What I collect, and why.

Dino Celotti

Postal address: Postal address to be added before launch

Email: Email address to be added before launch — until then, the contact form reaches me.

The site is hosted on Lovable's hosting platform. As with any web server, technical request data — IP address, timestamp, requested URL, referrer, browser and operating system information — is processed to deliver pages and keep the service secure and stable. Legal basis: Art. 6 (1) (f) GDPR, my legitimate interest in operating a functioning, secure website. I do not build visitor profiles from this data, and I do not have access to it beyond what the platform makes available for operations.

Content, interest requests, brand inquiries and event counters are stored in a PostgreSQL database provided by Supabase, acting as a processor for me. Access to personal data in that database is restricted by row-level security rules: public visitors cannot read interest requests, inquiries or events at all.

When you submit the interest form I store: the brand you asked about (or a brand name you typed), a coarse country bucket you choose (Germany, Austria, Switzerland, Canada, Rest of Europe, Elsewhere, or Prefer not to say), and a timestamp. No IP address, no name, no precise location.

An email address is stored only if you tick the consent box. If the box is unticked, no email address reaches the database at all. When you do opt in, I also record the version of the consent wording you agreed to and the time of consent, so I can later prove what you consented to.

I am not sending marketing emails yet. There is no email provider connected and no sending workflow. Before any availability email is ever sent, opt-ins will have to be confirmed through a confirmation step; records that have not been confirmed will not be used for mailing.

Legal basis: Art. 6 (1) (a) GDPR for the optional email address and its future use; Art. 6 (1) (f) GDPR for the anonymous demand signal itself (understanding which brands are wanted). You can withdraw consent at any time with effect for the future.

I record a small number of first-party events in my own database: profile view, outbound click, Germany interest and email signup. Each row holds the event type, the brand slug it relates to, the coarse country bucket where one was supplied, and a timestamp. No user ID, no cookie ID, no IP address and no device fingerprint is stored in my event table. The rows cannot be linked back to an individual by me.

There is no Google Analytics, Meta Pixel, advertising tag, heat-mapping tool, fingerprinting library or third-party marketing tracker in my implementation. Web fonts are self-hosted, so no font request leaves for a third-party server.

Legal basis: Art. 6 (1) (f) GDPR — knowing which brands people actually care about.

If you write to me via the contact form, I store your name, brand or company, business email, your message and the time it was sent, in a private table only administrators can read. This is used solely to reply to you and to follow up on a possible business relationship.

Legal basis: Art. 6 (1) (b) GDPR where your message concerns a potential or existing business relationship; otherwise Art. 6 (1) (f) GDPR, my legitimate interest in answering enquiries.

The private workspace at /admin is restricted to invited administrators and uses Google sign-in through Supabase Auth. When an administrator signs in, an authentication session is stored in their browser's local storage and identity data (email, account identifier) is processed by Supabase and Google. This concerns administrators only; ordinary visitors are never asked to sign in and no account is created for them.

The Vancouver guide shows a map built with Leaflet. Map images (tiles) are loaded directly from the OpenStreetMap Foundation's public tile servers (tile.openstreetmap.org), which means your browser sends a request — including your IP address and browser information — to that provider when a map is displayed. I have no influence over what the OpenStreetMap Foundation does with that request; see their own privacy information. Legal basis: Art. 6 (1) (f) GDPR, my interest in showing a usable map.

Links to brand websites, retailer sites and directions in Google Maps or Apple Maps are ordinary links. Nothing is transmitted to those services until you click. Once you do, the receiving provider's own terms and privacy notice apply.

Brand inquiries: kept while the conversation or business purpose is active, then deleted when no longer needed. Deletion is carried out manually by an administrator; there is no automatic deletion job, and I do not claim one.

Optional notification emails: kept until you withdraw consent or unsubscribe, or until the purpose ends. Opt-ins that were never confirmed are not used for mailing.

Anonymous demand signals and event rows: kept for aggregate planning, minimised by design — they contain no identifying data.

Server logs: retained by the hosting platform for its usual operational and security periods.

Under the GDPR you have the right to access your data (Art. 15), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

To exercise any of these, write to me using the contact details above. Note that anonymous demand signals and event rows contain nothing that lets me identify you, so I may not be able to link them to a person.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work or the place of the alleged infringement.