Privacy policy

What LGBTQ Prime collects, why, who processes it, and how to export or delete your data.

This policy explains, in plain language, what personal data LGBTQ Prime collects, why, who helps us process it, and what you can do about it. It applies to lgbtqprime.com. We are based in Germany, so the EU General Data Protection Regulation (GDPR) applies to everything we do, wherever you are.

Who is responsible

The controller for your data is:

Mark Latture, trading as WebDaVinci
[Postal address to be completed]
Email: [privacy contact address to be completed]

We are not required to appoint a data protection officer at our current size. Privacy questions go to the address above.

What we collect

If you only browse. Our servers log technical data needed to deliver pages and stop abuse: IP address, browser type, the page requested, and the time. Logs are deleted after 14 days. We do not use advertising cookies.

If you create an account. Your email address, a display name, and a password (stored only as a secure hash), or the account identifier from Google or Apple if you sign in with them. We do not ask for your real name, gender, or sexual orientation, and you never have to tell us.

If you contribute. The reviews, tags, photos, events, edits, and reports you submit, with the date and your account. For reviews we also store a one-way hash of your IP address for a limited time to detect fake reviews and spam; we cannot turn it back into your address.

If you claim a business. The contact details you use to prove you run it (an email address at the business's domain, or its listed phone number), the verification codes we send, and any documents you choose to provide for manual review.

If you use "Near me". Your browser shares your position only when you press the button, and only for that search. It is not stored with your account and not kept in our logs beyond the standard 14 days.

Things we never collect: check-ins, visit histories, background location, or contacts from your phone.

Why we use it, and on what legal basis

To run your account and show your contributions: performance of our contract with you (Art. 6(1)(b) GDPR).
To keep the directory accurate and free of spam, fake reviews, and fraudulent claims: our legitimate interest in a trustworthy directory (Art. 6(1)(f)).
To send account emails such as verification codes and replies to your reports: contract (Art. 6(1)(b)).
For analytics: only with your consent (Art. 6(1)(a)). See below.
To meet legal obligations, such as answering lawful requests: Art. 6(1)(c).

Some of what you share may reveal information about your sexual orientation or gender identity, for example a review of a gay sauna. That is special category data under Art. 9 GDPR. We process it only because you chose to make it public on the site (Art. 9(2)(e)), we show it only under your display name, and we never use it for profiling or advertising.

Analytics and consent

We measure traffic with privacy-friendly, cookie-free analytics where possible. Any analytics that set cookies or similar identifiers run only after you agree in the consent banner, and you can withdraw consent at any time from the same banner. Saying no does not change how the site works for you.

Who processes data for us

Hostinger hosts the site and database. [Confirm data center region]
Cloudflare sits in front of the site for security, caching, and delivery. It processes IP addresses and request data.
Our transactional email provider sends account and verification emails. [Provider name to be completed]
Google and Apple handle sign-in if you choose "Sign in with Google" or "Sign in with Apple". They receive the fact that you signed in to LGBTQ Prime.

Each processor works under a data processing agreement. Where data leaves the EU (for example, to US-based providers), transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.

We do not sell personal data, and we do not share it with listed businesses, advertisers, or data brokers. Business owners see aggregate numbers such as page views, never who viewed their page.

How long we keep it

Account data: until you delete your account.
Published reviews and contributions: until you delete them or your account. When you delete your account, your reviews are removed, and edits you made to listings stay without your name attached.
IP hashes for spam checks: 90 days.
Claim verification records: for as long as the claim is active, plus one year.
Server logs: 14 days.

Your rights

You can ask to see, correct, export, or delete your data, restrict or object to how we use it, and withdraw consent at any time.

Export: download a copy of your account data and contributions from Account, Privacy.
Delete: delete your account from the same page. Deletion is immediate for your profile and completed within 30 days for backups.
Anything else: write to the address above. We answer within one month.

You also have the right to complain to a data protection authority, either where you live or the authority responsible for us in Germany.

Business listings and open data

Listings describe businesses, not people. Some listing information comes from OpenStreetMap and other open sources. If a listing contains personal data about you, for example a sole trader's home address, tell us and we will remove it.

Changes

We will post changes here with a new date at the top, and email account holders before any change that affects how we use their data.