This page contains two documents that together govern your use of everything we operate: the Concierge mobile and web app used by hotel guests, and this website.

• Part 1 — Terms & Conditions: the rules for using the app and this website.
• Part 2 — Privacy Policy: what personal data we collect, why, on what legal basis, and what rights you have.

Cookies and similar technologies used on this website are described separately in our Cookie Policy.

If you do not agree with these documents, please do not use the app or this website. If anything is unclear, write to us at info@conciergefriend.com.

1. Who we are and what these terms cover

The Concierge app and this website are operated by Concierge Friend ("we," "us," "our"), a business established in Spain and owned by Mattia Penna, with its registered address at Calle Carlos Cervera 10, pta 2, 46006, Valencia and tax identification number ESY6134937T.

These terms apply to you both as a guest — someone using the app during a stay at a hotel or other accommodation that offers it — and as a visitor to this website. Section 14 additionally applies to accommodation businesses that subscribe to our service.

By downloading, installing, opening or otherwise using the app, you accept these terms. If you use the app on behalf of an organisation, you confirm that you are authorised to accept these terms on its behalf.

2. What the service is

Concierge is a digital concierge. You choose the accommodation you are staying at, and the app shows you a curated catalogue of places, activities, events and practical information around it, sorted by distance from where you are and filtered by the interests you tell us about.

We are an information and recommendation service, not a travel agency, tour operator, booking platform or payment provider for guests. We do not sell activities, tickets, tables, rooms or transport. Where the app offers you a way to book or buy something, that transaction takes place with a third party under that third party's own terms — see section 7.

3. Accounts and how you get access

You can use the app in one of three ways, and you choose which:

• With an email address. We send a one-time code to your email address; entering it in the app signs you in. No password is created or stored.
• With a social account. You can sign in with Google, Apple or Facebook through Firebase Authentication. See the Privacy Policy for what we receive.
• As an anonymous visitor. You can browse without giving us an email address at all. In that case your device holds a visitor token instead of an account, and features that depend on identifying you across devices will not be available.

You are responsible for keeping access to your device and to the email account or social account you sign in with. Do not share your access with anyone, and tell us at info@conciergefriend.com if you believe someone else is using your account.

The information you give us — your name, email address and interests — must be accurate, and you must keep it up to date. You can change it at any time in the app's settings.

4. Age requirement

The app is not intended for children. You must be at least 16 years old to create an account, or older if the law of your country sets a higher age for consenting to the processing of personal data. If we learn that we hold personal data of a child below that age, we will delete it.

5. Content in the catalogue and how accurate it is

The places, activities, events, opening times, prices, addresses and descriptions shown in the app come from several sources: content written and uploaded by the accommodation that offers you the app, data about places sourced from Google Places, activity and tour listings from our partners, and event listings from providers such as Ticketmaster.

We take reasonable care to keep this catalogue useful and current, but we do not warrant that any of it is accurate, complete or up to date, and we depend on those third parties for much of it. Opening hours change, venues close, events are cancelled and prices move. Always check directly with the venue or provider before you rely on what the app shows — in particular before you travel, spend money, or make plans that matter to you.

Nothing in the app is professional advice of any kind, and a place appearing in the catalogue is not an endorsement, a recommendation of its safety, or a statement about its quality.

6. Photographs in the app and their attribution

Every photograph in the catalogue belongs to whoever created it or licensed it to us, not to you, and none of it may be copied, downloaded, redistributed or reused outside the app. Photographs reach the app in three ways:

• Google Places. Most photographs of venues in the catalogue come from Google Places and were contributed by the people who took them. Where this is the case, the app displays an attribution badge on the photograph naming the author and identifying Google Places as the source, in line with Google's requirements. Rights in those photographs remain with their authors and with Google LLC as applicable, and their use is governed by Google's Terms of Service and the Google Maps/Google Earth legal notices.
• Our trusted partners and content providers. Photographs that are not from Google Places are supplied by the activity, tour, event and affiliate providers we work with — such as GetYourGuide, Civitatis, Ticketmaster and comparable providers — and are used under the licence each of them grants us. Where we hold the author's name, the app displays it in the same attribution badge on the photograph.
• The accommodation itself. Accommodations that subscribe to our service upload their own photographs as part of the content they publish in the app. Those photographs remain theirs. By uploading them, the accommodation confirms that it holds all necessary rights and permissions and grants us the licence described in section 14 so that we can store and display them in the app.

Attribution is displayed wherever we hold the author's name for a photograph. If you believe a photograph in the app infringes your rights or is attributed incorrectly, tell us — see section 16, and we will act on it.

7. Booking links and affiliate relationships

Some links in the app earn us a commission. When you tap a link to book an activity, tour, ticket or experience, we may add our partner identifier to that link so that the provider — for example GetYourGuide or Civitatis — knows the booking came from us and pays us a commission on it. This does not change the price you pay: it costs you nothing extra, and we do not receive any payment details from those bookings.

We tell you this plainly because you are entitled to know it. It does not mean a listing is paid placement in the ordinary sense, but you should be aware of the commercial relationship when you weigh a recommendation.

When you follow such a link you leave the app and enter a website or app operated by someone else. Any purchase, booking, cancellation, refund, complaint or dispute is between you and that provider, under their terms and their privacy policy. We are not a party to it, we do not control it, and we are not responsible for the goods or services provided, for their availability or pricing, or for the provider's handling of your data. The same applies to any other external link in the app, including links to a venue's own website and the WhatsApp link some accommodations offer for contacting reception.

8. Reviews and anything else you submit

The app lets you rate your experience and send us a written message. Keep it lawful and civil: do not submit anything unlawful, defamatory, hateful, harassing, deceptive, or infringing someone else's rights, and do not include other people's personal data.

You keep ownership of what you write. By submitting it you give us and the accommodation you are staying at a non-exclusive, royalty-free, worldwide licence to store, reproduce and use it in order to run and improve the service and to respond to you. We may remove any submission that breaches these terms.

9. Acceptable use

You agree not to:

• copy, modify, translate, adapt or create derivative works of the app, or attempt to extract, decompile or reverse-engineer its source code, except to the extent that mandatory law expressly permits it;
• scrape, harvest, bulk-download or systematically extract the catalogue, images, listings or any other content;
• use the service in a way that interferes with, overloads or damages it, or attempt to gain unauthorised access to it, to any account, or to any system connected to it;
• use the service to break the law, to infringe anyone's rights, or to resell or commercially exploit it without our written agreement;
• remove, obscure or alter any attribution, copyright notice or trade mark shown in the app.

We recommend that you do not jailbreak or root your device. Doing so removes security protections built into your operating system, may expose you to malware, and may stop the app from working correctly or at all.

10. Intellectual property

The app and this website, their software, design, structure, text, graphics, logos and trade marks — everything other than third-party content and content uploaded by accommodations — belong to Concierge Friend and are protected by copyright, trade mark and database rights.

We grant you a personal, limited, non-exclusive, non-transferable and revocable licence to use the app on your own device for its intended purpose. That licence gives you no ownership of anything, and it ends when these terms end.

11. Push notifications and location

The app may ask your permission to send push notifications and to use your device's location. Both are optional and both are entirely under your control: you can grant or withdraw either at any time in your device's settings, and the app will continue to work without them, with reduced functionality — without location it cannot sort recommendations by how near they are to you.

How location and notification data are handled is described in the Privacy Policy below.

12. Connectivity, devices, updates and availability

The app needs an active internet connection for most of what it does. We are not responsible for the app failing to work fully when you have no Wi-Fi or mobile data, when your device runs out of battery, or when your device or operating system is not supported.

If you use the app outside a Wi-Fi network, your agreement with your mobile operator still applies and you may be charged for data, including roaming charges when abroad. Those charges are yours. If you are not the bill payer for the device, we assume you have the bill payer's permission to use the app.

The app is available for Android and iOS and as a web app. We release updates from time to time, and system requirements may change. The app enforces a minimum supported version: when a release is too old to work safely with our service, the app will ask you to update before you can continue. We do not promise that the app will remain compatible with every version of every operating system, and we may change, suspend or discontinue any part of the service.

We aim to keep the service available but we do not guarantee uninterrupted or error-free operation. Maintenance, third-party outages and events beyond our control can interrupt it.

13. Ending your use, and deleting your account

You may stop using the app at any time and delete it from your device. You can delete your account directly in the app, under Settings → Account → Delete account. Deletion is described in the Privacy Policy under "How long we keep your data".

We may suspend or terminate your access if you breach these terms, if we are required to by law, or if we discontinue the service. On termination your licence to use the app ends and you must stop using it. Access may also end when the accommodation that offers you the app stops subscribing to our service.

14. Subscriptions for accommodations

This section applies to hotels and other accommodation businesses that subscribe to Concierge, and not to guests.

Subscriptions are taken out through our onboarding flow and paid by card through Stripe, which acts as our payment processor. We do not receive or store your full card details. Subscriptions are billed on a recurring basis at the price and interval shown at checkout, plus any applicable setup fee and VAT, and renew automatically until cancelled.

The signed subscription contract we send you at the point of purchase governs the specific commercial terms — price, term, notice period, cancellation and refunds — and prevails over this section where the two differ. Contact info@conciergefriend.com for a copy or to discuss changes to your subscription.

Content you publish. You keep ownership of the text, images and other content you upload. You grant us a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, adapt for display and publish that content in the app and in related materials for as long as your subscription is active and for as long afterwards as is necessary to wind down the service. You warrant that you hold all rights and permissions needed for that content, including for every photograph you upload, and that it does not infringe anyone's rights or breach any law. You are responsible for keeping it accurate and lawful, and you will indemnify us against claims arising from it.

Guest data. We are the controller of the personal data that guests give us through the app, as explained in the Privacy Policy. Your back-office account gives you access to the guests who used the app at your property — their name, email address, language, sign-in method and in-app activity — and lets you export that list. You may use it only in connection with those guests' stay and the service you offer them. When you use it for your own purposes you act as a controller in your own right and are responsible for complying with data protection law, including having a lawful basis for any marketing you send. You must not use it to contact guests of any other property, sell or pass it to anyone else, or keep it once it is no longer needed for those purposes.

15. Disclaimers and limitation of liability

To the fullest extent permitted by law, the service is provided "as is" and "as available", without warranties of any kind, whether express or implied, including implied warranties of merchantability, fitness for a particular purpose, accuracy and non-infringement.

We are not liable for any loss you suffer as a result of relying on catalogue content, third-party content, distances or directions shown in the app, or for any act or omission of a venue, activity provider, event organiser or accommodation. We are not liable for indirect or consequential loss, loss of profit, loss of data, or loss of opportunity.

Where we are liable, our total aggregate liability is limited to the amount you have paid us, if any, in the twelve months before the event giving rise to the claim. Since the app is free for guests, that amount will normally be zero.

Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited or excluded. If you use the app as a consumer, you keep all the rights that consumer law in your country gives you, and nothing here reduces them.

16. Reporting illegal, infringing or incorrect content

If you believe that anything in the app or on this website is unlawful, infringes your copyright or other rights, or is factually wrong, write to info@conciergefriend.com with enough detail to identify the content — a screenshot, the name of the venue or event, and the reason for your complaint. Where you claim infringement, please also tell us who you are and what right you hold.

We review every report and, where the complaint is justified, remove or correct the content within a reasonable time. Where the content came from a third-party source such as Google Places or a partner provider, we will also pass the report on to them.

17. Changes to these terms

We may update these terms to reflect changes to the service, to our partners, or to the law. The updated version takes effect when it is published on this page, and the "Last updated" date changes with it. If a change materially affects your rights, we will make a reasonable effort to bring it to your attention in the app. Continuing to use the service after a change means you accept it.

18. Governing law and disputes

These terms are governed by the law of Spain, and the courts of Valencia have jurisdiction over any dispute. If you are a consumer resident in the European Union, this does not deprive you of the protection of the mandatory law of your country of residence, and you may also bring proceedings in the courts of that country.

If any provision of these terms is found unenforceable, the rest remains in force.

19. Third-party platform terms

The app is distributed and supported by platforms that have their own terms, which apply alongside ours:

• Google Play and Google services
• Apple Media Services
• Mapbox, which provides the maps in the app

If you obtained the app from the Apple App Store: Apple is not a party to these terms and has no obligation to provide support for the app; these terms are between you and us alone; and Apple and its subsidiaries are third-party beneficiaries entitled to enforce them against you.

20. Contact

Concierge Friend, Calle Carlos Cervera 10, pta 2, 46006, Valencia — info@conciergefriend.com.

1. Who is responsible for your data

Concierge Friend is the data controller for the personal data described in this policy. That means we decide why and how it is processed, and you can exercise all of your rights directly with us. Our details:

• Concierge Friend, a business established in Spain, owned by Mattia Penna
• Registered address: Calle Carlos Cervera 10, pta 2, 46006, Valencia
• Tax identification number: ESY6134937T
• Email: info@conciergefriend.com
• Data protection contact: info@conciergefriend.com

The accommodation you are staying at can see your data. Through a back-office account it has access to the guests who used the app at its property — your name, your email address if you gave us one, your language, how you signed in, and what you looked at in the app while you were there. It uses that information to run and improve the service it offers you. When it does so for its own purposes it acts as a separate controller, and its own privacy policy applies to what it does from that point.

An accommodation can only ever see guests connected to its own property. It has no access to guests of any other property, and no accommodation receives a list of guests who did not use the app with it.

2. Which part of this policy applies to you

• If you are a guest using the app — on iOS, on Android, or in a browser — read sections 3 and 4.
• If you are visiting this website, read section 5.
• If you requested a demo or subscribed as an accommodation, read section 6.

Sections 7 onwards apply to everyone.

3. What we collect in the app, and why

Your account and how you sign in

What: your email address if you sign in by email; the one-time code we send you; the accommodation you selected; your language; the platform you use the app on (iOS, Android or web); how you arrived at the app; and, if you sign in with Google, Apple or Facebook, an identifier from that provider together with the name, email address and profile picture that provider gives us. We never receive your password for a social account.

If you use the app as an anonymous visitor, we do not collect an email address at all — your device holds a visitor token instead.

Why: to create your account, sign you in, keep you signed in and provide the service.
Legal basis: performance of a contract with you (Article 6(1)(b) GDPR).

More about signing in with Google, Apple or Facebook

Social sign-in runs through Firebase Authentication, a Google service. We receive only what the provider you chose passes to us:

• Google — an account identifier, your name, your email address and your profile picture. You can revoke our access at myaccount.google.com/permissions.
• Apple — an account identifier, your name and an email address. Sign in with Apple lets you hide your real address. If you choose to, Apple gives us a private relay address ending in @privaterelay.appleid.com that forwards our messages to you, and we never see or store your real one. You can revoke our access in Settings → your name → Sign in with Apple on your device.
• Facebook — an account identifier, your name, your email address and your profile picture. You can revoke our access under Settings → Apps and Websites.

We never receive your password. We do not post anything to your social accounts, we do not read your posts, and we do not access your friends, followers or contacts. We ask each provider only for the sign-in information listed above.

Revoking our access at the provider stops you signing in that way in future, but it does not delete the account you created with us — to do that, use Settings → Account → Delete account in the app.

Your name, interests and favourites

What: the name you optionally give us, the interest tags you pick during onboarding or later change in Settings, and the places you mark as favourites.

Why: to personalise which recommendations you see and to let you find your saved places again.
Legal basis: performance of a contract with you (Article 6(1)(b) GDPR).

Your location

What: the precise latitude and longitude reported by your device, together with the moment it was taken.

Why: the core of the service is showing you what is near you. Your coordinates are attached to the requests the app makes to our servers so that results can be sorted and filtered by distance, and so that we can place you and nearby venues on the map.

How it works in practice: the app asks your operating system for permission before it reads your location for the first time. Your position is kept on your device and is treated as valid for 30 minutes, after which the app asks your device for a fresh one. We do not build a history of your movements, we do not store a trail of your past positions, and we do not use your location for advertising.

Legal basis: your consent (Article 6(1)(a) GDPR), given through your device's location permission. You can withdraw it at any time in your device settings, with no effect on processing carried out before you withdrew it. The app continues to work without location; it simply cannot order results by distance.

When the map is displayed, map tiles are requested from Mapbox, which necessarily receives your IP address and the map area being requested in order to serve them.

How you use the app

What: which categories, places, events and action buttons you open, with the date and time, the language you were using, the accommodation you were connected to and the platform. This is our own measurement — we do not use Google Analytics, Mixpanel or any third-party analytics or session-recording tool inside the app.

Why: to understand which content is useful, to improve the catalogue and the app, and to show the accommodation you are staying at how its guests are using the app at its property. The accommodation sees this alongside your name and email address, not as anonymous totals — see section 1.
Legal basis: our legitimate interest in understanding and improving our own service (Article 6(1)(f) GDPR). You can object to this — see section 10.

Push notifications

What: a device token issued by Firebase Cloud Messaging and the notification topics your device is subscribed to.

Why: to send you notifications about your stay and about the app.
Legal basis: your consent (Article 6(1)(a) GDPR), given through your device's notification permission and withdrawable in your device settings at any time.

Reviews and feedback

What: the score and any message you send us, linked to your account and to the accommodation.

Why: to respond to you and to improve the service.
Legal basis: our legitimate interest in receiving and acting on feedback (Article 6(1)(f) GDPR).

Newsletter

What: your email address and the fact that you opted in.
Why: to send you our newsletter.
Legal basis: your consent (Article 6(1)(a) GDPR). Every newsletter contains an unsubscribe link, and you can also turn it off in the app's settings.

Technical and security data

What: data our servers record automatically when the app talks to them — IP address, request time and path, device and operating system information, app version, language and error reports.

Why: to operate and secure the service, diagnose faults and detect and prevent abuse.
Legal basis: our legitimate interest in the security and reliability of our service (Article 6(1)(f) GDPR).

4. QR codes and matching a scan to an installation

Accommodations often introduce the app with a printed QR code. When that code is scanned, we record the accommodation and language it points to, together with a small set of technical signals about the device: IP address, operating system, device type, language, screen dimensions and pixel ratio.

If the app is then installed and opened on a device shortly afterwards, we compare those signals with the ones reported by the new installation so that we can take you straight to the right accommodation instead of asking you to find it manually. Only scans from the last 15 minutes are considered, and the comparison is a similarity score, not an identification: it tells us "this is probably the same device", nothing more. We do not use these signals to build a profile of you or to track you across other apps or websites.

Legal basis: our legitimate interest in making the first run of the app work correctly (Article 6(1)(f) GDPR).

5. What we collect on this website

This website is our marketing site, aimed at accommodation businesses. What we use here is different from what runs in the app.

Google Analytics

We use Google Analytics, provided by Google Ireland Limited, to measure how the site is used: pages viewed, referring source, approximate location derived from IP address, device and browser characteristics, and interactions with the page. It sets cookies and similar identifiers on your device.

Google Privacy Policy · Google Analytics opt-out browser add-on

Mixpanel, including session recording

We use Mixpanel, provided by Mixpanel, Inc., on this website, configured against its European data residency servers. Mixpanel is set up with automatic event capture and with session recording enabled, which means that — in addition to counting page views and clicks — it can record a replay of your visit: the pages you moved through, where you moved your pointer, what you clicked and what you scrolled, together with technical data such as your device, browser, approximate location and a pseudonymous identifier stored on your device.

We use these recordings only in aggregate, to understand where the site confuses people and to improve it. We do not use them to identify you personally, and we do not sell them. Recordings are configured to mask text you type into form fields; even so, please avoid entering sensitive information into any field on this site that does not ask for it.

Mixpanel Privacy Policy · Mixpanel opt-out

Legal basis and your control

Analytics and session recording rely on your consent (Article 6(1)(a) GDPR and the applicable ePrivacy rules), which you give through the cookie banner shown on your first visit and can change or withdraw at any time. Cookies strictly necessary to make the site work rely on our legitimate interest in operating it. The full list of cookies and how to control them is in our Cookie Policy.

Our web server also keeps standard access logs — IP address, request time, page requested, browser — for security and troubleshooting, on the basis of our legitimate interest.

6. Demo requests and subscriptions

Requesting a demo

What: the first name, last name, business email address, phone number, company name and company size you enter in the demo form, plus the referral source if you arrived through a tracked link.

Why: to contact you about the demo you asked for and about our service.
How: the form does not create a record in our website's database — it is sent to us by email and handled in our own inbox and sales tools.
Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in business-to-business communication (Article 6(1)(f) GDPR). You can ask us to stop contacting you at any time.

Subscribing

What: the business and contact details you give during onboarding — company name, address, VAT or tax identifier, and the name and email address of the person responsible — together with subscription and invoice records. Payment is taken by Stripe, which collects and processes your card details directly as an independent controller. We never see or store your full card number.

Why: to set up and run your subscription, issue invoices and meet our accounting and tax obligations.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations, in particular tax and accounting law (Article 6(1)(c) GDPR).

7. Who we share data with

We do not sell your personal data, we do not rent it, and we do not share it for third-party advertising or cross-context behavioural profiling. We share it with the accommodation you are staying at, with the providers we need in order to run the service, and with authorities where the law requires it.

The accommodation you are staying at. As described in section 1, it can see the guests who used the app at its property, including your name, your email address and how you used the app there, and it may export that list. It is bound by its agreement with us to use that information only in connection with your stay and the service it offers you, and to comply with data protection law in its own right.

The service providers below are each bound by a contract that limits them to acting on our instructions:

• Google Ireland Limited / Google LLC — Firebase Authentication for social sign-in, Firebase Cloud Messaging for push notifications, Google Places for venue data and photographs, and Google Analytics on this website. Privacy policy
• Mapbox, Inc. — maps in the app; receives your IP address and requested map area. Privacy policy
• Mixpanel, Inc. — analytics and session recording on this website only, on EU servers. Privacy policy
• Stripe — payment processing for accommodation subscriptions. Privacy policy
• Apple Inc. — Sign in with Apple, if you use it. Privacy policy
• Meta Platforms — Facebook Login, if you use it. Privacy policy
• Our hosting and email providers — to run our servers and send you transactional email such as sign-in codes.

Affiliate and booking partners. When you tap a booking link, you leave our app and go to a partner such as GetYourGuide or Civitatis. We pass no personal data to them: the link carries only our partner identifier so that a resulting booking is credited to us. From that point their own privacy policy applies to you.

We may also disclose personal data where we are legally required to — to a court, regulator or law enforcement body — or where it is necessary to establish, exercise or defend legal claims, and in connection with a merger, acquisition or sale of assets, in which case the recipient will be bound by this policy.

8. Where your data is processed

Our servers and databases are located in the European Union.

Some of the providers listed above are established in, or transfer data to, the United States — in particular Google, Mapbox, Mixpanel, Stripe, Apple and Meta. Where personal data is transferred outside the European Economic Area, we rely on the safeguards required by Chapter V of the GDPR: the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise the European Commission's Standard Contractual Clauses together with supplementary measures. You can ask us for a copy of the safeguards that apply to a specific transfer.

9. How long we keep your data

As a rule, we keep the data described in section 3 for as long as your account exists — your profile, interests, favourites, in-app activity, reviews and feedback — because it is what the service is built from. Where the law requires us to keep something for longer, or to delete it sooner, the law takes precedence over this rule.

• If you delete your account: we deactivate it immediately and stop using it to provide the service. We keep the deactivated record only for as long as we still need it — to prevent abuse, resolve a dispute or meet a legal obligation — and not beyond what those purposes require.
• Location: never kept as a history. Your position stays on your device, is treated as valid for 30 minutes, and is used in the moment to sort results.
• QR scan signals: matched against a new installation, or disregarded, within 15 minutes. The scan records are kept while we still need them for attribution reporting.
• Server and access logs: kept for a limited period for security and troubleshooting, then discarded.
• Website analytics and session recordings: for the retention period configured in Google Analytics and Mixpanel, after which those providers delete them.
• Demo requests: for as long as we are in contact with you about the service, unless you ask us to delete them sooner.
• Invoices and accounting records: for the period required by tax law in Spain, normally 7 to 10 years — a legal obligation that applies regardless of the rule above.

Data held by the accommodation you stayed at is kept under its own retention rules, not ours. Deleting your account with us does not remove a copy it has already exported — ask the accommodation directly, or ask us and we will pass the request on.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Rectify data that is inaccurate or incomplete.
• Erase your data, where one of the grounds in Article 17 applies.
• Restrict our processing in the circumstances set out in Article 18.
• Object to processing based on our legitimate interests, including our in-app usage measurement, on grounds relating to your particular situation — and to object to direct marketing at any time, with no need to give a reason.
• Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
• Withdraw consent at any time where we rely on it — location, notifications, newsletter, website analytics — without affecting the lawfulness of what we did before you withdrew it.
• Lodge a complaint with a supervisory authority.

How to exercise them

Several of these you can exercise yourself, immediately, in the app: change your name and interests in Settings, turn the newsletter on or off there, revoke location and notification permission in your device settings, and delete your account under Settings → Account → Delete account.

For anything else, email info@conciergefriend.com. We answer within one month, and will tell you if we need longer because a request is complex. Exercising your rights is free; we may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive. We may need to ask you for information to confirm who you are before we act.

Complaining to a supervisory authority

If you think we are handling your data unlawfully, you can complain to the data protection authority of the EU country where you live or work, or to our lead authority, AEPD. A list of EU authorities is available here. We would appreciate the chance to address your concern first.

11. What we do not do

• We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
• We do not process special categories of data — health, religion, political opinions, sexual orientation, biometrics — and you should not send them to us.
• We do not make decisions about you by purely automated means that produce legal or similarly significant effects, and we do not carry out profiling of that kind.
• We do not run advertising networks, ad targeting or "offer walls" in the app.
• We do not track you across other companies' apps or websites.

12. Security

We use technical and organisational measures appropriate to the risk: encrypted connections, access controls and separation of duties, bearer-token authentication rather than stored passwords, delegation of card payments to Stripe so that card data never reaches us, and regular updates to our systems.

No system is completely secure, and we cannot guarantee that our safeguards will never be defeated. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as the GDPR requires.

13. Children

The service is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us at info@conciergefriend.com and we will delete it.

14. If you are in the United States

We apply the standard described in this policy to everyone, wherever they live. For residents of California and other US states with comparable laws: we do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. You have the right to know what we collect, to request deletion or correction, and not to be discriminated against for exercising those rights. Use the contact address above to make a request.

15. "Do Not Track"

There is still no agreed standard for how websites should respond to browser "Do Not Track" signals, and we do not currently respond to them. Use the cookie banner and the controls described in section 5 instead — those we do honour.

16. Changes to this policy

We update this policy when our processing changes or the law requires it. The revised version takes effect when published here, and the "Last updated" date changes with it. Where a change materially affects you, we will bring it to your attention in the app or on this website, and where the change concerns processing based on your consent, we will ask for your consent again.

17. Contact

Questions about this policy, or about anything we do with your data: info@conciergefriend.com — Concierge Friend, Calle Carlos Cervera 10, pta 2, 46006, Valencia.