Privacy policy

Who controls your data

My Location is operated by SIA AJL GROUP, registration No. 43603079409, VAT No. LV43603079409, legal address Bauskas nov., Iecava, Estrādes iela 8B, LV-3913, Latvia. For privacy questions and rights requests, contact info@mylocationpro.com or call +371 22180888. SIA HITEXIS, registration No. 40203260627, Rīga, Ieriķu iela 3, LV-1084, Latvia, provides development and technical services as instructed by the operator.

When this policy applies

This policy applies when you use the My Location website, business portal, public pages, mobile app, APIs, billing flows, loyalty campaigns and the prize wheel, support channels, and administrator-managed platform features. Businesses listed on My Location are independent from us when they provide their own goods, services or prizes to you.

Data we process

We process only the data needed to run the platform, keep it secure, publish user-requested content, and meet legal obligations.

• Account data: phone number and/or email, one-time-code verification result, Google or Apple account identifier if you sign in with them (Apple may give us a private relay email), session tokens, accepted legal-document version, first name, last name, display name, avatar, language, role, status, last sign-in time, and device push-token metadata.
• Business data: company or self-employed details, registration number, VAT number, legal address, contacts and contact person, website and social-media links, descriptions, categories and subcategories, regulated-category proof references, owner and managers, locations, region, coordinates, working hours, offers and prices, amenities, photos, posts, events, organizer contacts, ticket links, banners, prize-wheel prizes and vouchers, sponsorships, moderation status, and deletion or claim requests.
• Consumer activity: favourites, reviews, notification history, personal events you publish and your event-credit balance, prize-wheel spins, prizes won and coupons (the business sees the coupon when you redeem it), selected map/search location or address data needed to return results, and support messages you send us.
• Billing data: plan, subscription, extra-location tokens, event credits, banner bookings and sponsorships, payments, refunds, invoices and credit notes, Stripe customer/payment identifiers, and card display metadata such as brand, last four digits and expiry for your saved and backup cards. We do not store full card numbers or CVV codes.
• Technical and security data: request metadata, rate-limit records, bot-protection signals, audit logs, error diagnostics, and fraud or abuse-prevention signals.
• Engagement analytics and loyalty: which business profiles and locations you open, and which social or contact links you tap, in the mobile app — plus scans of businesses' printed QR codes. When you scan a QR code in the app to take part in a loyalty campaign, we also process your device's GPS location at the moment of the scan to confirm you are at the place, and store a record of that scan (time, location, points or tickets awarded and any cooldown). Scans earn lottery tickets, and at the campaign draw we select and publish winners and contact them to hand over the prize. We use this data to give the business aggregate view, click and scan statistics; QR scans are recorded on the server when a code is scanned.

Public content

Business profiles, locations, contact details, photos, services, prices, posts, offers, approved events, and visible reviews are public. Do not submit confidential or third-party personal data unless you have a lawful basis and permission to publish it.

Why we use data

We rely on the lawful bases required by the GDPR and Latvian data protection law.

• Contract and pre-contract steps: account login (including Google or Apple sign-in), business registration, profile management, search, favourites, reviews, event publishing, loyalty campaigns, lotteries and the prize wheel, subscriptions, invoices and support.
• Consent: push notifications and device location access (you can turn them off in your phone settings), optional notifications, non-essential cookies, analytics or marketing technologies, and marketing preferences where you choose them.
• Legal obligation: accounting, tax, payment, consumer-law, security, and regulatory record-keeping.
• Legitimate interests: service security, abuse prevention, moderation, audit trails, registry checks, operational analytics without advertising tracking, removal of long-inactive accounts, and protection of our users, platform and legal rights.

Service providers and transfers

We use processors and service providers only as needed to provide the platform.

• Twilio Verify for one-time codes sent by SMS.
• Stripe for payment processing, card storage on Stripe's side, subscriptions, refunds and payment security.
• Google Geocoding/Maps for addresses and coordinates entered into the location tools.
• Register of Enterprises of Latvia open data (data.gov.lv) for business-register checks.
• OneSignal, together with Firebase Cloud Messaging and Apple Push Notification service, for push notifications to your phone.
• OneSignal or a configured SMTP email provider for one-time codes sent by email, invoices, service emails and service SMS notices (such as price-change notifications).
• DigitalOcean, with servers in Frankfurt (Germany, EU), for hosting, database, object storage and backups; CDN and monitoring providers, including Sentry if enabled for error diagnostics.
• Google Sign-In and Sign in with Apple, if you choose to log in with them: we receive an account identifier and, where you allow it, your name and email.
• Cloudflare Turnstile for bot and abuse protection on public forms such as sign-in and contact, and Cookie-Script for recording your cookie choices.
• Where a provider processes data outside the EEA, we use an adequacy decision or appropriate safeguards such as Standard Contractual Clauses where required.

Cookies and local storage

We use cookies, local storage and similar technologies to operate My Location. Strictly necessary technologies keep you signed in, remember security state, maintain language or interface preferences, protect against abuse, enable payments and load requested platform content. Optional analytics, measurement, personalisation and marketing technologies are used only after your consent. The cookie banner or cookie settings show the available non-essential categories, providers and retention periods and let you change or withdraw consent. You can also block cookies in your browser, but blocking necessary technologies may prevent login, billing or portal features from working.

Retention

We keep data only for as long as needed for the purpose for which it was collected, unless a longer period is required by law or needed for claims and security.

• Account data is kept while the account exists. An account not used for 36 months is deleted after a 30-day warning in the app and by email; signing in cancels it. This does not apply to business owners and managers. After deletion, personal identifiers are removed or anonymised.
• Refresh tokens are removed at expiry or 7 days after revocation. Device push tokens are removed after 365 days without use. Read notifications are archived after 30 days and deleted 365 days after creation.
• Business, media, review, post, offer and event data is kept while it is active or needed for moderation, billing, evidence, legal claims or deletion workflows.
• Payment, invoice, refund and accounting records are kept for the statutory periods required by Latvian accounting and tax law.
• Audit logs are kept for 180 days and engagement analytics for 400 days. Lottery scans and tickets are deleted 12 months after the campaign ends (winners' records after 5 years, as prizes may be audited). Prize-wheel spins and coupons are deleted 12 months after the coupon expires. Security and moderation records are deleted or anonymised when no longer needed.

Your rights

Subject to legal limits, you may request access, correction, deletion, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. The portal and app include account export and account deletion tools; a deletion request is carried out after 30 days, and you can withdraw it in your account during that time. You may also contact info@mylocationpro.com or +371 22180888. You can complain to the Latvian Data State Inspectorate, Datu valsts inspekcija, at www.dvi.gov.lv.

Security

We use one-time-code and Google/Apple sign-in, access controls, hashed refresh tokens, rate limits, bot protection, HTTPS, image validation and re-encoding, audit logs, payment-provider webhooks with signature checks, and role-based administrator access. No online service is risk-free, so keep your phone, email account, device and browser session secure and sign out on shared devices.

Children and changes

My Location is not directed to children. If the law requires parental consent for a user, the account must not be created without it. We may update this policy when the platform, law or service providers change. Material changes may require renewed acceptance.