Privacy Policy
Last updated: 2026-04-29
Introduction
This Privacy Policy describes how Gorivata.bg ("we", "us") collects, uses and protects the personal data of users of the gorivata.bg website (the "Site"). By using the Site, you agree to the practices described below.
Data Controller
The data controller is the individual operating the Site. For data protection inquiries, contact us at: contact@gorivata.bg.
Data we collect
• Account data: username, email address and hashed password. • Contribution data: prices you submit, with timestamp and user identifier. • Location data: with your consent, we use your coordinates to show nearby stations. Coordinates are not stored on the server. • Technical data: IP address, browser and device type, automatically collected by our hosting providers for security and reliability. • Advertising cookies: if Google AdSense is enabled, the ad network may set its own cookies (see "Cookies" section).
Purposes of processing
We process your data for the following purposes: • Providing and maintaining the service (price browsing, profiles, contributions). • Security, abuse prevention and spam detection. • Improving the service through aggregated statistics. • Showing third-party ads (Google AdSense), where applicable.
Legal basis
We process personal data on the following legal bases: • Contract performance — for maintaining your user account. • Legitimate interest — for security, monitoring and service improvement. • Consent — for geolocation and personalised advertising cookies.
Recipients and processors
We share personal data with service providers acting on our behalf: • Vercel Inc. (frontend hosting) — US/EU. • Railway Corp. (backend hosting) — US. • Supabase Inc. (database, Frankfurt region) — EU. • Google LLC (AdSense, if enabled) — US. These providers are bound by data-protection terms. Transfers to the US rely on Standard Contractual Clauses.
Retention period
Account data is retained for as long as your account exists. After deletion, personal identifiers are removed; submitted prices may be kept in anonymised form for statistical purposes. Server logs are retained for up to 30 days.
Your rights (GDPR)
As a data subject you have the right to: • Access your data. • Request correction of inaccurate data. • Request erasure ("right to be forgotten"). • Object to processing. • Request data portability. • Lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) — https://www.cpdp.bg. To exercise your rights, write to contact@gorivata.bg.
Cookies
We use a minimal set of cookies: • Session cookie for authentication (httpOnly, SameSite=Lax) — required for the service. • Cookies storing your language and theme preferences — convenience. • If AdSense is enabled, Google may set advertising cookies. You can manage ad personalisation at https://adssettings.google.com.
Changes to this policy
We may update this policy from time to time. The last-updated date is shown at the top. Material changes will be announced on the Site.
Contact
For data-protection inquiries: contact@gorivata.bg.