Privacy policy
Revision of 28 August 2026
Who processes the data
The operator is the company that owns this site. Its name, company number, address and the email for enquiries are in the footer of every page and on the contacts page. Write to that same address about anything in this document or about your data.
What we collect
Only what the site cannot work without, plus whatever you have agreed to yourself.
- The account: email address, display name, a hash of the password (we neither store nor see the password itself), interface language, and whether the address has been confirmed.
- What you publish: places, descriptions, opening hours, business contacts, adverts, events, reviews and photographs. Metadata is stripped from photographs on upload, including the coordinates of where they were taken.
- Technical data: the IP address and browser of each sign-in, server logs, session tokens, error reports.
- Counters for businesses: page views and taps on contacts, tied to a hash of "IP + browser + a daily salt". The salt changes every day, so the hash identifies nobody and cannot join one day to the next.
- Email: the fact that a confirmation, password reset or monthly figures letter was sent and delivered.
- Referrals: if you registered through somebody's invitation link, which account that was and the IP address you registered from. If you ask to be paid what you have earned, the phone number and the channel you gave us for that conversation.
Why, and on what legal basis
| Purpose | Basis |
|---|---|
| The account, publishing places and adverts, subscriptions | Performance of our contract with you |
| Security, defence against spam and password guessing, moderation, counters for businesses | Legitimate interest: the site has to work, and what is published has to follow the rules |
| Optional cookies and external analytics | Your consent, which can be withdrawn at any time from the site footer |
| Accounting and invoices for paid placement | Legal obligation |
Who we pass data to
We do not sell data and do not hand it over for anybody else's advertising. Below is everyone involved in running the site, and exactly what each of them sees.
| Who | What they see |
|---|---|
| Hetzner (server) | Everything in the database and the logs — the server is theirs. EU. |
| Cloudflare R2 (photographs) | The uploaded files, and the visitor's IP address when a photograph is shown. |
| MapTiler (map) | The visitor's IP address and which part of the map they opened. Tiles load straight from their servers. |
| Resend (email) | The recipient's address and the text of the letter. |
| DeepL (translation) | The text of a place or advert sent for machine translation. |
| Sentry (errors) | Technical details of an error: the page address, the browser version, the account identifier. |
Some of these services process data outside the EU. The transfers rest on standard contractual clauses within each processor's own agreement with us.
How long we keep it
| What | How long |
|---|---|
| The account and what you published | As long as the account exists. Once closed it is deleted at once, along with the places, adverts, reviews and photographs. |
| Sign-ins (IP address, browser) | 30 days from the last sign-in; expired ones are deleted automatically. |
| Confirmation and password reset links | Until used or expired, then deleted automatically. |
| Moderation decisions and complaints | Longer than the rest: they are the evidence that a decision had a reason. |
| Referral earnings and payout requests | The amounts and dates are kept as accounting records. The phone number and channel given for a payout are deleted 90 days after the request is settled. |
The exact periods for server logs, counters and accounting are set by the operator, and will appear in this table.
What is public
Places, adverts, events and reviews are public pages. Anybody reads them, search engines included, and a review carries the name its author gave at registration. It is worth knowing that before publishing.
We can take material off our own site, but not out of somebody else's search: removal from Google's index is neither instant nor ours to decide.
When you close your account your reviews go with it, and the ratings of the places you reviewed are recomputed without them.
Your rights
You may ask for access to your data, for correction, erasure, restriction of processing, portability, and you may object to processing or withdraw consent. Two of these work immediately and without writing to anybody — on the account page: download a copy of everything in one file, and close the account.
The operator answers other requests within one month. If the answer does not satisfy you, you may complain to the Office for Personal Data Protection of the Slovak Republic.
Age
The site is not meant for anybody under 16, and we do not knowingly collect their data.
No automated decisions
We make no decisions with legal or similarly significant effects automatically, without a person. Places and applications are reviewed by a moderator.
Changes
When what we keep or who we pass it to changes, this document changes and the revision date at the top moves with it. Where a change is significant we say so on the site, and where consent is involved we ask again.