Privacy policy

Data controller

The controller under the GDPR is VIBE OF THE CITY S.L.U., Calle Maestranza 25, 29016 Málaga, Spain — NIF B93847945. You can reach us by email at hello@vibeofthe.city.

Content responsibility under § 18 Abs. 2 of the German MStV: Marc Petersen, Managing Director, at the address given in the imprint.

Data we process

Account data: email address, language, profile details (display name, handle, bio, avatar), visibility preferences, optional marketing opt-in, timestamp of your acceptance of the terms of use.

Usage data: saved days and cities, buddy connections, visit history, microsignal preferences, recommendation threads, push tokens (mobile app only) and your notification preferences.

Technical data: IP address (processed in truncated form for rate-limiting and abuse detection), user agent, anonymous onboarding cookie before sign-in, browser language preference.

Content you contribute: uploaded photos, photo reports, posts in recommendation threads, your profile avatar.

Legal bases and purposes

Performance of contract (Art. 6(1)(b) GDPR): providing the account, sign-in via magic link, storing your trip and city data, buddy connections, sending transactional emails (signup confirmation, sign-in link, profile invites).

Legitimate interest (Art. 6(1)(f) GDPR): protecting the platform from abuse (rate-limiting, spam detection), quality assurance for our recommendations, aggregated and anonymised usage measurement.

Consent (Art. 6(1)(a) GDPR): marketing communications (only if you explicitly opted in at signup or in your account), push notifications, location access in the mobile app.

Sub-processors and recipients

We use the following providers, with whom we maintain or sign Art. 28 GDPR data-processing agreements before any production data is shared:

Resend (Resend Inc., US / EU region) — sending transactional and marketing emails.

Railway (Railway Corp., US) — application and database hosting in the EU region.

Cloudflare (Cloudflare, Inc., US) — CDN, DDoS protection and WAF for the public websites.

PostHog (PostHog Inc., EU region eu.i.posthog.com) — product analytics, only with your consent given via the cookie banner. You can withdraw consent any time via "Cookie preferences" in the footer.

We do not sell personal data and do not use US advertising networks.

International transfers

Where a sub-processor processes data outside the EEA, we rely on the Standard Contractual Clauses (Module 2, Implementing Decision (EU) 2021/914) and supplementary measures (TLS in transit, short retention windows, IP truncation in logs).

Retention

Account and usage data are retained for as long as your account exists. After you delete your account, personal data is removed from production systems within 30 days; backups are rotated on a 90-day cycle.

Magic-link tokens expire automatically after 15 minutes. Rate-limit counters expire within a rolling hourly window. Share events are analysed in aggregate for 24 months and then pseudonymised.

Your rights

You always have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). You may withdraw any consent at any time with effect for the future.

Send requests to hello@vibeofthe.city. We respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — for example the Agencia Española de Protección de Datos (aepd.es).

Cookies and similar technologies

Strictly necessary: session cookie (votc_session) for sign-in, an anonymous onboarding cookie before sign-in, and a language cookie. These run on the basis of legitimate interest or contract performance — no prior consent is required.

Optional, only with consent: if you choose "Accept analytics" in the cookie banner, your browser loads PostHog (EU-hosted). PostHog sets a cookie to recognise the visitor and stores a pseudonymous identifier in localStorage (the votc_consent key remembers your choice). We do not use session replay or advertising trackers.

We do not set advertising cookies and do not participate in third-party targeting platforms. You can change your choice any time via "Cookie preferences" in the footer.

Privacy contact

Questions and rights requests: hello@vibeofthe.city. We currently have no external Data Protection Officer because the statutory thresholds are not met; Marc Petersen owns privacy internally.