Privacy Policy for Codi.

This Privacy Policy explains how Codi ("Codi," "we," "us," "our") collects, uses, and protects information in connection with the Codi mobile application (the "App") and the Codi website at getcodi.app (the "Website"). This Policy applies to consumers who use the App to browse business listings, to businesses whose information is displayed within the App, and to anyone who contacts us through a form on the Website. It is governed by Regulation (EU) 2016/679 (the "GDPR") and applicable Portuguese data protection law.

The data controller responsible for the Codi App is: Max Kiselyov, Sole trader / atividade aberta registered in Portugal. For any questions about this Policy or your personal data, please contact us at help@getcodi.app

3.1 App Users (Consumers)

Codi does not require personal identifiers from app users – including names, email addresses, or phone numbers – to use the App. There is no account creation or sign-in for consumers. The App does not request or access your device's location. Within the App, the only way a user may voluntarily provide personal data is through the optional bug report feature (see Section 3.2). Separately, anyone may choose to contact us through a form on our Website, which does collect personal data (see Section 3.4).

3.2 Bug Reports (Voluntary)

The App offers an optional bug report feature, through which users may voluntarily submit a Google Form to report technical issues. If you choose to submit a bug report, we may collect: your email address, a description of the issue, and photos/screenshots you choose to attach. This is entirely voluntary.

3.3 Business Data (Displayed in the App)

Codi displays information about businesses ("venues") for consumers to browse. Businesses do not sign in to or use the App directly. Instead, business data is collected in two stages:

Stage 1 – Initial registration (via Google Form):

• Business/venue name
• Name of the business representative
• Representative's phone number and email address
• Other business-related information provided voluntarily

Stage 2 – Following direct contact with the business:

• Venue address and branch locations
• Website and social media links
• Additional phone numbers
• Photos provided by the business
• Coupons and pricing information
• Other business-related information provided voluntarily

This data is collected for the purpose of publicly displaying accurate business listings within the App. The representative's name and phone number are personal data and are treated in accordance with this Policy and GDPR.

3.4 Website Enquiry Forms

Our Website at getcodi.app offers four optional forms. None of them is needed to read the Website, and we collect nothing from visitors who do not use one.

• Join the waitlist: email address (required) and your name (optional).
• Become a partner (for businesses): business name, the area you operate in, your name, your email address and your phone number (all required); business category and any notes you add (optional).
• Codi for companies: your name, your company name and your work email address (all required); team size and any notes you add (optional).
• Contact us: your name, your email address and your message (all required).

We also record the address of the page you submitted the form from, which tells us which language version of the Website you were reading and which part of the page you contacted us from. We do not store your IP address or your browser details; these are processed in transit by our anti-bot provider (see Sections 4 and 7) and are not retained by us.

Free-text fields reach us as written, so please do not enter anything you would rather not share with us – in particular health information or other special categories of data within the meaning of Article 9 GDPR.

• Via Google Form
  • Form for Business: Businesses voluntarily submit initial information through a Google Form we operate to register their interest in being listed.
  • Bug reports: App users may voluntarily submit a separate Google Form to report bugs and errors, including their email, an issue description, and optional screenshots.
• Via our Website: Forms on getcodi.app are submitted to our own server component, which checks the submission and stores it in our database. Your form data is not sent to any third-party form service.
• Via our anti-bot check: Each Website form is protected by Cloudflare Turnstile. To run that check, Cloudflare processes your IP address, your User-Agent and signals from your browser, and sets a cookie on your device (see Section 13).
• Via direct communication: Following the form submission, we contact the business representative directly (by phone/email) to gather additional listing details.
• Via Maps SDKs: Apple Maps (iOS) and Google Maps (Android) are used solely to render business locations on a map. The App does not request or collect the user's own device location.

Note: Since Google Forms is a third-party service, data submitted through it is also subject to Google's own privacy practices while in transit/storage on Google's systems before we retrieve it.

• Business listing data: Processed on the basis of legitimate interest (Art. 6(1)(f)) – enabling businesses to be discovered by consumers – and the business representative's consent, given by voluntarily submitting the Google Form.
• Bug report data: Processed on the basis of consent (Art. 6(1)(a)), given by voluntarily submitting the bug report form.
• Website enquiries (partner, companies and contact forms): Processed to take steps at your request before entering into a contract (Art. 6(1)(b)) and on our legitimate interest in answering enquiries about our product (Art. 6(1)(f)).
• Waitlist data: Processed on your consent (Art. 6(1)(a)), given when you submit the waitlist form. You may withdraw it at any time, and every message we send you will carry a way to unsubscribe.
• Anti-bot processing: Our legitimate interest (Art. 6(1)(f)) in keeping our forms working and free of automated abuse.

• To display business listings, offers, and related information to App users.
• To contact business representatives regarding their listing (e.g., verifying details, onboarding, support).
• To power in-app location-based features.
• To diagnose and fix reported bugs, and to follow up with you by email about your report if needed.
• To respond to enquiries submitted through our Website, and to contact businesses and companies that have enquired about partnering with us or bringing Codi to their staff. This contact may be made by a member of our team or by a contractor acting on our instructions.

We do not use collected data for advertising, profiling, or sell it to third parties.

We share data with the following service providers, strictly to operate the App:

Website enquiry data is also accessible to authorised individuals working on our behalf – members of our team and contractors engaged by us – for the purpose of contacting you about your enquiry. They act only on our instructions, are bound by a written confidentiality obligation, and may not use the data for any other purpose. We do not identify individuals in this Policy; if you want to know who currently has access to your data, write to help@getcodi.app and we will tell you.

We do not sell personal data to third parties or use it for third-party advertising.

Business data and Website enquiry data are stored within the European Union, on infrastructure provided by our hosting provider, Supabase.

Some of the service providers listed in Section 7 are established outside the EEA, or run infrastructure outside it, and may process limited data there – for example when an enquiry notification is delivered to us by email, or when a map-rendering or anti-bot request is handled. Where such a transfer takes place, we rely on the safeguards those providers maintain for it, including Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.

Google (Forms) and Apple, as global service providers, may process limited data (such as the business registration form data, or map-rendering requests) on infrastructure outside the EEA. Where this occurs, we rely on the safeguards these providers maintain for such transfers, including Standard Contractual Clauses (SCCs) and/or the EU-U.S. Data Privacy Framework.

Business data is retained for as long as the business remains listed on the App or maintains an active relationship with us. Businesses may request removal of their listing and associated data at any time by contacting help@getcodi.app. We will delete the data within 30 days of a valid request, unless retention is required by law.

Bug report data (email, issue description, screenshots) is retained for a maximum of 30 days from submission, after which it is deleted. We do not retain user email addresses beyond this period.

Website enquiry data from the partner, companies and contact forms is retained for 24 months from our last contact with you about your enquiry, after which it is deleted.

Waitlist data is retained until Codi launches in your market and for 12 months afterwards, or until you unsubscribe, whichever comes first.

If you are a business representative, have submitted a bug report, or have contacted us through a form on our Website, and we process your personal data, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint with the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados) - www.cnpd.pt

To exercise any of these rights, contact us at help@getcodi.app.

Codi is not directed at children under 16, and we do not knowingly collect personal data from children. As the App does not require consumer sign-in and collects no consumer personal data unless you deliberately choose to provide it, this risk is minimal by design. The App does not require consumer sign-in, and the optional collection points for consumers (bug reports and the Website forms) are not designed to target children.

We take reasonable technical and organizational measures to protect data, including relying on Supabase's built-in security infrastructure (encryption in transit, access controls) and limiting data access to what's necessary to operate the App and the Website and to the authorised individuals described in Section 7. Website form submissions are transmitted over HTTPS and are checked on our own server, including an automated-abuse check, before being stored. No method of transmission or storage is 100% secure, but we are committed to protecting data to industry standards.

The Codi App is a native mobile application and does not use browser cookies or any tracking or advertising identifiers. The App does not track users across other apps or websites.

Our Website uses no analytics, tracking or advertising cookies. It sets one strictly necessary cookie, placed by Cloudflare Turnstile when you open one of our forms, whose only purpose is to tell genuine visitors from automated traffic. Because it is strictly necessary to provide a service you have asked for, it does not require your consent.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above, and where appropriate, communicated within the App or on our website.

For any privacy-related questions, requests, or concerns, please contact:

Email: help@getcodi.app