The controller responsible for your data under the General Data Protection Regulation (GDPR) is:

Name

Adrian Gianluca Pupello

Anschrift

Diekwanne 5, 38448 Wolfsburg, Germany

Email

anima_studio_support@proton.me

Account data (all users): email address and password (managed securely by our authentication provider, Supabase — we never see your password in plain text), first and last name, date of birth, and account role (Customer, Store Owner, or Employee).

Optional profile data: gender, street address, postal code, and city — used, for example, to show a Store which cities and postal codes its favoriters come from, always as an aggregated count, never as a per-person breakdown.

Activity data: Stores you've favorited, coupons you've opened or redeemed, loyalty point transactions (including any purchase amount a Store's staff records against them), table requests you've made and their status, and Store news you've viewed.

Device data: a push-notification device token and platform, so we can deliver the notifications you've opted into.

Location data: if you grant permission, your device's approximate location is used on-device only, to center the map and show nearby stores. It is never sent to our servers or stored — Affare has no record of your location.

Store Owner data: your Store's name, description, address, banner image, and any menu PDF you upload, plus the employee-connection codes you generate.

We do not collect payment card details, and Affare does not process any payments — purchases happen directly between you and the Store.

• To create and run your account, and to provide the core features you use — coupons, loyalty points, table requests — necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• To send push notifications you've opted into, based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in Settings.
• To show your approximate location on the store map, based on your consent via the iOS location permission prompt (Art. 6(1)(a) GDPR), which you can withdraw at any time in iOS Settings > Affare > Location.
• To keep the service secure and prevent abuse, our legitimate interest (Art. 6(1)(f) GDPR).

We use the following processors to run Affare. Each only receives what it needs to provide its service, under a data processing agreement where applicable:

• Supabase, Inc. — hosts our database, authentication, file storage, and backend functions.
• Apple Inc. — delivers push notifications via Apple Push Notification service, provides on-device address search/autocomplete when you enter a street address, and provides on-device location services for the store map — all handled by Apple's own systems under Apple's privacy terms.

We do not sell your data, and we do not share it with advertisers.

We keep your account and activity data for as long as your account is active. If you ask us to delete your account (Section 8), we delete or anonymize your personal data, except where we're required to retain records for a longer period by law.

A Store owner can see the name and connection date of employees connected to their Store, and aggregated, non-identifying counts of favoriters by city/postal code and coupon/loyalty activity. A Store owner does not see your address, date of birth, gender, or any other Customer's personal profile details.

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data — most fields can be edited directly in Settings > Account.
• Request erasure of your data (Section 8).
• Request a copy of your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for optional processing, such as push notifications or location access, at any time.
• Lodge a complaint with your local data protection supervisory authority.

You can permanently delete your account and all data tied to it yourself, at any time, from Settings > Delete Account inside the app. You can also request deletion by emailing anima_studio_support@proton.me from the address associated with your account, and we'll confirm and process it within a reasonable time.

Affare is not directed at, and we do not knowingly collect data from, anyone under 18.

We rely on industry-standard measures provided by our infrastructure provider, including encrypted connections and row-level access controls, so that one Customer's or Store's data can't be read by another user who isn't supposed to see it.

We may update this Privacy Policy from time to time. We'll update the effective date above when we do.

Questions about this policy or your data: anima_studio_support@proton.me