Privacy Policy

What we collect

Only what we need to operate your workspace reliably.

• Account details like name, business email, and billing identity.
• Operational data such as calls, bookings, tasks, and workflow events.
• Security telemetry including device, IP region, and access timestamps.

Why we use it

• Deliver your active Valeron workflows and daily operations.
• Detect abuse, fraud, or suspicious access patterns.
• Improve service quality with aggregated, de-identified product analytics.

Website contact requests

When you write to us through the contact form on valeronsystems.com.

• We receive your name, your business name, your e-mail address or phone number, your city and your message.
• We use them only to answer your request, including an offer if you ask for one. The legal basis is GDPR Article 6(1)(b) when you ask about an offer (steps taken at your request before a contract); otherwise, and for keeping the correspondence for the period stated below, Article 6(1)(f): our legitimate interest in answering you and handling follow-ups. You can object to this processing at any time.
• The form sends one e-mail to the Valeron Systems company inbox through Resend. Nothing is stored in the Valeron OS database; the correspondence is kept in the company mailbox hosted by GoDaddy, our e-mail provider. Both providers are listed on the Subprocessors page.
• The company mailboxes (GoDaddy Professional Email on the Titan platform) run on AWS infrastructure in the USA, so your request and our correspondence are transferred outside the EEA. The safeguard is the GoDaddy Data Processing Addendum: the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework. The notification e-mail itself is delivered by Resend (Plus Five Five, Inc., USA), whose message content and delivery logs are stored in the USA for 30 days; the safeguard is Resend's DPA (the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework). You can ask for a copy of either safeguard by writing to support@valeronsystems.com with the subject PRIVACY.
• We delete the notification e-mail that carries your request from the company mailbox 90 days after it arrives; the mailbox trash is emptied after a further 30 days. Further correspondence with you is kept only as long as it is needed to answer your request and handle follow-ups. If a contract follows, its own retention rules apply.
• To limit abuse, the server keeps a one-way digest of your IP address in its memory for up to 1 hour, and for nothing else (GDPR Article 6(1)(f)).
• The controller is Grupa Rapid Sp. z o.o., the company behind Valeron Systems. For access, correction, deletion, restriction of processing, data portability or to object, write to support@valeronsystems.com with the subject prefix PRIVACY; no account is needed. You also have the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl).

Phone calls with the AI voice assistant

When you call a line answered by the Valeron Systems voice assistant: a salon's line, or one of Valeron Systems' own lines.

• Controller: the business you are calling. At present the assistant answers only Valeron Systems' own lines — the demonstration line +48 71 723 17 85 and the company line +48 71 723 18 09; for both, the controller is Grupa Rapid Sp. z o.o., the company behind Valeron Systems (contact: support@valeronsystems.com). When the assistant answers a salon's line, the salon is the controller and Grupa Rapid Sp. z o.o. handles the call for the salon as its processor (GDPR Article 28); each salon line is listed in this section, with the salon's name and contact details, before it is switched on.
• Before the assistant speaks, a recorded or synthesized notice tells you that you are talking to an AI assistant and that the call may be recorded and transcribed. The assistant is connected only if you press 1. Pressing 1 is voluntary: if you do not, the call ends and the assistant is not connected. You can still contact the business you called in another way, for example in writing or in person.
• Purpose and legal basis: the assistant answers your questions and helps you book or confirm a visit; it processes the call automatically (speech recognition, a language model and speech synthesis). The call with the assistant, including its recording and transcription, takes place only with your consent (GDPR Article 6(1)(a)), which you give by pressing 1. A record of your answer is kept to demonstrate that consent (GDPR Article 7(1)).
• Call log: for every call — also when you do not press 1 — the time, direction, outcome and your phone number are logged, on the basis of the legitimate interests of the business you are calling (GDPR Article 6(1)(f)): operating and securing the phone line (detecting faults and abuse), handling complaints and settling telephone costs. You can object to this at any time by writing to the address below.
• Retention: the transcript and summary of the call are deleted 30 days after the call ends, the call log (time, direction, outcome, your phone number) after 90 days, and the record of your consent (status, notice version, time — never audio, a transcript or a phone number) after 365 days. Valeron Systems does not store audio files of calls. Storage at the voice provider is described on the Retention & Deletion page.
• Recipients: the call is carried by Twilio (telephone connection) and handled by ElevenLabs (the voice assistant). Both process call data in the USA under the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework; the full list, with regions and safeguards, is on the Subprocessors page.
• Your rights: you can end the call at any time by hanging up, and the assistant then stops; you can withdraw your consent at any time, as easily as you gave it: call the same line again from the same number and, when asked to press 1, press 9 instead; or write to support@valeronsystems.com (a subject starting with PRIVACY helps us route it, but any message counts), giving your phone number and the approximate time of the call. We then delete the transcripts and summaries of your calls to that line, have the voice provider delete its copy, and confirm this to you within one month — by text message or phone call to that number, or by e-mail if you wrote. The call log and the record of your consent are kept for the periods stated above, because they rest on the bases described above, not on your consent. Withdrawal does not affect processing that took place before it. You also have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl). Requests about a salon's line can go to the salon or to the same address; as the salon's processor, we help the salon answer them.

Demo requests from advertising forms (Facebook/Instagram)

When you submit a demo request through a Valeron Systems Instant Form on Facebook or Instagram, operated by Meta Platforms Ireland Ltd.

• Controller: Grupa Rapid Sp. z o.o. (brand Valeron Systems), ul. Adama Mickiewicza 4-5, 56-500 Syców, KRS 0001252402. Contact: support@valeronsystems.com.
• Data collected through the form: first and last name (pre-filled by Meta from your profile), phone number, salon name, city, and your preferred time of day to be called (morning / midday / afternoon / evening).
• Source: the Instant Form on Facebook or Instagram, a service operated by Meta Platforms Ireland Ltd. Meta pre-fills fields from your profile and delivers the form response to us.
• Purpose: exclusively to schedule the Valeron AI demo you request through the form. We will inform you before the demo begins if any further processing of your data will take place in connection with it.
• Legal basis: we process the form data exclusively for the purpose of scheduling the Valeron AI demo: under GDPR Article 6(1)(b) if this is necessary to take steps at your request before entering into a contract with you, or under GDPR Article 6(1)(f) if you represent another entity — in that case our legitimate interest is handling its enquiry and scheduling the demo. We will contact you by phone only with your prior consent, in accordance with applicable electronic communications law. You may withdraw your consent to be called at any time, including during the call or by writing to support@valeronsystems.com — after withdrawal we will not call you for this purpose.
• Retention: we keep the submission data for the time necessary to handle it, no longer than 90 days from the date of form submission. If we enter into a contract, only the data necessary for its conclusion, performance and the fulfilment of legal obligations will be processed further — we will provide details of that processing in a separate notice.
• Recipients: we store submissions in Meta Leads Center (Meta Platforms Ireland Ltd.). When we make the phone call you asked for, the telecommunications operators that carry the call also process your phone number. For information on how Meta processes your data, including any transfers outside the European Economic Area, see Meta's privacy policy: https://www.facebook.com/privacy/policy
• Your rights: you have the right to access, rectification, erasure, restriction of processing, and objection, and to withdraw your consent to being called at any time (as described above). You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl). In connection with handling this submission, Grupa Rapid Sp. z o.o. does not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Where processing is carried out by automated means on the basis of GDPR Article 6(1)(b), you also have the right to data portability. The right to object applies to processing on the basis of GDPR Article 6(1)(f).

Website visit statistics (cookieless)

When you browse the public pages of valeronsystems.com (home page, legal pages, security, technology, partners, installation, letter of intent and the demo page).

• We use Vercel Web Analytics (Vercel Inc.), a service that produces aggregated visit statistics. It sets no cookies and stores nothing in your browser (no cookies, no local storage). The processing is limited to what is strictly necessary to measure our own site's audience — aggregated page views only, no cross-site identifiers. The legal basis for this processing is GDPR Article 6(1)(f) (our legitimate interest in understanding which pages are read and in keeping the site working); it does not appear in the cookie consent banner because no cookies or similar storage are used for this purpose.
• Scope: aggregated statistics only — number of visits and page views, the pages visited (path only, without any address parameters), country, device type, browser and operating system, and the referring site. We send no custom events, no user identifiers and no form content, and we strip the query string from every address before it is counted.
• Not counted: the signed-in panel and workspace, the sign-in and registration pages, links that carry a personal token (booking, consent and similar links), the privacy-request page, and the demo onboarding and request flows.
• The visitor is not identified by a persistent identifier and is not followed across sites or across days; the statistics do not allow us to tell who you are. To the extent that any of this is personal data, the basis is GDPR Article 6(1)(f) — our legitimate interest in knowing which pages are read and in keeping the site working — and you can object at any time at support@valeronsystems.com (subject starting with PRIVACY).
• Recipient: Vercel Inc. (USA), which hosts the site and acts as our processor under its DPA (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework); it is listed on the Subprocessors page.

Your controls

• Submit authenticated access/export, correction, and deletion requests at /legal/privacy-requests (signed in).
• Your Terms/Privacy acceptance is recorded at registration with the exact policy version and timestamp.
• Cookie preferences are controlled by the consent banner and the Cookie Policy page.
• Configure role-based access and audit visibility by team.