Privacy Policy

What we collect

You can browse the guide without creating an account. In that case we do not ask you for personal data beyond what our hosting and analytics providers may process automatically (see below).

When you choose to create an account, authentication is handled by Supabase. We do not see or store your password in plain text. We store account-related information needed for the service, such as your email address, profile name where provided, wishlist, and visited lists.

We use strictly necessary authentication cookies to keep you logged in and make account features work. We do not use advertising cookies, tracking pixels, or cross-site tracking.

We also use Vercel Web Analytics to obtain basic, aggregated information about site usage without setting analytics cookies. It does not track you across websites and is not used for advertising or individual profiling.

What you need to provide

Browsing the guide does not require you to share personal data.

Creating an account requires an email and a password (via our authentication provider). Without them, wishlist and visited features are not available.

Legal basis for processing

We process your data on the following bases under GDPR:

• Contract performance: to create and manage your account when you choose to sign up.
• Legitimate interest: to maintain the security and integrity of the service, and to understand usage in aggregated form.

We do not rely on consent for core account processing. We do not use your data for automated decision-making or profiling.

Why we use it

We use your information to:

• create and maintain your account when you choose to sign up,
• keep your wishlist and visited lists available across sessions,
• send essential service-related emails (sign-up confirmation, password reset),
• understand usage patterns in aggregated form so we can improve the site,
• protect the security and integrity of the service.

How we share data

We do not sell your personal data.

We share data only with the essential service providers that help us operate the website: Supabase (authentication and data storage), Vercel (hosting), and Resend (transactional email delivery for sign-up confirmation and password resets). All act on our instructions.

Supabase stores account data in the European Union. Vercel Web Analytics is cookieless and gives us aggregated information about visits and performance. Resend processes email addresses solely to deliver transactional messages.

Our service providers (Supabase, Vercel, and Resend) act as processors on our instructions under their respective data processing terms. Some may process data outside the European Economic Area; where they do, we rely on appropriate safeguards such as EU Standard Contractual Clauses or equivalent mechanisms offered by those providers.

How we protect your data

We work with reputable providers, limit access to personal data, and use industry-standard safeguards such as encrypted connections (HTTPS) and secure authentication. No method of transmission or storage is completely secure, but we handle your data carefully and only keep what we need.

Retention

Account data is kept while your account remains active. Wishlist and visited lists are kept until you remove them or ask us to delete your account.

If you request deletion, we will remove your personal data from active systems within 30 days, unless we need to keep limited information for legal, security, or backup reasons. Backup copies may remain for a limited period before being overwritten.

Your rights

As a data controller established in the European Union, we respect the following rights in relation to personal data. These rights may apply depending on your location and the applicable data-protection law:

• access the personal data we hold about you,
• correct inaccurate or incomplete data,
• request deletion of your data,
• request restriction of certain processing,
• object to processing based on legitimate interest,
• request a copy of your data in a portable format.

To exercise any of these rights, including requesting deletion of your account and associated personal data, email us at legal@thekayover.com. We may need to verify your identity before completing certain requests, and we will respond within the timeframe required by GDPR. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) or your local data protection authority.

Children's privacy

The Kayover is not directed at children and is not intended for use by anyone under the age of 15. We do not knowingly collect personal data from children under 15. If you believe that a child under 15 has provided us with personal data, please contact us at legal@thekayover.com so that we can review the request and take appropriate action, including deletion where applicable.

Changes to this policy

We may update this policy from time to time. The latest version is always available on this page, with the date at the top.