Privacy Policy

Uncanny World (the "Service") involves two data controllers under the EU General Data Protection Regulation (GDPR), each responsible for its own part:

UNCANNY LABS LLC (United States) — the seller of your membership — is the controller for the map itself: the restaurants and editorial content published on it, the member list of this map, and communications the creator sends you.

Uncanny Labs, operator of the My Foodie platform the Service runs on, is the controller for your account and sign-in (accounts work across every map on the platform), payment plumbing, security, and the cookieless analytics loaded on every page.

For anything related to your personal data, contact arthursimonian1@gmail.com — whichever controller your question concerns, it will reach the right one.

Account data. Your email address. That's the whole credential — sign-in is passwordless magic links, so there is no password, and no name or phone number is asked for.

Billing data. When you subscribe, Stripe collects your email, card details, and billing information directly on its own checkout pages. Your card number is never received by the Service; only Stripe customer and subscription identifiers and your subscription status (for example "active" or "canceled") are stored.

Things you save. Restaurants you save on the map.

Technical data. Like every website, the hosting provider processes your IP address and browser information in server logs when you load pages. Analytics (Vercel Web Analytics) is cookieless and aggregated — it doesn't identify or track you across sites.

Location (optional). If you tap the locate button on the map and grant your browser permission, your device position is used only in your browser to show where you are on the map. It is never sent to the servers and never stored. You can revoke the permission in your browser or device settings at any time, and the map works fine without it.

Providing the Service — creating your account, signing you in with magic links, showing you the map, remembering your saved places. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

Billing and subscription management — processing payments, renewals, and cancellations through Stripe. Legal basis: performance of the contract (Art. 6(1)(b)).

Service emails — magic sign-in links, receipts, a copy of the terms you accepted, and important notices about your subscription. Legal basis: performance of the contract (Art. 6(1)(b)). No marketing emails are sent; if that ever starts, it will be opt-in only.

Keeping records the seller is required to keep — invoices and billing records under the tax and accounting law of United States. Legal basis: legal obligation (Art. 6(1)(c)).

Security and abuse prevention — server logs and fraud screening keep the Service secure. Legal basis: legitimate interest in running a safe, working service (Art. 6(1)(f)).

Showing your location on the map — only with your consent, given through your browser's permission prompt (Art. 6(1)(a)); withdraw it any time by revoking the browser permission.

Personal data is shared only with the service providers needed to run the product, and only what each one needs:

Supabase — database and authentication; stores your account, saved places, and subscription records. https://supabase.com/privacy

Stripe — payment processing and billing; Stripe collects your payment details directly and also acts as an independent controller for its own fraud prevention. https://stripe.com/privacy

Vercel — hosting and cookieless web analytics. https://vercel.com/legal/privacy-policy

Resend — delivers sign-in and service emails to your address. https://resend.com/legal/privacy-policy

Mapbox — renders the map in your browser; your browser requests map tiles directly from Mapbox, which involves your IP address. https://www.mapbox.com/legal/privacy

Google — restaurant details and photos are sourced from Google Places on the servers; when you tap "Directions", your browser opens Google Maps. https://policies.google.com/privacy

Your personal data is never sold, and it is not shared with advertisers.

Your account, saved places, and subscription records are stored in the European Union (our database is hosted in the EU).

Some providers are US companies. Where personal data is transferred outside the European Economic Area, the transfer is protected by the EU–US Data Privacy Framework (for certified providers such as Stripe, Google, and Vercel) or by the European Commission's Standard Contractual Clauses included in the agreements with each provider.

Account data and saved places — for as long as you have an account, then deleted within a reasonable period after you ask to close it.

Billing records — as long as the tax and accounting law of United States requires (typically up to 10 years).

The terms you accepted — kept with your subscription record, so what you agreed to can always be reproduced.

Server logs — short rolling windows managed by the hosting provider.

Device location — never stored.

Under the GDPR you can, at any time and free of charge: ask for a copy of the personal data held about you (access); ask for it to be corrected (rectification); ask for it to be deleted (erasure); ask to restrict or object to certain processing; receive the data you gave in a portable, machine-readable format (portability); and withdraw any consent you gave, without affecting processing that happened before you withdrew it.

To exercise any of these, email arthursimonian1@gmail.com from your account email address. You will get a response within one month.

If you think your data has been handled unlawfully, you have the right to lodge a complaint with a supervisory authority. The competent authorities are:

For the seller: the data protection authority of United States.

For the platform (Uncanny Labs): CNPD — Comissão Nacional de Proteção de Dados — https://www.cnpd.pt.

You can always complain to the data protection authority of the EU country where you live instead — it will coordinate with the competent authority. We'd appreciate the chance to sort it out directly first.

Only strictly necessary cookies are used — the session cookies the authentication provider (Supabase) sets to keep you signed in. They exist purely so the Service works; that's why there is no cookie banner. No advertising, tracking, or analytics cookies are set. Analytics (Vercel Web Analytics) works without cookies and without identifying you.

If you pay or manage billing, those steps happen on Stripe's own pages (checkout.stripe.com, billing.stripe.com), where Stripe's cookies and cookie policy apply.

Language preference. When you explicitly choose a language, a functional foodie_locale cookie is stored on this host for one year. If you are signed in, preferred_locale is also stored in your account metadata so the choice can follow your account. An explicit anonymous choice carried through a successful sign-in can be adopted as that account preference, and the validated purchase language sets the initial preference for an account created during checkout. Merely viewing a language-specific public URL does not change the account preference. These values are used only to present your chosen language, never for tracking or authorization.

The Service is not directed at children. You must be at least 13 to have an account, and at least 18 (or the age of majority where you live) to purchase a subscription.

The map can rank or highlight restaurants for you (for example, suggested picks) based on what you save and browse within the Service. Under the GDPR this kind of personalisation is a form of profiling. It is used only to order and suggest restaurants — it produces no legal or similarly significant effects, and no decision about you is automated in that sense. You can object to it at any time by emailing arthursimonian1@gmail.com, and the map keeps working without personalised ordering.

If an AI chat feature is offered, your chat messages are processed by an AI provider to generate answers; this policy is updated with the provider's details before such a feature goes live. Your data is not used to train AI models.

If this policy changes in a meaningful way, the date at the top is updated and, for material changes, you are told by email or in the app before they take effect.

UNCANNY LABS LLC · United States · arthursimonian1@gmail.com

Platform: Uncanny Labs · info@uncannylabs.ai