contact, photo or invitation from a project owner or authorised collaborator. We use these for the relevant collaboration and protection of legitimate interests; you may contact us or the project owner. If we process content on your behalf as a business, request a data processing agreement before uploading third-party personal data. This information page does not itself replace that agreement.
Business collaboration, messages and notifications
For Business we also process membership and roles, job assignments, working-time and material records, rates, quotes, reports and handover acceptance details. Access follows roles and sharing settings. Chat stores encrypted content and technical information about participants and delivery; message encryption does not mean all project data uses the same encryption. Recovering message access depends on available keys and the configured recovery method.
If you enable push, we process a device token or subscription endpoint, device type and delivery status. Delivery uses the relevant browser push provider or Apple APNs for the supported iOS version; web push may also use Google, Mozilla or Microsoft. The provider receives technical data needed for delivery. A message notification may include the sender’s name; it does not carry decrypted conversation text. You can change permission in your device or browser settings. The marketing website does not subscribe you to push. Transfers outside the EEA depend on the service and available safeguards; request details at info@casvilo.com.