Privacy Policy

Short version: we collect only what Under10 needs to work. We never sell your data. Your email and home address are never public. Payments are handled by Apple or Google, never by us. You can delete your account and everything you posted from inside the app, at any time.

1. Who we are

Under10 (the app and under10.app) is published by [FULL NAME], trading as TechLoops, [ADDRESS], Clermont-Ferrand, France, SIRET [SIRET] ("we", "us"). We are the data controller for the personal data described here.

Contact: support@under10.app

2. What we collect

Your account

• Email address and password (the password is stored encrypted by our hosting provider; we never see it).
• Display name, username, profile photo, bio, home city, favourite cuisines and app settings (language, distance unit, maximum price, notification choices).
• Optional home address, if you add it. It is private and only visible to you.

What you post

• Spots you add: name, cuisine, price, address, city, description and the map location of the restaurant.
• Photos, videos (up to 1 minute) and stories (visible for 24 hours).
• Likes, "I was there" verifications, price suggestions, reports, saved spots, follows and blocks.

Your location

With your permission, the app uses your phone's location to show spots near you. When you add a spot, verify a price ("I was there") or suggest a new price, your position is sent once to check that you are close enough (1 km for verifications). We do not keep a history of where you have been and we do not track you in the background.

Restaurant owners

If you claim a restaurant, we also collect the business name, SIRET or company number, phone number, your role and a proof document (for example a Kbis or an invoice). The proof document is stored privately and is only used to review your claim.

Restaurant subscriptions and payments

Restaurants subscribe to Under10 for Restaurants inside the app. Payments are processed by Apple (App Store) or Google (Google Play), depending on the phone; we never see card details. We use RevenueCat to check that a subscription is active. We receive: the plan (monthly or yearly), trial and renewal dates, subscription status and an anonymous purchase identifier from the store.

Usage

We record when a restaurant page is viewed, when someone taps "Directions" and when a spot is shared, so restaurants can see how many people are interested. Restaurants only see totals, never who viewed their page. If you use the app without an account, these events are recorded without any identifier.

3. Why we use it (legal basis)

• To provide the service (contract): your account, the map, posting, verifications, points, notifications, restaurant pages and the restaurant subscription.
• With your consent: location, camera and photo library, push notifications. You can withdraw consent at any time in your phone's settings.
• Legitimate interest: keeping prices accurate, preventing fake or abusive content and payment fraud, securing accounts and improving the app.
• Legal obligation: keeping invoices and accounting records, and answering lawful requests from authorities.

We do not sell your data and we do not show banner ads. Restaurants can pay to boost their spot in Explore and on the map; boosted spots are always labelled Sponsored, and boosts are shown by area, never targeted using your personal data. Paying never changes prices or verifications.

4. What other people can see

• Public: your display name, username, profile photo, home city, points and level, spots you added, your photos, videos and stories (stories for 24 hours), your likes and verification counts, followers and following.
• Private: your email, your home address, your saved spots, your notifications, your reports and blocks, restaurant claim documents, and all billing information.

5. Who processes your data for us

• Supabase – database, file storage and login. Our project is hosted in the European Union (Frankfurt, Germany).
• Resend – account emails such as sign-up codes.
• Vercel – hosts this website.
• Cloudflare – our domain name and email forwarding.
• Apple and Google – app distribution, in-app subscription payments, maps displayed in the app and, if enabled, push notifications.
• RevenueCat – checks restaurant subscription status.

These providers only process data on our instructions. Where data may be transferred outside the EU, they rely on the EU Standard Contractual Clauses or an adequacy decision (such as the EU-US Data Privacy Framework).

6. How long we keep it

• Account data and content: until you delete your account.
• Stories: 24 hours, then removed automatically every day.
• Claim documents: for as long as your claim or restaurant page is active; deleted with your account.
• Subscription records: 10 years, as required by French accounting law, even after your account is deleted.
• When you delete your account, your profile, photos, videos, stories, likes, saves, follows, points and notifications are deleted. Spots that other people also contributed to stay on the map without your name, because they belong to the community.

7. Your rights

Under the GDPR you can access, correct, export or delete your data, object to or limit its use, and withdraw consent. Most of this is available directly in the app: edit your profile in Settings, and delete your account in Settings → Delete account. For anything else, email support@under10.app; we answer within 30 days. You can also complain to the French data protection authority, the CNIL (cnil.fr).

8. Children

Under10 is not intended for children under 15. If you are under 15, please do not create an account.

9. Security

Data is encrypted in transit (HTTPS). Access to data is restricted by per-user security rules in our database, so people can only change their own content. Card details stay with Apple or Google and never reach our servers. No system is perfectly secure; if a breach affected you, we would inform you and the CNIL as required by law.

10. Changes

If we change this policy, we will update the date above and, for important changes, tell you in the app.