Dekaf Connect App | Privacy Policy

Version / Feature Availability Notice (Privacy Policy)

This Privacy Policy is written to cover the Service as it may be offered across different app versions and feature rollouts. Some features and related data processing described in this Policy may not be present in older versions of the app and may be introduced, enabled, disabled, or changed in future updates.

For clarity (as of 20 February 2026): Versions prior to 4.0 (including the currently published 3.x version) do not include these features/mechanisms and related data processing:

• Sign in with Apple and/or Google (and related authentication identifiers)
• Device Identifier / ban enforcement mechanisms (and related security/enforcement records)
• Premium system/framework (and any purchase-related processing)

Where a feature is not available in your app version, the related data processing applies only if/when that feature is enabled or present in your version.

Last Updated: 28 February 2026

Operator (Data Controller): DEKAF INTERACTIVE LTD EOOD

Address: 47 Cherni Vrah blvd., Lozenets Distr., Fl. 5, 1407 Sofia, Bulgaria

Phone: +359 87 762 0805

Support / Privacy Contact: dekafapp@gmail.com

Summary

We do not sell your personal data and we do not share it with third parties for their own marketing/advertising purposes. However, to operate the app (map, messaging, venue tools, security, and abuse prevention), we do process certain data—such as profile details you choose to provide, venue owner contact details, device/session identifiers, and (if you grant permission) location-related data needed for nearby/venue functionality.

1) Information We Collect

1.1 Account / Authentication

Sign-in / account identifiers. The Service may require authentication (for example, Sign in with Apple and/or Google). We receive an account identifier from the provider and maintain an internal account record needed to operate the Service.

Anonymous Access. The app may allow access to features without requiring account registration or authentication (“Anonymous Access”). In such cases, autogenerated anonymous account identifier may be created and assigned to your device solely to provide the Service, maintain security, prevent abuse, and enforce our Terms.

Certain features, including guest-to-guest messaging, are currently not available to users accessing the app anonymously and require authentication through a supported sign-in method (e.g., Google or Apple).

1.2 Profile Information (Optional)

Profile photo and description. You may optionally provide a profile photo and a short description. This information is displayed to other users in the venue experience (for example, on the interactive map) and is used for personalization.

Important: Even if you do not use your real name, a photo or description can still identify you.

1.3 Venue Owner / Place Owner Information (Builder / Admin Tools)

If you are a venue/place owner and request access to venue tools (such as Builder/Admin features), we may collect:

• Place email address, phone number, and website (for verification/approval and account management).
• Venue/business information you submit as part of registration and configuration.

In many cases, venue contact details are public business contact information (for example, already shown on your venue’s website or social pages).

1.4 Venue Location / GPS Coordinates (for Venue Setup)

Place GPS coordinates. During venue registration/setup, we may use the device’s location to help pinpoint the venue’s location on the main city map presented to users.

1.5 Permissions and Sensor/Signal Data

• Bluetooth scan permission. The app may scan for nearby Bluetooth beacons and estimate relative proximity based on signal strength to help determine a user’s location/table/area in a venue experience. The app does not connect to or communicate with your personal Bluetooth devices.
• Location permission. Location access may be required for Bluetooth scanning, nearby place detection, and venue registration/setup, depending on the device/OS.
• Background location permission (if enabled). If you grant background location permission, the app may access location while the app is closed or not in use to support features like nearby detection and venue presence, depending on your device/OS behavior and settings.
• Notifications permission. On some Android versions (for example Android 13+), user permission is required to show notifications.

1.6 Messaging Data (Limited Storage)

Chat feature. Full chat history is not intended to be stored long-term on the server. As a general rule, the system stores only the most recent message per user per conversation (limited chat history), and older messages may be overwritten or deleted automatically.

Operational/security logs. Even with limited message storage, we may keep limited logs/records (for example timestamps, device/session identifiers, report-related records) as needed to operate the Service, prevent abuse, enforce Terms, and comply with legal obligations.

1.7 Device/Session Identifier (Security & Abuse Prevention)

We may generate and/or collect an app-scoped Device Identifier to help:

• prevent spam/fraud/abuse,
• support blocking/reporting,
• enforce bans and restrictions.

Android: We generate a stable app-scoped device identifier derived from device characteristics, used only for security and abuse prevention.
iOS: We generate a random app-scoped identifier (UUID) and store it in the device Keychain, used only for security and service reliability.

We do not use device identifiers for advertising, cross-app tracking, or third-party marketing.

2) How We Use Information

We use the information described above to:

• provide and operate the Service (map, messaging, venue tools),
• verify venue owners and manage venue accounts,
• enable Bluetooth/location-based venue experiences (where permissions are granted),
• show your profile/venue content in the app (as applicable),
• prevent abuse, enforce our Terms, and maintain security,
• respond to support requests and user reports,
• comply with applicable legal obligations.

2A) Lawful Bases (GDPR)

Under applicable data protection law (including the EU General Data Protection Regulation – GDPR), we process personal data only where we have a lawful basis. Depending on the context, this may include:

• Performance of a contract – to provide the Service features you request (such as messaging, venue map functionality, and account management).
• Consent – where you grant optional permissions (for example, location or Bluetooth access). You may withdraw consent at any time via device settings (this does not affect processing already performed).
• Legitimate interests – to maintain security, prevent fraud/abuse, enforce our Terms, and ensure reliable operation of the Service, provided such interests are not overridden by your rights.
• Legal obligations – where we must comply with applicable law.

3) Sharing of Data

We do not sell your personal data and we do not share it with third parties for their own marketing.

We may share limited data only in these situations:

• Service providers (processors): hosting/infrastructure, push notification delivery, and other vendors needed to operate the Service (they process data under our instructions).
• Authentication providers: if you choose Sign in with Apple/Google, those providers process authentication under their own terms and policies.
• Legal/safety: if required by law, legal process, or to protect the rights, safety, and security of users, venues, and the Service.
• Business transfers: if the company is involved in a merger, acquisition, reorganization, or sale of assets, subject to applicable law.
• Venues / Venue Tools: if you interact within a venue experience, limited operational information (such as feature requests or venue-related map activity) may be visible to the participating Venue and its authorized staff as necessary to operate the venue experience.

4) Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including operating the Service, maintaining security, enforcing Terms, and complying with legal obligations.

• Guest/user profile data (photo/description): retained while your account/session remains active or until you remove it or request deletion where available.
• Messaging: designed for limited storage (generally the most recent message per user per conversation).
• Security/enforcement records (including Device Identifiers): may be retained for as long as needed to prevent abuse and enforce bans/restrictions.
• Venue owner data: retained while the venue account exists; venue owners may request deletion by emailing dekafapp@gmail.com, subject to legal/operational requirements (for example, fraud prevention and dispute handling).

5) Your Choices and Controls

• You can choose whether to add a profile photo/description.
• You can manage permissions (Bluetooth, location, background location, notifications) in your device settings. If you disable required permissions, some features may not work.
• Where available, you can request deletion or support by contacting dekafapp@gmail.com.

5A) Your GDPR Rights

If you are located in the European Economic Area (EEA), you may have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion (“right to be forgotten”)
• Request restriction of processing
• Object to certain processing
• Request data portability
• Withdraw consent (where processing is based on consent)

To exercise these rights, contact us at dekafapp@gmail.com. We may request reasonable verification before responding.

You also have the right to lodge a complaint with your local data protection authority. In Bulgaria, this is the Commission for Personal Data Protection.

6) Security

We use reasonable administrative and technical measures intended to protect information. No system is 100% secure, and we cannot guarantee absolute security.

7) International Transfers

If we use service providers or infrastructure located outside your country, your information may be processed in other countries. Where required, we take steps intended to provide appropriate safeguards.

8) Children

The Service is not intended for children. You must be at least 18 years old to use Dekaf Connect.

9) Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and update the “Last Updated” date above.

10) Contact

For privacy questions or requests: dekafapp@gmail.com

Operator: DEKAF INTERACTIVE LTD EOOD

Address: 47 Cherni Vrah blvd., Lozenets Distr., Fl. 5, 1407 Sofia, Bulgaria

Phone: +359 87 762 0805