HoneyBeediary.com
HR
Privacy policy
This policy explains how the HoneyBeediary.com · Honey Bee Diary app (web and mobile) processes personal data, in line with the EU General Data Protection Regulation 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR (Official Gazette 42/18).
1. Controller
Nove vibracije d.o.o. (New vibrations Ltd.), Solinska 49, 21000 Split, Croatia · OIB (tax no.) 89017150505 · registration no. 060259803 (Commercial Court in Split) · info@novevibracije.hr · +385 21 314 001. No data protection officer has been appointed; please send privacy questions to the email address above.
2. What data we process
- Account data: email address, full name, phone (optional), app language and password – stored only as a one-way cryptographic hash, never as readable text.
- Farm data (optional): farm name and, for Croatian users, tax and registry numbers for official forms – only if you enter them.
- Beekeeping data you enter: apiaries (name, location description, GPS coordinates, land parcel), hives, inspections, treatments, queens, moves, harvests, finances, stock, tasks and disease reports.
- Technical data: the list of devices you are signed in on (browser or device type, sign-in and last-use time), IP address and time in records of security events (e.g. password change, failed sign-ins) and standard server logs.
Voice notes are never sent to the server. A recording stays only on the device it was made on; the server only learns that a note exists (duration and size). The app uses your device location only when you ask for it (e.g. “Record current location” for an apiary) and the camera only to scan QR codes. We use no analytics, advertising or tracking.
3. Purposes and legal bases
- Providing the service – the diary, web and phone sync, reports and exports: performance of a contract (Art. 6(1)(b) GDPR).
- Account emails – email confirmation, password reset link, password change notice: performance of a contract. We do not send promotional emails without your consent.
- Security – sign-in attempt limits, security event records, backups: legitimate interest (Art. 6(1)(f)).
- Billing after the free period – invoices and accounting records: legal obligation (Art. 6(1)(c)).
4. Who else has access
We do not sell your data or share it with third parties for their own purposes. Only processors needed to run the service have access:
- Hosting provider (server, database and email delivery): EuroVPS (eurovps.com), server in the Netherlands – within the European Union.
- OpenStreetMap Foundation (United Kingdom) – the apiary map: when the map is shown, your browser loads map images from their servers, so they see your IP address. The European Commission has adopted an adequacy decision for the United Kingdom.
Fonts, icons and all other parts of the app are served from our own server. We do not transfer data outside the European Economic Area, except for the map display above.
5. How long we keep data
- For as long as you have an account. When you delete your account, all account and beekeeping data is permanently deleted from the server immediately.
- Database backups are kept for up to 14 days and then deleted automatically, so deleted data disappears from them within that period.
- An account with no confirmed email and no apiary after 30 days is deleted automatically.
- Once billing starts, invoices and other accounting records are kept for as long as the law requires.
6. Cookies and on-device storage
We only use cookies that are strictly necessary for the service, which require no consent, so no cookie banner is needed. The home page sets no cookies on your first visit.
| Cookie | Purpose | Duration |
|---|---|---|
| PCELARSESSID | sign-in (session) | until the browser is closed |
| _csrf-frontend | protecting forms against abuse | until the browser is closed |
| _identity-frontend | “Remember me on this computer” | 30 days |
| hbd_lang | language, only when you choose it | 1 year |
| PCELARADMIN, _csrf-backend, _identity-backend | administration sign-in (administrators only) | until the browser is closed |
The mobile app stores data in your browser's local database on the device (IndexedDB) so that it works without signal: entries, the sign-in on the device, language and voice notes. This data leaves the device only when it syncs with your account; voice notes never do.
7. Security
The connection is encrypted (HTTPS). Passwords and sign-in tokens are stored only as cryptographic hashes, password guessing is rate-limited, and each user's data is visible only to that user. The administration shows account data (email, name, sign-up and sign-in dates) for support, but not the content of your diary.
8. Your rights
- Access and portability: export all your data in Reports (PDF, CSV) or request it by email.
- Rectification: change account data in Settings and other data in the app itself.
- Erasure: Settings → Delete account deletes the account and all data immediately; you can also request deletion by email.
- Restriction and objection: request them by email.
- Complaint to a supervisory authority: in Croatia, the Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, azop@azop.hr, or the authority in your country of residence.
We respond to requests without undue delay and within one month at the latest.
9. Changes
We will inform you of material changes by email or in the app before they take effect.