Privacy Policy

Last updated 14 October 2026

Velko connects people who rent water sports gear with the riders, schools and shops who lend it. To do that it has to know who you are, what you list and book, and what you say to the people you rent with. This page explains exactly what that is, who else handles it, and how to get it deleted.

Who is responsible

Velko is operated by David Miguel Ferreira Unip. Lda (NIPC 516583166),Rua das Escolas 26, 3840-065 Calvão, Portugal, which is the controller of your personal data for the purposes of the EU General Data Protection Regulation (GDPR). You can reach us about anything in this policy at hey@davidferreira.dev, or by post at the address above.

Velko is not required to appoint a Data Protection Officer: it doesn't carry out large-scale monitoring of people or large-scale processing of special categories of data. Privacy questions are handled directly by the operator at the address above.

What Velko collects

Your account

Your email address and a display name, from the way you sign in: Sign in with Apple, or a one-time code sent to your email. If you use Sign in with Apple, Apple gives us your name and email address, or only Apple's private relay address if you choose to hide your email. When you accept the Terms and confirm you are 18 or over, Velko records which version you accepted and when.

Your listings

What you describe about your gear, its photos, price, deposit and availability, and where it can be picked up. Photos are re-encoded on your phone before upload, so the location, time and device details a camera records are never sent. Your listing shows an approximate area, rounded to about a kilometre. The exact pickup address is shared only with a renter whose booking you have accepted.

Seller details (owners only)

Before you can lend, you give us your legal name, date of birth (private owners), tax identification number (NIF) and the country that issued it, address and phone, and, for businesses, your trade register number and a certification that you comply with EU law. These are never shown to other users. We need them to identify businesses on the marketplace (Digital Services Act, Art. 30) and to report owners' income to the Portuguese Tax Authority under Council Directive (EU) 2021/514 (“DAC7”) and Decree-Law 41/2023. If you set up a school or shop profile, your business name, type and website are public.

Your bookings and payments

The gear, dates, prices, fees, deposits, the Terms version, your safety confirmation at checkout, and the status of every booking you make or receive. Card payments are handled by Stripe: Velko never sees or stores your card number. Velko keeps a record of each payment's amount and status. If you lend gear, Stripe collects the identity and bank details it needs to pay you out, under its own terms; Stripe tells us your Stripe account identifier and whether your payouts and verification are set up.

Your conversations and the rental record

Messages and photos you send to other users; the photo checks at pickup and return, including whether each photo was taken with the in-app camera or chosen from your library; the other person's agreement or disagreement with a check; problem reports, damage claims and their outcome; reviews you write; and reports you file. Handover photos are kept with the rental record and are visible to both people on that rental, because they are the evidence if something goes wrong.

Moderation

Reports made by you or about you, the decisions taken, and the notices sent.

Your device

• Push token. If you allow notifications, a push notification token for your device.
• Crash and diagnostic reports. If the app crashes, freezes or (on iPhone) uses unusual amounts of battery or storage, it uploads a diagnostic report to Velko's servers: what went wrong inside the app, the device model, and your app and operating system versions. On iPhone these come from Apple's MetricKit; on Android, from the app's own crash and “app not responding” reporting. Reports sent while you're signed in are linked to your account. Velko uses them only to find and fix problems, and deletes them after 90 days.
• Approximate location (Android only, optional). If you allow it in the system permission prompt, the Android app reads your approximate (coarse) location to show gear near you. It is used for that search only and is not stored by Velko. You can say no and search by place instead. The iPhone app doesn't use your device location.

What you have to give us, and why

To create an account you need an email address (or Sign in with Apple), a display name, and your acceptance of the Terms and 18+ confirmation: without them we can't run your account or prove the contract. To book, you need a payment card with Stripe. To lend, you need Stripe payouts and the seller details above, because the law requires them (DAC7 and the Digital Services Act) and we can't let you lend without them. Everything else, including notifications, location and a profile photo, is optional.

What Velko does not do

• No advertising, and no advertising identifiers.
• No tracking across other apps or websites, and no analytics SDKs.
• No selling or renting your data to anyone.
• No access to your contacts, and no precise or background location.
• No decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22). Damage claims, reports and account restrictions are decided by a person.

Why it is used

• To provide the service (performance of a contract, GDPR Art. 6(1)(b)): your account, listings, bookings, payments, messages, handover records and notifications.
• To meet legal obligations (Art. 6(1)(c)): identifying business sellers (DSA Art. 30), collecting seller details and reporting owners' income to the Portuguese Tax Authority (DAC7), handling reports and sending moderation notices (DSA Arts. 16–17), and keeping invoices, payment and booking records for accounting and tax purposes.
• Legitimate interests (Art. 6(1)(f)): keeping the marketplace safe, deciding deposit claims, preventing fraud and abuse, fixing crashes and defects with diagnostic reports, and keeping proof of your Terms acceptance and 18+ confirmation. You can object to these (see Your rights).
• Consent (Art. 6(1)(a)): push notifications and, on Android, approximate location for “near me” search.

Consent, and how to withdraw it

Notifications and location are asked for through your phone's own permission prompts. You can withdraw either at any time in your phone's settings (iPhone: Settings → Velko; Android: Settings → Apps → Velko → Permissions or Notifications). Withdrawing doesn't affect what was done before, and the rest of the app keeps working.

Who else handles it

Velko relies on a small number of service providers, each processing data on our behalf only to run the service:

• Supabase hosts Velko's database, file storage and sign-in, in the EU (Ireland).
• Apple: Sign in with Apple, and push notifications to iPhones through the Apple Push Notification service (APNs).
• Google: push notifications to Android phones through Firebase Cloud Messaging, and maps and approximate location in the Android app (Google Maps SDK and Google Play services).
• Our email delivery provider sends your sign-in codes and service emails.
• Our certified invoicing software, used to issue invoices for Velko's commission as Portuguese tax law requires, receives the owner's name, NIF and address.

Stripe processes payments, deposits and owner payouts. For identity verification (“know your customer”), payouts and fraud prevention on owners' Stripe accounts, Stripe acts as an independent controller underStripe's privacy policy, not on our behalf.

The Portuguese Tax Authority (AT) receives the annual DAC7 report about owners where DAC7 applies, and may share it with the tax authorities of other EU countries. We also disclose data to courts or authorities when the law requires it.

Push notification previews. A new-message notification shows its first line of text, which passes through Apple's or Google's push service. You can turn previews off in your phone's notification settings.

International transfers

Some of these providers are based in, or may access data from, the United States: Supabase (data hosted in the EU, by a US company), Stripe, Google, Apple and our email delivery provider. Where the provider is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for it; otherwise, it is covered by the Commission's Standard Contractual Clauses. You can ask us for more detail or a copy of the relevant safeguards.

What other users see

Your display name, rating, listings and reviews, and whether you lend as a private person or a business (with the business name), are public. Your messages and rental record are visible only to the other person on that rental. Your exact pickup address is shown only once you've accepted their booking.

How long it is kept

Your account, listings and profile are kept while your account is open. Some records have their own limits, and are deleted automatically when they run out:

• Messages and handover or claim photos of a rental: 36 months after the rental ends or is cancelled, the period in which a claim about it can usually still be made.
• Messages about a listing that never became a booking: 12 months after the last message.
• Reports and moderation notices: 36 months after the report is made.
• Crash and diagnostic reports: 90 days, including after you delete your account.
• Bookings, payments, fees and invoices: 10 years, as Portuguese accounting and tax law requires.
• Seller details used in a DAC7 tax report: 10 years after the reporting period, as DAC7 requires.
• Your acceptance of the Terms: as long as the account exists, and afterwards as long as the bookings it relates to.

Deleting your account

Open Velko, go to Profile, and tap Delete account. It happens straight away. If you have a rental in progress, finish or cancel it first; requests that nobody has answered yet are withdrawn for you. You can also email us from your account's address.Delete your account explains both ways.

When you delete your account, your login, email, avatar, listings, listing photos, pickup addresses, saved gear, notification tokens, business details and your Sign in with Apple authorisation are removed. The text of your messages is replaced with “Message deleted”. Records of rentals you took part in, and the payments, reviews, claims and handover photos attached to them, are kept for the periods above so the other person still has their record and so Velko can meet its legal obligations. Your name on them is replaced with “Deleted user”.

Your rights

You can ask for a copy of your data (including in a portable, machine-readable format), and ask for it to be corrected or deleted, or for its use to be restricted. You can object at any time to processing based on legitimate interests, and withdraw consent as described above. Email hey@davidferreira.dev from the address on your account, and we'll respond within a month. If you're not satisfied, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or the authority where you live or work.

This website

The Velko pages at davidferreira.dev are a static website hosted on GitHub Pages. Like any web host, GitHub records technical request data (such as your IP address, browser and the page requested) in its server logs to deliver and secure the site; seeGitHub's privacy statement. The website sets no cookies, uses no analytics or trackers, and loads its fonts from the same server rather than from a third party. Email links open your own email app; anything you send us is handled as described above.

Age

Velko is for adults. You must be 18 or older to use an account, because renting and lending involves payments and binding agreements, and you confirm this in the app before you start. If we learn that an account belongs to someone under 18, we close it.

Changes to this policy

If this policy changes, the new version will be published here with a new date at the top, and significant changes will be announced in the app.