Privacy policy

Controller

[Company name], [address], [email]. Data protection contact: [email].

Data we process

Account: email address, identity provider, display name, language, role, and age confirmation.

Contributions: submitted places, reviews, photos, and reports.

Location: used only for a single nearby search, never stored and never attached to contributions.

Technical data: IP address, timestamps, requested page, and error logs where required for secure operation.

Purposes and legal bases

Providing the account and contributions (Art. 6(1)(b) GDPR).

Security and abuse prevention (Art. 6(1)(f) GDPR).

Moderation and removal of unlawful content (Art. 6(1)(c) and (f) GDPR).

Consent where explicitly given (Art. 6(1)(a) GDPR).

Retention

Account data is kept until the account is deleted. Contributions are anonymised so the directory stays consistent.

Rejected photos are deleted after 30 days, soft-deleted content after 90 days, logs after at most 30 days.

Processors

Supabase (database and auth, Frankfurt), Vercel (hosting), Cloudflare (CDN and storage), Resend (email). Data processing agreements are in place and data stays in the EU.

Cookies

Only strictly necessary cookies for sign-in and language. No advertising or tracking cookies.

Your rights

Access, rectification, erasure, restriction, portability, and objection. Account deletion is available in the app.

You may complain to the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna) or your local authority.

Children and photos

The service targets people aged 16 and over. Photos showing identifiable children are prohibited and removed on request.