Privacy Policy

1. Who processes your data

The controller is KUDE BG LTD („КЪДЕ БГ“ ООД), UIC (ЕИК) 208195419, registered office zh.k. Izgrev, bl. 56, entr. 4, fl. 5, 8008 Burgas, Bulgaria (“Kude.bg”, “we”).

For questions about personal data and to exercise your rights, write to contact@kude.bg or support@kude.bg. We have not appointed a data protection officer.

2. What this policy covers

This policy covers:

• the kude.bg website — the business directory, profiles, reviews, bookings, messages to businesses and the business owners’ panel;
• the “Kude.bg” app (iOS and Android) — for users: search, “Nearby”, favourites, reviews with photos, bookings and messages to businesses;
• the “Kude.bg Бизнес” app (iOS and Android) — for business owners and staff: bookings, messages, reviews and replies, timetable, business details and photos.

The website and both apps share one account and one server. Where this policy says “the apps”, it means both.

3. What we process, why, and for how long

Legal bases are under Art. 6(1) of Regulation (EU) 2016/679 (GDPR): (b) performance of the contract for using the service (the Terms of Use); (c) a legal obligation; (f) our legitimate interest; (a) your consent, which you may withdraw at any time.

3.1. Account and sign-in

Data

Name, e-mail address; the one-time sign-in code (we keep only its hash) and the IP address it was requested from; with Google sign-in — your Google account identifier; with Apple sign-in — your Apple account identifier. The Google profile picture is not stored. Sign in with Apple is currently not enabled in the apps.

Purpose

Creating the account, signing in, account security, service e-mails (e.g. sign-in codes, booking confirmations).

Legal basis

(b); for the sign-in IP address — (f) (abuse prevention).

Retention

For as long as the account exists. App sign-ins expire after 60 days without use. Sign-in code requests (e-mail and IP address) are deleted automatically within two days after the code is used or expires.

Who sees it

Only you and the Kude.bg team. Not public.

3.2. Optional profile data and public profile

Data

Phone, date of birth, city, a short bio, profile photo.

Purpose

The public profile of a review author; pre-filling your phone when booking; default city.

Legal basis

(b) — you provide them voluntarily to use the feature.

Retention

For as long as the account exists or until you remove them in settings.

Who sees it

The public profile (name, photo, city, bio, level, number of reviews and badges) is visible to everyone on kude.bg and in the apps unless you hide it in settings. Your e-mail, phone and date of birth are never shown publicly; your date of birth is not shared with businesses.

3.3. Device location

“Kude.bg”

With your permission and only while you use the app (never in the background): for “Nearby”, the coordinates are sent with the search request to show nearby businesses and distances; if permission was already granted, the app works out your nearest city on the device. Coordinates are not saved to your account or to the search records, are not used for advertising, and are deleted with the server logs within 14 days.

“Kude.bg Бизнес”

Only when you tap “Use my current location” — the coordinates are filled in as the business’s location and saved as its map position (public).

Website

Only when you press “Near me”: the browser asks for permission first; if it cannot provide a location, the approximate city derived from your IP address by Cloudflare is used. Either way the location is used for that search and is not saved; server logs that may contain it are deleted within 14 days.

Legal basis

(b); location access is granted and revoked in your phone or browser settings.

3.4. Searches

Data

The search text (up to 100 characters), the selected city, categories and sort order. Written to the server’s technical log without your account, IP address or coordinates.

Purpose

Running and improving search.

Legal basis

(f).

Retention

Up to 14 days, after which the logs are deleted automatically.

On your device

“Kude.bg” keeps your recent searches and recently viewed businesses only in the phone’s storage; they are removed when you uninstall the app.

3.5. Business statistics

Data

When you view a business, it appears in results, or you tap “Call”, “Directions” etc., a daily counter for that business is increased, split by device type (phone/computer). To avoid counting one visit repeatedly, a one-way hash of your IP address and browser is held for 30 minutes and never written to the database.

Purpose

Aggregated statistics for business owners, rankings and “trending” businesses.

Legal basis

(f).

Who sees it

Owners see aggregated counts only — never who viewed their business.

3.6. Reviews, review photos and business replies

Data

Rating, text and photos of the review, its date and a link to your public profile; the business’s reply.

Purpose

Publishing reviews of businesses; moderation.

Legal basis

(b); moderation — (f) and (c) (Regulation (EU) 2022/2065, the Digital Services Act).

Visibility

Reviews, photos and replies are public — on kude.bg, in the apps and in search engines. By default, new reviews are checked by the Kude.bg team before publication.

Photos

“Kude.bg” removes location and camera data (EXIF) from a photo before uploading it. The apps only pick from the photo library; they do not use the camera.

Retention

Until the review is deleted by you or a moderator. If you delete your account, reviews and photos remain without your name or profile (signed “Deleted user”).

3.7. Messages between customers and businesses

Data

The message text; the name, e-mail and phone you gave; for a guest without an account — a private link sent by e-mail and the IP address the first message was sent from. Blocks and reports on the conversation (section 3.12).

Purpose

Letting you write to a business and receive a reply; spam and abuse prevention.

Legal basis

(b); the IP address and spam check — (f).

Who sees it

Only you and the staff of that business with messaging rights; the Kude.bg team only following a report or for technical necessity.

Retention

For as long as the conversation exists at the business. If you delete your account, your name, e-mail and phone are removed from conversations and the message text stays with the business. Conversations are kept while the business is on Kude.bg and are deleted with it when the business is permanently deleted. You can ask for a specific conversation to be deleted at support@kude.bg.

3.8. Bookings

Data

Name, e-mail, phone, note, date, time, party size, chosen service/table; optionally your birthday and consent to messages from the business. The IP address is kept only as a one-way hash (abuse prevention).

Purpose

Making the booking and sending you confirmations, reminders and changes.

Legal basis

(b).

Who sees it

The business you book with — it receives the data to serve you and is an independent controller of it. The booking is also added to its customer list (section 3.9). You receive marketing messages from the business only if you ticked the consent box, and you can unsubscribe from any such message.

Retention

Bookings stay with the business, including after you delete your account — they are its record of the visit. They are kept while the business is on Kude.bg and deleted with it when the business is permanently deleted; where the law requires longer retention (for example accounting records when a payment was made), they are kept for as long as the law requires.

3.9. A business’s customer list (CRM)

Businesses using “Kude.bg Бизнес” and the owners’ panel keep a list of their customers (name, e-mail, phone, birthday, visit counts, notes, consent to messages). The business is the controller of this data; Kude.bg stores and processes it on the business’s behalf as a processor (Art. 28 GDPR) and does not use it for its own purposes. Send requests to access, correct or delete this data to the business; if you cannot reach it, write to us and we will forward your request. When a business is closed on Kude.bg, its customer list is erased.

3.10. Business, owner and staff data

Data

The business’s public details (name, address and coordinates, phone, opening hours, photos, description, menu and prices); names and e-mails of owners and staff and their permissions; billing details (company, UIC, VAT number, representative, address, e-mail); subscription and payment history.

Purpose

Managing the business and its subscription; issuing invoices.

Legal basis

(b); invoices — (c) (Bulgarian accounting and tax law).

Payments

Subscriptions and advertising campaigns are paid on the website only, through Revolut Business (Revolut Ltd / Revolut Bank UAB). Card details are entered on Revolut’s page and never reach us; we pass Revolut the business name, a billing e-mail, the amount and an order number. The apps sell nothing.

Retention

For as long as the business is managed on Kude.bg; invoices and payment records — for the periods required by accounting and tax law.

3.11. Push notifications and devices

Data

A push token, platform (iOS/Android), which of the two apps, the device name you set (e.g. “Maria’s iPhone”), and when it was last used.

Purpose

Notifications about bookings, messages and reviews; the “Devices” list from which you can sign a phone out.

Legal basis

(b); notifications are enabled and disabled in your phone settings.

Sharing

Notifications are sent through the Expo push service (650 Industries, Inc., USA), which hands them to the Apple Push Notification service or Firebase Cloud Messaging (Google). The token and the notification’s title and text are transmitted.

Retention

The token is revoked when you sign out, when you use “Sign out of this device”, and when you delete your account.

3.12. Reports and blocking

Data

Who filed a report, about what (a review and its photos, a profile, a business, a conversation or a single message), the reason and description; the moderator’s decision. The list of users and conversations you have blocked.

Purpose

Moderation, user protection, and our obligations under Regulation (EU) 2022/2065.

Legal basis

(f) and (c).

Who sees it

Only Kude.bg moderators. The user or business reported is not told who reported them. A blocked user is not notified.

Retention

When you delete your account, your reports remain without any link to you and your blocks are deleted.

3.13. Newsletter

Data

E-mail, name (optional), language, topics and a record of your consent (text, version, date).

Legal basis

(a) — consent confirmed through a link sent by e-mail. Unsubscribe with the link in every newsletter.

Sharing

If sending through Brevo (Sendinblue SAS, France) is enabled — e-mail, name and topics.

3.14. Search assistant (when available)

If the search assistant is enabled on the website, your question and up to 12 previous turns of the conversation are sent to a language-model provider (Perplexity AI, Inc. or Anthropic PBC, USA) to produce an answer. Do not put personal data in your question. Questions are kept for up to 30 days. Legal basis: (b).

3.15. Technical data, security and spam protection

Data

IP address, browser/device, time and address of the request; technical logs and error reports.

Spam protection

When you submit a form without being signed in (registration, a booking or message as a guest, a request to add a business, the newsletter), your IP address, e-mail, name, text, browser and referring page are checked by CleanTalk (CleanTalk Inc.). Forms from signed-in users are not sent to CleanTalk.

Errors

The server may send technical error reports to Sentry (Functional Software, Inc.), without personal data being deliberately included.

Legal basis

(f) — security and operation of the service.

Retention

Logs of sent e-mails — 30 days. Other server logs — up to 14 days.

3.16. Cookies and website analytics

Necessary

kude_session and kude_account (sign-in, 30 days), kude_consent (your cookie choice, 1 year) and short-lived cookies for Google sign-in and for completing forms. No consent needed.

Analytics

Only with your consent: Microsoft Clarity (Microsoft Corporation) and, if enabled, Google Analytics 4 / Google Tag Manager (Google Ireland Ltd). Google runs in “Consent Mode”: without consent no cookies are set, but Google may receive cookieless, de-identified signals.

Marketing

Only with your consent: Meta Pixel (Meta Platforms Ireland Ltd), if enabled.

Legal basis

Necessary cookies — (f) and Art. 4a of the Bulgarian Electronic Communications Act; analytics and marketing — (a). You can change your choice at any time under “Cookie settings” at the bottom of the site.

Apps

The apps use no analytics, advertising, advertising identifier or tracking tools.

4. Maps and external services

Maps in the apps and on the website are loaded from our own file server media.kude.bg (data © OpenStreetMap contributors, Protomaps style). We do not use Google Maps for the maps in the apps.

Exceptions that open an external service only when you act: “Directions” buttons open Google Maps or Waze; on an individual business page the owner may have chosen an embedded Google Maps map — Google then receives your IP address and browser data when the page loads. These services process data under their own policies.

5. Who we share data with

We do not sell personal data. We share it only as follows:

• The business you write to or book with — the data in the message or booking (sections 3.7 and 3.8).
• The public — reviews, their photos, replies and your public profile (sections 3.2 and 3.6).
• Hosting and infrastructure: Hetzner Online GmbH — servers in a data centre in Nuremberg, Germany (EU); Cloudflare, Inc. — content delivery and protection of the website, and storage of photos and maps (Cloudflare R2, media.kude.bg).
• E-mail: e-mails are sent through our own mail (SMTP) server, running on the same Hetzner servers in Germany; the newsletter through Brevo, if enabled.
• Notifications: Expo (650 Industries, Inc.), Apple and Google (section 3.11).
• Sign-in: Google (Google Ireland Ltd) and, once enabled, Apple (Apple Distribution International Ltd) — only if you choose that sign-in method.
• Spam protection: CleanTalk Inc. (section 3.15).
• Business payments: Revolut (section 3.10).
• Error reports: Sentry (Functional Software, Inc.).
• Website analytics and marketing: Microsoft, Google, Meta — only with consent (section 3.16).
• Search assistant: Perplexity AI or Anthropic, if enabled (section 3.14).
• Public authorities — where the law requires it.

We use DeepL only to translate interface texts and categories — no reviews, messages or other personal data are sent to it.

6. Transfers outside the European Economic Area

Some providers in section 5 (Expo, Cloudflare, CleanTalk, Sentry, Microsoft, Perplexity, Anthropic, Google, Apple, Meta) are established in, or process data in, the USA. Transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or on standard contractual clauses.

7. Deleting your account

Your account is deleted immediately and permanently: in “Kude.bg” — Profile → Profile settings → Delete account; in “Kude.bg Бизнес” — More → Account → Delete profile; on the website — from “Profile”. Without the app — write to support@kude.bg from the e-mail address you sign in with. Details: Delete your account.

Deleted:

• your name, e-mail, phone, date of birth, city, bio and profile photo (including the photo file);
• the link to Google or Apple;
• your favourites and blocks;
• every sign-in and registered device — push tokens are revoked;
• your public profile.

Kept, no longer linked to you:

• your reviews and their photos — signed “Deleted user”, because they are part of the business’s rating;
• messages to businesses — with the business, without your name, e-mail and phone;
• reports you filed — for moderators, without your name.

Kept by businesses or by law:

• bookings — with the business you booked with, with the details entered when booking; the customer list of a business that is not yours is managed by that business (section 3.9);
• invoices and payment records — for the periods required by accounting and tax law.

If the account owns a business, the “Kude.bg Бизнес” app (More → Account → Delete account) shows what will happen to each business before deletion and asks you to confirm; the customer app and the website point owners there. On confirmation each business is closed: its page is taken off Kude.bg, upcoming bookings are cancelled and the guests are notified by e-mail, staff lose access (their own accounts are not deleted), the business’s customer list (CRM) is erased and any paid plan is stopped with no further charges. Reviews of the business stay public and the owner’s replies stay without being linked to a person. Past bookings and invoices are kept where the law requires.

8. Age

You must be at least 16 years old to create a Kude.bg account (Terms of Use, clause 3.6). We do not verify age at registration. If we learn that an account was created by a younger person, we will delete it. A parent or guardian may write to us at the addresses above.

9. Your rights

Under the GDPR you have the right:

• to access your data and obtain a copy;
• to rectification — you can change most data yourself in your profile settings;
• to erasure — see section 7;
• to restriction of processing;
• to portability of the data you provided to us;
• to object to processing based on legitimate interest;
• to withdraw consent at any time, without affecting processing already carried out.

Write to contact@kude.bg or support@kude.bg, ideally from your account’s e-mail address. We reply within one month; we may ask for additional information to confirm that the request is yours.

10. Complaints to the supervisory authority

You have the right to lodge a complaint with the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg, or with the supervisory authority of the country where you live or work.

11. Security

Connections to the website and the apps are encrypted (HTTPS). Sign-in uses a one-time code sent by e-mail, with no passwords for users; in the apps, sign-in credentials are kept in the phone’s secure storage. Team access to data is limited by role. No system is completely secure — if you notice a problem, please tell us.

12. Changes

We may change this policy when we change our services or the law changes. The current version is always on this page with the date of the last change. We will notify account holders of material changes by e-mail or in the apps.

13. Contact

KUDE BG LTD („КЪДЕ БГ“ ООД), UIC 208195419, zh.k. Izgrev, bl. 56, entr. 4, fl. 5, 8008 Burgas, Bulgaria. E-mail: contact@kude.bg, support: support@kude.bg. See also the Terms of Use and Support.