Privacy Policy
This Privacy Policy explains what personal data the RevScen app (the “App”) and the website revscen.app (the “Website”) collect, why, who sees it and what rights you have. MRN Services OÜ, registry code 14444657, Mustamäe tee 137-118, 12918 Tallinn, Estonia, e-mail info@revscen.app, is the controller of your data (“we”, “us”).
We are an Estonian company, so the EU General Data Protection Regulation (GDPR) applies to us. We apply the same standards to all users, wherever you live. The supplement for your region at the end adds details that apply to you.
1. The short version
This summary is only for convenience. The full policy below is what counts.
- We collect only what we need: your sign-in details (name and e-mail from Apple or Google), what you post, and simple records of your use of the service.
- Your phone’s location stays on your phone and is not stored by us. If you drop a pin at your own position, that spot becomes the event’s public location.
- We do not sell personal data, show third-party ads or use advertising or analytics trackers.
- Our service providers, mainly Google (Firebase) and Apple, process data for us.
- You can ask for your data, or for your account to be deleted, at any time.
2. Who is responsible
The controller is MRN Services OÜ, registry code 14444657, Mustamäe tee 137-118, 12918 Tallinn, Estonia. Write to info@revscen.app about anything to do with your data.
We have not appointed a data protection officer because the law does not require one for our activities.
3. What we collect, why, and for how long
For each kind of data below we say what it is, why we use it, the legal basis under the GDPR and how long we keep it.
Account data
Data: e-mail address, name (as given by Apple or Google; if you choose “Hide My Email”, Apple gives us a private relay address), sign-in method, a random account ID, registration time, time of last sign-in and any role we have given you (administrator or organiser).
Why: to create and run your account, keep it secure, and let our administrators see who is registered for support and moderation.
Legal basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in security and preventing abuse (Art. 6(1)(f)).
Kept: until you delete your account.
Your acceptance of the Terms
Data: the version of the Terms and Privacy Policy you accepted, the region you chose and the time.
Why: to be able to show that you accepted the Terms.
Legal basis: legitimate interest in proving the agreement (Art. 6(1)(f)).
Kept: until you delete your account.
Events and other content you post
Data: event type, name, place (coordinates, address, town, region, country), start and end time, ticket price, whether it repeats, and your account ID. A venue claim also contains the message you write to us.
Why: to show events on the map to other users and to run the service.
Your confirmation: you cannot publish an event without confirming that it takes place at a lawful location, that the permits needed to organise it are in place and that it complies with local law. The event log keeps this confirmation: the version and language of the text and the time.
Legal basis: contract (Art. 6(1)(b)).
Who sees it: all signed-in users. Your name and e-mail are not shown on events. Events carry your internal account ID, which is not displayed in the App.
Kept: an event stops showing when it ends, and we delete ended events and their votes within 12 months after they end. A venue claim is deleted when we approve or reject it.
Permanent event log
Data: a copy of the event details, your account ID, whether the event was created, removed by you or removed by an administrator, the time and, for a created event, your confirmation (version and language of the text, and the time).
Why: to show you your own event history, to protect users, to prevent and investigate abuse (including events that break the “Legal events only” rule), to handle complaints and to defend legal claims.
Legal basis: contract for your own history (Art. 6(1)(b)); legitimate interest in safety, preventing abuse and legal claims (Art. 6(1)(f)).
Kept: while your account exists. After you delete your account the entries stay for up to 12 months without being linked to your name or e-mail (the account ID alone does not identify you), and then we remove the account ID from them. Entries that relate to an open report, dispute or legal claim are kept until the matter is closed.
“Like” and “Dislike” votes and “Called off” marks
Data: your account ID, your vote or mark and the time.
Why: to show other users what people think of an event, whether it may have been called off and, for users who turned on alerts, to tell them about popular events nearby.
Legal basis: contract (Art. 6(1)(b)).
Who sees it: other users see the totals.
Kept: deleted together with the event (within 12 months after it ends) or when you delete your account.
Reports
Data: the reported event, your account ID and the time.
Why: to handle reports and meet our moderation duties. When a report comes in, our servers e-mail it to our own mailbox with the event details and the e-mail addresses and account IDs of the person reporting and of the person who added the event, so that we can act when the App is closed.
Legal basis: legal obligation under the EU Digital Services Act (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).
Kept: until the report is closed and for 12 months afterwards; the e-mail is deleted on the same schedule.
Waitlist (Website)
Data: the e-mail address you enter, the language of the page, whether you go to events or organise them, and when you gave consent and to which wording. We do not store your IP address with it.
Why: to send you one e-mail when the App is available in the App Store and Google Play.
Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time by writing to info@revscen.app; we then delete your address.
Kept: we delete the list within one month after that e-mail is sent, or sooner if you withdraw your consent. We send no other e-mails and do not share the list.
Messages to us
Data: what you write to info@revscen.app, and our replies.
Why: to answer you and to handle requests, complaints and appeals.
Legal basis: legitimate interest (Art. 6(1)(f)); for requests about your rights, legal obligation (Art. 6(1)(c)).
Kept: as long as needed to deal with the matter, then up to 3 years where we need it to defend legal claims.
Location (stays on your phone)
Data: your phone’s precise location, only if you allow it and only while you use the App.
Why: to centre the map, show distances, place a pin at your position and, if you turn on nearby alerts, to compare your position with event locations on your phone.
Legal basis: your consent through your phone’s permission (Art. 6(1)(a)). You can withdraw it at any time in your phone’s settings.
Kept: not stored by us and not sent to our servers. If you place a pin at your own position, the coordinates of that pin become the public location of the event. When you add an event, your phone may look up the street address for the coordinates with Apple or Google.
Notifications
Data: alerts about nearby and popular events are created on your phone from event data and vote totals. We do not send these from our servers and do not store a device token for them. For administrators only, we store the phone’s push token, account ID and platform so that our servers can notify them about new accounts, until they sign out or lose the role.
Legal basis: your consent through your phone’s permission (Art. 6(1)(a)); for administrators’ tokens, legitimate interest in running the service (Art. 6(1)(f)).
Settings on your phone
Data: language, filters, alert settings, which popular-event alerts you have had, the region you chose and your acceptance status are stored on your phone only and removed when you uninstall the App.
Technical data
Data: when the App connects to our service providers, or when you open the Website, your IP address, device, browser and app information and timestamps are processed in their server logs. The Website sets no cookies and uses no analytics.
Why: to deliver the service and keep it secure.
Legal basis: legitimate interest (Art. 6(1)(f)).
Kept: as long as the providers keep their logs. We use no analytics or advertising tools. We only count, per day and without linking it to anyone, how often people open navigation to an event.
4. Who sees your data
- Other users see the events you post, as described above.
- Our administrators, meaning the operator and people we authorise, can see the list of registered users (name, e-mail, sign-in method, dates), the events a user created and the event log. They use this only for support, moderation, security and legal duties.
- Organisers we approve see statistics of their own events only and get no access to other users’ data. A “Founding partner” badge, if we give one to an organiser, is shown to all users with that organiser’s events.
- Service providers. Google (Firebase Authentication and Cloud Firestore; Google Ireland Limited for users in the EEA, otherwise Google LLC) hosts the data and handles sign-in, its Cloud Functions send us notices about new accounts and reports and store the waitlist, and Firebase Hosting delivers the Website. It acts on our instructions under Google’s data processing terms. Our data is stored in the European Union (Firestore location eur3). The notices about a new account (e-mail address, name, sign-in method, time) and about a new report (as described under “Reports”) are e-mailed to our own mailbox at Zone Media OÜ (Estonia). Admin phones also get a short push notification without your details, delivered through Expo (650 Industries) and Apple or Google push services.
- Apple and Google as separate providers. If you use Sign in with Apple or Google Sign-In, Apple or Google tells us your name and e-mail according to your choices, and their own privacy policies apply to what they do. On iPhone the App shows Apple Maps and iOS may look up addresses with Apple; on Android it shows Google Maps and Android may look up addresses with Google. If you choose Waze, Google Maps or Apple Maps to navigate, the event location is passed to that app.
- Address search. When an administrator or organiser searches for an address while adding an event, the text they type and their IP address go to the Photon search service run by komoot (Germany), which uses OpenStreetMap data. Their phone’s location is not sent. Legal basis: legitimate interest in placing events accurately (Art. 6(1)(f)).
- Authorities and advisers. We disclose data to courts, police and other authorities when the law requires or allows it and it is necessary (for example to investigate illegal events), and to professional advisers under confidentiality. If the business is sold or merged, data may pass to the successor under this policy.
We do not sell personal data and do not share it with advertisers or data brokers.
5. Transfers outside the EEA
We are based in Estonia and our data is stored in the European Union (Firestore location eur3). Google and Apple may process data in other countries, including the United States. Where that happens, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the EU’s standard contractual clauses, which are part of the providers’ terms. You can ask us at info@revscen.app for details of the safeguards.
6. Your rights
You have the right to:
- get access to your personal data and a copy of it;
- have wrong data corrected;
- have your data erased;
- have processing restricted;
- receive the data you gave us in a portable format;
- object to processing that is based on our legitimate interests;
- withdraw consent at any time, without affecting what happened before;
- not be subject to decisions based only on automated processing (we make no such decisions).
To use your rights, e-mail info@revscen.app, or use “My data and account deletion” in the App’s Settings, which prepares an e-mail to us. To delete your account you can also use “Delete account” in the Settings. We may ask you to confirm your identity. We answer within one month; the law allows us to extend this by up to two months for complex requests, and we would tell you. It is free unless requests are manifestly unfounded or excessive.
Deleting your account. In the App, open Settings and choose “Delete account”: your account is deleted at once. You can also ask us by e-mail as described above. We delete your profile and sign-in data, the events you added with their votes, your votes and marks on other events, your venue claims and any role we gave you, and we handle the event log and reports as described above. The steps are also at revscen.app/konto-kustutamine.
Complaints. You may complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee. You can also complain to the authority in the country where you live or work.
7. Children
The App is not for anyone under 16 and we do not knowingly collect data from them. If you think a child has an account, tell us at info@revscen.app and we will delete it.
8. Security
Data is sent over encrypted connections and is stored by Google with encryption at rest. Access rules in the database let each user read and write only what they need, and administrator access is limited to named accounts. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
9. No profiling and no tracking
We do not make decisions about you by automated means that have legal or similarly significant effects, we do not profile you for advertising and we do not track you across other companies’ apps or websites. If we ever add analytics or advertising, or send push notifications to regular users, we will update this policy first and ask for your consent where required.
10. Changes to this policy
We may update this policy. We will tell you in the App about material changes and, where the law requires, ask for your consent. The version and date are at the top.
Supplement for users in the EU, EEA, UK and Switzerland
11. Legal framework
The GDPR applies. For users in the United Kingdom the UK GDPR and the Data Protection Act 2018 apply, and for users in Switzerland the Swiss Federal Act on Data Protection. The legal bases are listed next to each kind of data above.
12. Supervisory authorities
Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. In the United Kingdom you can complain to the Information Commissioner’s Office (ico.org.uk); in Switzerland to the Federal Data Protection and Information Commissioner (edoeb.admin.ch); elsewhere to the authority in your country.
13. Consent
Where we rely on your consent (location and notifications) you can withdraw it at any time in your phone’s settings.
Supplement for users in the United States
14. Scope
We give the rights below to all users in the United States, whether or not a particular state privacy law applies to us.
15. What we collected in the last 12 months
- Identifiers: name, e-mail address, account ID and IP address (processed by our hosting provider).
- Internet or other electronic activity: the events, votes and reports you submit and records of your use of the service.
- Geolocation: we do not collect your device location. The coordinates of events you publish are shown to other users.
- Sensitive personal information: we do not collect it.
We get this information from you and from Apple or Google when you sign in. We use and share it only as described in this policy: with service providers such as Google and Apple, with other users for event content, and with authorities where the law requires.
16. No sale or sharing
We do not sell personal information and do not “share” it for cross-context behavioural advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
17. Your rights
Depending on your state, you can ask us to tell you what personal information we hold and give you a copy, to delete it, or to correct it. We will not treat you worse for using these rights. You can also opt out of sale, sharing and targeted advertising and limit the use of sensitive information; we do none of these things, so there is nothing to opt out of.
To make a request, e-mail info@revscen.app. We verify requests by matching them to the e-mail address linked to your account. An authorised agent may act for you with your written permission. We respond within 45 days, and may extend this once by another 45 days.
If we deny your request, you can appeal within 60 days by replying with the word “Appeal”. We answer within 60 days of receiving your appeal. If you are not satisfied, you can contact your state attorney general.
18. California “Shine the Light” and Do Not Track
We do not disclose personal information to third parties for their direct marketing. The App does not track you across other companies’ apps or websites, so there is nothing to opt out of, and we run no tracking that a browser Do Not Track signal could turn off.
19. Children
The App is not for anyone under 16, and we do not knowingly collect personal information from children under 13.
Supplement for users in the rest of the world
20. Local law
We apply GDPR-level protection to everyone. If the law where you live (for example in Canada, Australia, Brazil, Japan or South Korea) gives you additional rights, e-mail us at info@revscen.app and we will honour them as the law requires. You can also complain to your local data protection authority.
21. Transfers
Your data is transferred to the EU and processed by Google and Apple in the countries described in “Transfers outside the EEA”. Where local law requires your consent for this, we ask for it separately.