Mapnovi App Privacy Policy

§ 1 Who is responsible for your data

This policy applies to the Mapnovi app for iPhone and Android. The website mapnovi.de has its own privacy policy, published there.

The controller under the GDPR is:

Volkan Genc, sole proprietor

trading as V-Momentum / Mapnovi

Wiesenstraße 11

57537 Selbach

Germany

Email for privacy requests: info@mapnovi.de

Support: support@mapnovi.de

§ 2 The short version

• The app contains no third-party advertising, analytics or tracking services. We do not build advertising profiles.
• We do not sell personal data.
• The app does not access your location, contacts or microphone, and it does not send push notifications.
• The app uses the camera and photos only when you take, choose or save a photo yourself.
• The app can reach a Google Business Profile only after you connect it yourself.
• AI features send content to Google Gemini. A suggestion is published only if you confirm it.
• You can delete your account at any time in the app.

§ 3 Your account

To use the app you create an account, either with an email address and password or with "Sign in with Google" or "Sign in with Apple".

We process:

• your name, if you give one, and your email address,
• your password, only as a one-way hash,
• for Google or Apple sign-in, the identifier that provider sends us, and for Apple also a token we use to revoke the link when you delete your account,
• a sign-in token for the app,
• one-time password reset codes, also stored only as a hash and valid for a limited time,
• your plan, your credit balance and your use of features with a monthly allowance.

If you use "Sign in with Apple" and hide your email address, we receive only the relay address Apple creates.

The legal basis is Art. 6(1)(b) GDPR (contract). We cannot provide an account without this information.

§ 4 Your Google Business Profile

The app's core features work with your Google Business Profile. When you connect a profile, you grant permission on a Google page to manage your business profiles. With a direct connection we also request your Google identifier and the email address of the connected Google account, so that we can assign the connection correctly.

We store:

• identifiers of the connected account and its locations,
• the name, address, category and time zone of each location,
• with a direct connection, the access key in encrypted form, the identifier and email address of the Google account, and the permissions granted.

Through this connection the app can read reviews, replies, posts, photos, opening hours, the description, services, menus, attributes, links, search terms, performance figures and verification status. The app writes to your profile only when you trigger a change there. We store scheduled posts until they are published and publish them at the time you chose.

Depending on the connection, access runs directly through Google's interfaces or through our technical service provider Zernio.

You can remove a business in the app at any time, and you can also revoke our access in your Google account at myaccount.google.com/permissions.

The legal basis is Art. 6(1)(b) GDPR.

§ 5 Our commitment for data from Google APIs

Mapnovi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: we use this data only to provide and improve the app features you use. We do not sell it, do not use it for advertising, and share it only with the service providers named in § 16 where that is needed for those features, for security or by law. Our staff read it only with your agreement, where it is needed for security or support, or where the law requires it.

§ 6 Reviews and the people who wrote them

So that you can read and answer reviews, the app shows the data Google supplies for a review: public name, profile picture, stars, text, date and your reply.

This data comes from Google. We do not store it permanently. We fetch it when needed and hold it in a cache for a short time at most. Removal requests are the exception (§ 8).

For review authors the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of our customers, is managing and responding to reviews of their own business. We do not build profiles of authors. Authors can contact info@mapnovi.de to exercise their rights under § 19 and § 20.

§ 7 AI features

The app offers help powered by the AI service Google Gemini, for example suggested replies to reviews, bulk replies, post drafts, improved descriptions, suggestions for your profile, and the themes found in your reviews.

When you use these features, we send Google the content they need. This can include:

• the text and stars of a review and the public name of its author,
• details from your business profile,
• keywords or text you enter.

Results are suggestions and can contain mistakes. A suggestion is published only once you confirm it. We make no automated decisions within the meaning of Art. 22 GDPR. Results may be cached briefly so that the same analysis is not calculated twice.

Please do not enter special categories of personal data, such as health details, unless the text needs them.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for data of review authors. Our legitimate interest is providing the help you asked for in handling reviews.

§ 8 Review removal requests

When you request the removal of a review in the app, we store for each review its identifier, the name of its author, stars, text and date, the status of the request, and the movements on your credit balance.

If the business has replied to the review, that reply is taken off Google while the request runs. We store a copy so that it can be published again later.

Our team handles the request and uses the channels Google provides for this. Details of the review concerned and of your profile go to Google as part of that. We check whether a review is still visible using the review list of your profile. Google alone decides whether a review is removed.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for data of review authors. Our legitimate interest, and that of our customers, is clearly identifying, carrying out and billing a process the customer started.

§ 9 Photos, logos and QR codes

You take photos for your Google profile with the camera or choose them from your library. The app accesses only the photo you choose. We resize it and store it under a random address that cannot be guessed. This address is public, because Google downloads the photo from there. It then appears publicly on your Google profile. We store logos you upload for QR codes or print products in a similar way.

These files stay on our server after Google has taken them over. Profile photos are not linked to your account, so at present they are not deleted automatically, not even with your account. Email info@mapnovi.de if you want a file removed. Do not upload images that show confidential content or that you do not hold the rights to.

The app creates your QR code. We store its design settings on the device and on our server so that it looks the same on your devices. The code leads to your review page on Google. Anyone who scans it leaves the app and uses Google.

The legal basis is Art. 6(1)(b) GDPR.

§ 10 Payments and subscriptions

You buy credits through Stripe (Stripe Payments Europe, Ltd., Ireland), and depending on your device also with Apple Pay or Google Pay. Your payment details go directly to Stripe. We do not receive full card details, only the amount, status and reference numbers. Stripe partly processes data as an independent controller, including for fraud prevention.

You buy subscriptions through Apple's App Store or Google Play, which also handle billing. We receive the product, term, renewal and trial status and the store's technical references, and we assign these to your account. The stores do not give us your name or payment method.

The legal bases are Art. 6(1)(b) GDPR and, where retention duties apply, Art. 6(1)(c) GDPR.

§ 11 Print shop

When you order or request stands, stickers or other print products, we process your name, company, delivery address, phone number, email address, your note, the design with logo and business details, and the order and shipping status.

Print and shipping partners, such as wir-machen-druck.de, receive the details they need for production and delivery.

The legal basis is Art. 6(1)(b) GDPR.

§ 12 Website check, search terms and competitor comparison

For the website check we fetch the public pages of the website listed on your profile, using the service provider DataForSEO. We store the result with your location. For keyword ideas and the competitor comparison we send search terms, category and place to the same provider. This concerns public business and market data.

The legal basis is Art. 6(1)(b) GDPR.

§ 13 Website requests

If you request a website template in the app, we pass your details to Webnovi, which is also run by Volkan Genc under V-Momentum and answers the request. These are your name, email address, phone number, company, website, your message, the chosen template, and your IP address for abuse prevention. We also keep the request ourselves so that it is not lost.

The legal bases are Art. 6(1)(b) GDPR and, for the IP address, Art. 6(1)(f) GDPR. Our legitimate interest is protection against abuse.

§ 14 Referrals

Every account has its own referral code. When a new account redeems a code, we store who invited whom, the status, and the location that made the referral valid. If the code arrives through an invitation link, it stays on the device until it is redeemed.

The legal basis is Art. 6(1)(b) GDPR.

§ 15 What the app stores on your device and what it accesses

On the device we store only what the app needs to work:

• in the device's protected storage: your sign-in token and account details,
• in app storage: language, reply language, selected location, recent searches in the app, QR design, cart, notes such as the introduction, and a history of your figures.

This data is not used for tracking. Storing it is strictly necessary for the service you asked for (§ 25(2) TDDDG). Deleting the app removes app storage. On iOS, entries in protected storage can survive a reinstall, but only the app can read them. The Android app is excluded from automatic backup.

Depending on the device, and only when needed, the app asks for this access:

• camera: when you take a photo for your profile,
• photos: when you choose a photo or logo,
• adding to photos, or storage (Android 9 and older only): when you save your QR code.

You can withdraw this access at any time in your device settings.

Running the app also creates technical data on our servers: IP address, time, function used, device and app details, and error messages. We use it for operation, error analysis and to fend off attacks. Automatic protection may block individual requests for a time. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable service.

§ 16 Who receives data

We share data only where the feature concerned needs it. Service providers working on our behalf are bound under Art. 28 GDPR where the law requires this.

• Hosting and infrastructure providers: running servers, the database and files.
• Google (Google Ireland Limited, Ireland): Google sign-in, Business Profile interfaces, Gemini, Google Pay and Google Play.
• Apple (Apple Distribution International Ltd., Ireland): sign-in, the App Store, subscriptions and Apple Pay.
• Stripe: payments for credits.
• Zernio: technical connection to Google Business Profiles.
• DataForSEO: website check, search terms and competitor data.
• Resend: sending emails, such as password reset codes.
• Webnovi: answering website requests.
• Print and shipping partners: producing and delivering print products.
• Tax advisers, banks, authorities and courts: where the law requires it or to enforce claims.

Google, Apple and Stripe partly process data as independent controllers under their own privacy policies.

§ 17 Transfers outside the EU

Some of these providers also process data outside the EU and EEA, in particular in the USA. We transfer data there only on a permitted basis. That is an adequacy decision of the European Commission under Art. 45 GDPR, such as the EU-US Data Privacy Framework for certified providers, or appropriate safeguards under Art. 46 GDPR such as the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards.

§ 18 Retention and account deletion

We keep data for as long as your account exists and the feature concerned needs it. A location is removed when you remove it from the app. We delete technical logs once they are no longer needed for operation and security, unless a specific incident has to be resolved.

How to delete your account: "Account" tab, then "Account & privacy", then "Delete account". Once you confirm your identity, the account is deleted immediately and permanently. There is no waiting period and we cannot restore it. If you no longer have the app, email info@mapnovi.de.

With the account we delete your account details, locations, credit entries, orders, subscription details and referrals from our database. Running removal requests are ended. We try to publish hidden replies again first, but this does not always succeed. For Apple sign-in, we revoke the link to Apple.

The following remain:

• what is published on Google, such as replies, posts and photos: you manage this directly at Google,
• the own records of Stripe, Apple and Google,
• a subscription with Apple or Google, which you must cancel there yourself,
• the files named in § 9,
• records we must keep by law or need in order to resolve claims.

§ 19 Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To use them, email info@mapnovi.de. If we have reasonable doubts about your identity, we may ask for proof.

You can also complain to a data protection authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz

Hintere Bleiche 34

55116 Mainz

Germany

§ 20 Your right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can show compelling legitimate grounds, or the processing serves to establish, exercise or defend legal claims. An informal message to info@mapnovi.de is enough.

§ 21 For businesses only

The app is aimed at businesses, not at children or young people. We do not knowingly collect data from anyone under 16.

§ 22 Security

The connection between the app and our server is encrypted. We store passwords as a hash and Google access keys in encrypted form. Sign-in details on the device sit in the operating system's protected storage. Nobody can guarantee complete security, so please protect your device and your sign-in details.

§ 23 Changes

We update this policy when the app, the services we use or the law change. The current version is always in the app and at mapnovi.de/app/privacy-policy. If there are material changes, we will tell you in the app or by email.