Privacy
VeggieSmile is a map of vegetarian-friendly places in Central Italy. We collect the bare minimum to make that work. This page explains what, how and why.
Who handles your data
The data controller is VeggieSmile, a project by Lionel. For any question about your data write to privacy@veggiesmile.com.
What we collect
Email — when you sign in as an owner or super-admin, we use your address to send you a sign-in link (magic link). We do not ask for a password.
Place ownership — if you claim a place, we link your account to that place along with the claim date.
Interest signals — if you tap "I want this place verified" on an unverified listing, we save your email (if provided) and the place slug, so we can let you know when it gets verified.
Claim requests — if you ask to claim a place, we save the free-text note you sent us along with your account.
Photos and content — when you upload photos, menus or reviews as an owner, they stay attached to your place.
Browser-local preferences — your saved places, active filters and chosen language live only in your browser's localStorage. We never receive them.
Geolocation
When you open the map your browser asks permission to share your location. We use it only to center the map: we don't receive it, store it or share it. If you decline, the map still works — it just doesn't auto-center.
Data collected from public sources
The base catalogue comes from OpenStreetMap, an open database. For places with a website but no public contact listed on OSM, we automatically read the public pages of their site (home, contact, about) looking for a contact email, in order to invite the owner to claim and update their listing.
If you're a restaurant owner and don't want to be contacted, write to privacy@veggiesmile.com: we'll remove the email from our database and from the listing within a few days.
Cookies and tracking
We use two technical cookies, no advertising ones:
vs.locale — remembers your chosen language (1 year).
Auth.js session cookies — only when you sign in as an owner, to keep you logged in.
No advertising cookies, no cross-site tracking, no third-party analytics pixels.
Services we use
MongoDB Atlas — database, EU-based servers.
Vercel — site hosting.
Mapbox — maps and geocoding. Tile-server requests carry your browser's IP address to serve the maps.
Cloudinary — place photo hosting.
Resend — transactional emails (magic link, interest confirmations, owner invites).
Each of these has its own GDPR-compliant safeguards and contracts.
Your rights
Under the GDPR you can: access your data, correct it, erase it, request portability, object to or restrict processing. Write to privacy@veggiesmile.com — we respond within 30 days.
You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
Retention
Account data is kept as long as you have an account. Interest signals are kept while the related place is unverified. Place revisions (who changed what, when) are kept as an audit log for as long as the place exists.
Changes to this policy
If we change this policy we'll note it at the top with a new date; if the changes are substantial and affect you directly, we'll let you know by email.