Privacy Policy

1. Data Controller

QAVA GmbH (in formation)
Sample Street 1
80331 Munich
Email: privacy@qava.app

2. Data Collected

When using our platform, we collect the following data:

• First name – to personalize the WhatsApp message
• Nationality – for anonymized analytics for the restaurant owner
• IP address (hashed) – to prevent abuse (rate limiting). The IP is not stored in plain text.
• Language – for UI language selection
• User agent – for technical error analysis

3. Purpose of Data Processing

The collected data is used exclusively to:

• Provide the prize wheel experience
• Deliver the prize via WhatsApp
• Create anonymized statistics for the restaurant owner
• Prevent abuse through rate limiting

4. Legal Basis

Data processing is carried out on the basis of Art. 6(1)(a) GDPR (consent through active use) and Art. 6(1)(f) GDPR (legitimate interest in abuse prevention).

5. Data Retention

Spin and claim data is stored for a maximum of 12 months. IP hashes are automatically deleted after 24 hours. Guest data (first name, nationality) is anonymized after 12 months.

6. Third-Party Sharing

Data is not sold to third parties. The following services are used:

• Vercel (Frankfurt) – Platform hosting
• Supabase (EU) – Database hosting
• WhatsApp/Meta – Forwarding via standard WhatsApp links (no API integration)

7. Cookies

QAVA uses only technically necessary cookies for session management and to prevent multiple spins. No tracking or advertising cookies are used.

8. Your Rights

You have the right to access, correct, delete, and restrict the processing of your data under GDPR. Contact us at privacy@qava.app.

9. Hosting

The platform is hosted by Vercel Inc. Server location: Frankfurt, Germany (EU). The database is hosted by Supabase, also within the EU. All data remains within the EU.