1. Data Controller

The data controller for your personal data is Signalio (platform operator). For questions regarding data processing, please contact us.

2. Data We Collect

We collect only the data necessary to provide the service (Art. 5(1)(c) GDPR, data minimization).

Account Data

• Name (or pseudonym)
• Email address
• Hashed password (bcrypt)
• Notification preferences (encrypted)

Location Data

• Subscription zones (GeoJSON polygons defined by you)
• GPS coordinates (only with active consent for campaign tracking)
• Location history is automatically deleted after 30 days

Usage Data

• IP address (for security, not logged with PII)
• Device type and app version
• Alert interactions (received, read)

3. Purposes and Legal Basis for Processing

Purpose	Legal Basis (GDPR)
Providing the service (account, alerts, subscriptions)	Art. 6(1)(b), performance of contract
Sending alert notifications (push, email)	Art. 6(1)(b), performance of contract
Location tracking in campaigns	Art. 6(1)(a), consent
Cookies and local storage (IndexedDB)	Art. 6(1)(a), consent (Art. 5(3) ePrivacy Directive)
Publishing alerts to IPFS	Art. 6(1)(a), consent
Abuse prevention (rate limiting, CSRF)	Art. 6(1)(f), legitimate interest

4. Data Retention Periods

Data	Retention Period
Account	Until deleted by user
Deleted account (soft-delete)	30 days, then permanently deleted
Location history	30 days (automatic deletion)
Campaign data (active)	2 hours from recording
Campaign data (ended)	24 hours after campaign end
Session cookies	2 hours
Cookie consent	12 months

5. IPFS and Data Immutability

Alerts may optionally be published to IPFS (InterPlanetary File System), a decentralized network. Data on IPFS cannot be deleted as the network is distributed. Therefore, we do not publish personal data to IPFS. Alert authorship is recorded as a pseudonymized SHA-256 hash, not names or emails. Publishing to IPFS is at your discretion.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use third-party tracking or analytics tools. All data is processed entirely on our servers within the EU.

7. International Data Transfers

Your data is stored and processed on servers within the European Union. We do not transfer personal data outside the EEA, except when publishing to IPFS (which is a global network). In that case the data is pseudonymized and contains no personal information.

8. Your Rights

Under the GDPR, you have the following rights:

›

Right of access (Art. 15) : You can request a copy of your personal data.

›

Right to rectification (Art. 16) : You can correct inaccurate data from your profile.

›

Right to erasure (Art. 17) : You can delete your account. Data is retained for 30 days then permanently deleted.

›

Right to restriction (Art. 18) : You can request temporary suspension of processing.

›

Right to data portability (Art. 20) : You can request an export of your data in a machine-readable format.

›

Right to object (Art. 21) : You can object to processing based on legitimate interest.

›

Withdrawal of consent (Art. 7(3)) : You can withdraw any given consent at any time.

To exercise your rights, please contact us. We'll respond within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your data (Art. 32 GDPR): encrypted connections (HTTPS/TLS), encrypted sessions, hashed passwords (bcrypt), encrypted preferences, CSRF protection, rate limiting, Content Security Policy, regular backups, and monitoring.

10. Children

Signalio is not intended for children under 16 years of age. We do not knowingly collect data from individuals under 16. If we discover that we have collected such data, we will delete it immediately.

11. Cookies and Local Storage

For detailed information about cookies, localStorage, and IndexedDB, please see our Cookie Policy.

12. Changes to This Policy

We may update this policy periodically. The date of the last update is shown at the top. For material changes, we will notify you via email or a banner in the application.

13. Contact and Data Protection Officer

For questions about this policy or to exercise your rights, please contact us. If you have a complaint, you have the right to lodge it with the supervisory authority (see below).

14. Supervisory Authority

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP):
Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Website: www.cpdp.bg

Privacy Policy