Privacy policy
Last updated: [date]
In short: CompaCity has no accounts and collects no personal data about you.
It has no analytics, advertising or tracking, and the website sets no cookies. Your city and language are saved only on your phone. Like any online service, the servers that deliver content see technical data such as your IP address. We use that data only to run and protect the service.
1. Who we are
CompaCity is a mobile app and website for browsing spots, offers and events in your city. The controller of personal data under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Greek Law 4624/2019 is:
- [Company or trader name]
- VAT no. (ΑΦΜ): [ΑΦΜ], tax office (ΔΟΥ): [ΔΟΥ]
- Address: [street, number, postcode, city], Greece
- Email: info@compacity.gr
We have not appointed a Data Protection Officer, as the GDPR does not require one for this service.
2. What happens when you use the app
No account, no tracking
- CompaCity has no sign-up, sign-in or user profile.
- It contains no analytics, advertising, tracking or crash-reporting tools.
- It does not ask for your location, contacts, photos, camera, microphone or any other permission.
Stored on your phone only
The city and language you choose are saved on your device so the app reopens the way you left it. They are never sent to us. Deleting the app deletes them. This storage is strictly necessary for a feature you ask for, so no consent is needed for it (article 4(5) of Greek Law 3471/2006).
Loading content
Spots, offers, events and images are loaded from our content service, Supabase, on servers in the European Union. As with any internet request, these servers receive technical data: your IP address, the time of the request, what was requested and basic device and app information (for example the operating system).
App updates
The app checks for updates through Expo's update service (EAS Update). Each check sends the app's version, platform and update channel, your IP address, and a random identifier that the update module creates on your device. That identifier is not linked to your name, your account with Apple or Google, or any other information about you. [Check before publishing: Expo's current data practices for EAS Update.]
We do not use any of this technical data to identify you, build a profile of you or follow you across apps or websites. We do not sell it or share it for advertising.
Downloading the app
When you download CompaCity from the App Store or Google Play, Apple or Google process data about you under their own privacy policies. We may see anonymous, aggregated statistics from them, such as the number of downloads.
3. What happens when you visit compacity.gr
This website is hosted on Cloudflare Pages. It uses no cookies, no analytics and no third-party fonts or scripts, so it needs no cookie banner. To deliver the pages and protect the site against attacks, Cloudflare processes technical data about each visit, such as your IP address, browser type and the page requested.
4. When you email us
If you write to info@compacity.gr, we receive your email address, your name if you include it, and whatever you write. We use it only to reply to you and deal with your request. This mailbox is hosted by Proton (Proton Mail) in Switzerland.
5. Purposes and legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Technical request data (app and website) | Deliver content and updates, keep the service secure and working | Legitimate interests, art. 6(1)(f) |
| Emails you send us | Reply to you and handle your request | Legitimate interests, art. 6(1)(f); steps at your request before an agreement, art. 6(1)(b), for example when a business asks to be listed |
| Records we must keep | Meet tax or other legal obligations | Legal obligation, art. 6(1)(c) |
Our legitimate interest is to offer a working, secure, free service. Because we collect so little, and none of it is used to identify or profile you, we consider that this interest does not override your rights. We make no automated decisions about you and do no profiling.
6. Service providers and transfers outside the EU
We use the providers below to run CompaCity. They act as our processors, under data processing agreements, and may use data only on our instructions.
- Supabase Inc.: database, image storage and delivery; servers in the EU.
- Cloudflare, Inc.: website hosting, security and domain name service (DNS).
- Expo (650 Industries, Inc.): app updates.
- Proton AG: our email mailbox (Proton Mail); servers in Switzerland.
Some of these companies are based in the United States, and some data may be processed there or by their global networks. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (art. 46 GDPR). Switzerland has an adequacy decision from the European Commission (art. 45 GDPR). [Check before publishing: each provider's current certification and terms.]
We do not sell or rent personal data. We disclose it to public authorities only when the law requires us to.
7. How long data is kept
- Technical request data: kept by our providers in short-lived logs, generally a few days and at most a few weeks, then deleted. We do not keep copies.
- Emails: kept while we deal with your request, and deleted within two years of our last exchange, unless we need them longer to meet a legal obligation or to establish, exercise or defend legal claims.
- City and language: on your phone until you delete the app.
8. Your rights
Under the GDPR and Greek law you have the right to:
- access the personal data we hold about you (art. 15);
- have inaccurate data corrected (art. 16);
- have your data deleted (art. 17);
- restrict how we use it (art. 18);
- receive it in a portable format, where this applies (art. 20);
- object at any time to processing based on our legitimate interests (art. 21).
To use any of these rights, email info@compacity.gr. We reply within one month, free of charge. Because the app has no accounts, we usually cannot link technical data to a person (art. 11 GDPR). If you want us to look for data about you, please tell us what will help us find it.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1–3, 115 23 Athens, www.dpa.gr, or with the supervisory authority in the EU country where you live or work.
9. Links to other apps and sites
- "Get directions" opens your maps app, such as Apple Maps or Google Maps.
- "Menu" and "Get tickets" open the spot's or the organiser's web page in an in-app browser.
- Tapping a phone number opens your phone's dialler.
- "Instagram" opens our Instagram page, and "Contact us" opens your email app.
These apps and sites are run by others under their own privacy policies, which we do not control.
10. Children
CompaCity is a general-audience app. It does not collect personal data from anyone, including children. Some listings, such as bars or events, are aimed at adults.
11. Changes to this policy
If we change how CompaCity handles data, for example by adding a new feature, we will update this page and the date at the top before the change takes effect. If a change is significant, we will also announce it in the app or on our Instagram page.
See also our terms of use.