DeskCafésRefer a venue
en

DeskCafés · Legal information

Privacy Policy

Last updated: · Version 2026-10-14-google-maps-1

This policy covers browsing DeskCafes, privacy choices, available account functions and the venue participation you request: selected Overture places, referrals, automatic control verification, administration, recovery, publication and deletion. Optional analytics requires a separate affirmative choice. Describing a function does not enable it before its operating controls are ready.

Optional Google Ads acquisition measurement

Browser measurement addendum 2026-10-05-ads-1, updated 2026-10-05.

After a separate affirmative choice for the current Analytics and advertising measurement notice, our public home pages load Google's advertising tag AW-18496318457. Earlier analytics choices do not authorize this addition: we ask again. Google receives technical browser/network information, a home-page URL with advertising-click identifiers where present and measurement cookies. We do not deliberately send account details, email addresses, phone numbers, visit history, form contents or arbitrary query parameters. Google's processing is pseudonymous, not anonymous.

We use this information to measure acquisition from our advertisements, on the basis of your optional consent. We block the tag before permission, on refusal, on uncertain consent/session state and for signed-in accounts, including onboarding. Personalized advertising, Google signals and enhanced conversions are disabled. No Google Analytics property or purchase/signup conversion event is configured by this tag. Withdrawing through Privacy choices disables new measurement and clears the tag's first-party _gcl_ cookies and _gcl_ls storage; it does not undo previously transmitted data or erase Google's independent cookies.

Google provides the tag and advertising measurement service and may process information outside the European Economic Area. Google Privacy Policy and advertising-service arrangements govern its processing; use of Google OAuth does not establish a separate Google Ads processing agreement. The Cookie Policy describes tag storage. Contact [email protected] for access, erasure or other privacy requests concerning information held for this campaign. You may refuse measurement and continue browsing and using DeskCafes.

Who is responsible

ComandaPay, S.L., tax identifier B93869865, is the controller of the personal information described here. Our registered address is Avenida Europa 8A, Bajo E, 15178 A Coruña, Spain. For DeskCafes privacy requests, email [email protected] or write to that address. Our Legal Notice provides the full company identification.

Visiting the website

Delivering a page involves processing network addresses and technical request information. We use this information to serve the website, diagnose faults and protect its availability. Our legitimate interest is operating a reliable service and preventing misuse. We limit operational logging and do not intentionally log message contents, passwords, authentication codes or cookies.

Our application and database are hosted by OVHcloud in France. Fonts and the illustration shown when the interactive map is unavailable are served by DeskCafes. Optional analytics loads only after an affirmative choice for the current notice, as explained below. Browser location is optional, as explained below.

Interactive map and optional location

Pages with an interactive map load Google Maps Platform and its delivery network. Google receives ordinary network and browser information, our website origin, the map area viewed and geographic queries used to locate cities, neighbourhoods or addresses. Geographic suggestions are rendered by Google Places UI Kit; selecting a result or submitting a manual geographic search uses geocoding for its coordinates. Google processes this information under the Google Privacy Policy and applicable Maps terms, potentially outside the EEA. We do not deliberately send account identifiers, authentication data, venue-name filters, visit records or Overture selection receipts to these services. Our application does not store geographic queries or browser coordinates in URLs or browser storage.

We provide maps and geographic search as functional browsing services on the basis of our legitimate interest in making discovery usable. These requests are separate from optional acquisition analytics and do not authorize advertising measurement. Google manages its SDK, ordinary browser caching and provider-side retention under its own terms; we do not claim to disable all Google technical processing or control it through our local deletion schedule. Google's attribution remains visible. Our Google Maps Platform usage is capped at the provider; unavailable maps or searches leave ordinary list browsing available.

Only selecting Near me requests your browser's location permission. If you permit it, the browser uses the coordinates to centre the map or prepare a nearby venue search. Submitting that search sends its bounded area to DeskCafes for the immediate lookup; the map resources requested then reveal that area to the map provider. DeskCafes does not save the coordinates, put them in your account or URL, or run background location tracking. You can refuse or revoke permission in your browser and continue browsing. A map failure leaves the independent browsing and account functions available.

Saving your privacy choice

Saving a choice places an essential cookie containing a random browser identifier. The database records a hash of that identifier, your choice, the notice version and digest, the time and the form used. It also uses a request reference to avoid recording an accidental repeated submission twice. The record contains no account, email, phone, network address, user-agent string, location or browsing history. It is pseudonymous, not necessarily anonymous.

We use this record to remember and respect your request, prevent repeated or abusive submissions and evidence how privacy choices were handled. Our bases are the legitimate interest in honouring your preferences and protecting that function, and applicable privacy accountability obligations. Optional analytics requires your separate consent.

Only an affirmative choice for the current notice can authorise analytics. A choice saved under the earlier notice does not authorise PostHog: we ask again. You can use the website without saving a choice, refuse optional analytics or withdraw through Privacy choices without losing account or browsing functions. Withdrawing stops further capture; it does not undo processing already performed with your consent.

Optional pre-sign-in analytics and masked replay

With your consent, we use PostHog Inc.'s EU Cloud service to understand acquisition and use of the public home pages, including their language variants. Session replay reconstructs masked page interactions to help us understand usability. It is not advertising, and we do not load the analytics SDK on signed-in pages or other account screens. A temporary technical identifier distinguishes an eligible browser's capture; this information is pseudonymous, not a promise of irreversible anonymity.

We send the technical identifier, bounded event and timing information, and masked replay data through our own website proxy. All inputs and page text are masked, with restricted public layout information retained. We strip query strings, fragments, referrers and unapproved properties, do not forward the visitor's network address to PostHog, and disable GeoIP enrichment. We do not send account identifiers, email addresses, phone numbers, aliases, submitted form contents or precise browser location to PostHog. Our own server still processes network information to deliver and protect requests.

Capture authority lasts no more than twenty-four hours. SDK identifiers are held in memory, with a small local-storage consent marker described in the Cookie Policy. Capture stops and its browser identity is reset before signed-in use. It does not automatically restart after logout. For an eligible signup completed within a five-minute attribution window, a short-lived internal link can authorise at most one anonymous signup-conversion event. That event contains the technical analytics identifier, not the account details, and is not ongoing account tracking.

Changing to essential only stops new capture and closes its server-side authority. Requests already in flight can still finish; we account for their arrival before provider cleanup. We request deletion of the technical identity's events and recordings thirty days after first capture intent, or earlier after withdrawal or invalid consent once in-flight delivery has been resolved. Replay retention is configured to thirty days. Provider deletion is asynchronous and may run during later processing windows, so neither period promises immediate physical erasure. Restricted technical cleanup references remain until deletion has been verified; browser-choice evidence has its separate retention below.

We select PostHog's EU storage region. This does not mean every network operation or authorised support access is confined to the EU. PostHog data-protection information describes its storage and deletion practices. Contact us for the contractual safeguards applicable to your information. You can change your choice at any time through Privacy choices.

Contacting us

When you contact us, we receive your address, message and delivery information. We use these to answer your enquiry or handle the security, privacy or legal matter you raise. Answering ordinary enquiries serves our legitimate interest in helping people who contact us; rights requests are handled to meet applicable privacy obligations. Provide only the information needed for your request.

We use the existing DonDominio mailbox and a dedicated Google Gmail operations mailbox to handle DeskCafes correspondence. Addresses configured for forwarding use Cloudflare Email Routing to deliver messages to the operations mailbox. Earlier correspondence can remain in the old mailbox during migration; protected operational copies may be held on our OVHcloud server. Email also passes through your own mail service and the delivery networks involved, which may process it outside the European Economic Area. Authorised operators may access correspondence to handle it. We do not use enquiries as a newsletter or marketing list.

Account functions, if enabled

The following account sections explain email registration, mobile verification, private account settings and the account Terms agreement. Publishing this policy does not enable registration, verification messages or any other unavailable function. You can continue browsing without an account or a verified phone. The request screen shows whether a function and destination are supported.

If you request an account, the required information includes your email address, an internal account identifier, a chosen public display name and a unique public @username, an adult declaration, account status and privacy settings. Email verification uses a short-lived, single-use code and a request/browser binding: enter the code where you started, while reading the email in any app or device. Google is an alternative when offered, as described below. The adult record identifies the statement, its version and digest, and the declaration time; we do not request a date of birth. Eighteen is DeskCafes' participation rule, not a claim that every country requires this declaration.

We use the information necessary to carry out your requested account setup and provide the account service. Protecting account access, enforcing request limits and preventing misuse serve our legitimate interests in keeping the service and its users safe. These purposes do not authorise optional analytics, marketing or unrelated use of account information. The Privacy Policy informs you about processing; it is not a blanket consent that you must give to register.

An account session uses essential authentication storage with a configured seven-day lifetime that can be renewed during use. Logging out ends that session, not the account. Ordinary account information is kept while the account exists, subject to the deletion rules below. Your email address is not public; your chosen alias is for attribution where a public feature actually uses it. Visit history starts private. Venue administrators can access their permanent verified-visit archive as described below. Public reviews and optional public visit history follow the separate disclosures below when those functions are available.

New email registration requires a password; Google registration does not. We keep only a one-way password hash, never the readable password. Before email verification, that hash is attached only to the short-lived request. It expires with the request; replacement or scheduled request cleanup removes it. A valid code creates a restricted onboarding account and installs its password hash atomically; requesting a code alone creates no account. We use the hash for authentication with bounded attempt records and actual authentication time and method. Email codes support recovery. Resetting a password revokes other sessions without removing an enrolled additional factor. Account deletion removes the usable password hash; we do not retain previous passwords.

Google registration and sign-in apply when offered. Venue and compliance administration require their assigned role, a completed sign-in and, for sensitive actions, recent primary authentication. Authenticator enrollment alone grants no administrative role. Required setup includes the adult declaration and Terms agreement shown beside the confirmation action. Neither substitutes for the separate browser privacy choice or an explicit request for a verification text.

Your display name may contain spaces and need not be unique; your public @username distinguishes your account and cannot contain spaces. You choose both, and we do not copy a Google name or photograph into them. Existing chosen aliases are preserved as display names; spaces in an existing username are represented by underscores. Changing either field updates the public identity used by available account features; it does not change your internal account, email, phone or account history. Making visit history private does not hide your identity on individual public reviews. Account deletion removes these usable profile fields under the account-deletion rules below.

Optional Google registration and sign-in

Where offered, Continue with Google starts registration or signs you in without a prior email signup or manual linking step. We first identify an existing Google association by its stable account identifier. Otherwise we create your private onboarding account or associate an existing account only with adequate verified email evidence. Google-authoritative Gmail or Workspace evidence can support that first association; another email may require an email code in the same journey. Google authentication does not complete phone verification or the remaining onboarding steps. Email sign-in remains available.

We request only the OpenID and email permissions. We process Google's stable account identifier, verified email and authentication checks to establish the link and authenticate you. We do not request your Google name, photograph, contacts, calendar, files or messages, and do not use Google to replace your chosen public alias. We retain the active identifier while linked and protected, keyed identifier comparisons for account security. These comparisons are pseudonymous, not anonymous. Providing the optional authentication you request and protecting account access are the purposes; Google linking is not consent to analytics or marketing.

We do not keep Google credentials for ongoing API access. Transient authentication state expires after ten minutes. Any encrypted credential material needed for a pending cleanup becomes eligible for scheduled removal ten minutes after the attempt; minimal operational outcome records become eligible after thirty days. A ten-minute browser-binding cookie and short-lived server-side state protect the exchange; the Cookie Policy describes the cookie. Our local cleanup does not guarantee removal of permissions still shown in your Google account.

You can disconnect Google after confirming a fresh email code and your DeskCafes password, or setting your first password in that verified process. We check both for the same account before removing its local Google association and expiring other DeskCafes sessions. Protected identifier history can remain while your account exists to prevent evasion. Account deletion removes ordinary current and historical identity bindings, subject to the security and evidence rules below. Disconnecting does not delete your Google account. You can review or remove DeskCafes permissions in your Google settings; pending local credential cleanup continues independently.

Choosing Google takes you to Google's sign-in pages. Google processes the account, network and technical information involved under the Google Privacy Policy, including its international processing arrangements. DeskCafes does not load a Google sign-in SDK or embedded sign-in frame when you simply browse the website. Google's pages have their own storage and privacy controls; our browser privacy choice does not control them.

Email delivery and request protection

When you request a sign-in email, Cloudflare Email Sending processes the destination address, message containing the authentication code and delivery information. Your receiving mail service also processes the message. During an upgrade or recovery, a compatible earlier sender may deliver a short-lived sign-in link instead. We disable Cloudflare message previews. This does not mean email providers cannot process message content or that an email is end-to-end encrypted. We use email delivery to provide the authentication you request, not marketing. Request and verification attempts are bounded; authentication payloads are encrypted at rest and cease to be usable after their short expiry.

Cloudflare protects requests that pass through its network. Account forms use Cloudflare Turnstile to help distinguish people from automated abuse. It processes technical browser and network signals and a challenge result. Our verification request does not deliberately include your phone number, email, alias or authentication code in Turnstile data. Cloudflare's Turnstile Privacy Addendum explains its processing, including its own responsibility for improving bot detection. This essential abuse protection is separate from optional analytics.

DeskCafes uses keyed, pseudonymous identifiers for request limits and identifier comparisons. These are not anonymous data. Short-lived challenges and authentication values expire independently of longer-lived account or evidence records; expiry is not permission to reuse a code. We do not put sign-in links, submitted codes or full contact details in routine operational logs.

If you enrol an authenticator through account security, we store its verification secret encrypted on our server and only one-way hashes of your recovery codes, together with factor status and security events. Authenticator enrollment is optional for every role. If enabled, we use its code or a one-use recovery code only to complete a new sign-in by any primary method. We do not request another authenticator code for subsequent account or venue actions. A signed essential browser cookie binds the pending login for at most ten minutes; the pending session cannot access account functions. Completion rotates the session token. We record bounded verification attempts and outcomes to prevent replay and abuse. These controls protect the authentication the user chooses; enrollment grants no role. Keep your own authenticator and recovery copy. We do not store plaintext recovery codes; encryption of a verification secret does not protect it from an attacker who fully controls the server. Factor secrets are needed while the factor is enrolled; removing the factor or account clears its usable authentication material, while limited security evidence follows its separate retention rules.

Mobile verification you request

For mobile verification we process the number you enter, its country, the requested verification purpose, provider and challenge references, timestamps and outcome. Twilio Verify in its US1 region and the relevant communications carriers process the number and verification message. A submitted code is sent to Twilio to check it; DeskCafes does not use your phone as a login method or publish it. The verification provider and carriers may process data outside the European Economic Area, including in the United States.

Before each text or resend, the form asks you to request that specific message. Refusing leaves browsing available but prevents completion of functions requiring a verified number. This is not a continuing messaging subscription or permission for marketing. Standard message and data rates may apply. Do not request another code if you do not want another text. For help or to withdraw permission, contact [email protected]. Follow any additional instructions shown for the actual sender; some senders cannot receive replies, and an already requested message may be in transit.

We use verification to perform the account setup or phone change you request and to protect against duplicate or abusive participation. The separate affirmative request establishes permission to send that text; it is not a blanket consent to all account processing. We keep protected phone identifiers and verification status while needed for the account, including prior identifiers for applicable anti-evasion controls. Ordinary account deletion removes usable phone bindings; necessary evidence has the separate limits below. Permanent-sanction evidence, where applicable, is restricted to the anti-evasion purpose and is not a public phone history.

Each requested text has a minimal permission receipt containing the notice and document versions and digests, a keyed phone reference, the request time, purpose and bounded send window. It contains neither the plain phone number nor the code. Our selected retention is five years after that window closes, for evidence of the permission and related disputes, with a specific documented legal hold where necessary. This is a DeskCafes policy, not a universal statutory period or a five-year Twilio requirement. The receipt is separated from ordinary account access and is not removed just because the account is deleted. Short-lived phone journey data expires within ten minutes; its cleanup and eligible permission-receipt cleanup use the monitored local twenty-four-hour erasure limit.

Twilio and Cloudflare provide data-protection terms covering their processing and applicable international-transfer safeguards, including standard contractual clauses where applicable. See the Twilio Data Protection Addendum and Cloudflare Data Processing Addendum, or contact us for the safeguards relevant to your information. Their independent legal duties and provider-side retention are not replaced by DeskCafes' local deletion schedule. French hosting does not make these functions EU-only.

For supported destinations with ambiguous mobile and fixed-line numbering, we first send the number to Twilio Lookup in its US1 region to check its line type. We use that result only to determine whether the requested verification may proceed to a mobile line; we do not save the returned carrier details or line type. This check serves our legitimate interest in enforcing mobile participation eligibility and avoiding misdirected verification texts. It does not prove ownership; the requested code must still be verified. The provider may process this information outside the European Economic Area under its own applicable retention and safeguards.

Your account Terms receipt, if you accept

If you explicitly accept the account Terms of Use, we record a separate contractual receipt. It contains a receipt reference, a private random reference for the contractual relationship, the accepted document version and digest, the acceptance-statement digest, the database acceptance time and the explicit-checkbox method. The accepted document and statement are archived. The receipt does not contain your email address, phone number, alias, date of birth, network address, user-agent string, sign-in link or security code.

While the contractual relationship continues, a separate operational link associates your account with its receipts so that the service can check your agreement and show your own confirmation. That confirmation identifies the accepted version, time and receipt reference and links to the accepted Terms. A later publication does not rewrite an earlier agreement. The random references are protected pseudonymous information, not a claim of anonymity.

We use the agreement to administer the requested contractual relationship. Keeping its minimal evidence serves our legitimate interest in establishing what was agreed and addressing specific contractual claims, rather than retaining a duplicate profile. Where a particular business-record obligation applies, we retain the necessary evidence to meet it. Accepting Terms does not give consent to analytics or to every possible use of personal information.

Account closure and contractual evidence

If account deletion becomes available, it requires recent authentication and explicit confirmation. Ordinary deletion ends the account sessions, removes the public alias and adult declaration, clears the ordinary contact and identity bindings, and closes the contractual relationship. It does not silently erase still-required contractual evidence. Contact [email protected] about access or deletion even when no account screen is available.

Our selected policy retains minimal Terms receipts during the contractual relationship and for six years after it ends, or until six years after a later relevant accounting entry where applicable. This is a bounded DeskCafes business-document policy, not a claim that every application record has a universal six-year statutory lifetime. It does not extend the lifetime of authentication secrets, an adult declaration or an unrelated browser privacy choice.

Closure removes the operational account links from every receipt belonging to the relationship, including earlier accepted versions. The retained receipts do not need an account that can be used to sign in. They are blocked from ordinary account and support access; any permitted legal-purpose access must be separately authorised and confined to its applicable legal ground. Where statutory blocking applies, the evidence is reserved only for the competent authorities and liabilities covered by that requirement, not for general reuse.

A specific legal claim, regulatory request or court order may justify a longer hold on the necessary evidence. Each hold has a concrete case, a responsible person, a finite end and a review date within ninety days. Reading a receipt or creating another account does not restart its retention clock.

The account Terms retention controls use scheduled, bounded erasure and monitoring. The selected local erasure limit is twenty-four hours after a receipt becomes eligible, once its retention period and any applicable hold have ended. New account agreement and initial activation are unavailable if the required maintenance is unhealthy; this does not prevent reading an existing confirmation or requesting account deletion. This local schedule is not a deadline for deletion by another provider or from an existing recovery copy.

Retention

The browser choice lasts up to 180 days, unless you replace it or clear its cookie earlier. Reading a choice does not renew that period. Clearing its cookie does not erase the separate server record. Our selected policy retains minimal choice evidence for three years after the choice ends through replacement, withdrawal or expiry, subject to a specific documented legal hold. It is not a record of the pages you visit. Changing to essential only does not erase that evidence or restart an ended choice's retention clock.

Routine local operational logs are configured to rotate with a 30-day retention limit; storage limits can remove them sooner. Records needed for a particular security incident or legal matter may need to be kept separately for that purpose.

For correspondence, the relevant criteria are whether the request is resolved, whether we need to demonstrate the response, and whether a specific legal obligation or claim still requires the information. A request for deletion is assessed separately from retaining limited evidence of how we handled it. You can ask us about the records and retention that apply to your request.

Existing protected OVHcloud backups and snapshots are separate recovery copies. Deletion from a live system does not immediately remove data from those copies. They are retained for recovery and may outlast the live information; there is no single verified maximum lifetime covering both backup types.

Recipients and your rights

Hosting and email providers receive the information needed for those functions. We may also disclose necessary information to a competent authority when legally required or to address a specific legal claim. Our French application hosting does not mean that every network or email service you use processes data only in France. Contact us for information about the recipients and safeguards relevant to your request.

You can request access, correction, deletion or restriction of your personal information, object to processing based on legitimate interests, and request portability where applicable. You can withdraw consent without affecting the lawfulness of earlier processing. Email [email protected]. We may need proportionate information to match the relevant records; please do not send identity documents unless requested. Removing your browser identifier can prevent us from reconnecting its choice record.

We normally respond within one month and explain any legally permitted extension. You can complain to the Spanish Data Protection Agency or another competent supervisory authority. Rights apply subject to their legal conditions. The report thresholds described below prepare private cases for meaningful human review before any account sanction, venue delisting or content removal. You can request the technical reconsideration described below and exercise applicable privacy rights.

Changes

We will explain new processing before its collection starts and request a fresh choice where required. The date and version above identify this notice. Future features do not collect information merely because they appear in our delivery plans.

Selected venue sources and bounded lookup

An active account chooses a city, neighbourhood, address, Near me or a map location for a claim, referral or recovery. A venue name is optional. We send the resulting bounded area and optional venue name to our lookup service; the displayed radius defines the area searched. We query the current Overture Places release through its public distribution. Overture and its data contributors are the source of names, addresses, coordinates, GERS identifiers and published email, phone and website fields. These can include personal information where a venue is identified with an individual. Overture's source-data licences do not replace people's privacy rights.

Unselected candidates, the query and browser location are transient; we do not keep a candidate catalogue, search history or periodic synchronization. An encrypted selection receipt lasts ten minutes and is bound to the requesting account, session and purpose. We retain only the selected GERS and source fields needed for the requested flow. The place identity stays fixed at selection. Historical control-source contacts remain private and are distinct from the public contacts authored by an administrator.

We use selected source information to carry out requested participation and to protect venues against impersonation. Contract necessity applies to the participant's own required account/venue actions; our legitimate interests support limited public business-source use, role security, abuse prevention and control evidence involving other people. Public availability is not blanket permission for unrelated processing. For a privacy objection or correction/erasure request concerning source information, contact [email protected]. The fixed-identity product rule does not waive mandatory rights; restriction or removal may be appropriate without editing the historical source.

Cloudflare Turnstile checks abuse-related browser/network signals on lookup and contact-proof requests. A first-party venue-device cookie lasts up to 48 hours; server counters use opaque keyed device/network/contact references, not raw network addresses or candidate lists, and expire on the stated cleanup schedule. These controls serve our legitimate interest in protecting the requested service and its bounded provider usage, independently of optional analytics. The Cookie Policy describes the storage. Map selection uses the Google Maps and optional browser-location processing described above.

Venue proofs, roles, recovery and review

A requested email proof sends the selected published email, venue name and code through the approved Cloudflare email service. A requested SMS or voice proof sends the selected number and verification context to Twilio Verify in US1. Conditional Twilio Lookup checks whether the number is an eligible mobile or fixed line; returned carrier/line information is not stored. Twilio processes the code to check the requested proof. The same international processing and safeguards described for these providers above apply. DNS/HTTPS proof queries the official website's public domain or prescribed challenge path; the domain operator sees the server request and challenge information involved.

We retain an expiring keyed email verifier or temporary provider reference, proof method/source index, timestamps and bounded attempt results. Phone checks temporarily hold the submitted code encrypted for at most 30 seconds before worker consumption; consumed, completed or expired usable proof material is erased. Email/phone proofs expire after ten minutes and domain challenges after 24 hours. Tokens do not become permanent credentials and no code enters job payloads or public exports.

Venue phone permission evidence records the account's independent identifier, a separately keyed recipient reference, exact notice/Terms/Privacy binding, locale and request/window times. We keep that minimum evidence for five years after the ten-minute request window closes to evidence the requested communication and handle related claims. It survives account deletion in restricted form; it is not a readable phone-number archive. This is our proportionate controller policy, not a universal provider-imposed period. Cost reservations retain their existing 32-day period. Declining a send leaves that proof method unavailable; each new text or call needs another affirmative request.

We retain the administrator relationship, staff invitations/membership, public configuration and fixed audit events to operate the venue and protect role changes. Public pages show only published venues and their selected identity plus administrator-authored public fields. A new control proof can initiate the seven-day recovery, which notifies both parties and removes former staff on transfer. The former administrator can request one technical reconsideration. Its reason, accepted proof context and final explanation are accessible only to the parties and authorized compliance reviewers as applicable; the final explanation is shared with both parties. Reviewers must provide only necessary facts. Every privileged evidence read and decision is audited.

Control and transfer are automated under the stated source-proof, authentication, timing and GERS rules. A successful proof may grant or transfer administration; unavailable methods or failed checks do not. A request for technical reconsideration does not pause the automatic deadline. We provide meaningful access to the technical review described in the Terms and retain the available statutory privacy/legal request route. No reviewer may rewrite a frozen source identity merely through this product review.

Referrals and rewards

A referral links its creator's account, selected GERS and frozen source to a shareable random reference. Active recipients see the creator's public alias and whether the reference is their own. Creating and sharing a reference grants no control role. The claimant explicitly chooses the code and acknowledges its free-session obligation. We record the acknowledgment and the one award issued at first publication. We process these records to perform the requested referral arrangement; minimum outcome, abuse and dispute evidence also serves our legitimate interests.

Open referrals retain the selected source while they can be shared. First publication closes competing links and immediately removes their source email, phone and website arrays. Closed referrals are erased after twelve months. An award contains the beneficiary reference, venue, twelve-month expiry and one-session/24-hour limit. Unused rewards are erased twelve months after expiry or cancellation. When session use becomes available, its separately disclosed session-retention rules must apply before a reward can be consumed. We do not create a platform payment or paid-state ledger.

Venue erasure, retention and your information

Abandoned pending claims expire after 30 days; the minute-based cleanup removes expired uncompleted material in bounded batches. Venue deletion immediately removes public configuration, selected source, staff access and pending recovery. Deleting an administrator's account deletes all their administered venues in the same transaction; ordinary staff removal does not delete another administrator's venue. Deleted places retain a minimal internal GERS/control reference for enforcement and rights, not a hidden public page.

Ordinary venue audit and evidence-read events are retained for twelve months. Minimum verified control, transfer and technical-review records remain while relevant control is live and for six years after venue deletion. Permanent GERS blocks and necessary enforcement anchors survive deletion so a fresh claim cannot evade them. These are purpose-specific records, not permission to retain usable authentication secrets or unrelated personal data indefinitely.

Account deletion removes the subject's operational referrals and unused rewards and detaches selected-code links. A specific existing legal hold can preserve minimum closed evidence without source contacts or account access. A hold records its case, purpose, review and expiry, with venue-event/permission holds limited to six months per review. Expired holds release eligible data to cleanup. The privacy worker runs every minute with bounded transactions; stale cleanup or materially overdue unheld data stops new venue admission. Existing residual-copy and restoration/reapplication rules described above still apply.

Recent-authenticated download includes your claims, administered venue records, current staff memberships, own events, phone permission records, referrals, rewards and recovery review outcomes. It excludes other account identifiers, verifier material, device/network keys and hold details. A later authorization loss discards the entire download. Contact [email protected] for rights or retained evidence that cannot be handled by the self-service export; the general rights and complaint information above applies to these venue records too.

Location suggestions for venue search

When you type at least two characters into a geographic search field, the browser sends that location text and interface language to Google Places to suggest cities, neighbourhoods or addresses. Coordinates and geographic bounds are requested only for a place you choose. Current-page suggestions are held in bounded transient memory; they are not an account or saved search history. Venue identity and claim contacts remain sourced from Overture. Account identifiers, venue-name filters, claim purpose, selection receipts and authentication data are not deliberately sent to Google Maps Platform.

Location queries, chosen centres, search results and encrypted selection receipts stay in the current page or immediate request and are not saved as account search history, in the URL or in browser storage. The optional map loads only when you open it; moving it does not search establishments. A geocoding or map failure leaves manual location correction, available location alternatives and account functions usable. No background location tracking is performed.

Private verification destination for a designated test venue

For one specifically designated operational test venue, we retain an owner-authorized verification phone number in encrypted operational credential storage until the designation is withdrawn or the number is replaced. Its purpose is to test the ordinary SMS and voice verification flow, including future claims and recovery. It is shown only in the authenticated verification flow and is sent to Twilio only on an explicit verification request. It does not replace the historical Overture contact or populate the public venue contact.

Each request records the configuration revision and a keyed destination binding in the existing short-lived proof delivery record so a configuration change cannot redirect queued requests. Ordinary proof cleanup erases that binding. The existing independent five-year recipient-permission evidence, access restrictions, erasure rights and protected-backup residual periods apply to test requests too. We do not record verification codes or phone numbers in operational logs.

Verified visits and exact public counts

For a requested visit, we process your account and original sign-in reference, the venue, current staff authorization, explicit start/end intent, timestamps, original tax-inclusive rate and currency precision, schedule revision and timezone, automatic deadline, any referral reward, an available locked exchange estimate, final calculation and closure reason. Contract necessity supports providing the requested visit and its history. Our legitimate interests support role checks, replay prevention and proportionate record-integrity controls. Accepting Terms is evidence of agreement; it is not blanket consent for unrelated processing.

Your history is private by default. You can read and export your own visits. A venue administrator sees the permanent archive for their venue, including the visitor's current alias while the account exists. Ordinary staff see active visits and only their own most recent closure for up to ten minutes. Public venue pages show the exact active count, including zero and small numbers, without account identifiers. A count can allow someone with outside knowledge of a venue to infer attendance; it is not a guarantee of anonymity.

Camera scanning is optional and decodes the QR image locally in your browser. Camera frames are not uploaded or recorded by DeskCafes. Permission can be denied and the short code entered instead. Scanning stops when the page is hidden, the code is consumed or the bounded camera period ends. Visit pages, codes and camera content are excluded from optional acquisition analytics. Codes contain opaque random material rather than readable account, venue or price data; the server stores only their one-way digests.

The server requests a daily public currency table from ExchangeRate-API without sending account, venue or visit identifiers. The provider receives the server's ordinary connection information. We retain dated rate observations to reproduce estimates. Timezone lookup runs locally using geographic data and the already frozen venue coordinates; it does not transmit browser location to a timezone provider.

Visit reports, retention and deletion

Missing a staff-verified closure by the deadline automatically closes the visit and creates a qualifying non-payment report, even when the amount is zero. It records an absent closure, not verified non-payment. We use the minimal visit, venue, time and report facts to operate the disclosed rules and protect the service against repeated misuse, on the basis of our legitimate interests. These records can contribute to the automatic report thresholds described below. Contact [email protected] to contest an objective error or exercise your rights. We do not decide commercial payment disputes.

Operational notices go to the visitor's and administrator's current verified email addresses through Cloudflare Email Sending. Queue payloads contain report identifiers, not email addresses or message text. The notice is attempted for up to seven days after the report is recorded; a delivery acknowledgement is eligible for removal after thirty-one days. Delivery failures do not rewrite visit facts. Notice content explains the automatic report and does not assert that payment was unpaid.

Visit facts, events and report references have no automatic deletion date because the product provides a permanent venue archive and a reproducible enforcement record. This is our selected operating policy, not a statutory requirement. Ordinary account deletion removes the usable account, starting-staff and closing-staff links from those records. Venue deletion removes its public surface and ordinary access; retained records remain restricted. The remaining venue, time and amount facts can still permit identification when combined with outside information, so we treat them as restricted records rather than promise irreversible anonymity. Specific rights requests are assessed on their circumstances, including whether further erasure or restriction is required by law.

Opaque intent codes, retry receipts and scan counters become eligible for removal after twenty-four hours under bounded scheduled cleanup. Short-lived code validity is at most ninety seconds. Agreement receipts use the separate account Terms retention and rights process above; reading or starting a visit does not extend an ended agreement's retention period. Deleting an account or venue closes its active visits without inventing an early non-payment report; an already due automatic report remains. Protected recovery copies follow the backup residual periods described above.

Reviews, public history and discovery

We process the eligible visit reference, venue, your current public identity, ratings, optional text and work attributes, photo references, revisions and timestamps to provide the review and history you request. The current review is public under your alias even if your consolidated history is private. Keeping history private does not hide an individual review's disclosure that you visited the venue. Administrators' responses are attributed to the venue, with their edits retained privately. Providing the requested contribution and history relies on contract necessity; proportionate integrity and abuse controls serve our legitimate interests.

Your consolidated visit history is private by default. A separate public-history choice exposes past verified visits and reviews, excluding current visits, contacts, amounts, staff identities, reports and enforcement records. Returning to private removes the public profile projection. Public search indexing additionally requires three live reviews at three different venues and the site's separate launch/indexing permission. Information already copied by another person may remain outside our control. We do not load acquisition analytics on authenticated history, review or upload surfaces.

Discovery derives ratings, work attributes, typical duration, repeat-visit measures and popular weekday/hour distributions from verified visits and current reviews. It suppresses community summaries until five distinct verified visitors exist and reduces older evidence's weight. Exact historical totals and active counts are unweighted, including small counts. Distinct visitors use a random account-and-venue reference instead of contact identifiers; this is pseudonymous rather than anonymous. These summaries serve our legitimate interests in useful and reliable venue discovery. Selected map areas, distance and filters are used to answer bounded searches, not to store your browser location or a personal movement history.

Review and response revisions remain while their history is required for the service and disputes; there is no automatic expiry for the immutable version archive. Account deletion removes the account link and public identity while retaining community reviews and attached photos as Deleted user. Venue deletion removes the public content and ordinary venue access; minimal review and visit references remain for private history and necessary rights/enforcement handling. Text and photos can themselves identify a person even after the account link is removed. We treat retained content accordingly and assess further erasure, objection or restriction requests individually rather than promise irreversible anonymity.

Photo processing, moderation and retention

Upload bytes are accepted only for an authorized venue or eligible review. We decode the image, apply its orientation, strip metadata and re-encode a sanitized WebP master and responsive variants. Raw originals are not written to storage and their server buffers are cleared after processing or rejection. Size, pixel, format and concurrency limits protect the service. We do not use photos for facial identification, advertising profiles or unrelated model training.

Google Cloud Vision receives a sanitized image for SafeSearch classification using its EU service endpoint and EU resource location. It is not sent your account, contact details, venue reference or review text as request metadata, although the image itself may contain identifying information. Cloudflare R2 stores sanitized private and public copies in EU-jurisdiction buckets. These choices concern selected processing/storage locations, not a guarantee that every provider administrative or support operation is confined to the EU. The applicable provider agreements and transfer safeguards must be in place before activation. Provider identities, rights contacts and the general international-transfer disclosures above continue to apply.

Very-likely unsafe classifications reject a photo; ambiguous results remain private for the authorized owner to assess. Provider failure also holds publication. We retain the decision, time, classification when available and a recorded explanation for a human decision. Moderation supports our legitimate interests in reducing harmful content and protecting others' rights. Photo moderation alone does not sanction an account. Separate community report thresholds can remove a reported photo as described below. Contact [email protected] to seek review, explain a mistake or exercise applicable rights.

An unfinished upload reservation expires after one hour; sanitized unattached drafts expire after seven days. Expired, rejected and withdrawn objects enter bounded cleanup. Selected attached photos become public after sanitization and storage, before safety review. Pending and ambiguous photos remain visible during review or provider outages; review is retried, and rejected photos stop being served immediately and enter stored-copy cleanup. Replacing a review withdraws its previous public photos but retains sanitized private copies with the previous review version. Venue deletion withdraws all of its media. Provider deletion is asynchronous and retried after outages; storage reservations remain until cleanup is confirmed. Short-lived filesystem remnants are also subject to bounded cleanup. Protected recovery copies follow the residual periods described above.

Media operation-attempt records contain an asset reference, operation kind and time, and become eligible for deletion after forty-five days. Immutable moderation and reviewer-role events remain restricted while needed to explain retained content decisions and resolve disputes; they have no automatic expiry in this release. This is an operating retention policy, not a universal statutory requirement. The account download includes private review versions and photo metadata; current venue administrators can export official-photo metadata. Sanitized files may be supplied through authenticated access or the rights-request process. We never provide another visitor's private photo history to venue staff.

The single review reminder uses your current verified email through Cloudflare Email Sending. It is due twenty-four hours after an eligible close, expires eight days after close and is suppressed if the visit has already been reviewed. Its queue and receipt contain references rather than email or message text. Reminder receipts become eligible for cleanup thirty-one days after close; account or venue deletion removes them. Unknown delivery outcomes are not automatically resent. Normal visits do not otherwise generate review email.

Community reports and human decisions

Pending threshold cases contain the minimum report references, counts and target revision needed for a decision. Evidence reads and reasoned approvals or refusals are private and audited. Review explanations, read audit and hold history become eligible for redaction eighteen months after the later of resolution and acceptance of an action notice, provided no linked technical review or specific reviewed hold still requires them. Pending cases and pending action notices do not start that clock. Preservation holds require a reason, a review date and expiry within twelve months. Minimum outcome, target, report references and dates remain restricted while needed to explain enforcement or prevent identical declined evidence from reopening the same action; individual rights and necessity reviews still apply.

A linked staff member may report a closed visit; a visitor with a verified stay may report a venue or their experience; and an eligible account may report a review or photo. We keep the report category, target reference, eligibility and timing facts, reporter reference and any submitted explanation in restricted records. Reporter identities and raw explanations are not public and are not included in affected-party notices. We use these records to investigate misuse, apply the published Community Policy and protect other users, venues and the service, on the basis of our legitimate interests. Staff-report free text becomes eligible for redaction eighteen months after submission, unless an unredacted threshold review, linked recent sanction, open technical review or specific reviewed hold requires it longer. The report's minimal counting facts remain restricted for enforcement and objective-error review.

Three qualifying staff or automatic closure reports from three different venues within twelve months can permanently sanction an account. Five distinct verified visitors reporting the same venue category, representing at least twenty percent of its distinct verified visitors in the last ninety days, can delist the venue. Five eligible distinct accounts reporting a review or photo can remove that item; a removed review can also prevent its author from reviewing that venue again. These thresholds automatically prepare a private review case. An authorised human reviewer assesses the evidence and may approve or decline the action even when the threshold is correctly reached. No account sanction, venue delisting or content removal takes effect before an affirmative, reasoned human decision. The evidence is checked again when deciding; changed evidence cannot be applied as if it had already been reviewed. A report is an allegation or a missing closure, not proof that a payment dispute or interpersonal claim is true.

For the venue threshold, a private ledger records the account, venue and start time of each newly verified visit. Ordinary ledger rows become eligible for deletion after ninety-one days. Rows used in a delisting decision remain through its six-month reconsideration window so the denominator can be checked. The ledger is unavailable to venue staff and is not a public movement history. Venue-report free text becomes eligible for redaction eighteen months after submission, unless an unredacted threshold review, open technical review or specific reviewed hold still needs it. The restricted report category, visitor and venue references and dates remain for threshold and objective-error evidence.

Review and photo reports have no counting window. Their free text becomes eligible for redaction eighteen months after submission or a later removal decision that used that report. An unredacted threshold review, open technical review or specific reviewed hold postpones scheduled erasure. Reports already redacted can still count toward a later removal through their restricted reporter, target, category and time facts; their old free text cannot be recovered for that later review. Your authenticated account download includes the reports you submitted, with any explanation that remains; it does not disclose a reported person's private identity or another reporter's evidence. We can erase a particular report's free text earlier after an individual assessment while retaining necessary minimum facts. We can also limit an exact report's use in future automatic thresholds while preserving its stored evidence for an individual rights case. Such limitations have a documented review date and do not expire automatically; lifting one can resume threshold evaluation. Minimal case-linked restriction and release records remain private. Contact us for individual access, erasure or restriction requests that the download cannot address.

Sanction notices, reconsideration and anti-evasion

After an approved action, we send affected parties the human reviewer's recipient-safe explanation and a private rule, category, date and count summary through Cloudflare Email Sending without revealing reporter identities. Our one technical reconsideration may be requested within six months of a decision. It addresses objective errors and does not replace any mandatory complaint or privacy right, which has its own applicable conditions and time limits. An authorised reviewer may correct an objective identity, calculation, fraud or evidence error; the reviewer does not decide commercial or interpersonal disputes. Requests use a short-lived email code sent to the account's currently verified address. The case retains a restricted reason and proof digest, not the code or submitted address. Evidence reads, decisions and corrections are audited.

Decision and reconsideration email queues store a decision or case reference, the delivery state and relevant dates, not a copy of the recipient address or report text. The current verified address is resolved for a permitted send; a reconsideration outcome is sent only while that address matches the one proved when the request was accepted. A terminal queue's transient attempt identifier and retry details become eligible for deletion after thirty-one days. Minimal delivery or unreachable-state proof remains restricted while the underlying decision or outcome marker is needed to explain enforcement and avoid duplicate sends, subject to individual necessity review. Unreachable notices remain in aggregate operational alerts until the owner records a reasoned manual-delivery or no-safe-channel disposition; this does not itself send a message or decide the underlying case.

A permanent account sanction revokes usable access. The ordinary verified contact details are removed seven months after the decision when no notice, review or specific reviewed hold still needs them. Current verified email and phone identifiers and a currently linked Google identity may instead remain as separate keyed fingerprints tied to that decision to prevent evasion. They are personal data even though the original values cannot be read from the fingerprint. The owner reviews each fingerprint's necessity at least every twelve months and releases it if no longer justified; an overturned decision releases its fingerprints. Minimal decision and report references can remain restricted while enforcement remains necessary. Deletion of an ordinary account does not erase those necessary enforcement records automatically. If you cannot sign in after a sanction, contact us to request access or another privacy right; the owner verifies and assesses the individual case. A technical reconsideration is separate from these rights.

A resolved reconsideration's free-text reason, email proof, explanations and evidence-read audit become eligible for redaction eighteen months after the later of resolution and acceptance of its outcome email, unless a concrete, reviewed and time-limited preservation need applies. A pending outcome or unresolved case does not start that clock. The remaining decision reference, outcome, remedy and dates stay restricted to prevent a corrected decision from firing again and to explain the enforcement record.

Illegal-content notices

Anyone may submit an electronic notice about allegedly illegal public content without creating an account. We collect the exact content reference, legal rationale, supporting facts, good-faith declaration and the notifier's name and contact address where required. A short-lived keyed network reference limits abuse and becomes eligible for deletion after twenty-four hours. We acknowledge receipt, place plausible urgent harm in an internal twenty-four-hour target queue and other notices in a seven-day target queue, and send a reasoned human decision and available redress information. These are our operating targets, not statutory deadlines. The affected author does not receive the notifier's identity unless disclosure is legally required.

Only authorised reviewers may inspect private notice evidence, and each read and decision is audited. A decided case, its correspondence and audit become eligible for deletion eighteen months after the later of the reasoned decision and latest accepted acknowledgement or outcome email, provided no mail remains pending. A specific legal claim or required preservation may delay deletion through a documented hold reviewed within twelve months. An open case has no deletion clock; its continuing necessity is reviewed. Routine email delivery attempt details are cleared separately. Protected backup copies follow the residual periods explained above.

Installation and offline information

The website registers a first-party service worker to support installation and a neutral information screen when a page cannot be reached. Its browser cache contains only our fixed icons, static offline information in the supported languages and the code/style required by that information screen. It contains no account response, visit history, QR/code, location or submitted action. We never queue an offline start, end, scan or account change for later transmission. This functional storage does not grant permission for analytics or notifications. You can remove it using your browser's site-data controls or by removing the installed web app.

Optional visit notifications

You may explicitly enable device notifications from your account and grant the browser permission. This separate optional choice is our basis for processing a subscription to send a useful reminder shortly before your active visit's automatic closing deadline. We do not send marketing or rely on delivery for visit correctness. A notification can appear on a lock screen and suggest that you use DeskCafes; it contains only generic reminder text and a link to your authenticated visits screen, not the venue, location, account identity, price, report evidence or scan code.

We store the account and current login-session binding, a private delivery endpoint, browser encryption/authentication keys, preferred language, the notice version and acceptance time, and the last subscription settings observation. The endpoint is a security-sensitive capability and can indirectly identify a device; it is not anonymous. We restrict operational access and do not intentionally log endpoints, keys or message payloads. Our worker uses the standard encrypted Web Push protocol; the delivery service still processes routing, network, timing and technical metadata.

The browser selects its push delivery infrastructure, which may involve Google, Mozilla, Apple or Microsoft and may process metadata outside the European Economic Area. These are the browser's standard notification channels, not optional acquisition analytics. The browser and delivery operator apply their own service and privacy arrangements; a DeskCafes deletion does not delete your browser/provider account or guarantee deletion of their independent records. We do not claim that a processor agreement for another Google service covers all browser push relays, that encryption hides all metadata or that every delivery remains in Europe. You can decline notifications and continue ordinary use.

You can disable a device or all devices from account settings and revoke notification permission in your browser. Withdrawal removes the selected local subscription and linked delivery receipts immediately. Signing out/revoking its login also removes the corresponding subscription. Expired or inactive/restricted account sessions cannot receive new reserved reminders; bounded maintenance clears their subscription data. We clear a subscription after ninety days without a settings observation, or after the browser service reports it expired. Minimal visit-linked attempt time and generic outcome records otherwise expire after thirty-one days. These are our purpose-based retention choices, not universal statutory periods. A message already accepted or in flight cannot always be recalled; device permission is an additional control. Residual backup copies follow the periods described above.

Your notification-data download includes your own endpoints, preferences, consent dates and delivery outcomes. Browser authentication/encryption keys are excluded as security credentials. Existing account access and recent-authentication safeguards protect that download; other users cannot retrieve your subscriptions. The usual access, deletion, withdrawal and complaint channels in this policy also apply. Browser capability, installation and delivery can vary; an unavailable reminder never stops an ordinary visit action.

Optional account photograph and biography

You may choose to upload a profile photograph and a short biography. These optional account settings are processed to provide the profile you request; you can use DeskCafes without them. Your selected sanitized photograph appears publicly with your reviews even when visit history is private. Your biography and any links you enter appear on your public profile only when you explicitly enable that profile. External links are ordinary links, not embedded or fetched content; following them contacts the other website. Do not include information you do not want to publish or upload an image you lack permission to share.

Profile photographs use the same existing sanitization, restricted staging, object storage and safety moderation as venue and review photographs. We remove image metadata and publish selected sanitized variants before safety review, withdrawing them if they are rejected. This uses the providers and safeguards already described above, with no new biometric recognition, analytics purpose or provider. We store the profile fields, their revision and the selected photograph until you change/remove them or delete your account. Receiving a sanitized replacement withdraws the previous selection; rejected or withdrawn photographs follow the existing media cleanup rules. Public images may be copied by third parties and cannot always be recalled from their independent copies.

Removing your photograph withdraws its public projection and schedules removal of its stored image copies. Account restriction suspends its public projection; account deletion removes the biography, selected photograph and account profile record. Existing review photographs are separate content and retain the review-specific deletion rules described above. Your authenticated data download includes your own biography and photograph records. Access, correction, removal and complaint channels, and the residual backup periods described above, also apply to these optional fields.

Staff membership notifications

Venue administrators can search registered public usernames and add a matching account directly to their staff. Search shows public names and usernames, without disclosing contact details. We send the new member an operational email through Cloudflare describing the venue membership. Membership delivery state remains with that membership until removal; bounded email-attempt metadata follows the existing thirty-one-day retention period. This supports the requested venue administration service and is not marketing. Staff membership and removal remain subject to the access and rights procedures above.

Agents and connected applications

When you deliberately authorize an agent or application, DeskCafes gives that connection the operations permitted by your current account and venue roles. It receives only the information requested by those operations. Your password, authenticator secrets, authentication cookies and Google credentials are not shared. You can disable all external access, block a particular client or disconnect it from Connected accounts in your web profile. Disabling revokes existing credentials; re-enabling requires a new connection. Ordinary website sign-out does not end a connection. Account restriction, deletion, password recovery and account-wide session revocation invalidate delegated access.

We process the account and client identifiers, developer-supplied client name and registered redirect addresses, authorization and token records, connection state and revision, connection date and latest-use date to provide the connection you request and protect account access. Custom client names are not verified platform identities. Client developers and the agent platform process the information you choose to send them under their own terms and privacy rules, potentially outside the European Economic Area. Connecting does not authorize DeskCafes to use conversation contents for analytics or marketing. Protecting authorization and request quotas serves our legitimate interests in account security and availability.

Authorization codes expire after one minute, access tokens after fifteen minutes and rotating refresh tokens after thirty days. Expired token and replay records become eligible for removal after one further day. Pending operations, their submitted data and bounded private lookup results with selection receipts expire after thirty minutes and are removed by scheduled maintenance; passwords and authentication codes are never pending-operation input. Original visit QR and fallback code material is returned once and is not stored in integration activity. Bounded pseudonymous quota buckets expire after one day. Unused public client registrations without connections are eligible for removal after thirty days. Connection metadata, owned developer applications and disabled-client preferences remain while the account exists or until you remove the application. Your data download includes your connection metadata, external-access preference and owned application metadata, without client secrets or usable credentials. Account deletion removes these ordinary integration records, subject to the existing backup and separately explained evidence rules.

Optional profile location and statistics

You may enter a city and country to describe your location. This is optional, self-declared coarse information: we do not obtain GPS coordinates, geocode it or verify your residence. It is shown on your public profile only while your existing public-profile and visit-history choice is enabled. Changing it does not change the location of a visit. You can edit or clear it at any time; we keep these settings and their revision until removal or account deletion. Your authenticated media/profile data download includes them, and account deletion removes the profile record.

Your profile shows totals and durations of completed visits, different venues and known venue countries, local days of activity, repeat visits and visits completed in the last thirty days. These totals use the whole retained history, exclude live visits and contain no live location, billing, staff identity or visit codes. The same public-profile choice controls public access to these statistics. They are calculated from existing visit records rather than kept in an additional tracking store; removed venue information can reduce known country counts. They are service information, not acquisition analytics.

Reviews may include an optional title. The title is public with the review and follows the same immutable-version, correction, withdrawal, export, erasure and retention rules as its text. Your profile includes a paginated list of current visible reviews and their venue photographs, plus arithmetic means and score distributions showing your personal rating pattern. Each criterion averages only reviews that scored it, with the sample count shown. Edited reviews contribute once; removed or unpublished reviews do not contribute to this panel. These personal means do not change the existing age-weighted venue ratings and do not automatically classify, sanction or rank you. Consolidating them with your visit statistics remains subject to your public-profile choice; individual public review attribution remains independent as already described above.