Privacy policy

Privacy Policy for Calba

Effective Date: May 29, 2026

1. Introduction

Welcome to Calba. This Privacy Policy explains how Lunåker AB ("we," "us," or "our") collects, uses, stores, and protects your personal data when you use the Calba mobile application (the "App").

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable Swedish data protection laws. By using the App, you consent to the data practices described in this policy.

2. The Data We Collect

To provide the analog film emulation and cloud-storage experience of Calba, we collect the following types of information:

Account and Profile Data: When you create an account (e.g., via Apple Sign-In, Google Sign-In, or email), we receive basic profile information such as your email address and name.
User Content: We collect the photographs you capture using the App, alongside associated metadata you provide, such as dates, captions, and device camera data (EXIF data) necessary for processing the images.
Usage and Analytics Data: We may collect anonymized data about how you interact with the App, including crash reports, performance metrics, and feature usage to help us improve the software.
Purchase History: If you purchase a premium subscription or in-app product, we collect purchase validation data. We do not collect or store your credit card or direct payment details. All financial transactions are handled securely by Apple (App Store) or Google (Google Play).

3. How We Use Your Data (Lawful Basis)

Under the GDPR, we must have a lawful basis to process your data. We use your data for the following purposes:

To Provide the Service (Contract Fulfillment): We process your photographs, captions, and account data to deliver the core functionality of the App, including applying film emulations and securely syncing your gallery across your devices.
Subscription Management (Contract Fulfillment): We use receipt data to verify your premium entitlements and unlock features within the App.
To Improve the App (Legitimate Interest): We analyze anonymous usage data and crash reports to fix bugs, optimize algorithms, and improve user experience.
Customer Support (Legitimate Interest): We use your email to respond to your support inquiries.

4. How We Store and Share Your Data (Data Processors)

We do not sell your personal data to advertisers. We share your data only with trusted third-party service providers ("Data Processors") strictly necessary to operate our infrastructure:

Cloud Infrastructure (Supabase): We use Supabase for user authentication, database management, and secure cloud storage (including your User Content, photographs, and captions). You can read their Privacy Policy at https://supabase.com/privacy.
Revenue Infrastructure (RevenueCat): We use RevenueCat to manage and validate in-app subscriptions. We share anonymous App User IDs and purchase receipts generated by Google Play and the Apple App Store. RevenueCat does not collect or have access to your credit card information. You can read their Privacy Policy at https://www.revenuecat.com/privacy.
Legal Compliance: We may disclose your data if required by law, court order, or governmental request to comply with our legal obligations in Sweden or the European Union.

5. Data Retention

We retain your Account Data and User Content (photos and captions) for as long as your account is active. If you choose to delete your account, we will permanently delete your photographs, metadata, and personal identifiers from our active cloud servers within 30 days, except for anonymized analytics or transaction data we are legally required to keep for financial auditing and corporate reporting purposes.

6. International Data Transfers

Our third-party cloud infrastructure providers may host data on servers located outside of the European Economic Area (EEA), such as in the United States. In such cases, we ensure that adequate safeguards are in place to protect your data, relying on mechanisms such as the EU Standard Contractual Clauses (SCCs) or adequacy decisions recognized by the European Commission.

7. Children's Privacy

Our App is not intended for or directed at children under the age of 13 (or 16 in certain European Union jurisdictions). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verified parental consent, we will take immediate steps to delete that information from our servers.

8. Your GDPR Rights

As a resident of the European Union, you have specific rights regarding your personal data:

Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can request corrections to inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You can request the permanent deletion of your account and associated User Content directly within the App's settings panel. If you have already uninstalls the App, you can submit your erasure request by emailing us directly at support@calba.app.
Right to Data Portability: You can request to receive your data in a structured, commonly used, and machine-readable format.
Right to Restrict or Object: You can object to or request restrictions on certain types of processing.

To exercise any of these rights, please contact us using the details provided below. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY) if you believe we are processing your data unlawfully.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Privacy Policy within the App and updating the "Effective Date" at the top.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact the Data Controller:

Lunåker AB

Sweden

Email: support@calba.app

Page updated

Report abuse