Privacy Notice — Pinguin

This Privacy Notice explains how Boyan Valchev ("we", "us"), operating the Pinguin service ("Service"), collects, uses, and shares your personal data. We act as the data controller for personal data we process about you in connection with the Service.

1. Personal data we collect

Account data: email address, authentication identifiers (e.g. Google account ID where you sign in with Google), and password hashes managed by our authentication provider.
Trip planning data: destinations you search, activities you save or remove, plans you generate, notes, and preferences.
Feedback: ratings and messages you submit through the in-app feedback form, together with the page you sent them from.
Usage and device data: IP address, browser type, language, timestamps, basic telemetry, and error logs.
Support communications: messages you send to us and our responses.

Payment data (card details, billing address, tax information) is collected and processed directly by our payment provider, Paddle, and is not stored on our servers.

2. How we use your data

To create and maintain your account and provide the Service (legal basis: performance of a contract).
To save and display your plans, preferences, and history (legal basis: performance of a contract).
To provide customer support and respond to feedback (legal basis: legitimate interests).
To detect, prevent, and address fraud, abuse, and security incidents (legal basis: legitimate interests, legal obligation).
To improve the Service, including reliability and feature design (legal basis: legitimate interests).
To comply with legal obligations such as tax and accounting (legal basis: legal obligation).

3. Who we share data with

Paddle — our Merchant of Record for the sale of paid plans, including subscription management, payment processing, tax compliance, and invoicing.
Service providers / subprocessors — including cloud hosting, database, authentication, and email infrastructure providers used to operate the Service.
Third-party content providers — for example Wikipedia and Openverse for activity descriptions and images. We share only the search keywords needed to fetch results, not your account identity.
Professional advisers such as legal and accounting advisers, where necessary.
Authorities when required by law, regulation, or valid legal process.

4. International transfers

Some of our service providers may process personal data outside your country of residence, including in the European Economic Area (EEA), the United Kingdom, and the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

5. Data retention

We keep your personal data only for as long as necessary to provide the Service and meet our legal obligations. Account and plan data are retained while your account is active and for a reasonable period afterwards. You can request deletion of your account at any time, after which we will delete or anonymise your data unless we are legally required to keep it (e.g. tax records).

6. Your rights

Depending on your location, you may have rights to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data ("right to be forgotten").
Request restriction of, or object to, certain processing.
Receive a portable copy of data you provided to us.
Withdraw consent where processing is based on consent.
Lodge a complaint with your local data protection supervisory authority.

We aim to respond to verified requests within one month. To exercise any of these rights, contact us via the in-app feedback form.

7. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and audit logging. No system is perfectly secure; if you believe your account has been compromised, please contact us immediately.

8. Cookies and similar technologies

We use a small number of essential cookies and similar technologies to keep you signed in, remember your preferences, and keep the Service secure. We do not use advertising cookies. Your browser allows you to manage cookies via its settings.

9. Children

The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided personal data, please contact us so we can delete it.

10. Changes to this notice

We may update this Privacy Notice from time to time. The "Last updated" date above indicates when it was last revised. Material changes will be communicated through the Service.

11. Contact

If you have questions about this Privacy Notice or how we handle your personal data, please contact Boyan Valchev via the in-app feedback form. For payment-related privacy questions, contact Paddle at paddle.net.