Privacy Policy for Codi.

This Privacy Policy explains how Codi ("the App," "we," "us," "our") collects, uses, and protects information in connection with your use of the App. This Policy applies to consumers who use the App to browse business listings, and to businesses whose information is displayed within the App. It is governed by Regulation (EU) 2016/679 (the "GDPR") and applicable Portuguese data protection law.

The data controller responsible for the Codi App is: Max Kiselyov, Sole trader / atividade aberta registered in Portugal. For any questions about this Policy or your personal data, please contact us at help@getcodi.app

3.1 App Users (Consumers)

Codi does not require personal identifiers from app users – including names, email addresses, or phone numbers – to use the App. There is no account creation or sign-in for consumers. The App does not request or access your device's location. The only way a user may voluntarily provide personal data is through the optional bug report feature (see Section 3.2).

3.2 Bug Reports (Voluntary)

The App offers an optional bug report feature, through which users may voluntarily submit a Google Form to report technical issues. If you choose to submit a bug report, we may collect: your email address, a description of the issue, and photos/screenshots you choose to attach. This is entirely voluntary.

3.3 Business Data (Displayed in the App)

Codi displays information about businesses ("venues") for consumers to browse. Businesses do not sign in to or use the App directly. Instead, business data is collected in two stages:

Stage 1 – Initial registration (via Google Form):

• Business/venue name
• Name of the business representative
• Representative's phone number and email address
• Other business-related information provided voluntarily

Stage 2 – Following direct contact with the business:

• Venue address and branch locations
• Website and social media links
• Additional phone numbers
• Photos provided by the business
• Coupons and pricing information
• Other business-related information provided voluntarily

This data is collected for the purpose of publicly displaying accurate business listings within the App. The representative's name and phone number are personal data and are treated in accordance with this Policy and GDPR.

• Via Google Form
  • Form for Business: Businesses voluntarily submit initial information through a Google Form we operate to register their interest in being listed.
  • Bug reports: App users may voluntarily submit a separate Google Form to report bugs and errors, including their email, an issue description, and optional screenshots.
• Via direct communication: Following the form submission, we contact the business representative directly (by phone/email) to gather additional listing details.
• Via Maps SDKs: Apple Maps (iOS) and Google Maps (Android) are used solely to render business locations on a map. The App does not request or collect the user's own device location.

Note: Since Google Forms is a third-party service, data submitted through it is also subject to Google's own privacy practices while in transit/storage on Google's systems before we retrieve it.

• Business listing data: Processed on the basis of legitimate interest (Art. 6(1)(f)) – enabling businesses to be discovered by consumers – and the business representative's consent, given by voluntarily submitting the Google Form.
• Bug report data: Processed on the basis of consent (Art. 6(1)(a)), given by voluntarily submitting the bug report form.

• To display business listings, offers, and related information to App users.
• To contact business representatives regarding their listing (e.g., verifying details, onboarding, support).
• To power in-app location-based features.
• To diagnose and fix reported bugs, and to follow up with you by email about your report if needed.

We do not use collected data for advertising, profiling, or sell it to third parties.

We share data with the following service providers, strictly to operate the App:

We do not sell personal data to third parties or use it for third-party advertising.

All business data is stored within the European Union via our hosting provider, Supabase, and is not subject to international transfer outside the EEA.

Google (Forms) and Apple, as global service providers, may process limited data (such as the business registration form data, or map-rendering requests) on infrastructure outside the EEA. Where this occurs, we rely on the safeguards these providers maintain for such transfers, including Standard Contractual Clauses (SCCs) and/or the EU-U.S. Data Privacy Framework.

Business data is retained for as long as the business remains listed on the App or maintains an active relationship with us. Businesses may request removal of their listing and associated data at any time by contacting help@getcodi.app. We will delete the data within 30 days of a valid request, unless retention is required by law.

Bug report data (email, issue description, screenshots) is retained for a maximum of 30 days from submission, after which it is deleted. We do not retain user email addresses beyond this period.

If you are a business representative or have submitted a bug report, and we process your personal data, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint with the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados) - www.cnpd.pt

To exercise any of these rights, contact us at help@getcodi.app.

Codi is not directed at children under 16, and we do not knowingly collect personal data from children. As the App does not require consumer sign-in and does not collect consumer personal data, this risk is minimal by design. The App does not require consumer sign-in, and the only optional data collection point for consumers (bug reports) is not designed to target children.

We take reasonable technical and organizational measures to protect data, including relying on Supabase's built-in security infrastructure (encryption in transit, access controls) and limiting data access to what's necessary to operate the App. No method of transmission or storage is 100% secure, but we are committed to protecting data to industry standards.

Codi is a native mobile application and does not use browser cookies or any tracking/advertising identifiers. The App does not track users across other apps or websites.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above, and where appropriate, communicated within the App or on our website.

For any privacy-related questions, requests, or concerns, please contact:

Email: help@getcodi.app