Privacy Policy

1. Who we are

Estalocal ("Estalocal", "we", "us") is operated by YesNow OÜ, a company registered in Estonia. We are the data controller for personal data processed through our website and application at https://www.estalocal.xyz.

Controller: YesNow OÜ (registry code 16506641), Pärnu mnt 139b, 11317 Tallinn, Estonia
Email: info@estalocal.xyz

2. Scope

This Privacy Policy explains how we process personal data when you use Estalocal, including when you browse public content, create an account, sign in with Google, apply to become a local, publish or purchase curated travel lists, save favorites, leave ratings or comments, or contact us.

This policy should be read together with our Terms of Service and Cookie Policy.

3. Data we collect

Account and authentication data

• Email address and password (if you register with email)
• Google account information when you use Google Sign-In, such as your name, email address, and profile picture
• Authentication session data managed through Supabase Auth

Profile data

• Username, first and last name, display name, and avatar
• Bio, location (city or region as text), and role on the platform
• Additional information you provide when applying to become a local, such as experience, connection to the destination, and social proof
• A record of your agreement to the Creator Terms & Conditions when you apply to become a local or publish lists, including the document version, a hash of the accepted text, timestamp, IP address, and browser user agent

Content and activity data

• Collections, experiences, descriptions, thumbnails, and destination information you publish
• Google Maps links and local tips you add to experiences (we do not collect live GPS location from your device)
• Favorites, ratings, comments, and purchase or unlock records

Communications and support

• Information you submit through our contact form, including name, email, subject, and message
• Transactional emails we send, such as account confirmation, password reset, and local application updates

Technical data

• Server and security logs generated when you use the service, such as IP address, browser type, and request timestamps
• Bot-protection signals processed by Cloudflare Turnstile on signup, password reset, and contact forms
• Theme preference stored locally in your browser when you change appearance settings

We do not currently use advertising cookies or third-party marketing analytics on Estalocal.

4. Purposes and legal bases

Under the General Data Protection Regulation (GDPR), we process personal data only where we have a lawful basis. The main purposes are:

• Providing the service (Art. 6(1)(b) GDPR): creating and managing your account, authenticating you, enabling you to browse, publish, favorite, rate, comment on, and unlock collections
• Local applications and moderation (Art. 6(1)(b) and Art. 6(1)(f) GDPR): reviewing applications, assigning roles, and keeping the marketplace trustworthy
• Creator contracts (Art. 6(1)(b) and Art. 6(1)(f) GDPR): recording that you read and agreed to a specific version of the Creator Terms, so we can form the contract and evidence it if a dispute arises
• Security and abuse prevention (Art. 6(1)(f) GDPR): protecting accounts, preventing spam and automated abuse, and maintaining platform integrity
• Communications (Art. 6(1)(b) GDPR): sending service-related emails such as verification, password reset, and application status updates
• Support (Art. 6(1)(b) and Art. 6(1)(f) GDPR): responding to contact requests and handling user inquiries
• Legal compliance (Art. 6(1)(c) GDPR): meeting legal obligations and responding to lawful requests

Where we rely on legitimate interests, we balance those interests against your rights and expectations. You may object to processing based on legitimate interests as described below.

5. Service providers

We use trusted providers to operate Estalocal. They process personal data on our instructions and only as needed to provide their services:

• Supabase — authentication, database hosting, and file storage for profile images and collection thumbnails
• Google — optional Google Sign-In authentication; users may also include Google Maps links in published content
• Vercel — website and application hosting
• Resend — delivery of transactional emails from notifications@estalocal.xyz
• Cloudflare Turnstile — bot protection on selected forms

When payment processing is enabled in the future, payment data will be handled by a payment processor such as Stripe. We will update this policy before launching paid checkout.

We do not sell your personal data.

6. International transfers

Some of our providers are located outside the European Economic Area, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the contractual protections offered by our providers.

You can contact us for more information about the safeguards used for specific transfers.

7. Retention

We keep personal data only for as long as necessary for the purposes described in this policy:

• Account and profile data is retained while your account is active
• Published content may remain visible until you delete it or close your account, subject to backup and legal retention requirements
• Contact form submissions are retained as needed to handle your request and maintain support records
• Creator Terms acceptance records are retained for the life of your Creator relationship and for as long as needed to establish, exercise, or defend legal claims
• Security and server logs are retained for a limited period for troubleshooting and abuse prevention

When data is no longer needed, we delete or anonymize it unless we are required by law to retain it longer.

8. Security

We implement technical and organizational measures designed to protect personal data, including access controls, encrypted connections (HTTPS), and provider security features. No online service can guarantee absolute security, so please use a strong password and keep your login credentials confidential.

9. Your rights

If you are in the European Economic Area or another jurisdiction with similar data protection laws, you may have the following rights:

• Access to the personal data we hold about you
• Correction of inaccurate or incomplete data
• Erasure of your data, subject to legal exceptions
• Restriction of processing in certain circumstances
• Data portability for data you provided to us
• Objection to processing based on legitimate interests
• Withdrawal of consent where processing is based on consent, without affecting prior lawful processing

To exercise your rights, email info@estalocal.xyz. We may need to verify your identity before responding. We aim to respond within one month, as required by GDPR.

Self-service account deletion is not yet available in the app. If you want your account deleted, contact us and we will process your request manually.

You also have the right to lodge a complaint with your local supervisory authority. The lead supervisory authority for Estalocal is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

10. Children

Estalocal is not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

To become a local (Creator) you must be at least 18 years old, as set out in the Creator Terms & Conditions.

11. Changes

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on this page and update the effective date above. Your continued use of Estalocal after changes become effective means you acknowledge the updated policy.

12. Contact

For privacy questions or requests, contact:
YesNow OÜ (registry code 16506641), Pärnu mnt 139b, 11317 Tallinn, Estonia
info@estalocal.xyz