Privacy Policy
Last updated: 2026-08-29
This policy explains what personal data Vitosha (Sofia) Guide collects on vitosha.guide, why we collect it, how long we keep it, and the rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Cookies specifically are covered in more detail in our Cookie Policy.
Who is responsible for your data
The data controller — the party that decides why and how your personal data is processed — is:
What we collect and why
We collect as little as the site can work with. Most visitors are never identified at all: you can browse, search and read everything here without an account.
Email address, display name and profile picture (if you choose to add one or your sign-in provider supplies one), preferred language.
- Purpose:
- To let you sign in, save places, and receive replies about anything you submit.
- Legal basis:
- Performance of a contract (Art. 6(1)(b)) — you asked us to create an account.
- Kept for:
- Until you delete your account.
Session identifier, one-time login codes, a hashed (not readable) version of your IP address, and your browser's user-agent string.
- Purpose:
- To keep you signed in, and to detect and slow down automated abuse of the login form.
- Legal basis:
- Legitimate interests (Art. 6(1)(f)) — protecting the service and your account.
- Kept for:
- Sessions up to 90 days; login codes 10 minutes; abuse counters up to 24 hours.
Which listings and articles you saved, and when.
- Purpose:
- To show you your own saved list.
- Legal basis:
- Performance of a contract (Art. 6(1)(b)).
- Kept for:
- Until you remove them or delete your account.
The text you type into the AI search, the language, and the time. Not linked to your account.
- Purpose:
- To answer your question and to improve the quality of the search.
- Legal basis:
- Legitimate interests (Art. 6(1)(f)) — operating and improving the service.
- Kept for:
- Up to 12 months.
Cookie-based usage data collected by Google Analytics and Google Ads.
- Purpose:
- To understand how the site is used and to measure advertising.
- Legal basis:
- Your consent (Art. 6(1)(a)), given through the cookie banner and withdrawable at any time.
- Kept for:
- As set by Google; your cookie choice is remembered for 90 days.
Signing in
An account is entirely optional. You only need one to save places; everything else on the site works without signing in.
There are three ways to sign in, and all of them identify you by a verified email address:
- A one-time code we email to you. We learn only your email address.
- Google. Google tells us your email address, your name and your profile picture. We do not receive your password, your contacts, or anything else in your Google account.
- Facebook. Facebook tells us your name, your profile picture and — if you allow it — your email address. If it does not supply one, we ask you for an address and confirm it by email before your account is created. We do not receive your friends, your posts, or anything else.
We do not use passwords and we never store one. We also do not keep any access token from Google or Facebook after you have signed in — we read your name, email and picture once, and discard the rest.
Who else sees your data
We do not sell your personal data and we do not share it for anyone else's marketing. It is handled on our behalf by:
- Cloudflare, Inc. — hosting, the database that stores your account, and delivery of our emails.
- Vercel Inc. — hosting of the website itself.
- Google Ireland Limited / Google LLC — sign-in with Google, analytics and advertising.
- Meta Platforms Ireland Limited — sign-in with Facebook, only if you use it.
- OpenAI and Google — processing of AI search queries. Do not type personal details into the search box.
Some of these providers are based outside the European Economic Area or may process data there. Such transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased
- Restrict or object to certain processing
- Receive a copy of your data in a portable format
- Withdraw consent at any time, without affecting processing already carried out
To exercise any of these, email us at the address above from the address on your account. We will respond within one month. Exercising your rights is free.
Deleting your data
You can have your account and everything attached to it deleted at any time. There is no charge and you do not have to give a reason.
- Email us from the address on your account, asking for deletion.
- We confirm we have received your request and delete the account within 30 days.
- We delete your email address, name, profile picture, saved places, sessions and any link to your Google or Facebook account.
If you signed in with Facebook, you can also remove this site from Settings → Apps and Websites in your Facebook account; that revokes our access, and emailing us then removes what we already hold. Anything you posted publicly, such as a review, is anonymised rather than removed, so that pages other people rely on do not break.
Cookies
Cookies, including which ones we set and how to change your choices, are described separately. Read the Cookie Policy
Complaints
If you believe we have handled your data improperly, please contact us first — we would rather fix it. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, cpdp.bg, or to the supervisory authority in your own country.
Changes to this policy
We may update this policy. The date above shows the last revision. If a change materially affects how we use your data, we will say so on the site.
Contact
For any question about this policy or about your data, write to us at: info@vitosha.guide