PRIVACY POLICY - ORADEA XPERIENCE

Last updated: 27 September 2026. Versiunea în limba română

1. Who we are

Oradea Xperience is a city guide and community platform for Oradea, available at oradeaexperience.ro and as a mobile app for iOS and Android. The platform is operated by HAIAS ENTERPRISE SRL ("we", "us"), which is the data controller for the personal data described in this policy.

This policy explains what data we collect, why we collect it, who we share it with, how long we keep it and how you can control or delete it. It applies to the website and to the mobile app.

2. Data we collect

• Account data: name or username, email address, password (stored only as a secure hash), profile picture, and optionally a phone number and bio if you add them.
• Sign-in data from Google or Apple: see section 3.
• Content you create: forum posts, comments, reviews, startup ideas, photos and other files you upload, survey answers and messages you send us.
• Activity data: events you save or attend, tickets and reservations, challenges, points, badges, rewards, referrals and followed users.
• Purchase data: the items you bought and the payment status. Card details are entered directly with our payment processor, Stripe, and never reach our servers.
• Device data: push notification token, app version, language and basic technical logs such as IP address and browser type, used for security and troubleshooting.

We do not collect your precise location. Maps in the app show places in the city but do not store where you are.

3. Google user data

If you choose "Sign in with Google", Oradea Xperience requests only the basic "profile" and "email" scopes. From your Google account we receive:

• your name,
• your email address,
• your profile picture URL,
• your Google account identifier.

How we use it: only to create your Oradea Xperience account, sign you in, show your name and picture on your profile and contributions, and send you account-related emails such as ticket confirmations. We do not access your Gmail, contacts, calendar, Drive files or any other Google data.

How we store it: this data is stored in our account database, hosted on MongoDB Atlas, protected by encryption in transit and access controls.

How we share it: we do not sell Google user data, do not use it for advertising and do not transfer it to third parties, except to the service providers listed in section 5 that are strictly needed to run the platform, or when required by law.

How to delete it: you can delete your account at any time from the mobile app (My Account, Edit Account, Delete Account) or by emailing [email protected]. Deleting your account removes the Google data we received. You can also revoke our access at any time from your Google Account at myaccount.google.com/permissions.

Oradea Xperience's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Why we use your data

• To provide the service (contract): your account, tickets, reservations, rewards and community features.
• To keep the platform safe (legitimate interest): preventing abuse and automatically checking uploaded images and posts for inappropriate content.
• To communicate with you (contract or consent): transactional emails and push notifications, and news about events if you opted in. You can turn these off in the app or with the unsubscribe link.
• To improve the platform (legitimate interest or consent): aggregated usage statistics.
• To meet legal obligations: accounting and tax records for purchases.

5. Service providers we share data with

We share only the data each provider needs to do its job for us:

• MongoDB Atlas - database hosting.
• Stripe - payment processing for tickets, subscriptions and purchases.
• Mailgun - sending account and ticket emails.
• Expo - delivering push notifications to the mobile app.
• Google Cloud Vision - automatic safety check of uploaded images.
• OpenAI - automatic moderation of text posted in the community. Text is not used to train their models.
• Google and Apple - sign-in, only if you choose these options.
• Meta Pixel - website visit statistics, on the website only.

Businesses and event organisers on the platform receive the data needed to honour a ticket, reservation or reward you claim with them, such as your name and ticket code. We never sell personal data.

6. How long we keep data

We keep account data for as long as your account is active. When you delete your account, we immediately delete your profile, your posts and comments and the personal data linked to them. Purchase records are kept for the period required by Romanian accounting law. Server logs are kept for a limited period for security purposes.

7. Your rights

Under the GDPR you can request access to your data, correction, deletion, restriction, portability, and object to processing, including for marketing. You can withdraw consent at any time. To exercise these rights, email [email protected]. You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro).

8. Security

All traffic is encrypted with HTTPS. Passwords are hashed, access to data is limited to staff who need it, and payment details are handled by Stripe.

9. Children

Oradea Xperience is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.

10. Changes and contact

We will post any changes to this policy on this page and update the date above. For any question about your data, contact us at [email protected].