Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
Last updated: 18 October 2026.
The data controller is Kutluhan Ozan Köse, reachable at privacy@placeinn.app. The controller's postal address is available on request, by writing to the same address.
PlaceInn S.R.L. is currently being incorporated. Until incorporation is complete, the data controller is the natural person named above (see section 14).
No Data Protection Officer has been appointed, as the conditions set out in Article 37 GDPR do not apply.
This policy covers:
The apps are currently in a pilot: they are available only to the people and venues taking part in it. Where this policy says "you", it means whoever is using the website or one of the apps.
On the website we collect only the data you give us by filling in the form. What is asked depends on the path you choose:
| If you run a venue | Venue name and area, first and last name, email address and, if you provide it, a phone number |
|---|---|
| If you are an investor or a partner | First and last name, fund or company, work email address |
| If you want to try the app | Email address and, if you provide them, your name and the kinds of venue you are interested in |
Providing the data marked as required in the form is necessary for us to follow up: without it we cannot contact you or send you the material you asked for. Providing the optional data is up to you.
| Purpose | Legal basis |
|---|---|
| Assessing a possible partnership with your venue and getting back to you; sending you the deck you asked for and answering your questions | Steps taken at your request prior to entering into a contract — Art. 6(1)(b) GDPR |
| Notifying you once, when the service opens | Your consent, given by ticking the relevant box — Art. 6(1)(a) GDPR |
| Defending ourselves in any dispute and complying with legal obligations | Legal obligation and legitimate interest — Art. 6(1)(c) and (f) GDPR |
Venue, investor and partner contacts are kept for 24 months from the last meaningful contact, unless a contractual relationship has arisen in the meantime, in which case statutory retention periods apply. Waiting-list sign-ups are kept until consent is withdrawn, and in any case no longer than 24 months from sign-up. Once the period expires, the data is deleted or irreversibly anonymised.
The website itself does no profiling and makes no automated decisions about you. It uses no profiling, marketing or statistical cookies, and no traffic analytics tools. The form is provided by Tally, which states that it uses only technical cookies necessary for the service to work; for this reason you are not asked for prior consent to cookies.
| Your account | Email address and password (stored only as a protected value by our sign-in provider), or the identity of the Google account you sign in with; first name, last name, username, date of birth; and, if you add them, a profile photo, a bio and your town |
|---|---|
| Your answers at sign-up | Your profession, the music, drinks, food and cuisines you like, your hobbies and sports, your favourite teams if you add any, when and with whom you like to go out, your price range, and up to two lifestyle profiles you pick. You can edit them at any time in Settings → Consumer Preferences |
| Your dietary needs — optional | Vegetarian, vegan, gluten-free, dairy-free or halal. These can say something about your religion or health, so we keep them only if you tick the consent box on that question. They are never shown to venues and never used to profile you (section 5) |
| What you do in the app | Check-ins at venues (confirmed when the venue's staff scan the code your app shows), discounts you unlock and redeem, venues and people you follow, favourites, posts and photos, comments and reactions, event replies, messages, reports you send, and a mood you choose (which expires after a few hours) |
| Your location | Only with your phone's permission; how we use it is set out in section 6 |
| Your device | A notification token so we can send you notifications, an identifier the app creates for your phone, the phone's platform (Android or iOS) and when the app was last used; and a security check that the app talking to us is genuine (App Check) |
| What we work out | Categories from your answers (for example "craft beer" from the drinks you chose) and up to five lifestyle profiles ("segments"), from your answers and the profiles you picked |
| Your account | Name, email address, your role at the venue, and sign-in data. A staff member is invited by email with a one-time link to set their own password; we never send a password by email |
|---|---|
| Your work in the app | The venue's details, offers, events and posts you create, the check-ins and redemptions you confirm, and a record of sensitive actions (who did what, and when) kept for security |
| Support | The messages you send us from the app, with your name, email address and role |
We do not collect your contacts, your photo library (you pick each photo yourself) or your precise location history. The pilot version of PlaceInn Business collects no analytics, crash reports or performance data.
| Purpose | Legal basis |
|---|---|
| Running your account and the service you sign up for: your profile, the feeds, check-ins, discounts, follows, posts, messages and notifications, and showing you venues and suggestions that fit the answers you gave us | Performance of the contract with you — Art. 6(1)(b) GDPR |
| Applying our minimum age of 16 at sign-up | Performance of the contract (our terms set the age) — Art. 6(1)(b) GDPR |
| Offers Picked For You: matching you to offers from venues, including ones you do not follow, and sending at most one notification a day | Your consent, given in the app and off unless you turn it on — Art. 6(1)(a) GDPR. You can withdraw it in one tap in Settings → Notification Preferences |
| Keeping your dietary answers | Your explicit consent — Art. 9(2)(a) GDPR. Clearing the answers withdraws it and deletes them |
| Area totals: counting, anonymously, the kinds of people who check in around an area, so a venue can see roughly how many people an offer could reach. A venue only ever sees a range, and never for fewer than 25 people | Our legitimate interest and the venues' in running and sizing offers — Art. 6(1)(f) GDPR. You can object by turning on Limit Analytics Personalization in Privacy Settings: you stop being counted, and what was counted from your check-ins is deleted |
| Giving venues statistics and written suggestions about their own visitors, made only from totals | Legitimate interest — Art. 6(1)(f) GDPR. Limit Analytics Personalization also removes you from them |
| Keeping the service safe: confirming check-ins and redemptions on our servers, checking that photos are not unsafe before they are published, handling reports and blocks, preventing abuse | Legitimate interest in a safe, fair service — Art. 6(1)(f) GDPR; and legal obligations where they apply — Art. 6(1)(c) |
| Answering your support requests and reports | Performance of the contract and legitimate interest — Art. 6(1)(b) and (f) GDPR |
| Defending ourselves in any dispute and complying with legal obligations | Legal obligation and legitimate interest — Art. 6(1)(c) and (f) GDPR |
Providing your account details and your answers at sign-up is necessary to use the app: they are what the service is built from. Everything marked optional above, and the consents, are up to you, and saying no changes nothing else.
The app uses your location only if you allow it in your phone's settings, and you can withdraw the permission at any time.
We never keep a trail of where you have been, and we never record a home or work address.
To personalise what you see, we work out categories and up to five lifestyle profiles from your answers and the profiles you picked. Your dietary answers are never part of this.
If you turn on Offers Picked For You, we match you to venue offers using those profiles and categories, your profession category, your age band (worked out from your date of birth), your favourite teams if you added any, your rough location if you share it, and your own check-ins, unlocks and follows. Venues choose a kind of person to reach; they never choose you, and they never learn who was matched.
None of this produces a decision with legal effects on you or that affects you in a similarly significant way (Article 22 GDPR): it decides which venues and offers you see first, and whether an offer reaches your inbox. You can edit your answers at any time, turn the offers off, or turn on Limit Analytics Personalization.
Your profile starts public, at every age from 16, as on most social apps; you can make it private at any time in Settings → Privacy Settings.
These providers process data for us under contracts that bind them to our instructions:
| Provider | What for |
|---|---|
| Google (Firebase, Google Cloud, Google Maps Platform) | Hosting the apps' data and servers, sign-in, notifications, the app security check, maps and address lookups, checking photos for unsafe content, and writing venue suggestions from totals. Our database and files are stored in the EU; sign-in data is processed by Google in the United States |
| Algolia (Algolia SAS, France) | Search: the public details of venues, events and offers, and the username, name, photo and visibility of people who can be found |
| Resend (Resend Inc., United States) | Sending service emails: staff invitations, and forwarding support requests and reports to our inbox |
| Migadu (Migadu GmbH, Switzerland; servers in France) | Our mailboxes, including privacy@placeinn.app and support@placeinn.app |
| OpenStreetMap Foundation (United Kingdom) | Looking up the name of a town from an area about 1 km wide (section 6) |
| Tally (Tally BV) | The website's form, and storing your answers to it, in the European Union |
| Google (Firebase Hosting) | Hosting this website |
Transfers outside the EU. Some of this processing happens outside the European Economic Area:
You can ask for a copy of the safeguards by writing to privacy@placeinn.app.
To deliver the pilot builds, Google Play and Google Groups act under Google's own terms and privacy policy, not ours (section 13).
| Data | Kept for |
|---|---|
| Your account, profile, answers, follows, favourites, posts and check-ins | Until you delete your account |
| An account whose email address was never confirmed | 30 days from its creation |
| Your dietary answers | Until you clear them or delete your account |
| Your rounded position | Replaced at every reading; deleted when you withdraw the location permission |
| A check-in request | 14 days after it is completed or refused |
| Your mood | Until it expires, after 3 to 8 hours |
| Notifications in the app | 90 days |
| Offers in your Offers Picked For You inbox | Until the offer closes, plus 14 days |
| What your check-ins contribute to area totals | 90 days from each check-in |
| Event replies | 6 months after the event |
| Usage events, which hold ids and event names, never content | 180 days |
| Reports you send | Until handled, then 180 days |
| Support requests | 24 months |
| Redemptions of discounts | 2 years, kept as a fraud and audit record |
| Security records of sensitive actions | 90 days in full; a pseudonymised record for 7 years, for legal defence |
| Messages | Until the account is deleted (see below) |
| A backup copy of the database, which also holds what a deletion removed | 7 days, then gone for good |
When you delete your account (Settings → Delete Account):
Backups. Our database keeps a point-in-time backup for 7 days. What the deletion removes stays in it for up to 7 days and is then gone for good. Only we can access it, and we use it only to recover from a fault or a mistake. Photos are not in it: once deleted, they cannot be recovered.
In the app, at any time:
At any time you may exercise the rights set out in Articles 15 to 22 GDPR:
To exercise them, write to privacy@placeinn.app. We will reply without undue delay and in any case within one month of the request. A copy of your data is sent to you by email as a file you can open and reuse. If you run a venue and want its account deleted, write to the same address.
You must be at least 16 years old to create a PlaceInn account; we check the date of birth you give us and do not create the account otherwise. Some offers set by venues have their own, higher age limit (for example 18 for offers involving alcohol), and are shown only to people who meet it.
The pilot apps are distributed through a closed test on Google Play. To join, you join a Google Group with your Google account and install the app from Google Play. Google processes your group membership and the installation under its own terms and privacy policy; we see the email address you joined the group with, and only the group's managers can see the members.
We use the pilot to find and fix problems. If you write to us about the app, we keep your message as a support request (section 10). You can leave the pilot at any time: delete your account in the app, uninstall it, and leave the group.
Once the incorporation of PlaceInn S.R.L. is complete, controllership and the data collected through the website and the apps will be transferred to the company, which will continue processing for the same purposes and in accordance with this policy. You will be informed of the change, in the apps and by email, and this policy will be updated accordingly.
We may update this policy to reflect changes in the law, in the apps or in the services we use. The version in force is always the one published on this page, with its last-updated date. If a change affects how we use your data in a significant way, we will tell you in the apps before it applies.