Terms and Privacy

1. Terms and Conditions

What KaliMap is

KaliMap is a community-built map of pet-friendly places in Romania — cafés, restaurants, parks, vets, accommodation and more. Some of the data comes from OpenStreetMap (an open source), the rest from user contributions: suggestions for new places, photos, and “Yes, we were welcomed” / “We weren't welcomed” votes.

Who operates KaliMap

KaliMap is operated by a Romanian sole trader (an authorised natural person), who is also the controller of your personal data under the GDPR:

• Name: KELEMEN A. RÓBERT PERSOANĂ FIZICĂ AUTORIZATĂ
• Tax identification number (CUI): 55433389
• Trade Register number: F2026040203009
• Locality: Florești, jud. Cluj, România
• Email: [email protected]

The email address above is also the single point of contact required by Regulation (EU) 2022/2065 on digital services (Articles 11 and 12), both for users and for authorities. You can write to us in Romanian, Hungarian or English.

Content you submit

When you suggest a place, send a photo or vote, you are contributing content you created. For photos specifically:

• You remain the owner of the photo — we don't “take” it from you. By uploading it, you grant us a non-exclusive right to display it publicly on the map, which you can revoke at any time by asking us to delete it.
• When you ask for deletion, we delete it from our systems and request de-indexing wherever possible — for example, from search engine results. We cannot control what someone else copied before the deletion, and we won't promise you otherwise.
• By uploading, you warrant that you have the right to publish the photo — you took it, or you have the consent of whoever did — and that any people who can be recognised in it have agreed to appear. Don't upload photos you can't warrant this for.

Moderation

Every place suggestion, photo or report goes through a moderation queue before it appears publicly — nothing at all is published automatically. An admin checks every entry.

What happens to what we reject: rejected photos are deleted from storage — they are not kept “just in case”. Rejected place suggestions are kept only as an internal moderation record (so the same suggestion doesn't come back again and again), but they are never published.

On what grounds. A suggestion or photo is not added to the map, and something already published may be removed, for one of the reasons below. We also state the reason in the rejection email.

• We couldn't confirm that the place welcomes pets.
• The place is already on the map.
• The details we received aren't enough to identify the place (for example, the name or address is missing).
• The place appears to be permanently closed.
• The place doesn't fit any of the map's categories.
• The photo doesn't clearly show the place.
• The photo shows people who can be recognised, without their consent, or personal data.
• It isn't clear that you have the right to publish the photo — see the warranty under “Content you submit”.
• The review doesn't describe the experience with a pet at that place.
• The review contains someone else's personal data.
• Spam, advertising or offensive language.
• The content appears to be unlawful. In that case we also tell you which legal provision.
• Another reason, which we write out for you — for example, plainly false information about a place.

Suggestions, photos and reports are checked by a person, not an algorithm. The only automated steps are the anti-abuse filters — the anti-spam check (Turnstile) and rate limiting — which stop mass submissions without judging the content.

How to report illegal content. Write to us at [email protected] and include: the exact link to the page or photo, why you believe it is illegal, your name and email address, and a statement that the information is accurate and submitted in good faith. We will confirm receipt, review the notice without undue delay and tell you what we decided. For wrong information about a place (it has closed, it has moved), use the “Something wrong or missing?” form on the place's page.

If we reject or remove something you contributed. When we have your email address (you left it with your suggestion), we email you the reason for the rejection, with the grounds and the ways to contest it. Otherwise, or if you want to contest the decision, write to us at the same address; we will review it again and reply. You can also go to court or use other remedies available under the law at any time.

What we do NOT guarantee

• The catalogue is built from OpenStreetMap — an open source anyone can edit — and from community contributions. The KaliMap team tries to check places one by one, but only as far as our capacity allows, so we can't guarantee that every place has been checked. The data may contain errors or outdated or incomplete information (wrong name, changed opening hours, a place that has since closed). Any help from the community is always welcome.
• The “pet-friendly” label reflects what the community reported at a given moment — it is not a certification, not a legal guarantee and not a check carried out by us. It does not automatically hold true every day: venues change their policy from one day to the next — a new owner, the season, a spur-of-the-moment decision. Call or message the venue before you go if you want to be sure.
• KaliMap is not a party to the relationship between you and the place you visit. If a venue refuses entry with your pet, contrary to the information on the map, or any other problem arises on site, that is a matter between you and the venue — we cannot intervene and we are not liable for it.

2. Privacy Policy

What data we collect

The table below covers everything we ourselves deliberately collect in the app. In addition, as with any site hosted through Cloudflare, the network that serves our traffic processes IP addresses at infrastructure level (standard access logs, needed for security and operation) — this is not a separate collection decided by us, but an inherent feature of any hosting/CDN provider.

About the voting identifier, in short. It is created only when you first vote or first submit a tag (the “What do you know about this place?” section on a place's page), not when you merely visit, and it is generated randomly in your browser. It is used solely to stop you voting twice for the same place and to count your tags only once; it is not sent to any third party and is not used for anything else — neither for statistics nor for tracking across sites. It expires after 12 months. The alternative would have been to tell votes apart by IP address, which would mean processing more personal data, not less.

What else stays in your browser. Alongside the voting identifier we keep, again only in your browser, the votes and tags you have given, so we can show them to you when you come back; they are deleted together with the identifier, after 12 months. For the duration of your visit, until you close the tab, we also keep the county you chose and the map position. While you sign in, the tab remembers, for up to 10 minutes, the address we sent your code to, if you asked for one by email (but not the code), and whether you reached the step where you choose your name, so you don't have to start over if you reload the page. None of this goes to third parties or is used for tracking.

Signing in (your account)

An account is optional and is only for actions, such as reviews. You never need an account to read the site. You can sign in in three ways:

• With Google — we receive from Google your name, email address, profile picture and the identifier of your Google account.
• With Facebook — we receive from Facebook your name, email address, profile picture and the identifier of your Facebook account (the public_profile and email permissions).
• With a code sent by email — we receive only your email address; we send you a single-use code that is valid for a short time.

What we use it for. Only to sign you in and to link what you publish to your account. You choose the name shown next to your contributions; we do not show your email address or profile picture publicly. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR): you create the account yourself, on request. We keep the data for as long as you have an account.

What we don't do. We don't post anything on your behalf on Google or Facebook, we don't ask for access to your friends, contacts or other data in your account, and we don't use the data for advertising. To keep you signed in, your browser stores a strictly necessary session token, which is deleted when you sign out.

Accounts are managed by Supabase Auth, and the email with the code is sent by Resend (see the processors below). Google and Facebook confirm your identity; what they process when you sign in is governed by their own privacy policies.

Who else sees this data (processors)

• Supabase — hosts the database, the photos and the accounts (Supabase Auth). The server is in eu-central-1 (Frankfurt, EU). Supabase Inc. is a US company, and remote access by its staff or sub-processors may amount to a transfer outside the EU; this is covered by the European Commission's standard contractual clauses in their data processing agreement. Your browser requests the photos of places directly from Supabase, so Supabase receives your IP address when you open a page with photos. Their privacy policy: supabase.com/privacy.
• Cloudflare — hosts the site (Cloudflare Pages) and provides protection against attacks (anti-bot, firewall). Every request to the site passes through its network, so it receives your IP address. Their privacy policy: cloudflare.com/privacypolicy.
• Cloudflare Turnstile — the anti-spam check on forms (suggestions, photos, votes, reports). It receives your IP address explicitly, as part of the check. The Turnstile privacy policy: cloudflare.com/turnstile-privacy-policy.
• OpenFreeMap — the map tiles (the map images themselves), operated by Hyperknot Software Kft., based in Hungary (EU). It receives your IP address every time the /harta page loads, like any server that sends images to a browser. It does not set cookies. Its access logs do not contain IP addresses; its error logs may contain them, together with the requested URL. During a security incident it may temporarily enable IP logging. Logs are deleted automatically after 7 days, and those from a security incident after at most 30 days. Their privacy policy: openfreemap.org/privacy.
• OpenStreetMap — the small map on a place's page, with map images from the OpenStreetMap Foundation, based in the United Kingdom. When the page shows the small map, your browser requests the images directly from the foundation's servers, which receive your IP address and the map area requested, like any server that sends images to a browser. As the referring page they receive only kalimap.com, not the address of the page you are reading. Their privacy policy: osmfoundation.org/wiki/Privacy_Policy.
• Resend — sends our emails: the notice that your suggestion has been approved, and the sign-in code. It receives your email address and the text of the message. Resend is a US company and stores the data in the US, even when the emails are sent from the EU; the transfer is covered by Resend's certification under the EU-U.S. Data Privacy Framework and by the standard contractual clauses in their data processing agreement.

Turnstile, OpenFreeMap, OpenStreetMap and Supabase (for photos) receive your IP address for unavoidable technical reasons — an anti-spam form or an image server cannot work without knowing whom it is responding to. They are necessary for the site to work, unlike the fonts we used to load from Google (removed — we now host them ourselves, directly).

The database and photos (Supabase) are stored in the EU, with the remote access described above. Resend stores data in the US, with the safeguards above. Cloudflare operates a global network — your requests to the site, to the OpenFreeMap map and to the photos on Supabase, all served through Cloudflare, may be processed through nodes outside the EU, depending on where you are; Cloudflare is certified under the EU-U.S. Data Privacy Framework and has standard contractual clauses in its data processing agreement. The OpenStreetMap Foundation is in the United Kingdom, which the European Commission has recognised as providing an adequate level of data protection; its map images, however, come through a global network of cache servers, so requests for the small map may also be processed outside the EU.

Photos and EXIF data

Photos sent through the suggestion form or from a place's page are automatically resized in your browser before upload. A real side effect, technically verifiable: this process removes the EXIF metadata of the original file — including GPS coordinates, if your phone recorded them when the photo was taken.

Cookies

We do not use tracking or advertising cookies. The site sets one strictly necessary cookie for logging in to the admin panel. In addition, Cloudflare — the network that hosts us and protects us from attacks — may set a security cookie (cf_clearance) for a visitor if it detects suspicious or unusual traffic; this does not happen on every visit, only when Cloudflare triggers an anti-bot check.

If you sign in, the site also sets your account's session cookies (sb-…-auth-token): they keep you signed in, cannot be read by scripts on the page and stay until you sign out; otherwise they expire at most 400 days after your last visit. While you sign in with Google or Facebook, one more is added (sb-…-auth-token-code-verifier), which expires after 10 minutes. If you don't sign in, you get none of them.

All of these cookies are strictly necessary — for login or for security — and are exempt from the consent requirement under the ePrivacy Directive (Art. 5(3)), as transposed into Romanian Law 506/2004 on the processing of personal data in the electronic communications sector. We do not set any tracking, analytics or advertising cookies.

The statement above is about the cookies WE set, on kalimap.com. Some links on the site lead to partner shops and platforms, and those may set their own cookies on their domains after you click — see the next section.

Affiliate links

Some links on the site are affiliate links. If you go through them and buy or book something, we receive a commission from the merchant. It costs you nothing extra — the price is the same as if you had gone directly to their site.

Where they appear:

• Shops (the Shop page) — online pet shops, through the 2Performant affiliate network. eMAG goes through the Profitshare affiliate network, which redirects via the l.profitshare.ro domain.
• Accommodation (the Pet-Friendly Accommodation page and the accommodation page of each county) — the search button to Booking.com, through the CJ affiliate network (CJ Affiliate, a US company), which redirects via the dpbolvw.net domain.

We choose ourselves what appears there. Nobody pays to be listed, and the order is not for sale. Every such button is labelled “Affiliate link”, and in the page code we mark these links with the rel="sponsored" attribute, the standard way for a site to declare a commercial relationship.

What happens to your data. Clicking such a link first sends you through a domain belonging to the affiliate network, which sets a cookie on its OWN domain so it can later recognise the order as coming from us. That cookie is not ours, is not set on kalimap.com and we cannot read it. What happens after the click is governed by the privacy policy of the network and the shop, not by ours.

We do not receive your name, address, email or what exactly you bought from the network. We receive aggregate reports — how many orders came through our links and what commission is due. We cannot link an order to your visit to the site: the network sends us no identifier of yours, we do not track visitors, and your account, if you have one, is not linked to the affiliate links.

The redirect only happens if YOU click such a link. Nothing is loaded from the affiliate networks while you read our pages — no pixels, no scripts, no cookies set in advance.

Your rights

You can ask at any time for:

• Access — what data we hold about you.
• Erasure — for us to delete your data (e.g. a photo, a suggestion).
• Rectification — for us to correct inaccurate information.
• Portability — to receive your data in a usable format.
• Complaint — to a data protection authority: in Romania, the ANSPDCP (dataprotection.ro), or the authority in the country where you live.

Write to us at [email protected] about any of the above. We will reply within 30 days.

Deleting your account and data

You can ask at any time for your KaliMap account and the data linked to it to be deleted, including the data we received from Google or Facebook when you signed in.

• How: write to us at [email protected] from your account's email address, with the subject “Delete account”. If you no longer have access to that address, tell us how you signed in and we will help you prove the account is yours.
• How long it takes: we confirm receipt and delete the data within 30 days, then let you know we are done.
• What we delete: the account, your name, email address, profile picture, the identifier of your Google or Facebook account and whatever you published from the account. If you would like us to keep what you published, with no name attached, say so in the same email.
• Facebook: you can also remove KaliMap's access from your Facebook account: Settings & privacy → Settings → Apps and websites → KaliMap → Remove. From then on we receive nothing from Facebook; to have the data we already received deleted too, write to us as above.
• Google: you can remove access from your Google account, on the myaccount.google.com/connections page; for the data we already received, write to us as above.
• Without an account: for a photo, a suggestion or the email address you left with a suggestion, write to the same address telling us what to delete (the link to the place helps). You can delete the voting identifier and the votes and tags stored in your browser yourself, by clearing the site's data in your browser.