Skip to content
Get early access
Menu

Privacy policy

Effective 2026-10-18. This policy covers tervo.health and the early-access signup. The TERVO applications will have separate data-processing information when they become available.

Who is responsible

The controller is TenBytes Ltd. (ТенБайтс ООД), registration number 203076172, VAT BG203076172. Registered address: office 38, floor 1, 4A Dr Stoyan Chomakov Street, Mladost-1, Mladost district, Sofia 1750, Bulgaria. For questions, withdrawal of consent and rights requests, contact us at hello@tervo.health.

What we collect and why

  • If you sign up: your email, chosen language, request date, source tervo.health and consent-text version. We use these for confirmation, early-access notifications and TERVO updates with your consent under GDPR Article 6(1)(a).
  • Brevo processes confirmation through an email link and keeps signup information. Your address enters the early-access list after confirmation. An unconfirmed request does not authorise marketing campaigns.
  • To deliver and protect the site, Cloudflare processes technical information, including IP address, requested page and time. Request limiting uses temporary derived codes instead of recording email or IP in application logs. Our basis is the legitimate interest in maintaining a secure, functioning site under Article 6(1)(f).
  • Only if you allow analytics: PostHog measures visits, navigation clicks and form outcomes using an anonymous session identifier, language and form position. We also measure the referring site when the browser provides it and permitted UTM campaign markers. We do not send your email, typed text, the full referrer URL or other URL query parameters. Session recording and automatic click capture are disabled. The basis is your consent.

This landing page does not collect health data, body measurements, food diaries or workout records. Signup is voluntary; we need an email and consent to subscribe you, but neither is needed to browse.

Abuse prevention

We use Cloudflare Turnstile to protect signup forms from automated abuse. The check loads when you submit the form and processes technical signals from your browser and device under Cloudflare’s Turnstile Privacy Addendum. This necessary security check is separate from analytics and does not depend on your analytics choice.

Providers and international transfers

We use Cloudflare for hosting and abuse protection, Brevo for the list and email, and PostHog’s European region for consented analytics. Providers operate under our data-processing agreements. Global infrastructure and subprocessors may involve processing outside the EEA; where this occurs, applicable GDPR safeguards include an adequacy decision or standard contractual clauses. We do not sell personal data.

Retention

We retain your confirmed subscription while you want TERVO updates. We review the list at least annually and remove information no longer needed. Unsubscribing stops marketing; Brevo may keep a minimal suppression record to prevent accidental resubscription. Evidence of consent or withdrawal is kept only as needed for compliance and protecting legal rights. Technical logs are subject to limited provider retention and are not used for marketing.

Language and analytics choices expire after 180 days. After permission, an anonymous identifier and the visit source are kept in this tab’s sessionStorage; the session expires after 30 minutes of inactivity or at most 24 hours. Declining removes this record. Unconfirmed requests are managed by Brevo’s confirmation process and are not used for campaigns.

Your rights and unsubscribe

You can request access, correction, deletion, restriction and portability, and object to processing based on legitimate interest. Withdraw consent at any time using the unsubscribe link in every marketing email or contacting us at hello@tervo.health. Withdrawal does not affect the lawfulness of previous processing. Use cookie settings to change analytics consent.

We respond within GDPR deadlines, normally one month, and may reasonably verify your identity. You can complain to Bulgaria’s Commission for Personal Data Protection or the authority where you live.

Other information

We do not make automated decisions with legal or similarly significant effects through this site. The site is intended for adults. When this policy changes, we publish a new effective date and seek renewed consent where needed.