Privacy policy

Who controls your data

My Location is operated by SIA AJL GROUP, registration No. 43603079409, VAT No. LV43603079409, legal address Bauskas nov., Iecava, Estrādes iela 8B, LV-3913, Latvia. For privacy questions and rights requests, contact info@mylocationpro.com or call +371 26101872. SIA HITEXIS, registration No. 40203260627, Rīga, Ieriķu iela 3, LV-1084, Latvia, provides development and technical services as instructed by the operator.

When this policy applies

This policy applies when you use the My Location website, business portal, public pages, mobile app, APIs, billing flows, support channels, and administrator-managed platform features. Businesses listed on My Location are independent from us when they provide their own goods or services to you.

Data we process

We process only the data needed to run the platform, keep it secure, publish user-requested content, and meet legal obligations.

• Account data: phone number, OTP verification result, session tokens, accepted legal-document version, first name, last name, display name, email, avatar, role, status, and device push-token metadata.
• Business data: company or self-employed details, registration number, VAT number, legal address, contacts, descriptions, categories, regulated-category proof references, managers, locations, coordinates, working hours, services, amenities, photos, posts, offers, events, organizer contacts, ticket links, moderation status, and deletion or claim requests.
• Consumer activity: favourites, reviews, notification history, event publications, selected map/search location or address data needed to return results, and support messages you send us.
• Billing data: plan, subscription, payments, refunds, invoices, Stripe customer/payment identifiers, and card display metadata such as brand, last four digits and expiry. We do not store full card numbers or CVV codes.
• Technical and security data: request metadata, rate-limit records, audit logs, error diagnostics, and fraud or abuse-prevention signals.
• Engagement analytics: which business profiles and locations you open, and which social or contact links you tap, in the mobile app — plus scans of businesses' printed QR codes. We use these to give the business aggregate view, click and scan statistics. QR scans are recorded on the server when a code is scanned.

Public content

Business profiles, locations, contact details, photos, services, prices, posts, offers, approved events, and visible reviews are public. Do not submit confidential or third-party personal data unless you have a lawful basis and permission to publish it.

Why we use data

We rely on the lawful bases required by the GDPR and Latvian data protection law.

• Contract and pre-contract steps: account login, business registration, profile management, search, favourites, reviews, event publishing, subscriptions, invoices, and support.
• Consent: optional notifications, non-essential cookies, analytics or marketing technologies, and marketing preferences where you choose them.
• Legal obligation: accounting, tax, payment, consumer-law, security, and regulatory record-keeping.
• Legitimate interests: service security, abuse prevention, moderation, audit trails, registry checks, operational analytics without advertising tracking, and protection of our users, platform and legal rights.

Service providers and transfers

We use processors and service providers only as needed to provide the platform.

• Twilio Verify or an equivalent OTP provider for phone verification.
• Stripe for payment processing, card storage on Stripe's side, subscriptions, refunds and payment security.
• Google Geocoding/Maps for addresses and coordinates entered into the location tools.
• Lursoft public company pages for Latvian business-register checks.
• Expo, Firebase Cloud Messaging and Apple Push Notification service for push notifications.
• A configured SMTP email provider for invoices and service messages.
• Hosting, database, object storage, CDN, backup and monitoring providers, including Sentry if enabled for error diagnostics.
• OneSignal for SMS one-time codes, service SMS notices (such as price-change notifications) and transactional email.
• Cloudflare Turnstile for bot and abuse protection on public forms such as sign-in and contact.
• Where a provider processes data outside the EEA, we use an adequacy decision or appropriate safeguards such as Standard Contractual Clauses where required.

Cookies and local storage

We use cookies, local storage and similar technologies to operate My Location. Strictly necessary technologies keep you signed in, remember security state, maintain language or interface preferences, protect against abuse, enable payments and load requested platform content. Optional analytics, measurement, personalisation and marketing technologies are used only after your consent. The cookie banner or cookie settings show the available non-essential categories, providers and retention periods and let you change or withdraw consent. You can also block cookies in your browser, but blocking necessary technologies may prevent login, billing or portal features from working.

Retention

We keep data only for as long as needed for the purpose for which it was collected, unless a longer period is required by law or needed for claims and security.

• Account data is kept while the account exists. After deletion, personal identifiers are removed or anonymised where possible.
• Refresh tokens are removed after expiry or after the short revocation-retention period used for security.
• Business, media, review, post, offer and event data is kept while it is active or needed for moderation, billing, evidence, legal claims or deletion workflows.
• Payment, invoice, refund and accounting records are kept for the statutory periods required by Latvian accounting and tax law.
• Audit logs, security records and moderation records are kept for operational, legal and abuse-prevention purposes and then deleted or anonymised when no longer needed.

Your rights

Subject to legal limits, you may request access, correction, deletion, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. The portal includes account export and account deletion tools. You may also contact info@mylocationpro.com or +371 26101872. You can complain to the Latvian Data State Inspectorate, Datu valsts inspekcija, at www.dvi.gov.lv.

Security

We use OTP login, access controls, hashed refresh tokens, rate limits, HTTPS, image validation and re-encoding, audit logs, payment-provider webhooks with signature checks, and role-based administrator access. No online service is risk-free, so keep your phone, device and browser session secure and sign out on shared devices.

Children and changes

My Location is not directed to children. If the law requires parental consent for a user, the account must not be created without it. We may update this policy when the platform, law or service providers change. Material changes may require renewed acceptance.