We never sell your personal data. We do not rent it or hand it to advertising networks or data brokers. We use it only to make the app work for you.
Who processes your data (controller)
The data controller is TERRA VOLTA EOOD (UIC 207322301), registered at 1 Pirin St, entr. B, fl. 3, apt. 18, Momchilgrad 6800, Bulgaria, operator of the “Haide” app. Contact: shakito999@gmail.com, +359 894 764 846.
What data we collect
- Profile data you enter: name, username, email, photo (optional), short bio, gender, date of birth, city, languages and interests.
- Content you create: events, RSVPs, chat messages, reviews and Scheduler plans.
- Location for sorting events: (1) approximate location derived from your IP address by our host (Vercel), rounded to about 1 km — used only at that moment to sort events by distance and never stored; (2) precise location from your device — only if you allow it, kept on your device for up to 24 hours and not stored on your profile; (3) a place you pick yourself (e.g. a city for a trip) — kept only on your device. You can change or clear it with one tap.
- Time zone of your device (e.g. “Europe/Sofia”): stored on your profile so times and your free time in the Scheduler are shown and computed in local time.
- Calendar busy-times (if you connect a calendar in the Scheduler): we extract only busy/free intervals — never the titles or contents of your events.
- Technical data: page visited, referrer, approximate country/region, device, operating system and browser type, log data and IP address — for security, reliability and aggregate statistics. For Scheduler guests the IP is stored only in hashed form.
- Notification subscription (optional), if you enable push notifications.
Why we use your data and on what basis
- Performance of a contract (Art. 6(1)(b) GDPR): to create and run your account, and to show and organise events, chat and the Scheduler.
- Consent (Art. 6(1)(a)): for push notifications, precise location and other optional features. You can withdraw consent at any time.
- Legitimate interests (Art. 6(1)(f)): safety, moderation, spam/abuse prevention, security and improving the service, and sorting events by approximate (unstored) location.
- Legal obligation (Art. 6(1)(c)): where applicable law requires it.
Who we share data with
We use the following providers only as necessary to run Haide. Depending on the service, they act as processors on our instructions or as independent controllers for their own services:
- Supabase — database, authentication and file storage; data is hosted on servers in the European Union (Frankfurt, Germany).
- Brevo — sends transactional sign-in and security emails on our behalf. It receives the recipient email address, the transactional-email contents and technical delivery data. We do not use Brevo for marketing emails.
- Vercel — hosting, technical logs, anonymous Web Analytics and Speed Insights. Analytics uses no advertising identifiers or third-party cookies and receives page, referrer, approximate geography and device/browser data.
- Cloudflare Turnstile — protects sign-in against bots and abuse using technical browser signals; it does not receive form contents.
- Google — only if you choose Google sign-in or connect Google Calendar. For Calendar we keep an encrypted token, selected calendars and extracted busy/free intervals; we do not keep meeting titles or descriptions.
- OpenCode and selected AI models — automated safety screening of public events. We send the public title, description, additional details and cover to detect drug promotion, prostitution, violence, scams and other serious violations. We do not send email, private profile data, private chats or calendar data.
- Map services (OpenFreeMap / OpenStreetMap for maps, Geoapify (Germany) for address search) — receive map requests, address and city searches, and the name of your approximate city (to show it in your language), without your profile data.
- Weather service (MET Norway, Norway) — receives only approximate event coordinates, no personal data.
Information that is public by design (for example a “public” event or a public profile) is visible to other users according to your privacy settings.
Where your data is stored
Your core information in Supabase is stored in Frankfurt, Germany. Providers such as Vercel, Cloudflare, Google and OpenCode may process limited data outside the EEA. We use an applicable GDPR mechanism — an adequacy decision, the EU–US Data Privacy Framework for certified recipients, or Standard Contractual Clauses. You can ask us for information about the specific safeguards.
How long we keep data
We keep your profile and content while your account is active. When you request deletion, the account is deactivated and permanently erased after a 7-day grace period (during which you can cancel). We keep minimal data longer only where required by law or to prevent abuse and protect safety.
Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy (the app also has an export feature);
- rectify inaccurate data (directly from your profile);
- erasure (the “right to be forgotten”);
- restrict processing and object to processing;
- data portability;
- withdraw consent at any time, without affecting processing before the withdrawal.
To exercise your rights, email us at shakito999@gmail.com. We will respond within one month.
Right to complain
If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority: the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, email kzld@cpdp.bg, website www.cpdp.bg.
Cookies and local storage
- Sign-in and security — session data, PKCE/OAuth state, bot protection and a local sign-in-code rate limit; necessary for the requested service and its security.
- Preferences — theme, language, filters, recent searches and dismissed tips; remember your choices on this device.
- Drafts and Scheduler — an unfinished event, guest name/identifier and last approximate location (up to 24 hours) when you use those features.
- Offline cache — IndexedDB and service-worker caches for faster loading, tickets/QR and requested screens; cached query data is limited to 24 hours and can be cleared in the browser.
- Statistics — Vercel Web Analytics and Speed Insights measure aggregate use and performance without advertising cookies or an advertising profile.
We use no advertising cookies, cross-site tracking or marketing pixels. You can clear local data in your browser settings; doing so may sign you out and remove offline content.
Moderation and automated tools
Public events may be screened automatically by AI for drug promotion, prostitution, violence, scams and other serious violations. Screening uses only the public event content and may temporarily hide it for human review; it does not delete content or block an account. User reports also receive human review. When we restrict content, we give a reason and a way to appeal.
Children
The service is not intended for anyone under 16. If you believe a child has given us personal data, contact us and we will remove it.
Security
We protect data with encrypted connections (HTTPS), database-level access rules (RLS) and EU hosting. No system is entirely risk-free, but we aim for a high level of protection.
Changes to this policy
We may update this policy. For material changes we will notify you in the app and update the date above.
Contact
TERRA VOLTA EOOD, 1 Pirin St, entr. B, fl. 3, apt. 18, Momchilgrad 6800, Bulgaria. Email: shakito999@gmail.com. Phone: +359 894 764 846.