Legal

Privacy Policy

Last updated: 1 June 2026

This policy is available in English. A Dutch (Nederlands) version will be added soon.

1. Data Controller

kafinder.be is operated as a personal project based in Leuven, Belgium. The data controller responsible for your personal data is:

kafinder.be
Leuven, Belgium
Contact: jrzeczkowski@proton.me

2. Data We Collect

We collect only the data necessary to provide the kafinder service:

Account data: Email address, username, full name (optional), bio (optional), avatar URL (optional). Collected when you register.
Occupancy reports: Busyness level you report for a café. Anonymous (session ID only); never linked to your account or IP address.
Reviews: Your star ratings and written comments on cafés.
Favourites: The cafés you save as favourites.
Suggestions: Café suggestions you submit, including name, address, description, and your reason for suggesting it.
Error reports: Corrections you submit for inaccurate café information.
Feedback: Bug reports, feature requests, or general feedback you submit via the in-app feedback button.
Usage data: Page view counts per café (aggregate, not per-user). Collected server-side by Vercel.

3. Legal Basis for Processing (GDPR Art. 6)

Data	Legal Basis	Basis
Account data (email, username)	Performance of a contract	Art. 6(1)(b)
Occupancy reports	Legitimate interest — provide real-time café busyness	Art. 6(1)(f)
Reviews & favourites	Legitimate interest — community features	Art. 6(1)(f)
Suggestions & reports	Legitimate interest — improve data accuracy	Art. 6(1)(f)
Feedback	Legitimate interest — improve the service	Art. 6(1)(f)

4. Third-Party Processors

We use the following processors to deliver the service. All are bound by GDPR-compliant data processing agreements:

Supabase (Supabase Inc.) — Database and authentication. Data stored in the EU (Frankfurt, AWS eu-central-1).
Vercel Inc. — Hosting and CDN. EU region (Paris cdg1).
Google LLC — OAuth sign-in (Google). Subject to Google's privacy policy.
Meta Platforms Ireland Ltd. — OAuth sign-in (Facebook). Subject to Meta's privacy policy.
Mapbox Inc. — Interactive maps. May collect IP address for tile requests.
Resend Inc. — Transactional email (account confirmation, notifications).

5. Data Retention

Account data: retained until you delete your account.
Occupancy reports: logically expired after 2 hours; permanently deleted after 30 days.
Reviews, favourites, suggestions: retained until you delete them or your account.
Feedback & error reports: retained until reviewed and resolved by an admin.
Server logs (Vercel): retained per Vercel's data retention policy (typically 30 days).

6. Cookies and Local Storage

kafinder uses:

HttpOnly session cookies (Supabase auth) — strictly necessary for login. No consent required.
localStorage — stores your anonymous session_id for occupancy rate-limiting only. Contains no personal data.

We do not use advertising cookies, tracking pixels, or analytics cookies (e.g. Google Analytics).

7. Your Rights (GDPR Chapter III)

As a data subject in the EU/EEA, you have the right to:

Access — request a copy of your personal data.
Rectification — correct inaccurate data (available via your profile page).
Erasure (“right to be forgotten”) — delete your account and all associated data via the “Delete Account” button in your profile, or by contacting us.
Restriction — request that we restrict processing of your data.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interest.
Withdraw consent — where consent is the legal basis, withdraw at any time without affecting prior processing.

To exercise your rights, contact us at jrzeczkowski@proton.me. We will respond within 30 days.

You also have the right to lodge a complaint with the Belgian Data Protection Authority: dataprotectionauthority.be.

8. Minimum Age

kafinder is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child has registered, please contact us immediately.

9. Security

We implement appropriate technical and organisational measures to protect your data, including: encryption in transit (TLS), HttpOnly cookies, Row-Level Security on all database tables, and strict access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via a banner on the site. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of kafinder after changes are posted constitutes acceptance of the updated policy.