Privacy policy

Who is the data controller?

What we collect

• Account data. Email address (for magic-link sign-in), display name, optional avatar URL and city.
• Content you create. Reviews, ratings, saved spots, owner-claim submissions.
• Approximate location. Only when you grant the browser’s location prompt. Used to compute distances and to seed the search radius. Coordinates are not stored in your profile.
• Coarse IP-based geolocation. Used as a fallback when you decline the browser prompt. We resolve to city-level only and do not persist the IP address.
• Technical signals. Browser user-agent and rough page timings collected by Vercel Analytics in a privacy-preserving, first-party way. No cookies, no cross-site tracking.

What we do not collect

• We do not run third-party advertising trackers.
• We do not run Google Analytics, Meta Pixel, or any equivalent.
• We do not sell, rent, or share your data with brokers.
• We do not store payment data — payments (where they exist for business owners) are handled by Stripe and we never see card numbers.

Why we process your data

• To run the service you signed up for — performing the contract under Article 6(1)(b) GDPR.
• To improve the service using aggregated, non-personal usage metrics — our legitimate interest under Article 6(1)(f) GDPR.
• To comply with legal obligations such as tax records for business owners — Article 6(1)(c) GDPR.
• Marketing email only with your explicit opt-in consent under Article 6(1)(a) GDPR; you can withdraw consent at any time.

How long we keep it

• Account data: as long as your account exists.
• Reviews and ratings: as long as the spot exists. If you delete your account, your reviews are anonymised but retained so that the aggregate rating for a spot stays accurate.
• Sign-in tokens: 30 days.
• Server logs: 30 days.

Who we share it with

We rely on a small set of processors, each bound by a Data Processing Agreement:

• Supabase Inc. (database, auth, storage) — United States; EU Standard Contractual Clauses in place.
• Vercel Inc. (hosting, analytics) — United States; SCCs in place.
• Google LLC (Maps and Places API) — limited geolocation queries; SCCs in place. We do not pass your account data to Google.
• Resend Inc. (transactional email) — United States; SCCs in place.
• Sentry, Inc. (error monitoring) — United States; personally identifying fields are scrubbed before transmission.

Your rights

Under the GDPR and the Spanish LOPDGDD you have the right to access, rectify, delete, or restrict the processing of your data, to object to processing based on our legitimate interest, and to request data portability. You can exercise any of these by emailing privacy@kebapnearby.com. You can also delete your account at any time from your account page, which triggers the deletion procedure described above.

You also have the right to lodge a complaint with a supervisory authority — in Spain, this is the Agencia Española de Protección de Datos.

California residents

We do not sell your personal information as defined by the California Consumer Privacy Act. California residents have the right to know what personal information is collected, the right to delete it, and the right to non-discrimination for exercising these rights. Send requests to privacy@kebapnearby.com.

Cookies

We use only strictly necessary cookies for sign-in. We do not set tracking, advertising, or analytics cookies. See the cookie policy for the full list.

Changes

When we change this policy in a material way, we update the date above and, for signed-in users, we send an email at least seven days before the change takes effect.