← Enuva

Privacy Notice

Last updated: 2 June 2026

This notice explains how OverBox s.r.o. (“we”, “us”) processes personal data collected through the Enuva early-access waitlist at enuva.app. It applies to EU/EEA residents and complies with the General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 on Personal Data Protection.

1. Controller

OverBox s.r.o.
Slovakia
Contact: hello@enuva.app

2. What data we collect and why

When you join the waitlist we collect:

• Email address — to contact you when your early-access spot opens. This is the primary purpose.
• Hear-from answer (optional) — the option you select on the waitlist form, if you choose to answer it, so we can understand where people find Enuva.
• Technical attribution source (optional) — when available, we may store campaign/referrer source information (for example UTM source/medium or referring domain) to understand where our audience comes from.
• Consent timestamp and version — to demonstrate that you gave valid informed consent (GDPR Art. 7(1)).

Lawful basis: explicit consent (GDPR Art. 6(1)(a)). You give consent by ticking the checkbox on the form. Your email is used only for Enuva early access contact. If you provide a hear-from answer, we use it only for audience attribution — not for newsletters, advertising, or third-party offers.

3. Analytics

We use PostHog (EU region) to count privacy-preserving usage events (e.g. page views, referral/UTM source, “form submitted”). PostHog is configured with no cookies, no localStorage, and project-side IP discard. Full URL and full referrer values are stripped before events are sent. A fresh random identifier is generated on each page load and discarded when you leave — it cannot be used to identify or track you across sessions. Session recording is disabled. We do not send your email address, name, or full browsing URL to PostHog.

4. Processors and international transfers

We use the following sub-processors, each with a signed Data Processing Agreement:

• Cloudflare, Inc. (USA) — web hosting, CDN, and Turnstile CAPTCHA. Data processed under Cloudflare’s Standard Contractual Clauses (SCCs). Turnstile processes limited technical signals to detect bots and abuse. We do not use Turnstile for advertising or behavioural profiling.
• Supabase, Inc. — email database. We use the EU (Frankfurt) region. Data stays in the EU.
• PostHog, Inc. — anonymous usage analytics. We use the EU (Frankfurt) region at eu.i.posthog.com. We do not send waitlist email addresses to PostHog (see section 3).

No data is sold or shared with advertisers.

5. Retention

We keep your email until whichever of the following happens first:

• You withdraw your consent (see section 7).
• Enuva launches publicly and we migrate active waitlist contacts to the production email service with a fresh consent flow.
• 18 months have passed since you joined and Enuva has not launched.

6. Your rights

Under GDPR Arts. 15–22 you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure (“right to be forgotten”) — ask us to delete your data.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing.

We will respond within 30 days (Art. 12(3)).

7. Withdrawing consent

Email hello@enuva.app with the subject “Withdraw early access consent”. We will delete your record within 30 days.

8. No automated decision-making

We do not use your data for automated decision-making or profiling as defined in GDPR Art. 22.

9. Right to complain

If you believe we have handled your data unlawfully you can lodge a complaint with the Slovak supervisory authority:

Úrad na ochranu osobných údajov Slovenskej republiky
Hraničná 12, 820 07 Bratislava
dataprotection.gov.sk

10. Changes to this notice

If we make material changes we will update the “Last updated” date above and, where required, seek fresh consent. The current version number is stored alongside every waitlist record.