Privacy Policy

1. Controller

[NAME / COMPANY]
[ADDRESS]
Email: [EMAIL ADDRESS]

2. Hosting & server log files

This website is hosted by [ENTER HOSTING PROVIDER]. When you access the site, our hosting provider automatically collects so-called server log files (IP address, date/time of access, page accessed, browser type, referrer URL). This data is used to ensure trouble-free operation and IT security (Art. 6(1)(f) GDPR) and is automatically deleted after [PERIOD, e.g. 7 days].

3. User account & registration

For certain features (writing reviews, saving stores, adding your own stores) you can create a user account. In doing so, we process:

• Name, email address
• If you register with email & password: your password, stored exclusively as a hash (bcrypt) — we never have access to your plaintext password
• Time of registration and email confirmation
• Saved stores/products and reviews you have written

The legal basis is the performance of the usage agreement with you (Art. 6(1)(b) GDPR). To secure your account, we also set a technically necessary session cookie (Art. 6(1)(f) GDPR), which expires upon logout or when the session ends.

4. Login with Google

Alternatively, you can register/sign in via “Sign in with Google”. In doing so, Google Ireland Limited (or, for users outside the EEA: Google LLC, USA) transmits your name, email address and, where applicable, your profile picture to us. Google's privacy policy applies: https://policies.google.com/privacy. The legal basis is your consent through actively choosing this login option (Art. 6(1)(a) GDPR). For transfers to the USA, Google states that it relies on standard contractual clauses and/or the EU–U.S. Data Privacy Framework.

5. Sending emails (confirmation & password reset)

To confirm your email address and for the “forgot password” process, we send automated emails via [ENTER SMTP PROVIDER, e.g. GMX]. In doing so, your email address is transmitted to the respective mail provider. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) or our legitimate interest in securing accounts (Art. 6(1)(f) GDPR).

6. Maps (OpenStreetMap)

To display store locations, we embed map material from OpenStreetMap. When the map loads, your IP address is transmitted to the servers of the OpenStreetMap Foundation. Further information: https://osmfoundation.org/wiki/Privacy_Policy. The legal basis is our legitimate interest in a clear presentation of store locations (Art. 6(1)(f) GDPR).

7. Sponsoring & payment processing (Mollie)

Store owners can take out a paid, monthly cancellable sponsoring subscription to have their store shown preferentially in search, categories and, where applicable, on the homepage (clearly marked as “Sponsored”). For payment processing we use the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. In doing so, name, email address and the payment data required for processing are transmitted to Mollie; Mollie processes this data as an independent controller in accordance with Mollie's privacy policy (https://www.mollie.com/en/privacy). The legal basis is the performance of the sponsoring subscription contract (Art. 6(1)(b) GDPR). We do not process payment data itself (e.g. card numbers) on our own servers — this remains with Mollie.

8. Insights & reach measurement

For views of store detail pages, we collect our own, server-side statistics, which we provide to store owners in an insights overview (views over time, origin, approximate location, search queries) — comparable to simple metrics from Google Analytics or Google Search Console, but without third-party tracking. We collect:

• the page viewed and the referrer URL (if available)
• an approximate, usually two-letter country code, if provided by our hosting provider/proxy or — if not — determinable via an external geolocation service (ipapi.co); in the latter case your IP address is transmitted once to ipapi.co for this purpose
• a daily-recalculated, salted hash value derived from an anonymized IP address and browser identifier, used to roughly estimate unique visitors — this value cannot be reversed to your actual IP address and changes daily, so it is not suitable for tracking across multiple days

We never store complete IP addresses and do not use cookies for this purpose. Additionally, we record how often a store appears in search and category results (“impressions”), so we can show store owners metrics similar to Google Search Console. The legal basis is our legitimate interest, and that of store owners, in traceable reach figures (Art. 6(1)(f) GDPR). Individual page views are automatically deleted or aggregated after 12 months.

9. Your rights

You have the right at any time to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data or your account (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a data protection supervisory authority

Simply reach out to: [EMAIL ADDRESS]