Informativa sulla privacy

The data controller is Greek Island Platforms Single Member P.C. (registered in Greek as Greek Island Platforms ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.).

Γ.Ε.ΜΗ. (General Commercial Registry) 195743338000
VAT No. 803382933
EUID ELGEMI.195743338000
Registered office: Naxos 84300, Greece
Supervisory body: Chamber of Kyklades, member reg. 65787

Write to us about anything on this page at [email protected].

We have not appointed a Data Protection Officer, because we are not required to have one.

The iPhone and Android apps are published on the App Store and Google Play by Global Outsource Solutions Pty Ltd (Australia), which holds the developer accounts, on behalf of Greek Island Platforms Single Member P.C. That is why the stores show it as the seller.

Global Outsource Solutions does not operate the service and does not receive your data. The controller for everything described on this page is Greek Island Platforms Single Member P.C., and that is who to contact: [email protected].

Pagine di navigazione (/q, /map): la lingua scelta (cookie) e, solo se lo consenti, la posizione del dispositivo — usata sul tuo dispositivo e per il percorso. Durante la navigazione conserviamo anche una traccia anonima della camminata (posizioni con un identificativo casuale, mai collegate a te) per migliorare mappa e indicazioni. Statistiche standard (Google Analytics) misurano le visite.

App di mappatura: il tuo account (nome ed email da Apple o Google) e le camminate registrate — geometria 3D dei vicoli e tracce GPS. La fotocamera serve solo al tracciamento del movimento sul dispositivo; foto e video non vengono mai salvati né caricati.

Solo se acconsenti. Le app lo chiedono una volta, prima di raccogliere qualsiasi cosa, e puoi cambiare idea quando vuoi dal Profilo. Se rifiuti non viene inviato nulla — è anche l'impostazione predefinita.

Se acconsenti usiamo Google Analytics per Firebase e Firebase Crashlytics (Google Ireland Limited) per contare quali schermate e funzioni vengono usate e ricevere i report di arresto. Cosa viene inviato: nome della schermata o del pulsante, conteggi, lingua, versione dell'app, un identificativo di installazione casuale, modello del dispositivo e sistema operativo, e il tuo Paese approssimativo, che Google ricava dall'indirizzo IP e che non possiamo disattivare. Cosa non viene mai inviato: nome, email, account, alloggio salvato, testo di ricerca o posizione GPS. Gli identificativi pubblicitari sono completamente disattivati.

Base giuridica: il tuo consenso (ePrivacy art. 5(3); GDPR art. 6(1)(a)). Revocabile in qualsiasi momento dal Profilo. Conservazione: eventi 14 mesi, report di arresto 90 giorni.

La traccia anonima del percorso descritta sopra è separata e prosegue indipendentemente: non contiene alcun identificativo e resta sui nostri server.

I dati delle camminate costruiscono la mappa pubblica dell'isola. I contributi approvati guadagnano punti in classifica pubblica (solo nome). Non vendiamo dati personali.

We use a small number of providers. Each is bound by a data-processing agreement and may only act on our instructions. Providers outside the EEA are marked.

DigitalOcean, LLC — hosting. Our server and database run in New York, United States; account, claim and walk data is stored there. This is outside the EEA. Transfer safeguard: Standard Contractual Clauses.

Cloudflare, Inc. (United States) — DNS, content delivery, security filtering and the edge analytics described in the cookie policy. Transfer safeguard: EU–US Data Privacy Framework, backed by Standard Contractual Clauses.

Google Ireland Limited (Ireland) — Google Analytics 4 for this website, and Google Analytics for Firebase plus Crashlytics inside the apps, with onward transfer to Google LLC in the United States under the EU–US Data Privacy Framework, backed by Standard Contractual Clauses in Google's data-processing terms.

Twilio Inc. / SendGrid (United States) — the transactional email we send (owner welcome kits, sign-in alerts, our replies). Transfer safeguard: EU–US Data Privacy Framework, backed by Standard Contractual Clauses.

Anthropic, PBC (United States) — translates the recommendations hosts write for their guests into our other languages. Only the host's own text is sent, never anything about guests or visitors, and it is not used to train models. Transfer safeguard: Standard Contractual Clauses in Anthropic's data-processing terms.

Apple Inc. and Google Ireland Limited — only if you create a mapper account with Sign in with Apple or Google sign-in. They pass us your name and email; we pass them nothing about you.

The EU–US Data Privacy Framework is under appeal before the Court of Justice of the EU (Latombe, C-703/25 P). If it is ever set aside, the Standard Contractual Clauses already in place with each provider continue to apply.

We do not sell personal data and we do not share it for advertising.

Giving you directions — our legitimate interest in running the service you asked for (GDPR Art. 6(1)(f)). Your location is used in your browser and to compute the route. We never store your position against you.

Anonymous walk traces — legitimate interest in finding where our directions send people wrong (Art. 6(1)(f)). A trace carries a random per-walk identifier and no account, name, device id or IP address. Because any GPS trace could in principle be re-identified, we treat these as pseudonymous rather than truly anonymous. Kept 24 months, then deleted automatically. If your browser sends a Global Privacy Control signal, no trace is recorded at all. A walk to one of your own saved places to stay is sent without its destination and without its last 150 m, so a trace never shows where you are staying.

Mapper account and contributions — performance of our agreement with you (Art. 6(1)(b)). Kept while your account exists, and erased within 30 days of your deletion request. Street geometry you contributed stays in the public map, detached from you.

Business listing claims — steps taken at your request before an agreement, plus our legitimate interest in checking who owns a listing (Art. 6(1)(b) and (f)). Kept 24 months after the claim is decided, then deleted automatically. Details you publish on your listing stay public until you ask us to remove them.

Hosts’ recommendations — a host who gives us recommendations for their guests can choose to show their first name with them; performance of our arrangement with the host (Art. 6(1)(b)). Kept while the recommendations are published, and removed when the host asks. Guests who open them are not identified. For each host map we keep daily totals: how often it is opened and from where (a room card, the front door, a website, our app), how often its places and walks are used and how far walks get. A total holds no identifier, device, IP address or position, so it cannot point at anyone. See the cookie policy for the anonymous page statistics.

Email to business owners — legitimate interest in offering a free listing to a business we have already mapped (Art. 6(1)(f)). We take the address from the business's own sign, website or public listing. One reply stops it for good. Kept 24 months from our last contact.

App analytics and crash reports — your consent, and nothing is collected until you give it (Art. 6(1)(a)). Crash reports are kept 90 days; analytics events are kept for the retention period set in our Google Analytics settings (currently 2 months for event-level data and 14 months for user-level data).

Website analytics — see the cookie policy.

Security: sign-in alerts, rate limiting and server logs — legitimate interest in keeping the service up and unabused (Art. 6(1)(f)). Your IP address is used as a short-lived rate-limit counter in memory. When a member of our team signs in to our staff tools, we record the IP address and rough location of that sign-in for security: kept 90 days. Visitors and mappers are never recorded this way. Logs kept 90 days. They keep the full page address, except the exact position of someone asking for walking directions, which is cut out before anything is written.

We make no automated decisions about you and build no profiles.

Chiedi in qualsiasi momento la cancellazione di account e contributi: [email protected]. I residenti UE godono dei diritti GDPR (accesso, rettifica, cancellazione, portabilità).