Legal
VLH: Your Plant Collection — App Privacy Policy
This policy explains what personal data is processed when you use the mobile app “VLH: Your Plant Collection”, and why. The app contains no advertising trackers and your data is never sold. For the privacy policy of the velvetleafhouse.com website, see the website privacy policy.
1. Controller
10X Labs GmbH
Gregerstraße 20a
2401 Fischamend, Austria
Email: contact@velvetleafhouse.com
Commercial register: FN 647962 k, Landesgericht Korneuburg
VAT ID: ATU81909614
2. What data the app processes
Account data: your email address, an encrypted (hashed) form of your password, the time you accepted the Terms & Conditions and, if given, the time of your newsletter consent.
Your catalogue: the plants, photos, purchase details, locations, care notes and other entries you add to your personal catalogue. These are only visible to you.
Information about other people: details you choose to enter about someone else — for example the name of a seller you bought a plant from, or the nickname of someone you sold, traded or gave a plant to. Please only enter what you need, use a first name or a nickname rather than a full address, and remember that you decide what goes in here.
Technical data: basic technical information needed to run the service, such as authentication tokens and timestamps.
Camera and photo library access is used exclusively to let you add pictures of your plants; the app only receives the photos you actively select or take.
3. Purposes and legal bases
Providing your account and storing your catalogue: performance of contract, Art. 6(1)(b) GDPR. The emails that belong to your account — confirming your address and resetting your password — are sent for us by Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France) under a data processing agreement pursuant to Art. 28 GDPR. Your email address is passed to them for that purpose.
Email newsletter and offers: only with your separate, voluntary consent, Art. 6(1)(a) GDPR. These are sent through the same provider. Every email contains an unsubscribe link; you can withdraw your consent at any time with effect for the future, and withdrawal does not affect the lawfulness of processing before withdrawal. Your address is never shared with third parties for their own purposes.
Security and abuse prevention: legitimate interest, Art. 6(1)(f) GDPR.
4. Where your data is stored
Your data is stored with our processor Supabase, hosted in the European Union (Frankfurt, Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
5. Sharing of data
We do not share your personal data with third parties, except where technically necessary to provide the service (see sections 3 and 4) or where we are legally obliged to do so.
6. Storage period
Your data is stored for as long as your account exists. When you delete your account in the app (Settings → Delete account), your account data, plants and photos are permanently deleted. Consent records may be retained as long as legally required to document compliance.
7. Your rights
You have the right to access the personal data we hold about you, and the right to rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, contact contact@velvetleafhouse.com.
You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
8. No automated decision-making
The app performs no automated decision-making and no profiling.
9. Children
The app is not directed at children under 16. We do not knowingly process data of children under 16.
10. Changes to this policy
We will update this policy when the service changes. The current version is always available in the app and on this page.
Last updated: 17 September 2026