Effective from 1 December 2026

1. Data controller

1. The controller of personal data is Dariusz Rys, 62-510 Konin, ul. Chopina 10/3, e-mail: maya@heymaya.eu. You can write to this address about any matter concerning personal data.

2. In short

• Apiary data are stored on the phone. They reach the server only when you use the cloud backup or team work.
• Your voice never leaves the phone. Speech recognition runs on the device, without the internet. Recordings of dictated notes are stored only on the phone and deleted after 7 days.
• The app contains no ads and no analytics tools, and does not track you.
• Data are not sold or used for profiling.

3. What data, for what purpose and on what legal basis

1. Account and activation – e-mail address, activation code, device name and type (e.g. the phone name given by its owner), app version, language, activation date, device token. Purpose: creating the Account, sending the activation code, recognising the device, notifying about new app versions. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
2. Cloud backup – data entered into the app: apiaries (with the location entered by the user), hives, inspections, frames, queens, feeding, treatments, harvests, notes, purchases, sales, photos, custom hive types. Purpose: storing the backup and restoring it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
3. Team work – e-mail addresses of the Database owner and Workers, invitation status, assigned apiaries and permissions, data entered by a Worker in the owner’s database. We send the invited person an invitation e-mail containing the owner’s e-mail address, and send the owner a notice that the invitation was accepted. Purpose: providing team work. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
4. Subscription – the Account identifier in the payment system (in the form “hb_” plus the Account number), Subscription status, its end date, the Store and product name, information about cancellation or a payment problem. We do not receive card details or any other payment data – they are handled by the Store. Purpose: granting access to paid features, handling complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, for accounting, a legal obligation (Art. 6(1)(c) GDPR).
5. Security – IP address and the number of failed attempts to enter a code or to send a code e-mail in the last hour; server logs kept by the hosting provider. Purpose: protection against abuse and intrusion. Legal basis: the controller’s legitimate interest (Art. 6(1)(f) GDPR).
6. Contact – data from e-mail correspondence. Purpose: answering questions and complaints. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
7. Service messages – Account e-mail address, language. Purpose: informing about changes to the Terms and this policy, to the price and scope of the services, about the end of the free period and about Account security. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
8. News about the app (newsletter) – Account e-mail address, language, date and method of giving consent. Purpose: sending information about new features and offers. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of messages sent before it.

Providing an e-mail address is voluntary, but the app cannot be activated without it. Other data are provided at your discretion – the app works without the cloud backup and without team work.

4. Data stored only on the phone

Without sending anything to the server, the app stores: recordings of dictated notes (7 days), settings, and all apiary data until a cloud backup is made. The app asks only for the permissions it needs:

• microphone – voice control and dictating notes (speech recognised on the device);
• camera and photos – attaching photos to hives;
• NFC – reading NFC tags on hives;
• notifications – reminders set by the user (created on the phone, without a push notification server).

The app does not read the phone’s location (GPS). The user enters the apiary location or picks it on the map.

5. Recipients of data

1. Hosting provider of the server and e-mail: cyber_Folks S.A – stores Account data and cloud backups and sends e-mails, under a data processing agreement.
2. RevenueCat, Inc. (USA) – Subscription handling: Account identifier, purchase history from the Store, device identifiers assigned by the Store, IP address. The transfer to the USA is based on the standard contractual clauses approved by the European Commission.
3. Apple and Google – as Stores, they process data related to downloading the app and payments as independent controllers, under their own privacy policies.
4. OpenWeather Ltd (United Kingdom) – weather forecast: we send the town name or the coordinates of the apiary and – as with any connection – the IP address. The United Kingdom is covered by a European Commission adequacy decision.
5. OpenStreetMap Foundation (United Kingdom) – map tiles when the apiary map is displayed: IP address and the map area viewed.
6. Alpha Cephei (alphacephei.com) – one-time download of the speech recognition model: IP address. No voice is sent there.
7. In team work, a Worker’s data (e-mail address, entries made) are visible to the Database owner, and the owner’s database is visible to the Worker within the permissions granted.
8. Public authorities – only where required by law.

6. How long we keep data

• Account data – until the Account is deleted.
• Consent to news about the app – until it is withdrawn or the Account is deleted; proof of giving and withdrawing consent – until the limitation period for possible claims expires.
• Cloud backup – until the user deletes it in the app (“Deleting cloud backup” in Settings → Data management) or until the Account is deleted.
• Team work invitations – 7 days if not accepted; the owner–Worker link – until either party removes it.
• Device token – expires after 365 days of non-use.
• Subscription status – until the Account is deleted; data needed for tax purposes – for the period required by law (usually 5 years from the end of the tax year).
• Attempt counters with IP addresses – overwritten every hour; server logs – under the hosting provider’s rules.
• Correspondence – until the matter is closed and then until any claims become time-barred.

7. Your rights

1. You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. Just write to

maya@heymaya.eu

from the Account e-mail address. We reply within one month.

Deleting the Account and data:

1. you can delete the cloud backup yourself in the app; the whole Account can be deleted with the “Delete account” button in the app (About app → Delete account) or on request sent to maya@heymaya.eu. The server then permanently deletes the Account, the cloud backup with photos (including earlier archived copies), apiary locations, hive types, team work links, device tokens and the stored Subscription status, and the customer data in RevenueCat. The apiary data on the phone remain. Deleting the Account does not cancel the Subscription in the Store – it must be cancelled in the Store settings.

You have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in your country of residence.

8. Children

The app is not directed at children under 16, and we do not knowingly collect their data.

9. Security

Connections to the server are encrypted (HTTPS). Access to data on the server requires a device token or an activation code, and the number of failed attempts is limited. A Worker has access only to the apiaries and parts of data granted by the owner.

10. Changes to this policy

We will inform you of significant changes to this policy in the app or by e-mail. The current version is always available on heymaya.eu.