AQVELIS
← Back to home

Privacy Policy

Information on the processing of personal data in connection with AQVELIS.

Controller

Controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR):
Florian Krenn
Dornhof 14
9300 Frauenstein
Austria

What data is processed

The following categories of personal or user-related data are processed for the operation of AQVELIS:

  • Account and sign-in: email address and authentication data, processed via the backend service Supabase. When signing in with email and password, your password is processed exclusively in encrypted form – AQVELIS has no access to your password in plain text. When signing in via Google, provider metadata supplied by the provider is additionally processed. In addition, your display name and, in your profile, a reference to the version of the Terms of Service most recently accepted by you, together with the associated timestamp, are stored.
  • Legal consents: in addition to the reference stored in the profile, each individual consent is logged – stating the document (e.g. Terms of Service), the accepted version and the time of consent.
  • Water environments/facilities: name, facility type (Pool, Spa, Freshwater Aquarium or Saltwater Aquarium), volume and active status.
  • Measurements: parameter, measured value, source of the measurement, time of measurement and – where available – a reference to a measurement device.
  • Target ranges: target or reference ranges set by you for measurement parameters per water environment.
  • Product assignments: assignment of products from the AQVELIS product catalog to your water environments.
  • Measurement device metadata: a technically provided data field for a possible reference to a measurement device. Active synchronization with external sensors or IoT devices does not currently take place.

Purpose of processing

The data listed above is processed in order to provide you with the core features of AQVELIS: to manage your account, to create and manage your water environments, to record your measurements and display target ranges, and to enable product assignments. Legal consents are processed in order to document your consent to the Terms of Service in a traceable manner.

Legal basis

Processing that is necessary for the provision and use of the free AQVELIS service is carried out on the basis of Art. 6(1)(b) GDPR (necessity for the performance of the contract or for taking steps prior to entering into a contract). This applies in particular to:

  • user account and authentication
  • profile data
  • water environments/facilities
  • measurements and target ranges
  • necessary account, confirmation and password reset communication
  • voluntarily chosen Google sign-in as an alternative sign-in method

The documentation of the acceptance of the Terms of Service (see “Legal consents” above) is also attributed to Art. 6(1)(b) GDPR for the current AQVELIS version, insofar as it is necessary for managing and evidencing the specific usage relationship.

For the technical and organizational security of the processing operations mentioned (Art. 32 GDPR), AQVELIS uses access restrictions (Row Level Security) in the Supabase database, which ensure that users can only access their own data. Row Level Security is not a separate processing operation with its own legal basis, but a security measure within the scope of the processing operations mentioned above that are permitted under Art. 6(1)(b) GDPR.

Storage period

Personal account data and the other user-related application data (including profile, legal consents, water environments/facilities, measurements, target ranges, product assignments and measurement device metadata) are generally processed for as long as your AQVELIS account exists and this data is required for the provision of the service.

When your account is deleted, the user-related application data is deleted in accordance with the deletion process described in the section “Deleting your account”. Statutory retention obligations remain unaffected, insofar as they exist in individual cases.

The primary AQVELIS project data is stored with our processor Supabase in the eu-west-1 region (Ireland, EU). With the email delivery service Mailtrap, the complete removal of deleted data from records/logs may, according to the provider, take up to 30 days.

Deleting your account

You can delete your AQVELIS account directly in the app. In doing so, the app calls a server-side function that deletes your authenticated Supabase Auth user. Via deletion rules stored in the database, the following data assigned to you is completely deleted in the process: your profile, legal consents, your water environments/facilities, measurement target ranges, measurements, product assignments to your facilities and measurement device metadata. Global product catalog data (e.g. product master data) remains unaffected, as it is not assigned to you personally.

The exact procedure for deleting your account in the app can be found on the Delete Account page.

Disclosure to third parties / processors

The following external services are used for the operation of AQVELIS:

  • Supabase: actually used as a processor for authentication, the PostgreSQL database including access restrictions (Row Level Security), file storage (Storage) and server-side functions (Edge Functions). The primary AQVELIS project data is stored in the eu-west-1 region (Ireland, EU). Supabase provides a Data Processing Addendum (DPA) and may use sub-processors in the course of providing its services.
  • Google: optionally as a sign-in provider (Google OAuth), if you sign in with your Google account.
  • Email delivery: registration and password reset emails as well as other transactional emails are sent via the external email delivery service Mailtrap. Mailtrap provides a Data Processing Addendum (DPA) for this purpose. For possible data transfers outside the EU/EEA, Mailtrap, according to its own information, relies on, among other things, the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.

Push notifications, analytics and crash reporting services as well as active connections to external sensor or IoT providers are currently not used.

With both Supabase and Mailtrap, data processing relationships exist on the basis of the Data Processing Addenda (DPA) provided by the respective provider. The primary AQVELIS project data is processed by Supabase in the eu-west-1 region (Ireland, EU). Mailtrap may also process data outside the EU/EEA; as the basis for transfer, the provider names, among other things, the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.

Rights of data subjects

Under the GDPR, users generally have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to the processing of their personal data. Information on deleting AQVELIS accounts can be found on the Delete Account page. To exercise your data subject rights, you can contact us by email at support@aqvelis.at.

Contact

For questions about data protection: support@aqvelis.at

Last Updated

Last updated: September 2026