Privacy Policy

Small Plates

Privacy contact: stheiveekan2@gmail.com
Illegal content / abuse reports: stheiveekan2@gmail.com

We process personal data as a controller under the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

Depending on how you use the service, we may process:

• Waitlist data: email address, consent timestamp, consent version, and stated purpose when you opt in on the public home page to be notified about launch / invite access. We do not use waitlist emails for advertising.
• Account data: name, email address, and authentication credentials (password hash for email signup, or Google / Apple account identifiers when you sign in with those providers).
• Profile data: display name, public profile slug, profile photo, and home city.
• Community content: Google Maps list links you import; places you add or save; “been here” marks; invite codes and who invited you.
• Social graph: follow requests you send or receive, follow status (pending / accepted), and related in-app notifications.
• Place details: venue information from Google Places / Maps and, where configured, automated enrichment via Apify actors that crawl public Google Places data (names, addresses, coordinates, photos, hours, ratings, categories) to power the guides.
• Optional location: approximate device location when you enable Nearby. This is used in your browser session to sort nearby places and is not stored as a permanent GPS history on our servers.
• Technical data: session cookies, onboarding / invite cookies, server logs, and browser localStorage for essential client preferences (for example saved / been marks before sync, active import selection, and display name hints during onboarding).

We process personal data to:

• notify waitlist subscribers when invites open or the product launches (consent, Art. 6(1)(a) GDPR);
• create and secure your account;
• provide city guides, profiles, maps, imports, follows, inbox, and invites;
• show community signals (for example, who listed a place);
• prevent abuse and keep the service reliable;
• communicate about account or service issues when needed.

Legal bases under GDPR include performance of our contract with you (providing the service), our legitimate interests in running a secure community product, and consent where required (for example, optional location access in the browser and your agreement to the Terms and this Policy when you sign up).

If you choose social sign-in, Google or Apple shares basic account information with us (typically name, email address, and profile photo) so we can authenticate you. We use this only to create or sign in to your Small Plates account. We do not request access to your Gmail, Drive, or other unrelated services.

Those providers’ processing is governed by their own privacy policies. You can review and manage permissions in your Google or Apple account settings.

Member profiles are private by default. Other members see your display name and profile photo when they find you, but your city lists and highlights are visible only after you accept their follow request (or they accept yours). Guest visitors who are not signed in cannot unlock private profiles.

On shared city pages, community signals may show that a member saved or listed a place without exposing your full profile to people who are not connected.

The public home page may show limited teaser content to visitors who are not signed in.

We do not sell your personal data. We use service providers to host and operate Small Plates, including:

• infrastructure and deployment (Vercel);
• database hosting (Neon Postgres);
• avatar / file storage (Vercel Blob);
• Google APIs for Maps / Places, OAuth sign-in, and place details;
• Apify (when configured) for automated place enrichment from public Google Places data;
• OpenStreetMap-based map tiles when Google Maps is unavailable.

These providers process data on our instructions to deliver the service. Map providers require attribution; see map credits in the app.

We use essential cookies and similar storage for authentication sessions, onboarding state, invite redemption, and client-side preferences described above. We do not use analytics or advertising cookies on Small Plates.

We keep account and community content while your account is active. You can delete your account from your profile (“Your data”) or by emailing us. We will delete or anonymise personal data we no longer need, except where we must retain limited records for security, dispute resolution, or legal obligations. Shared place records in the community graph may remain after account deletion where they were contributed to the common city guide, without linking them to your identity where feasible.

Waitlist emails are kept until you unsubscribe, or until we no longer need them for the launch notification purpose (for example after a general launch campaign), whichever comes first. You can withdraw consent via the unsubscribe link we will include in launch emails, or by contacting us.

If you are in the EU/EEA (including Germany), you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability, subject to applicable law. You may also withdraw consent where processing is based on consent.

You can download a JSON export of your account data from your profile. To exercise other rights, email stheiveekan2@gmail.com. You also have the right to lodge a complaint with a supervisory authority. In Germany, that may be your state data protection authority or the authority where we are established.

Small Plates is not directed at children under 16. We do not knowingly create accounts for anyone under 16. If you believe a child has provided personal data, contact us and we will take appropriate steps.

Our hosting and tooling providers may process data in the EU and other countries. Where personal data is transferred outside the EEA, we rely on appropriate safeguards required by applicable law (such as standard contractual clauses used by our providers).

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of Small Plates after an update means you acknowledge the revised policy.

Privacy requests: stheiveekan2@gmail.com
Service: https://smallplates.de
Legal notice: Impressum