Hauspot Privacy Policy
Draft. Hauspot is in testing. Fields in square brackets will be completed before launch. This text needs a lawyer's review before publication.
1. Who is responsible for your data
The controller of your personal data is [operator name], [address], [tax / company register number] ("the Operator", "we").
For anything concerning personal data, write to us: kontakt@hauspot.pl.
This policy covers:
- the Hauspot mobile app - searching for pet-friendly places, reviews and favourites,
- the Hauspot website, including its contact forms,
- the Business Panel - venue owners' accounts and their venues' information.
2. What data we process and why
We collect only what we need for the service to work. All categories are listed below.
2.1 App account
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Signing in, contact about the account | Performance of a contract (Art. 6(1)(b) GDPR) |
| Display name | The signature under your reviews | Performance of a contract |
| Sign-in identifier | Linking the account to the sign-in service (Firebase Authentication) | Performance of a contract |
We do not know your password. Sign-in is handled by Firebase Authentication (Google); we only receive confirmation that it is you.
2.2 Reviews and favourites
| Data | Purpose | Legal basis |
|---|---|---|
| Rating, review text, date, your display name | Reviews are public - every user sees them on the place's page | Performance of a contract |
| List of favourite places | Your list in the app; it is not public | Performance of a contract |
2.3 Location
- With your permission in the phone's settings, the app reads the approximate position of the device to show places nearby and the distance to them.
- The position is sent to our server in queries for places and is not stored in your account. It may appear in the server's technical logs (section 2.7).
- The last position is remembered only on your device, so the app works straight away when it starts.
- We work out the name of the city and district ("Warszawa, Śródmieście") by sending the OpenStreetMap Nominatim service the position rounded to about 100 m - from our server, with no data about you.
- Without location permission the app keeps working; distances are then counted from the last known position or from the centre of Warsaw.
Legal basis: performance of a contract (searching nearby is a feature you ask for). You can withdraw location access at any time in the phone's settings.
2.4 Place suggestions
When you suggest a place that is not in Hauspot, we process the place's name and address, your note, the photo you add and - if you are signed in - the link between the suggestion and your account.
Legal basis: our legitimate interest in growing the database of places (Art. 6(1)(f) GDPR).
2.5 The "I run a venue" form
The venue's name, an email address and, if you give them, your full name, phone number and message. We use them to contact you about adding the venue.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
2.6 Business account (Business Panel)
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, contact person's full name, phone number | The account, contact about verifying the venue | Performance of a contract |
| Date and version of the accepted terms and policy | Demonstrating acceptance | Legal obligation and legitimate interest |
| Venue information and its history of changes | Verification, publication, resolving disputes | Performance of a contract and legitimate interest |
The contact details of the person running the account are not public. What is public is the venue information the owner enters for guests: name, address, the venue's phone and website, hours, menu, photos.
Every version of a venue's information is kept, so that it is known who changed what and when.
2.7 Technical data
- Session: the session refresh token - in the app in the phone's secure storage, on the website in the browser tab's storage (
sessionStorage, cleared when the tab is closed). On the server we keep its hash, so that the session can be signed out. - Server logs: IP address, date and time, the request address (which may contain an approximate position from a search) and information about the browser or app. They serve security and fixing errors; we keep them for 30 days.
- Abuse protection: the IP address for 1 minute, to count requests.
Legal basis: legitimate interest - the security and operation of the service.
2.8 Emails
We send only messages related to the service: confirmation of the email address, a link to set or change the password, decisions about your venue, a one-off reminder about a venue not yet sent, and announcements for businesses (e.g. about a change to the terms or about fees) - in the Business Panel - as well as confirmation that an account was deleted. We do not send newsletters or advertising.
Sent messages. We record every email we send (to whom, when, its content), so that we can show that we informed you of a decision, a change to the terms or fees. We keep them for 3 years after sending - also after the account is deleted, because they serve as evidence in a dispute. [to be specified]
3. Who we share data with
We do not sell data. We use providers who process data on our behalf:
| Provider | Purpose |
|---|---|
| Google (Firebase Authentication, Cloud Storage for Firebase) | Sign-in; storing photos and logos |
| Google (Google Maps, Android) and Apple (Apple Maps, iOS) | Showing the map in the app - the map provider receives the data needed to show it, under its own privacy policy |
| OpenStreetMap Foundation (Nominatim) | Finding the coordinates of a venue's address and the name of the city and district for an approximate position - with no data about you |
| Resend | Sending the messages described in section 2.8 |
| OVHcloud | The server (VPS) in the European Union on which Hauspot runs |
Some providers are based outside the European Economic Area (e.g. in the USA). Data is then transferred on the basis of a European Commission decision (the EU-US Data Privacy Framework) or standard contractual clauses.
We may also disclose data to public authorities when the law requires it.
4. How long we keep data
| Data | How long |
|---|---|
| App account | Until the account is deleted |
| Reviews | Until the review is deleted; after the account is deleted the review stays without the author's data ("Deleted user") - the rating concerns the place, and removing it would allow the average to be manipulated |
| Favourites | Until the account is deleted |
| Business account | Until the account is deleted; the venues are hidden |
| Venue history of changes | For as long as the venue exists in Hauspot and 3 years after it is deleted |
| Place suggestions and "I run a venue" forms | 12 months |
| Sent emails | 3 years after sending, also after the account is deleted |
| Server logs | 30 days |
5. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectification of your data,
- erasure of your data - you can delete the account yourself in the app (Account → Delete account) or by writing to us,
- restriction of processing,
- portability of the data you gave us,
- object to processing based on our legitimate interest,
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
To exercise your rights, write to kontakt@hauspot.pl. We will reply within a month.
Giving data is voluntary, but without an email address you cannot create an account, and without contact details - a business account. You can browse places without an account.
We do not make decisions about you based solely on automated processing, including profiling.
6. Cookies and device storage
The website does not use analytics or advertising cookies. The Business Panel keeps the session in the browser tab's storage (section 2.7).
The app stores on the device: the session token (in secure storage), the chosen language, theme and the last position.
7. Children
Hauspot is for everyone, including families with children. Browsing places does not require an account. If a minor creates an account, they should do so with the knowledge of a parent or guardian. A parent or guardian may ask us to delete a child's account at any time.
8. Changes to this policy
We will announce material changes in the app or by email. Venue owners will accept the new version at their next sign-in to the panel.