§1Data controller
The controller of your personal data is Maciej Czerwonka, Sterkenburg 92, 5653 NH Eindhoven, the Netherlands, who runs WantPin (wantpin.com). For anything about your data, write to kontakt@wantpin.com.
We process data under the General Data Protection Regulation (EU) 2016/679 (GDPR) and collect only what the Service needs.
§2What data we process
- Account: email address, name, encrypted password; with Google sign-in, also the name and email from your Google account. Optionally: bio, country, currency, language, categories you deal in.
- Listings: text, photos, budget, category, town and the place on the map. Only you see the exact place; others see it moved by 0.5–2 km.
- Communication: “I have it!” replies, chat messages (including photos and meeting proposals), reviews, content reports and appeals.
- Activity: watched listings, alerts (words, categories, area), notifications, blocked users, listing view counts.
- Push notifications (if you turn them on): your browser’s technical subscription address.
- Technical data: IP address, browser and device type, request times (server logs), the country derived from your IP address (so the map opens on your country).
- Your location: only when you allow it in the browser (e.g. “Near me”). We don’t store it unless you use it as a listing’s or alert’s place.
§3Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the Service (listings, chat, alerts, notifications) | Art. 6(1)(b): contract |
| Handling content reports, moderation, statements of reasons and appeals (DSA) | Art. 6(1)(c): legal obligation |
| Security, preventing abuse and fraud, logs | Art. 6(1)(f): legitimate interest |
| Statistics about the Service (e.g. listing views) | Art. 6(1)(f): legitimate interest |
| Establishing, exercising and defending legal claims | Art. 6(1)(f): legitimate interest |
| Push notifications | Art. 6(1)(a): consent (in the browser) |
| Personalised adverts and related Google cookies | Art. 6(1)(a): consent |
§4Who receives data
We don’t sell data. We use providers who process data on our behalf under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | database, sign-in, photos, chat | servers in Frankfurt (EU) |
| Vercel Inc. | website hosting | servers in Frankfurt (EU) and a CDN; US company |
| Resend (Plus Five Five, Inc.) | sending email | servers in Ireland (EU); US company |
| Google Ireland Ltd / Google LLC | Google sign-in (if you choose it), adverts (AdSense) | EU and US |
| komoot GmbH (Photon) | searching for towns: the text you type or a map point | Germany (EU) |
| OpenFreeMap | the base map (tiles), loaded directly by your browser | EU |
| Browsers’ push services (Google, Mozilla, Apple) | delivering push notifications | depends on the browser |
Other users see some data: your name, listings (with an approximate place), reviews and public profile; messages are seen only by the other person in the chat. We may also pass data to authorities where the law requires it.
Transfers to the US (Vercel, Resend, Google) rely on the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.
§5Google AdSense adverts
The Service uses Google AdSense, an advertising service of Google Ireland Limited. Google and its partners may use cookies and similar technologies to show adverts, measure them and prevent abuse, including based on your earlier visits to this and other websites.
On your first visit from the European Economic Area you’ll see Google’s consent message (a certified consent platform following IAB TCF). Without your consent Google may show only non-personalised adverts. You can change or withdraw your consent at any time: .
How Google uses data: policies.google.com/technologies/partner-sites. You can also turn off personalised ads at adssettings.google.com.
§7How long we keep data
- Account data, listings, messages and reviews: until you delete your account (or earlier, when you delete a listing).
- Reports, moderation decisions and appeals: up to 3 years after the decision (limitation period and DSA accountability).
- Server logs: per our providers’ settings, usually days to weeks.
- Data processed on the basis of consent: until you withdraw it.
§8Your rights
You have the right to:
- access your data and get a copy;
- rectify it (you can change most of it yourself in your account settings);
- erasure (“the right to be forgotten”);
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time (without affecting earlier lawful processing).
To use them, write to kontakt@wantpin.com; we reply within a month. You can also complain to a supervisory authority: the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), competent for the controller’s place of residence, or the authority in the country where you live (in Poland: Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).
Giving data is voluntary, but you can’t create an account without an email and password (or a Google account). We make no decisions about you based solely on automated processing with legal effects. Matching alerts to listings is automatic but only used to send notifications.
§9Security and changes
The connection is encrypted (HTTPS), passwords are stored encrypted and database rules make sure everyone sees only what they should. Phone photos are resized on upload and their EXIF data (including GPS position) removed.
We announce significant changes to this policy in the Service. See also the Terms and Contact.