Conttinu Privacy Policy

1. Controller and scope

This Policy covers the iOS and Android apps, web services, user accounts and active Partner functions. The launch release provides the directory, maps, account features and community. Visits, Max messages, Partner payments and optional product analytics remain disabled. This Policy is not a request for blanket consent.

This Policy covers the iOS and Android apps, website and user and Partner accounts. A venue receiving your enquiry or sending you messages may be a separate controller as explained below. This Policy does not request blanket consent.

2. Data and sources

You provide account details (email, username, password processed as a secure hash, avatar), settings, lists, favourites, trip plans, reviews, photographs, posts, votes, reports and correspondence. When you choose Apple or Google login, the provider supplies its account identifier and available authentication details and email, including an Apple relay address. We do not receive your Apple or Google password.

Searches send the entered query and filters to the server. If you use a relevant feature and allow location access, we receive your location or map area. Recent searches may remain on your device. Functional search data are separate from product analytics; entering a query does not consent to marketing analysis of its text.

We process the IP address visible in a connection, session and security data, device model, operating system, app version, language, regional settings and time zone. Notifications use APNs/FCM tokens, a Firebase installation identifier and necessary delivery data; a token may be associated with a signed-in account. Crash reports may contain an error description, stack trace, technical event traces, device information and a diagnostic account identifier.

Partners provide organisation and venue details, manager and staff details, invitations, evidence of authority to manage a profile, menus, photographs, review replies, billing data and service settings. Venue information may also come from public sources, user suggestions and the Operator’s verification. Where information identifies a natural person, that person may ask for the specific source and request correction. We provide required information to people identified by a Partner or public source, generally within one month, upon first contact or disclosure, as applicable under GDPR Article 14.

3. Purposes and legal bases

• Accounts, authentication, synchronisation, searches, favourites, requested publication, trip plans and requested contact: performance of a contract or pre-contractual steps at your request, GDPR Article 6(1)(b).
• Security, access control, abuse prevention, minimised error diagnostics, necessary feature configuration and defence of claims: the Operator’s legitimate interests, Article 6(1)(f), in providing a secure service and protecting participants. You may object.
• Legal obligations, data subject rights, required reporting and tax records for sales: Article 6(1)(c) together with applicable law. This does not require keeping all app data for tax purposes.
• Optional product analytics and measured experiments are disabled in the launch app; we do not collect new consent for this purpose. Earlier consent and data from previous versions are addressed in the Analytics Notice.
• Partner staff accounts: contract performance where the person is a contracting party; otherwise legitimate interests in managing cooperation and access under Article 6(1)(f).

Required fields are identified when collected. Without them, the relevant account, enquiry or payment cannot be handled. Optional data and refusals do not block independent basic features.

4. Health data, Visits and venues

We do not require a diagnosis, medical documentation or test results to create an account. Choosing a directory of gluten-free options does not mean that we infer a disease. Do not publish other people's health information or private contact details.

If you deliberately make your own health data public in a review or discussion, GDPR Article 9(2)(e) may apply only to data you have actually and manifestly made public yourself. We do not extend this exception to private messages, inferred health profiles or other people's data. You may request removal of disclosed information. Health data are not used for advertising profiling.

Visits is disabled in the launch release. We do not collect dietary requirements or private arrangements with venues through this feature. Any introduction requires separate notices, definition of the venue's and Operator's roles, and appropriate legal bases and evidence for health data.

5. Venue updates and messages

Max messages and their measurement are disabled in the launch release. Saving a venue as a favourite, signing in or accepting the Terms does not enable venue marketing. Before offering messages or measurement, we will provide separate information and ensure appropriate legal bases and withdrawal of any required consent.

6. Analytics and diagnostics

Optional product analytics, measured GrowthBook experiments and product-event breadcrumbs are disabled in the launch app. Previously saved consent does not enable them in the new release. We do not offer new consent or change the user's decision history. The Analytics Notice explains earlier data and related requests.

Operational notifications, minimised Sentry/Crashlytics diagnostics and ordinary feature-definition downloads may operate without product analytics consent. Providers see necessary connection metadata, including IP. Diagnostics may use an account identifier to investigate failures; this does not use the account identifier for product analytics. See the Cookies and SDK Notice for device access.

7. Recipients and international transfers

Authorised service personnel and infrastructure providers receive necessary data: OVHcloud for hosting and databases; Cloudflare for files, backups and content delivery; Brevo for operational email, including account-related messages; Apple for login, maps and APNs; Google for login, FCM and Crashlytics; Sentry for diagnostics; GrowthBook for operational feature configuration. Android retrieves its map from OpenFreeMap (Hyperknot Software Kft., Hungary); tile requests transmit connection data, including IP address and the requested map area. Historical data from earlier analytics may remain in Google Analytics/BigQuery under the applicable retention and rights procedures; new collection by the launch app is disabled.

Paid Partner plan purchases are not enabled in the launch release. If payments are introduced, we will identify the payment provider, data scope and applicable terms before data are transferred. Public authorities may receive data on a proper legal basis.

Public content is visible to other users, and some to people without accounts. Having a Partner account does not entitle a venue to sell users' data.

Providers may use infrastructure or support outside the EEA, including the United States. Transfers require an applicable adequacy decision or, in its absence, standard contractual clauses and assessment of necessary additional safeguards. The DPF is used only for an entity and service covered by valid certification. An EU server location alone does not exclude a transfer. Contact support@conttinu.com for countries, recipients and a copy or description of safeguards, subject to protection of confidential information and others’ rights.

8. Retention and deletion

• Account data, private lists and plans: while used, until account/data deletion, subject to a specific legal obligation or dispute.
• Public content: until removed or a justified moderation decision; third-party copies are outside the Operator’s direct control.
• Web server logs: daily rotation with 14 archives. Crashlytics reports and associated identifiers: the provider begins deletion after 90 days. Other security logs and Sentry reports are retained for the time needed to identify and resolve an error or investigate an incident; evidence of a specific dispute is retained until the matter ends and the applicable claims period expires. This does not justify indefinite retention of all logs. Search data serve the request; any logged data are minimised and follow the retention applicable to that log.
• GA4: non-aggregated data covered by retention settings for up to 14 months, without restarting the period on new activity. Historical BigQuery exports are retained for the time needed to verify measurement and investigate errors in earlier releases; once that purpose ends, they are deleted or aggregated, and a valid erasure request may apply earlier. GA4 retention does not automatically govern BigQuery exports. Aggregated statistics that cannot identify someone may remain longer.
• Complaint correspondence and claim records: until the matter closes and the applicable limitation period expires; no single maximum period is automatically applied to every case. Tax records are kept as required, generally five years from the end of the year in which the tax payment deadline fell, subject to interruption or suspension rules.
• Backups: daily up to 7 days, weekly up to 28 days monthly up to 180 days, and copies created before restoration up to 14 days. Confirmed deletions are reapplied after restoration before ordinary access resumes.

After a confirmed request, we delete the account and associated active-service data without undue delay, usually within minutes; file deletion failures are retried. We respond to rights requests within GDPR deadlines. A technical deletion trace, including a hash used to recognise reintroduced data after restoring backups and operation dates, is retained up to 180 days. We do not call this hash fully anonymous. Account-linked acceptance and consent histories are deleted with the account; separate minimal dispute evidence may be preserved only on an established basis.

Withdrawal stops future operations but does not make earlier processing unlawful or automatically erase every historical provider record. Separate deletion requests are handled within lawful and available identification limits. Account deletion does not automatically remove records a venue lawfully retains as an independent controller in its own separate relationship with you.

9. Your rights

You may request access and a copy, rectification, erasure, restriction and portability where the GDPR provides them. Contact support@conttinu.com to withdraw an earlier consent; the launch app does not offer an analytics switch. You may object to legitimate-interest processing on grounds relating to your situation; objection to direct marketing is unconditional and includes related profiling.

We respond without undue delay, normally within one month. Complexity or the number of requests may justify up to two additional months; we explain this within the first month. Identity verification is proportionate and does not automatically require an ID scan. If we refuse, we explain why and the remedies. Exercising basic rights is free.

You can complain to the President of the Polish Personal Data Protection Office through uodo.gov.pl, or another competent EU authority under GDPR Article 77, and seek judicial protection. See Complaints, Data Rights and Deletion for procedures and forms.

10. Automated decisions, protection and changes

We do not make solely automated decisions with legal or similarly significant effects under GDPR Article 22. Sorting, recommendations and optional message scenarios are not medical assessments. Automated safety filters may block content; human contact and reconsideration are available.

We use access controls, transport encryption, secure password storage and data minimisation. Administrative access is limited to authorised people. We explain changed purposes or material data expansion before new processing and seek a new decision where consent is required. The version and effective date identify the particular notice.

11. Minors

Conttinu sets no minimum age of its own for the consumer app and does not ask for age or date of birth. This does not mean that we assume every user is an adult. Processing is limited to the applicable purposes and legal bases; accepting the Terms does not replace consent to optional processing.

The launch app does not offer analytics consent or Max marketing messages. If future processing for a service offered directly to a child requires consent under GDPR Article 8, consent or authorisation from the holder of parental responsibility will be required below the applicable age threshold. A legal representative's involvement in contracting is required where provided by law. This does not mean that access to the app itself requires universal guardian verification. Contact the Operator about a child's data.