Privacy Policy

• There is no sign-up and no password. We never ask for your name, e-mail address or phone number.
• We use no cookies and no third-party advertising.
• We measure how the site is used with an analytics system we host ourselves, with no cookies, no persistent identifiers and nothing sent to a third party.
• The only thing we store on your device is a random identifier, so your votes are not counted twice.
• A room, and everything belonging to it, is deleted 90 days after it is created.
• We do not sell data and do not share it for advertising purposes.

escolhe.la is operated from Portugal. The data controller can be reached at contact-us@escolhe.la. Any question about this policy, or about exercising your rights, should be sent to that address.

Given the nature, scope and volume of the processing, we are not required to appoint a Data Protection Officer under Article 37 GDPR. The address above is the only contact channel.

• Participant identifier. A UUID generated at random by your browser and kept in localStorage. It distinguishes your votes from someone else's in the same room and stops the same restaurant being voted on twice. It is not linked to a name, an e-mail address or any other identifier. Basis: performance of the service you requested (Article 6(1)(b) GDPR).
• Votes. Yes or no, per restaurant, per room, tied to the participant identifier. Basis: performance of the service you requested.
• Room and search. The text you typed into the search, the filters you chose, the room code and the language it was created in. Basis: performance of the service you requested.
• Candidates. Name, address, rating, review count, price level, coordinates, Google Maps link and photo references, obtained from the Google Places API. This is data about businesses, not about you.
• Booking intent clicks. A count per candidate and per room. We do not store the participant identifier alongside the click, so the count is anonymous. Basis: legitimate interest in understanding which restaurants end up chosen (Article 6(1)(f)).
• Approximate location. Only if you allow your browser's prompt. Coordinates are rounded to four decimal places, sent with the search to bring results closer to you, and are not stored. Basis: consent (Article 6(1)(a)), which you can withdraw at any time in your browser settings.
• Server technical logs. IP address, date and time, requested page and browser identification, written automatically by the hosting platform for diagnostics and security. They are not cross-referenced with rooms or votes. Basis: legitimate interest in keeping the service available and protected (Article 6(1)(f)).
• Usage statistics. Each page viewed and a small set of actions — searching, voting, reaching the end of a vote, sharing a room, following a link to a restaurant — are recorded without cookies, along with the text you typed into the search and the filters you chose, the page (rooms are recorded as /rooms/:code, without the code), the site you arrived from, your country, browser, operating system, device type and screen width. Your IP address is used only to derive the country and a hashed session identifier that changes every day; it is not stored. There is no way to link these statistics back to you, or to recognise you from one day to the next. Basis: legitimate interest in understanding how the site is used in order to improve it (Article 6(1)(f)).

There is no solely automated decision-making producing legal effects concerning you, and no profiling, within the meaning of Article 22 GDPR.

We store a single localStorage entry, named participantId, holding the random identifier described above. We use no cookies.

You will not see a cookie banner because there is nothing to consent to: Article 5 of Portuguese Law 41/2004 requires prior consent to store information on your device, except where that storage is strictly necessary to provide the service you explicitly requested — and without this identifier you cannot vote.

The usage statistics store nothing on your device and read nothing from it either: no cookie, no localStorage, no identifier that follows you between visits. That is why the same exception is not even needed for them.

You can delete it at any time by clearing site data in your browser. The only thing you lose is the link to votes you had already cast; from then on you count as a new participant.

• Google (Places API). Your search text and, if you allowed it, your approximate location are sent to Google to retrieve restaurants. The Google Privacy Policy applies and is incorporated into this policy for that processing. Photos are fetched by our server and served from escolhe.la, so your browser never contacts Google to display them.
• OpenStreetMap. The map on the results page loads tiles directly from openstreetmap.org, which sees your device's IP address. The OpenStreetMap Foundation privacy policy applies.
• unpkg.com. Serves the JavaScript libraries the page uses (HTMX and Leaflet). Loading them reveals your IP address to that service.
• Hosting provider. Hosts the application and the database as a processor, handling data only on our instructions.

The usage statistics are shared with no one: the system that collects them runs on our own servers, on the same infrastructure as the application, and the requests your browser makes to it are addressed to escolhe.la rather than to a third-party domain.

None of these receives your data for its own advertising purposes. We sell data to no one.

Google and the content delivery services above may process requests outside the EEA, in particular in the United States. Those transfers rely on the mechanisms in Chapter V GDPR — a European Commission adequacy decision or standard contractual clauses, depending on the service. The data we store — rooms, candidates and votes — stays on servers in the European Union.

Rooms are deleted 90 days after they are created, and their candidates, votes and booking clicks go with them. Deletion is automatic and does not depend on you asking for it.

• Server technical logs: 30 days.
• Usage statistics: 180 days, after which they are deleted automatically.
• Database backups: 7 days. A deletion takes at most that long to reach every copy.
• Participant identifier: stays on your device until you delete it.

The site is served over HTTPS only. Scripts and stylesheets are loaded with subresource integrity checks and constrained by a content security policy, and database access is limited to the application. Because we collect no names, e-mail addresses, payment details or special categories of data, the impact of an incident is small by construction.

As a data subject, the GDPR gives you rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw any consent you have given, without affecting the lawfulness of processing carried out beforehand.

There is one limit here we would rather state than hide: because we collect no data identifying you, we cannot tell from a random identifier which votes are yours. Under Article 11 GDPR, where we are unable to identify you we may not be in a position to act on an access or portability request, unless you provide additional information enabling that identification.

In practice: send a room code to contact-us@escolhe.la and we will delete that room and everything belonging to it. That is the most direct way to exercise the right to erasure here. The identifier on your device is yours to delete, by clearing site data in your browser.

Objecting to the statistics: if your browser sends the Do Not Track or Global Privacy Control signal, no measurement happens at all — the script checks for both before sending anything. That is the most direct way to object to the processing described in clause 3, and it does not require writing to us.

The service is not directed at children under 13, the age set in Portugal by Article 16 of Law 58/2019. We do not ask for age and collect no data that would reveal it.

If you believe the processing of your data breaches the law, you may lodge a complaint with the supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, geral@cnpd.pt, www.cnpd.pt. We would appreciate hearing from you first, but you are not obliged to do so.

If this policy changes, we publish the new version on this page and update the date at the top. Changes that materially affect what we process or who receives the data will be flagged visibly.