1. Introduction

Kopiaste ("we", "us", "our") operates the website kopiastecyprus.com and the Kopiaste mobile application. We are committed to protecting and respecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the Cyprus Processing of Personal Data Law (Law 125(I)/2018).

This policy explains how we collect, use, store, and protect your personal data when you use our services.

2. Data Controller

Kopiaste is the data controller for all personal data processed through our services.

Operator: Kopiaste
Registered address: Limassol, Cyprus
Contact: info@kopiastecyprus.com

3. What Data We Collect

We may collect and process the following categories of personal data:

3.1 Data you provide directly

Account information: name, email address, profile photo, phone number
Booking information: selected experiences, dates, number of guests, special requirements
Payment information: processed by Stripe (we do not store card details)
Communication: messages with hosts, AI Concierge conversations, support requests
Reviews and feedback: ratings, written reviews, photos you submit
Partner/host information: business name, address, tax identification, bank details

3.2 Data collected automatically

Device information: browser type, operating system, screen resolution
Usage data: pages visited, features used, click patterns, session duration
Location data: general location based on IP address (with your consent)
Cookies and similar technologies (see our Cookie Policy)

3.3 Data from third parties

Google: name, email, profile photo (when you sign in with Google)
Facebook: name, email, profile photo (when you sign in with Facebook)
Apple: name, email (when you sign in with Apple)

4. How We Use Your Data

We process your personal data for the following lawful purposes:

Contractual necessity: To facilitate bookings, process payments, and deliver our services
Legitimate interest: To improve our services, prevent fraud, ensure security, and personalize your experience
Consent: For marketing communications, location-based features, and non-essential cookies
Legal obligation: To comply with tax, anti-money laundering, and other regulatory requirements in Cyprus and the EU

5. Data Sharing

We may share your personal data with:

Experience hosts: Your name, booking details, and communication are shared with the host you book with
Stripe: Payment data is processed by Stripe, Inc. (PCI DSS compliant). We do not store card numbers
Google Firebase: Infrastructure provider for hosting, authentication, and database services
Google AI (Gemini): Powers the AI Concierge feature. Conversations are processed to generate responses
Analytics providers: Aggregated, anonymized usage data
Legal authorities: When required by Cyprus or EU law

6. International Transfers

Your data may be processed outside the European Economic Area (EEA) by our service providers (Google, Stripe). We ensure appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Participation in the EU-US Data Privacy Framework where applicable
Compliance with PCI DSS for all payment data

7. Data Retention

Account data: Retained for the duration of your account plus 3 years after deletion for legal compliance
Booking data: Retained for 7 years (Cyprus tax and legal requirements)
AI Concierge conversations: Not permanently stored; used only for the current session
Marketing data: Retained until you withdraw consent or unsubscribe
Cookies: As specified in our Cookie Policy

8. Your Rights under GDPR

As a data subject in the EEA, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your data ("right to be forgotten")
Restriction: Limit how we process your data
Data portability: Receive your data in a structured, machine-readable format
Object: Object to processing based on legitimate interest
Withdraw consent: Withdraw consent at any time where processing is based on consent
Lodge a complaint: With the Cyprus Commissioner for Personal Data Protection (www.dataprotection.gov.cy)

To exercise any of these rights, contact us at info@kopiastecyprus.com. We will respond within 30 days.

For information about cancellations and refunds, please see our .

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption in transit (TLS/HTTPS) and at rest
Firebase Security Rules limiting data access to authorized users only
Regular security reviews and access controls
PCI DSS compliance via Stripe for all payment processing

10. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete it. Bookings for children must be made by an adult.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: info@kopiastecyprus.com
Address: Limassol, Cyprus
Data Protection Officer: Available upon request

Privacy Policy