Who is responsible for your data
Nakude helps you discover events and places in Bulgaria. Contact: hello@nakude.com
Account and security
On registration we receive your email and password. We store a password hash, identifier, status and account creation and update dates. Visitors sign in with email and password or a signed link provided by email.
For password recovery we store request data and token verification information; the link is valid for one hour. Sign-in links are valid for 15 minutes. We send service emails for registration and account recovery. These do not depend on a weekly ideas subscription.
Processing for your account and requested features is necessary to provide the service (GDPR Article 6(1)(b)). Sessions, abuse checks and rate limits protect users and the service based on legitimate interest (Article 6(1)(f)), following an assessment of necessity and your rights.
Your interests and suggestions
When you mark “Interested”, save places or mark “Want to visit” and “Visited”, we link these choices to your account. You can change or remove them. These lists are not published as a public profile.
You can save a date, note, rating and photo in a private memory. The photo is stored in the database and reviewed for inappropriate content by authorised administrators. It remains private before and after approval and is not published in the catalogue. If rejected, the image is removed from the current memory and the reason is shown to its owner. Notes and ratings are not sent to the review queue.
You can save a free-text description of your interests. Please leave out sensitive information such as health, political or religious details. When AI suggestions are available and you request them, this text and the event catalog are sent to the configured Ollama server. Your email and password are not included. Contact hello@nakude.com for information about how this request is processed.
When you ask us to interpret a plan request, we send your text, chosen town and day to the configured AI server. We do not add your email, password or profile details. The application does not store this AI request text in a database or log. Confirmed preferences and the original text appear in the planner URL and may remain in browser history. Do not include sensitive information.
You can suggest a new place or event without an account. We store the selected type, public link or name and area, and any optional date, note or email you provide. Submissions from an account are associated with it. The details are available for editorial review and possible questions; submitting does not publish anything automatically or subscribe you. Unsent drafts stay only in memory during the current visit. The form uses a session cookie and CAPTCHA protection.
Organisation accounts include the organisation's name and type, and membership/role. Event submissions contain a title, description, venue, city, dates and an optional source; we store the author, organisation and review status. Submission does not mean automatic publication. When collecting public event and place information, we may also receive organisers' and participants' names or work contacts from original sources. We keep sources and evidence for editorial review; a public source does not remove affected people's rights. Contact us for corrections or removal.
Weekly ideas and contact
The weekly ideas subscription is a separate, voluntary choice confirmed by email. Registration alone does not subscribe you. We keep request, confirmation and withdrawal dates and sources, and your chosen day and time zone. These emails are based on consent (Article 6(1)(a)). You can withdraw it in your profile or through the unsubscribe link in an email, without affecting earlier processing.
You can choose when to receive weekly ideas or unsubscribe in your profile. Sign-in and password recovery emails are sent separately.
The contact form sends your name, email, subject and message to the team by email. Team chat stores your name, email and conversation history. A session cookie lets you continue in the same browser. While chat is open, we send presence and read-message signals; an unread reply may be emailed while you're away. Data is needed to review and respond to your enquiry: performance of requested pre-contractual steps or legitimate interest for other correspondence, depending on its content. Do not send unnecessary sensitive data.
Technical data, maps and weather
For sessions and security, we process technical identifiers and IP addresses to limit attempts. Infrastructure may record the IP address, requested URL, time, status and browser information in technical logs. Contact hello@nakude.com about data from a specific visit or a deletion request.
Cloudflare Turnstile protects forms. When it loads, Cloudflare receives the IP address and technical signals about the browser and connection. Our server checks the security token without separately sending your IP address in that check.
Maps load images or an embedded view from OpenStreetMap or a configured tile provider. The provider receives your IP and technical request data. Displayed coordinates belong to a place or event, not the visitor's GPS location.
When choosing a weather area automatically, your IP is sent to IPWhois. The approximate chosen city is cached by an IP hash for one hour. Choosing a city manually avoids this request. Open-Meteo receives the chosen city's coordinates from the server, without the visitor's IP in that request.
When our analytics is enabled and you allow it, we record the visit, its IP address, viewed pages, approximate visible time and clicks to event sources and calendars. Organizers see only aggregate statistics for their events, without individual visitor profiles, names, email addresses or browsing history. For signed-in users, visits are linked to their account; names, emails and IP addresses are visible only to authorized administrators. Analytics records do not contain form text, URL parameters or full browser details. You can decline future collection on the Cookies and storage page. When an administrator views the records, the IP address is sent to IPWhois to obtain an approximate city, region and country. Results are cached for up to 24 hours and are visible only to administrators.
Recipients and international transfers
Authorised team members and providers needed for hosting, security and email have access. Mailgun is integrated for email delivery and receives addresses, content and links when a real transport is configured.
You can ask hello@nakude.com about recipients of your data and any transfers outside the European Economic Area.
External organisers and ticket sites process the data you provide under their own policies. Nakude does not automatically send them your profile or lists.
How long we keep your data
Your profile, interests, suggestions and subscription history are not automatically deleted after a set period. An expired link stops working but does not delete the associated records. You can request deletion at hello@nakude.com; we will explain which data can be deleted and whether there is a reason to retain any of it.
The session cookie is set for up to 30 days. The server session is configured for 30 days; physical removal depends on periodic server cleanup. Signing out ends the authenticated session.
Your rights and how to exercise them
You can request access and a copy, correction, deletion, restriction, portability where applicable, and object to processing based on legitimate interest. You can withdraw consent to optional emails. Rights apply subject to their legal conditions.
Use the contact page for requests, stating “Personal data” and your account email. There is no automatic deletion button or full export. We may request only what is necessary to verify identity; do not send an identity document without a specific justified need. We respond within GDPR deadlines — usually one month — and will notify you of any permitted extension.
You can complain to the Bulgarian Commission for Personal Data Protection (CPDP), cpdp.bg, or the competent supervisory authority where you live, work or where the alleged infringement occurred.
Contact us about your personal data → · Data Protection Commission ↗︎
Security, children and changes
We use password hashing, access checks, CSRF protection, rate limiting and checks against automated abuse. No system guarantees absolute security.
Children do not need their own accounts for family suggestions. You can optionally add their birth dates in family settings so that we can suggest age-appropriate ideas. We do not require their names. You can change or remove these dates in your profile.
We update this policy when processing changes; significant changes will be communicated appropriately.
Have a question? Contact Nakude →