Privacy Policy

etlas is a food-focused social network: you discover restaurants and cafés, follow your friends, post the visits you make with a photo and your rating, save favourites, book tables and join the clubs of the places you love. This policy explains what data we process, why, and the control you have over it.

1. Who processes your data

The data controller is etlas OÜ, a private limited company (osaühing) incorporated in Estonia, owner of the application and the platform.

You can write to that address about anything related to your data, including exercising the rights described below.

2. What data we collect

• Account data: name, username, email address and password (always stored encrypted, never in plain text). Optionally, profile photo, bio and your food preferences.
• Content you post: the photos of your visits, the rating you give each place (on a 1-to-7 scale), your comments, your stories and the direct messages you send to recommend a place.
• In-app usage data: the places you save as favourites, the ones you have visited, the loyalty clubs you join, your table and anti-waste pack bookings, plus who you follow and who follows you.
• Approximate location: only while you are using “Discover”, to sort and show nearby places. We do not track your location in the background and we keep no history of where you have been.
• Basic technical data: device type and OS version, a session token, and — if you enable them — identifiers to send you notifications.

We do not access your contacts, your messages in other apps or your activity outside etlas.

3. Device permissions

• Camera and photo library: requested only when you post a visit, a story or change your profile photo. Only the image you choose is uploaded.
• Foreground location: only to show you nearby places in “Discover”. Background location is never requested.
• Notifications: optional, to tell you about interactions, messages and the status of your bookings.

You can grant or revoke any of these permissions at any time in your device Settings. The app keeps working, though features that depend on them will become unavailable.

4. Why we use your data and on what legal basis

• Creating and maintaining your account, publishing your content, following people, messaging, and managing your bookings and clubs. Legal basis: performance of a contract (art. 6.1.b GDPR).
• Keeping the service secure, preventing fraud and abuse, moderating content and improving the app. Legal basis: legitimate interest (art. 6.1.f GDPR).
• Showing you nearby places using your location and sending you notifications. Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time in your device Settings.
• Complying with our legal obligations where applicable. Legal basis: legal obligation (art. 6.1.c GDPR).

5. Who we share data with

We do not sell personal data or hand it to third parties for advertising. Data is shared only in these cases:

• With the relevant business, and only what is needed: when you book, the venue receives your name and booking details; when you join its club, the data needed to identify you as a member.
• With other users, for whatever you choose to publish, according to your account settings. Direct messages are only seen by their recipient.
• With infrastructure providers (cloud hosting, image storage, email and notification delivery), acting as processors on our behalf under contract, with no right to use the data for their own purposes.
• With competent authorities, where a legal obligation requires it.

If you sign in with Google Sign-In, Google provides us your name, email and profile photo to create your account. We do not share your etlas activity with Google.

6. Your rights (GDPR)

Our users are in Spain and Portugal, so Regulation (EU) 2016/679 applies. You have the right of access, rectification, erasure, portability, objection, restriction and to withdraw consent at any time.

To exercise them, write to app@etlas.info from the address linked to your account. We will reply within one month.

You may lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee) or with your local authority: in Spain, the AEPD (www.aepd.es); in Portugal, the CNPD (www.cnpd.pt).

7. How to delete your account

8. Data retention

We keep your data while your account is active. Direct messages remain while both participants’ accounts exist. Stories are deleted after 14 hours. The device session token is deleted when you log out.

9. Security

All communication travels encrypted over HTTPS. Passwords are stored with irreversible hashing and nobody on our team can read them. Internal access to data is limited to the people who need it to run the service.

10. Minors

The minimum age to use etlas is 14. If we detect an account belonging to someone younger, we will delete it. If you are a parent or guardian and believe a minor in your care has created an account, write to app@etlas.info.

11. Changes to this policy

We may update this policy. The current version will always be published at this address, with its date. If a change is significant, we will tell you inside the app.

12. Contact

For any privacy question or to exercise your rights, write to app@etlas.info or by post to etlas OÜ, Sepapaja tn 6, 15551 Tallinn, Harju, Estonia.