← Enuva

Privacy Notice

Last updated: 31 August 2026

This notice explains how OverBox s.r.o. (“we”, “us”) processes personal data collected through the Enuva early-access waitlist at enuva.app and through the Enuva iOS app. Where the two differ, each section says so. It applies to everyone who uses them. We are based in Slovakia and follow the General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 on Personal Data Protection; the rights in section 6 are the ones the GDPR gives EU/EEA residents, and we apply them to everyone.

1. Controller

OverBox s.r.o.
Slovakia
Company ID (IČO): 53938461
VAT ID (IČ DPH): SK2121532721
Contact: hello@enuva.app

2. What data we collect and why

When you join the waitlist we collect:

• Email address — to confirm your signup and contact you when your early-access spot opens. This is the primary purpose.
• Hear-from answer (optional) — the option you select on the waitlist form, if you choose to answer it, so we can understand where people find Enuva.
• Where the visit came from (optional) — campaign or referrer information such as UTM source and medium, when it is available. This is not stored on your waitlist record; it goes to our analytics as part of the signup event described in section 3.
• Consent timestamp and version — to demonstrate that you gave valid informed consent (GDPR Art. 7(1)).

Lawful basis: consent (GDPR Art. 6(1)(a)). You give consent by ticking the checkbox on the form. Your email is used only for Enuva early access contact. If you provide a hear-from answer, we use it only for audience attribution — not for newsletters, advertising, or third-party offers.

When you use the Enuva app we collect:

• An account — created for you automatically when you first open the app. It holds no name or email, but it is pseudonymous, not anonymous: it ties together your settings, your feedback and your usage, so it still counts as personal data. If you choose Sign in with Apple, we also receive the email address Apple gives us (which may be Apple’s private relay address) and the name you approve, so your account works across devices and we can recognise you as an early-access participant.
• Your settings — country, language and the sources you follow, because there is nothing to generate without them. Your time zone is read from the phone so briefings arrive at a sensible hour, and updated when it changes.
• What you type when adding a source — if you search for a publication by name, we look it up in public reference databases run by the Wikimedia Foundation, which never sees your IP address. We record that an attempt happened, not what you typed.
• Your feedback — the “more like this” and “less like this” ratings you give on briefings and segments, and what topics they imply, to steer what you get next. There is no free-text field.
• A device identifier — a random identifier held on your device and sent with each request, so we can apply per-device limits. It is not an advertising identifier, and it goes no further than the providers in section 4.
• Push token — the address iOS gives us for your device, stored with a flag recording whether you allowed alerts. It is registered when the app starts, so we hold one even if you refuse; nothing is ever sent to it unless you allowed alerts.
• Usage and cost records — counts, durations and costs of the AI and speech requests your briefings need, to keep the service affordable. These contain no article or script text.
• Fault reports — sent when the app crashes or a briefing fails, with user and device identifiers stripped before they leave your phone. Our servers send their own fault reports to the same provider.

Lawful basis, by purpose: your account, your settings and the sources you follow are processed to deliver the service you asked for, which is our agreement with you under Art. 6(1)(b) — without them there is nothing to generate. Your feedback is optional: skipping it does not stop Enuva working, it only leaves your briefings less tailored to you, and we rely on the same basis for it because tailoring is what you signed up for. Push notifications are optional: sending you one rests on your consent (Art. 6(1)(a)) — the iOS permission prompt is where you give it, and you can withdraw it in iOS Settings. Holding the token itself, including the flag that records a refusal, rests on our legitimate interest (Art. 6(1)(f)) in knowing which devices to leave alone. The device identifier, the usage and cost records and the fault reports rest on our legitimate interest (Art. 6(1)(f)) in keeping the service working, affordable and debuggable; refusing them is not possible while using the app, which is why we keep them minimal and free of content.

When your briefing is built, the publishers you follow see your device’s IP address and browser details, as they would if you visited them yourself. They are not our processors, and we tell them nothing about you. Article text and the summaries made from it pass through our AI provider, and the briefing you keep lives on your device rather than on our servers. Spoken audio is not switched on yet; when it is, the text to be spoken will go to our speech provider, and the audio will be stored briefly before it reaches you.

3. Analytics

We use PostHog (EU region) to count privacy-preserving usage events (e.g. a custom landing_page_viewed event, referral/UTM source, “form submitted” and “form completed”). PostHog is configured with no cookies, no localStorage, and project-side IP discard. Automatic pageview capture is disabled. We use site and environment labels to keep production reports separate from development and preview visits. Full URL and full referrer values are stripped before events are sent. In this cookieless mode PostHog does not store anything in your browser; instead its servers derive an identifier by hashing a salt that rotates daily together with technical signals of the request. Visits from the same browser can therefore be counted together within one day, and the link breaks when the salt rotates. Session recording is disabled. We do not send your email address, your name, or the full URL of the page you are on. We do send the path, the hear-from answer if you gave one, and where the visit came from.

Lawful basis: our legitimate interest (GDPR Art. 6(1)(f)) in knowing whether the site works and where our audience comes from. We rely on it because the measurement is cookieless, its identifier lasts a day at most, and it cannot be tied back to you. You can object to it (Art. 21). Because the measurement holds nothing that identifies you, we cannot exclude one browser on request — blocking eu.i.posthog.com, or using a browser or extension that blocks analytics, stops the measurement your browser sends. One event is sent from our server rather than your browser: when a new waitlist record is created we record that it happened, with the answer you gave and where the visit came from, and blocking cannot prevent that one. This event has its own random identifier and is not linked to your browser's identifier. Browser form-completion counts also include repeat submissions; the separate server count includes only new waitlist records.

The app has no analytics. It contains no PostHog and no other analytics SDK. Everything it sends is listed in section 2, and none of it exists to study how you behave; the fault reports carry no identifier that could attribute them to you. The app does not track you across other companies’ apps or websites and asks for no tracking permission.

4. Processors and international transfers

We use the following sub-processors for the website:

• Cloudflare, Inc. (USA) — web hosting, CDN, and Turnstile CAPTCHA. Data processed under Cloudflare’s Standard Contractual Clauses (SCCs). Turnstile processes limited technical signals to detect bots and abuse. We do not use Turnstile for advertising or behavioural profiling.
• Supabase, Inc. — email database. We use the EU (Ireland) region, so the database itself is in the EU. Supabase may still involve support or sub-processors elsewhere under its data processing terms, so we do not claim that every operation happens inside the EU.
• PostHog, Inc. — usage analytics for the website only, with no identifier that persists past the day. We use the EU (Frankfurt) region at eu.i.posthog.com. We do not send waitlist email addresses to PostHog (see section 3).
• Plus Five Five, Inc. (Resend) (USA) — delivery of the transactional email confirming a new waitlist signup. Resend receives the recipient address and email content and processes them primarily in the USA. The transfer is covered by Resend’s Data Processing Addendum, which incorporates the EU Standard Contractual Clauses. We do not add waitlist addresses to Resend marketing contacts and do not request open or click tracking for this message.

The app additionally uses:

• Supabase, Inc. — accounts, settings, feedback and usage records. The same EU (Ireland) project as the waitlist above.
• Cloudflare, Inc. (USA) — Turnstile bot and abuse prevention when a guest account is created, plus generation of your audio and its short-lived private storage, under SCCs, once spoken audio is switched on. Turnstile receives the request IP address, browser and device properties, challenge outcome, and timing and abuse signals. We use these signals only to protect account creation, not for advertising or behavioural profiling, and we do not set how long Cloudflare keeps them. Audio is stored in a European location, which Cloudflare treats as a preference rather than a guarantee, so we do not claim EU-only storage for audio.
• OpenAI (USA) — turns article text into the text of your briefing, under Standard Contractual Clauses. We ask it not to store requests; it may still keep their content for a limited period under its own terms, currently up to 30 days, to detect abuse. It does not use API content to train its models.
• ElevenLabs (USA) — turns scripts into speech, under Standard Contractual Clauses. We ask it to keep neither the text nor the audio, and speech for your own briefings stays switched off until we have confirmed it retains nothing.
• Functional Software, Inc. (Sentry) (USA) — fault reports, under Standard Contractual Clauses, with user and device identifiers removed before sending.

Apple delivers the notifications you turn on and handles Sign in with Apple. For those, Apple decides on its own account how it processes the data, so it acts as an independent controller rather than as our processor; Apple’s own privacy policy governs it.

Each provider in the two lists above processes data for us under its own data processing terms, which form the Art. 28 arrangement between us. Ask us at hello@enuva.app for the position on any one of them, or for a copy of a transfer safeguard.

One image in the homepage footer is loaded from ElevenLabs’ content network, so opening the page tells them your IP address and browser, as any image loaded from another site would. We are moving it onto our own domain.

No data is sold or shared with advertisers.

5. Retention

We keep your email until whichever of the following happens first:

• You withdraw your consent (see section 7).
• Enuva launches publicly and we migrate active waitlist contacts to the production email service with a fresh consent flow.
• 18 months have passed since you joined and Enuva has not launched.

In the app:

• Your account and its settings — until you delete it. A guest account with no activity for 90 days is deleted for you.
• Briefings on your phone — 30 days, apart from the one you are playing. Article text is not kept on your phone at all.
• Article text on our servers — 48 hours. Audio in transport storage, once spoken audio is switched on — 24 hours. What our AI and speech providers keep is in section 4.
• Push token and device identifier — as long as the account; the identifier on your phone stays until you erase the device.
• Fault reports — as long as our error-reporting provider keeps them; ask us for the current setting.
• Usage and cost records — these outlast the account, so the accounting stays whole. They hold no article or script text, but still carry the account’s identifier.

6. Your rights

Under GDPR Arts. 15–22 you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure (“right to be forgotten”) — ask us to delete your data.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing.

These rights apply as the GDPR grants them, which in some cases attaches conditions — erasure, for example, does not reach records we must keep. We will respond within one month (Art. 12(3)), and will tell you if a request is complex enough to need the extension that article allows.

You have the right to object. Where we rely on our legitimate interest — the website measurement in section 3, and the device identifier, usage records and fault reports in section 2 — you can object at any time under Art. 21, on grounds relating to your situation. Email hello@enuva.app and we will stop unless we can show compelling grounds that override yours.

In the app, ask us. Self-service account deletion is not built yet. Email hello@enuva.app and we will delete your account and its data by hand within one month, apart from the usage and cost records described in section 5. The same address gets you a copy of your data.

The app’s “Delete account & data” button does less than its name suggests, and we would rather say so than let you find out. If you signed in with Apple it does nothing at all and tells you so. If you are a guest it signs you out and starts a fresh account — the old one becomes unreachable, but its briefings stay in the app’s storage on this phone, and its rows on our side are removed no sooner than 90 days after your last use. Deleting the app removes everything it stored, except a small random identifier we use for per-device limits, which stays in the system keychain.

7. Withdrawing consent

This section is about the waitlist. For the app, see section 6.

Email hello@enuva.app with the subject “Withdraw early access consent”. We will delete your record within one month.

8. Personalization and automated decisions

The app does profile you, in the GDPR’s sense: it works out which topics you are interested in from the sources you pick and the feedback you give, and uses that to choose what goes into your briefing. That is the product doing what you asked it to.

What it does not do is make a decision about you with legal or similarly significant effects, so the prohibition in GDPR Art. 22 does not apply. We do not profile you for advertising, and we do not sell or share your data. What we store about your interests is a set of weights over subjects and over things in the news — an organisation, a place, a person — which your ratings move up or down. It holds no opinions about you and nothing you typed, and we use it only to order your next briefing. Rating something down changes what you get next; it does not undo what was already generated.

9. Right to complain

If you believe we have handled your data unlawfully you can lodge a complaint with the Slovak supervisory authority:

Úrad na ochranu osobných údajov Slovenskej republiky
Hraničná 12, 820 07 Bratislava
dataprotection.gov.sk

10. Changes to this notice

If we make material changes we will update the “Last updated” date above and, where required, seek fresh consent. The current version number is stored alongside every waitlist record.