Expadu — Anar Haqverdiyev, Köln, Germany (contact: [email protected]) is the controller for the processing described here.
Our servers are operated by Hetzner Online GmbH in Germany. When you visit, standard server logs are processed (IP address, time, requested page, user agent) to deliver the site securely and diagnose faults — legal basis: legitimate interest (Art. 6(1)(f) GDPR). Logs are short-lived and not used to profile you. On our production domain, traffic is routed through Cloudflare, Inc. as a security/CDN layer; Cloudflare processes connection data as our processor under EU standard contractual clauses.
We set only technically necessary cookies: a session cookie, a CSRF protection token, and — if you use the toggle — your theme preference in your browser's local storage. These are required for the site to function (§ 25 (2) TDDDG), so no consent banner is needed. We use no tracking, advertising or third-party analytics cookies. If that ever changes, we will ask for your consent first.
If you leave your e-mail and city, we store both together with a timestamp, and send you a single confirmation e-mail (double opt-in). Only after you confirm do we keep you on the list, and we use it solely to tell you when Expadu launches in your city — legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw at any time via the link in any e-mail or by writing to us; withdrawal deletes your entry.
Account e-mails (address verification, password resets) and waitlist confirmations are delivered through Resend (Resend, Inc.) acting as our processor; our sending domain is configured to Resend's EU region, so delivery is processed on servers in the EU (Ireland). Your e-mail address is shared with Resend only for the purpose of delivering the message.
If you create an account at app.expadu.com, we process the data you provide (e-mail, name, password — stored hashed) and, to power the product, the situation profile you set up (e.g. residency situation, arrival date, neighbourhood, interests) — legal basis: contract performance (Art. 6(1)(b) GDPR). You can also sign in with Google or Apple; in that case we receive your name and e-mail address from the provider, and nothing is shared back with them beyond the sign-in itself.
If you grant browser location access, your position is used to compute departures, routes and nearby suggestions. Recent positions are retained for at most 7 days to power these features and then deleted automatically. Route and departure calculations run on our own servers in Germany — your location is not sent to third-party routing services.
Application errors are monitored with Sentry to keep the service reliable (legitimate interest, Art. 6(1)(f) GDPR); error reports are scrubbed of sensitive values where feasible. We do not sell data, we do not use it for advertising, and we make no automated decisions with legal effect about you.
Account data is kept while your account exists and deleted when you delete your account or ask us to. Waitlist entries are kept until you withdraw or until the launch notification for your city has been sent. Location data expires automatically as described above. Server logs rotate on a short schedule.
You have the rights of access, rectification, erasure, restriction, portability and objection under Art. 15–21 GDPR, and the right to complain to a supervisory authority — in NRW: LDI Nordrhein-Westfalen. Writing to [email protected] is the fastest route for any of these.
This policy will be updated as the product evolves; the date above always reflects the current version.