Privacy Policy

1. Who controls your data

The data controller and operator of the Services is Alexandros Fysentzou, a natural person operating under the name “Avenue”. Avenue is a project name, not a company or separate legal entity. Alexandros is not registered as self-employed and has no VAT registration or VAT number.

Postal address: Psaron 28, Agios Dometios, 2362 Nicosia, Republic of Cyprus
Privacy email: privacy@avenuecy.com
Support email: support@avenuecy.com

2. Personal data we collect

Account and authentication data

• Email address, username, optional name and phone number, account identifiers, account timestamps, and authentication and session records.
• If you register with email, your password is handled by our authentication provider in protected form; we do not store a readable copy.
• If you use Sign in with Apple or Google sign-in, we receive a provider identifier and the email address and name you choose to share. Apple may provide a private relay email address.
• Security data such as IP address, user agent, sign-in attempts, CAPTCHA results, and records used to prevent abuse and limit concurrent sessions.

Activity, preferences, and communications

• Events you save, venues you follow, notifications you open, and notification preferences.
• Recommendation choices such as interests, preferred days and times, budget preference, plan context, selected city, and whether onboarding was completed or skipped.
• Support and content reports, including the subject, message, optional contact email, related event or venue, and our response status.

Location data

With your device permission, Avenue may obtain your current precise location to provide “Near Me”, map, and recommendation features. A current-location coordinate may be stored in your recommendation preferences if you choose that option. You can instead select a city or browse without location permission. We do not use location data for advertising.

Event, venue, and image submissions

If you submit or manage an event or venue, we process the listing information you provide, including titles, descriptions, categories, dates and times, address and map coordinates, venue details, ticket or website links, public contact options, and uploaded images. We also keep moderation status and the account identifier connected to a submission while your account exists.

Usage, device, and diagnostics data

• A randomly generated anonymous identifier stored on your device or browser, a session identifier, platform, app version, source, and timestamps.
• Interactions such as searches, filters, event or venue impressions and views, saves, follows, shares, notification opens, and clicks to ticket, website, phone, Instagram, or directions links. Analytics may include the relevant event or venue identifier and limited contextual properties, but not the text of your searches.
• Technical request data such as IP address and user agent may be processed by our servers and providers for delivery, logs, rate limiting, and security. Avenue hashes IP-derived rate-limit identifiers rather than adding the full IP address to its product analytics records.
• When crash reporting is enabled, Sentry receives error and technical diagnostic information. Avenue configures Sentry not to send default personally identifiable information, screenshots, session replay, logs, or automatic breadcrumbs.

Push notification data

If you enable notifications while signed in, we store a device push token, platform, enabled status, and last-seen time. Notification delivery also involves Apple Push Notification service and Firebase Cloud Messaging.

Website storage

The website uses local storage and session storage for consent preferences and optional first-party analytics identifiers, plus essential secure cookies for authorised administrator and venue-manager sessions. See the Cookie Policy for details. Browser and hosting logs may also contain IP address, user agent, requested page, referrer, and timestamps.

We do not intentionally request special-category data such as health information, political opinions, religious beliefs, biometric identifiers, or sexual orientation. Please do not include such data in free-text fields or submissions.

3. Why we use personal data and our legal bases

• Provide the Services and perform our agreement with you: create and secure accounts; authenticate users; save events; follow venues; maintain preferences; deliver requested notifications; process submissions; provide support; and enable account deletion.
• Your consent: access device location; send push notifications; use optional website technologies where consent is required; and process any other information for a purpose for which we specifically ask permission. You may withdraw consent at any time without affecting earlier lawful processing.
• Our legitimate interests: operate, secure, troubleshoot, and improve the Services; understand aggregate usage; prevent fraud and abuse; moderate submissions; enforce our Terms; keep event and venue information accurate; and establish or defend legal claims. We balance these interests against your rights and use data-minimising safeguards.
• Legal obligations: comply with applicable law, respond to valid legal requests, protect users and the public, and meet accounting or regulatory duties if they arise.

Recommendations use your chosen preferences and location to rank events. They do not produce legal or similarly significant effects, and Avenue does not make solely automated decisions about you that have those effects.

4. Information that becomes public

Approved event and venue listings, including images and public contact details supplied for a listing, may be visible to anyone and may be shared through public web pages. Your private account email, saved events, followed venues, recommendation preferences, and precise device location are not shown publicly.

Do not submit personal contact details unless you are authorised and want them displayed as part of a listing. You can request correction or removal of a listing by using the in-app report tool or emailing support@avenuecy.com.

5. When we share data

We disclose only the data reasonably needed for the following providers to perform their services:

• Supabase — database, authentication, API, and backend functions. The Avenue production database is hosted in the EU West (Ireland) region.
• Mapbox — maps, location display, and geocoding. Mapbox may receive device, usage, and de-identified location telemetry through its SDK. Mapbox’s attribution control provides its telemetry privacy and opt-out options.
• Google Firebase and Apple Push Notification service — device registration and push notification delivery.
• Sentry — crash and error diagnostics.
• ImageKit — storage, delivery, and transformation of listing images.
• Cloudflare — Turnstile CAPTCHA and abuse prevention.
• Apple and Google — optional account sign-in and mobile platform services.
• Vercel — website hosting and request delivery.
• Email and infrastructure providers that process technical or communication data on our behalf.

These providers act under their terms and, where applicable, data-processing commitments. We also may disclose data when required by law, to protect rights or safety, in connection with a legal claim, or if operation of Avenue is transferred to another operator. We do not sell or rent personal data.

6. International data transfers

Although Avenue’s primary Supabase database is hosted in Ireland, some providers may process data in the United States or other countries. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision, the EU Standard Contractual Clauses, or another lawful transfer safeguard, as applicable. You may contact us for more information about the relevant safeguards.

7. How long we keep data

• Account and feature data: for as long as your account is active, then deleted or anonymised when the account is deleted, subject to the exceptions below.
• Raw product analytics and redirect records: automatically deleted after 90 days. Aggregated statistics that no longer identify a person may be kept longer.
• Support and content reports: resolved or dismissed reports are stripped of the user identifier, contact email, subject, and message after 12 months and the remaining record is deleted after 24 months.
• Public listings: approved event and venue facts may remain while relevant to the discovery service. When an account is deleted, the account link is removed. Submitted images linked to that user are deleted during the in-app account-deletion process. Contact us if you also want a specific listing removed.
• Security and legal records: kept only as long as reasonably necessary to prevent abuse, comply with law, or establish, exercise, or defend legal claims.
• Provider backups and logs: may persist for a limited period under the provider’s documented deletion cycle before being overwritten.

8. Your controls and choices

• Use the app’s discovery features without creating an account.
• Change or withdraw location permission and push notification permission in iOS Settings. You can browse manually without location access.
• Change recommendation and notification preferences in the app.
• Use Mapbox’s attribution and telemetry control to review or change Mapbox telemetry preferences.
• Reject or change optional website analytics at any time using the website’s Cookie preferences control. Rejection stops Avenue analytics and clears Avenue analytics identifiers. You can also clear browser storage in your browser settings.
• Delete your account from Profile settings → Delete account. You may also review the account deletion page.

Disabling an optional permission may limit the related feature but will not block general event discovery.

9. Your data-protection rights

Under the GDPR, subject to its conditions and exceptions, you may request access to and a copy of your personal data; correction; deletion; restriction; data portability; or object to processing based on legitimate interests. You may withdraw consent at any time. You also have the right to complain to a supervisory authority.

Send a request to privacy@avenuecy.com. Please describe your request and the account email, if applicable. We may ask for proportionate identity verification. We normally respond within one month, or tell you if the GDPR permits more time. Exercising your rights is free unless a request is manifestly unfounded or excessive.

10. Children

The general discovery content may be viewed without an account, but accounts and content submissions are not intended for children under 16. We do not knowingly collect account data from a child under 16. If you believe a child has provided personal data, contact us so we can investigate and delete it where appropriate.

11. Security

We use measures appropriate to the nature of the data, including encrypted transport, access controls, row-level database security, restricted administrative credentials, rate limits, CAPTCHA protection, moderation, and data minimisation. No online service is completely secure. Keep your password confidential and contact us if you suspect unauthorised account use.

12. Changes to this policy

We may update this policy when the Services, providers, or legal requirements change. We will change the date above and, for material changes, provide a prominent notice or in-app message where appropriate. Earlier versions can be requested by email.

13. Contact and complaints

Contact Alexandros Fysentzou at privacy@avenuecy.com or by post at Psaron 28, Agios Dometios, 2362 Nicosia, Republic of Cyprus.

You may lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus, Kypranoros 15, 1061 Nicosia, Cyprus, email commissioner@dataprotection.gov.cy. You may also contact the supervisory authority where you live or work.