Data and privacy
Last updated 16 Sep 2026
KORENA Partner app privacy notice
This notice explains how personal data is processed in the KORENA Partner mobile app for iOS and Android. It supplements the main Privacy Policy.
1. Who is the controller
The controller of your personal data is:
"Martial Labs" Ltd. ( Маршъл Лабс ЕООД )
UIC/ЕИК 207453941 · VAT BG207453941
8A Yordan Badev Str., 1700 Sofia, Bulgaria
Manager: Pavel Danielov Nikolov
Data Protection Contact: office@korena.eu
Privacy requests should be sent to office@korena.eu. Account deletion requests should be sent to partner@korena.eu.
2. Who the app is for
KORENA Partner is used by staff of vetted partner timber yards and workshops. It lets them list slabs, document origin and fulfil orders for KORENA. KORENA creates each account. There is no self sign-up.
3. What data the app processes
| What we collect | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address and user ID | Sign-in through Supabase Auth, and password reset emails sent through Resend | Art. 6(1)(b): performance of the partnership contract | Duration of the partnership relationship + 24 months, unless earlier deletion is requested and no legal duty requires retention |
| Photos of slabs, QR stickers, origin and EUDR documents, and transport tickets | Create listings, build the EUDR passport for each slab, and keep proof of fulfilment | Art. 6(1)(b): performance of the partnership contract; Art. 6(1)(c): legal obligation for EUDR records | For slabs already listed or sold, for the period required by EUDR and other applicable law; other records follow the duration of the partnership relationship + 24 months |
| Optional voice recordings and resulting product-story text | Draft the product story; transcription is performed on the device where possible, otherwise by KORENA's transcription service providers | Art. 6(1)(b): performance of the partnership contract when the partner chooses to use the feature | Audio is not kept as product data. Resulting listing text follows the retention applicable to the listing |
| Listing text, measurements, species, storage location, and order and shipment actions | Publish and manage listings, document slabs, and fulfil orders | Art. 6(1)(b): performance of the partnership contract; Art. 6(1)(c): legal obligation for EUDR records where applicable | Duration of the partnership relationship + 24 months; records needed for EUDR due diligence or traceability are kept for the period required by law |
| Partner documents issued between KORENA and the partner, such as agreements, invoices and handover protocols, which the app lets you view and download | Give the partner access to its documents | Art. 6(1)(b): performance of the partnership contract; Art. 6(1)(c): legal obligation for invoicing and accounting records | Invoices and other accounting records: 10 years from the end of the year of issue, under Bulgarian accounting law. Other documents: duration of the partnership relationship + 24 months |
| Push notification token and platform | Send order and task notifications through Apple Push Notification service or Google Firebase Cloud Messaging | Art. 6(1)(b): performance of the partnership contract | Duration of the partnership relationship + 24 months, unless earlier deletion is requested and no legal duty requires retention |
| Crash and diagnostic data not linked to your identity | Find and fix app errors through Sentry in the EU region | Art. 6(1)(f): legitimate interest in app security and reliable operation | Only for as long as needed for diagnostics |
| Android only: Google Firebase installation ID, and Google ML Kit usage and performance diagnostics | Operate the Android installation and monitor the on-device QR scanning function | Art. 6(1)(f): legitimate interest in app security and reliable operation | Only for as long as needed for app operation and diagnostics |
4. Voice recordings
Voice recording is optional. It is used only to prepare the product story for a slab. The app transcribes the recording on the device where possible. If on-device transcription is not used, the audio is sent to KORENA and processed by the transcription provider KORENA has selected, ElevenLabs or OpenAI. The audio is not kept as product data.
5. Device permissions
- Camera: to photograph slabs, QR stickers, origin and EUDR documents, and transport tickets, and to scan QR codes.
- Microphone: to make an optional voice recording for a product story.
- Speech recognition on iOS: to transcribe an optional voice recording on the device.
- Motion sensors: to help capture slab photos and measurements.
- Notifications: to show order and task alerts.
6. What the app does not do
The app does not access your location or contacts. It does not read your photo library. It does not show advertising, track you across apps or websites, or sell data.
7. Buyer order details
Buyer order details shown in the app come from KORENA's systems. They are shown to the partner only when needed to fulfil the order and must be used only for that purpose.
8. Service providers
| Provider | What they get | Purpose |
|---|---|---|
| Civo (Frankfurt, Germany) | All data the app exchanges with KORENA's servers, including voice audio on its way to transcription | Hosting of KORENA's servers |
| Supabase (EU region, Frankfurt) | Email address, user ID, push notification token, and app records such as listing data and order and shipment actions | Authentication and database hosting |
| Cloudflare (R2 storage) | Photos and documents uploaded from the app, and partner document PDFs | File storage |
| Resend | Email address and the content of account emails, such as password reset links | Delivery of account emails |
| Apple Push Notification service and Google Firebase Cloud Messaging | Push notification token and platform | Deliver order and task notifications |
| Sentry (EU region) | Crash and diagnostic data not linked to the user's identity | Error diagnosis and app reliability |
| Google Firebase and Google ML Kit (Android only) | Firebase installation ID, and QR scanning usage and performance diagnostics | Android installation services and on-device QR scanning diagnostics |
| ElevenLabs | Optional voice audio when on-device transcription is not used | Transcription |
| OpenAI | Optional voice audio when on-device transcription is not used and KORENA has selected OpenAI for transcription; listing text, including the product story, when KORENA drafts or translates listing copy | Transcription, and drafting and translating listing copy |
Some providers may process data outside the European Economic Area. The safeguards for these transfers are described in §5 and §6 of the main Privacy Policy.
9. Retention and account deletion
To request deletion, email partner@korena.eu from the email address used for the account and identify the account and partner yard or workshop. We will confirm the request and delete the account and associated data that we are not required to keep.
After deletion, KORENA keeps only records it must retain by law. These include invoices, accounting and tax records, which the main Privacy Policy states are kept for 10 years from the end of the year of issue under Bulgarian accounting law. They also include records required for EUDR due diligence and traceability of slabs already listed or sold, for the period required by law. Other partner contact data follows the main policy and is kept for the duration of the partnership relationship + 24 months.
10. Your rights
Your GDPR rights and the details of the supervisory authority are set out in §7 of the main Privacy Policy. They include the rights of access, rectification, erasure, restriction, portability and objection, where applicable. Send general privacy requests to office@korena.eu. Send account deletion requests to partner@korena.eu.
11. Changes to this notice
We may update this notice when the app, its providers, or the applicable legal requirements change. The current version is always published on this page.