Политика конфиденциальности

The data controller is Greek Island Platforms Single Member P.C. (registered in Greek as Greek Island Platforms ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.).

Γ.Ε.ΜΗ. (General Commercial Registry) 195743338000
VAT No. 803382933
EUID ELGEMI.195743338000
Registered office: Naxos 84300, Greece
Supervisory body: Chamber of Kyklades, member reg. 65787

Write to us about anything on this page at [email protected].

We have not appointed a Data Protection Officer, because we are not required to have one.

The iPhone and Android apps are published on the App Store and Google Play by Global Outsource Solutions Pty Ltd (Australia), which holds the developer accounts, on behalf of Greek Island Platforms Single Member P.C. That is why the stores show it as the seller.

Global Outsource Solutions does not operate the service and does not receive your data. The controller for everything described on this page is Greek Island Platforms Single Member P.C., and that is who to contact: [email protected].

Страницы навигации (/q, /map): выбранный язык (cookie) и, только с вашего разрешения, местоположение устройства — используется на вашем устройстве и для маршрута. Во время навигации мы также сохраняем анонимный след прогулки (позиции под случайным идентификатором, никогда не связанные с вами), чтобы улучшать карту и подсказки. Стандартная аналитика (Google Analytics) считает посещения.

Приложение картографа: ваш аккаунт (имя и e-mail из Apple или Google) и записанные прогулки — 3D-геометрия переулков и GPS-треки. Камера используется только для отслеживания движения на устройстве; фото и видео никогда не сохраняются и не загружаются.

Только с вашего согласия. Приложения спрашивают один раз, до начала любого сбора данных, и ответ можно изменить в любой момент в Профиле. Если вы откажетесь, ничего не отправляется — это и есть настройка по умолчанию.

При согласии мы используем Google Analytics для Firebase и Firebase Crashlytics (Google Ireland Limited), чтобы считать, какие экраны и функции используются, и получать отчёты о сбоях. Что отправляется: название экрана или кнопки, счётчики, язык, версия приложения, случайный идентификатор установки, модель устройства и ОС, а также приблизительная страна, которую Google определяет по IP-адресу и которую мы не можем отключить. Что никогда не отправляется: имя, email, аккаунт, сохранённое жильё, текст поиска или координаты GPS. Рекламные идентификаторы полностью отключены.

Правовое основание: ваше согласие (ePrivacy ст. 5(3); GDPR ст. 6(1)(a)). Отозвать можно в любой момент в Профиле. Хранение: события 14 месяцев, отчёты о сбоях 90 дней.

Описанная выше анонимная запись маршрута отделена от этого и продолжается независимо: она не содержит идентификаторов и не покидает наши серверы.

Данные прогулок строят публичную карту острова. Одобренные вклады приносят баллы в публичном рейтинге (только имя). Мы не продаём персональные данные.

We use a small number of providers. Each is bound by a data-processing agreement and may only act on our instructions. Providers outside the EEA are marked.

DigitalOcean, LLC — hosting. Our server and database run in New York, United States; account, claim and walk data is stored there. This is outside the EEA. Transfer safeguard: Standard Contractual Clauses.

Cloudflare, Inc. (United States) — DNS, content delivery, security filtering and the edge analytics described in the cookie policy. Transfer safeguard: EU–US Data Privacy Framework, backed by Standard Contractual Clauses.

Google Ireland Limited (Ireland) — Google Analytics 4 for this website, and Google Analytics for Firebase plus Crashlytics inside the apps, with onward transfer to Google LLC in the United States under the EU–US Data Privacy Framework, backed by Standard Contractual Clauses in Google's data-processing terms.

Twilio Inc. / SendGrid (United States) — the transactional email we send (owner welcome kits, sign-in alerts, our replies). Transfer safeguard: EU–US Data Privacy Framework, backed by Standard Contractual Clauses.

Anthropic, PBC (United States) — translates the recommendations hosts write for their guests into our other languages. Only the host's own text is sent, never anything about guests or visitors, and it is not used to train models. Transfer safeguard: Standard Contractual Clauses in Anthropic's data-processing terms.

Apple Inc. and Google Ireland Limited — only if you create a mapper account with Sign in with Apple or Google sign-in. They pass us your name and email; we pass them nothing about you.

The EU–US Data Privacy Framework is under appeal before the Court of Justice of the EU (Latombe, C-703/25 P). If it is ever set aside, the Standard Contractual Clauses already in place with each provider continue to apply.

We do not sell personal data and we do not share it for advertising.

Giving you directions — our legitimate interest in running the service you asked for (GDPR Art. 6(1)(f)). Your location is used in your browser and to compute the route. We never store your position against you.

Anonymous walk traces — legitimate interest in finding where our directions send people wrong (Art. 6(1)(f)). A trace carries a random per-walk identifier and no account, name, device id or IP address. Because any GPS trace could in principle be re-identified, we treat these as pseudonymous rather than truly anonymous. Kept 24 months, then deleted automatically. If your browser sends a Global Privacy Control signal, no trace is recorded at all. A walk to one of your own saved places to stay is sent without its destination and without its last 150 m, so a trace never shows where you are staying.

Mapper account and contributions — performance of our agreement with you (Art. 6(1)(b)). Kept while your account exists, and erased within 30 days of your deletion request. Street geometry you contributed stays in the public map, detached from you.

Business listing claims — steps taken at your request before an agreement, plus our legitimate interest in checking who owns a listing (Art. 6(1)(b) and (f)). Kept 24 months after the claim is decided, then deleted automatically. Details you publish on your listing stay public until you ask us to remove them.

Hosts’ recommendations — a host who gives us recommendations for their guests can choose to show their first name with them; performance of our arrangement with the host (Art. 6(1)(b)). Kept while the recommendations are published, and removed when the host asks. Guests who open them are not identified. For each host map we keep daily totals: how often it is opened and from where (a room card, the front door, a website, our app), how often its places and walks are used and how far walks get. A total holds no identifier, device, IP address or position, so it cannot point at anyone. See the cookie policy for the anonymous page statistics.

Email to business owners — legitimate interest in offering a free listing to a business we have already mapped (Art. 6(1)(f)). We take the address from the business's own sign, website or public listing. One reply stops it for good. Kept 24 months from our last contact.

App analytics and crash reports — your consent, and nothing is collected until you give it (Art. 6(1)(a)). Crash reports are kept 90 days; analytics events are kept for the retention period set in our Google Analytics settings (currently 2 months for event-level data and 14 months for user-level data).

Website analytics — see the cookie policy.

Security: sign-in alerts, rate limiting and server logs — legitimate interest in keeping the service up and unabused (Art. 6(1)(f)). Your IP address is used as a short-lived rate-limit counter in memory. When a member of our team signs in to our staff tools, we record the IP address and rough location of that sign-in for security: kept 90 days. Visitors and mappers are never recorded this way. Logs kept 90 days. They keep the full page address, except the exact position of someone asking for walking directions, which is cut out before anything is written.

We make no automated decisions about you and build no profiles.

Попросите удалить аккаунт и вклады в любой момент: [email protected]. Жители ЕС имеют права по GDPR (доступ, исправление, удаление, переносимость).