KlendarPrivacy policy
This is a courtesy translation provided for information only. In case of any discrepancy, the Spanish version prevails.
To be completed before launch: the details highlighted in yellow (owner, tax ID, address) depend on the legal form chosen. This text is a professional draft and should be reviewed by a lawyer before the app is published.
This policy explains which personal data we process in the Klendar app and on klendar.app, why, on what legal basis, for how long, and what your rights are. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: [Owner / company name] · Tax ID: [Spanish tax ID (NIF/CIF)]
- Address: [Full address, Spain]
- Data protection contact: [email protected]
2. What we process and why
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| User account | Email, display name, password (hashed), date of birth, language, profile photo (optional), date and version of the terms you accepted | Create and manage your account; verify the minimum age (14) and access to 18+ content | Performance of a contract (art. 6(1)(b) GDPR); legal obligation for age (art. 6(1)(c); art. 7 LOPDGDD) | While the account is active. When you delete it, data is erased within 30 days unless we must keep it by law |
| Sign in with Google / Apple | Provider identifier, email, name | Passwordless authentication | Performance of a contract | Same as the account |
| Location | Approximate or precise device coordinates (depending on the permission you grant) or the city you pick manually | Sort the feed and the map by distance; "deals near you" if you enable it | Consent (art. 6(1)(a)), revocable in your device and app settings | No history is kept. Only the last known location is stored (for "near you") and discarded after 7 days |
| Favourites, reviews, redemptions | Saved businesses, ratings and comments, redemption codes and their status, deal views | Provide the service: your favourites, your public reviews, your redemption history and aggregate statistics for businesses | Performance of a contract | While the account exists. Reviews are shown with your display name |
| Push notifications | Device token, preferences (favourites, nearby, quiet hours) | Alert you about news from your favourites and nearby deals | Consent, revocable at any time | Until you revoke the permission, sign out or delete the account |
| Business account | Business details (name, address, tax ID, phone, contact email, opening hours), team members (email and role), plan and payments | Register, verify and manage the business; invoice the subscription | Performance of a contract; legal obligation (invoicing) | During the relationship and afterwards for the statutory period (tax: 4 years; commercial: 6 years) |
| Content reports | Identity of the reporter, reason, reported content | Moderate the Platform (Regulation (EU) 2022/2065, DSA) | Legal obligation and legitimate interest | 2 years from resolution |
| Diagnostics and performance | Installation identifier, device model and OS, crash reports, aggregate screen usage | Detect failures and improve the app (Firebase Crashlytics and Analytics) | Legitimate interest (art. 6(1)(f)): keeping the app stable | Crashlytics 90 days; aggregate Analytics 14 months |
| Marketing emails | Send you Klendar news (never from third parties) | Specific consent ticked at sign-up; revocable in every email or in your profile | Until you withdraw it | |
| Support | Email and the content of your message | Answer your enquiries | Performance of a contract / legitimate interest | 1 year after closure |
3. Recipients and processors
We never sell or share your data. To provide the service we rely on providers acting as processors under contracts compliant with art. 28 GDPR:
- Supabase (database, authentication and storage; servers in the European Union).
- Google Firebase (push notifications, crash reports and aggregate analytics; Google Ireland Ltd.; international transfers covered by the EU-US Data Privacy Framework and standard contractual clauses).
- Mapbox (maps; receives the coordinates of the area you look at in order to render the map).
- Cloudflare (hosting and content delivery for klendar.app; processes visitors' IP addresses to serve and protect the website).
- A transactional email provider for account emails.
Businesses see your display name when you redeem a deal or post a review, plus aggregate statistics (never your email or your location).
4. Minors
The minimum age to use Klendar is 14. Content marked "18+" (nightlife venues, alcohol) is only shown to people who have confirmed they are over 18 through their date of birth. If we detect an account belonging to someone under 14, we will delete it.
5. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by writing to [email protected] from your account email. From the app (Profile → Settings → Privacy and data) you can also see what you have consented to and when, withdraw location, push and marketing consent separately, download all your data as a file (access and portability), and delete your account entirely. If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
6. Security
Data is transmitted encrypted (TLS), passwords are stored hashed, database access is restricted by row-level security policies (each person only reaches their own data), and the providers listed hold recognised security certifications.
7. Changes
If we change this policy in a material way we will let you know in the app. The current version is always at klendar.app/privacidad (Spanish, governing) and klendar.app/en/privacy.