Privacy

Controller

[FIRST AND LAST NAME], contact see Imprint.

What happens when you visit this site

• Server logs: the web server stores technical data of each request (IP address, time, page requested, browser) for at most 14 days to keep the site running and secure (Art. 6(1)(f) GDPR).
• No tracking: the public pages use no analytics or advertising services and set no cookies unless you sign in. Fonts are served from our own server.
• View counter: when you open a place or guide, the page tells our server once. To count each visitor only once every six hours we keep a keyed hash of your IP address for six hours; the address itself is not stored and no cookie is set (Art. 6(1)(f) GDPR).
• Instagram stories and posts: stories and posts of @namiatik are copied to our server, so viewing them on SmartBali sends nothing to Instagram. Stories are deleted after 24 hours.
• Map: the map on the "Map" page and on place pages loads map tiles from OpenStreetMap (OpenStreetMap Foundation, UK), which transmits your IP address to their servers.
• External links: links to Google Maps, Instagram or places' websites lead to third-party services. Their privacy policies apply only once you click them.
• Authors: people who write for SmartBali have an account in the admin area, which sets a sign-in cookie in the admin area only.

Member accounts

• What we store: your name, e-mail address, password (only as a scrypt hash, never readable), optionally your Instagram handle and the note you wrote when joining. Your name, Instagram handle and comments are public; your e-mail address is never shown.
• Why: to run your account, approve it, let you like and comment, and send you the mails the account needs (confirmation, approval, password links, security notices) (Art. 6(1)(b) GDPR).
• Sign-in cookie: signing in sets one strictly necessary cookie that keeps you signed in for up to 30 days. We store only a hash of it, so you can see and end every session in your account.
• Security log: sign-ins, failed attempts and account changes are logged with a keyed hash of the IP address, to stop break-in attempts (Art. 6(1)(f) GDPR). Entries are deleted after 12 months.
• Breach check: when you choose a password, the first five characters of its SHA-1 hash are compared with the Have I Been Pwned database. Your password and e-mail address never leave our server.
• Mail: account mails are sent through our mailbox at Titan (Flock FZ-LLC).
• Deleting: you can delete your account in your account settings at any time. Your likes and comments are deleted with it.

Your rights

You have the right to access, rectification, erasure, restriction of processing and objection, and the right to lodge a complaint with a data protection authority.