← Enuva

Privacy Notice

Last updated: 11 May 2026

This notice explains how OverBox s.r.o. (“we”, “us”) processes personal data collected through the Enuva early-access waitlist at enuva.app. It applies to EU/EEA residents and complies with the General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 on Personal Data Protection.

1. Controller

OverBox s.r.o.
Slovakia
Contact: hello@enuva.app

2. What data we collect and why

When you join the waitlist we collect:

• Email address — to contact you when your early-access spot opens. This is the primary purpose.
• “How did you hear about us” (optional) — to understand where our audience comes from.
• Consent timestamp and version — to demonstrate that you gave valid informed consent (GDPR Art. 7(1)).

Lawful basis: explicit consent (GDPR Art. 6(1)(a)). You give consent by ticking the checkbox on the form. Your email is used only to contact you about Enuva early access — not for newsletters, advertising, or third-party offers.

3. Analytics

We use PostHog (EU region) to count anonymous usage events (e.g. “early-access form opened”, “form submitted”). PostHog is configured with no cookies, no localStorage, and no IP collection. A fresh random identifier is generated on each page load and discarded when you leave — it cannot be used to identify or track you across sessions. Session recording and automatic page-view capture are disabled. Because no personal data is processed, this activity falls outside the scope of GDPR (Recital 26).

4. Processors and international transfers

We use the following sub-processors, each with a signed Data Processing Agreement:

• Cloudflare, Inc. (USA) — web hosting, CDN, and Turnstile CAPTCHA. Data processed under Cloudflare’s Standard Contractual Clauses (SCCs). Turnstile does not set cookies or track users.
• Supabase, Inc. — email database. We use the EU (Frankfurt) region. Data stays in the EU.
• PostHog, Inc. — anonymous usage analytics. We use the EU (Frankfurt) region at eu.i.posthog.com. No personal data is sent to PostHog (see section 3).

No data is sold or shared with advertisers.

5. Retention

We keep your email until whichever of the following happens first:

• You withdraw your consent (see section 7).
• Enuva launches publicly and we migrate active waitlist contacts to the production email service with a fresh consent flow.
• 18 months have passed since you joined and Enuva has not launched.

6. Your rights

Under GDPR Arts. 15–22 you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure (“right to be forgotten”) — ask us to delete your data.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing.

We will respond within 30 days (Art. 12(3)).

7. Withdrawing consent

Email hello@enuva.app with the subject “Withdraw early access consent”. We will delete your record within 30 days.

8. No automated decision-making

We do not use your data for automated decision-making or profiling as defined in GDPR Art. 22.

9. Right to complain

If you believe we have handled your data unlawfully you can lodge a complaint with the Slovak supervisory authority:

Úrad na ochranu osobných údajov Slovenskej republiky
Hraničná 12, 820 07 Bratislava
dataprotection.gov.sk

10. Changes to this notice

If we make material changes we will update the “Last updated” date above and, where required, seek fresh consent. The current version number is stored alongside every waitlist record.