This policy explains how Lense Oy (“Fontavio”, “we”), business ID 2372264-7, Turku, Finland, processes personal data when you use the Fontavio mobile app or the fontavio.com website. We are the data controller under the EU General Data Protection Regulation (GDPR).
Contact: Support (also for all privacy requests).
1. What we collect and why
Account data
When you sign in (Google, Apple, or email) we receive your email address, an authentication identifier, and — depending on provider — a display name. We use it to operate your account, attribute your contributions, and (only if you opt in) send a newsletter. Legal basis: contract (Art. 6(1)(b)); newsletter: consent (6(1)(a)).
You can browse the map without an account; an account is required only to contribute.
Contributions
Places, edits, verifications, reviews, reports, and photos you submit are stored with your account id and shown publicly in the app with your display name. Photos are re-encoded on our servers and embedded GPS/EXIF metadata is removed. Legal basis: contract; publication of content you chose to publish.
Location
Your device location is used in the app, in the foreground only, to center the map, sort places by distance, and drive the compass. Your precise location is not stored on our servers and is not used in the background. Map data is fetched by map-tile area, not by exact coordinates. Legal basis: consent via the OS location permission — deny or revoke it any time in system settings; the map remains usable by panning manually.
Technical and crash data
We use Firebase Crashlytics and Firebase Analytics (Google) to collect crash reports and aggregate usage events (device model, OS version, app version, coarse country-level usage). We use this to fix bugs and understand what features are used Legal basis: legitimate interest (6(1)(f)) in keeping the app working; analytics respects the consent choices below where required.
Alongside those events, the app attaches a small set of coarse attributes to your install: whether you are signed in, your trust level, whether Pro is active (subscription or a grant from us), where you are on the Guide path, a bucket for how much you have contributed (none/some/many, never a number), and the language the app is set to. They exist for one purpose: so that a service notice shown when you open the app can be aimed at the people it concerns — for example a rules change that only affects Guides, or telling the people whose Pro we extended after an outage that we did. They never include your name, your email, your account id, or anything you have contributed, and they are cleared when you sign out.
Legal basis: legitimate interest (6(1)(f)) in informing users about the service they use.
The app also generates a random per-install identifier the first time it runs and sends it with map requests. It is not linked to your account, to your device’s hardware ids, or to your advertising id, and it serves one purpose: counting requests per install so that a single client cannot scrape the whole database. We store daily request counts against it, never the areas you looked at. Legal basis: legitimate interest (6(1)(f)) in protecting the service from abuse.
Advertising
The free app shows ads via Google AdMob. To serve them, the AdMob SDK collects your device’s advertising identifier (Android advertising ID or iOS IDFA), technical device and app information, an approximate location derived from your IP address, and your interactions with the ads. Google acts as an independent controller for that data; what it does with it is described in Google’s advertising privacy notice. We never send your account id, your email, your precise location, or anything you have contributed to AdMob.
Before any personalized ads are shown you are asked for consent through the Google-certified consent flow (UMP); on iOS the AppTrackingTransparency prompt applies. If you decline, you get non-personalized ads, which still involve the technical data above but no advertising profile, and the app works identically. You can change your ad-consent choices at any time in the app (Profile → Settings → Ad privacy settings), and you can reset or delete your advertising identifier in your device’s system settings. Pro subscribers see no ads, and the AdMob SDK requests none. Legal basis: consent for personalized ads; legitimate interest for contextual, non-personalized ads.
Moderation of what you submit
Places, edits, reviews and photos you submit are checked before and after they appear. Photos are screened by automated classifiers before publication — one for explicit imagery, one that detects whether a recognisable person appears in the photo so it can be held for human review instead of published. That detection identifies nobody: it measures how large a face is in the frame, keeps no face data, and is discarded once the photo is screened. Text is screened by an automated filter, and reported content is reviewed by a person. Some measures are automatic: a review that is reported enough times is hidden until someone looks at it, and repeated inaccurate edits can limit what an account may do. Automated measures can only hide or limit content, never publish or alter it. No decision here is purely automated and final — you can contest any removal or restriction through support and a person will review it again. Legal basis: legitimate interest (6(1)(f)) in a trustworthy, lawful map, and compliance with our obligations as a hosting service.
Purchases
Pro subscriptions are billed by Google Play or the Apple App Store. We never see your payment details; we receive only a purchase token to activate Pro.
Support and website
If you contact us (email or the fontavio.com form) we process what you send us to answer you. The website form is protected by Cloudflare Turnstile (a privacy-friendly bot check). The website uses cookieless Cloudflare Web Analytics and sets no advertising or tracking cookies.
2. Where data lives, and who processes it
Our servers and database run in the EU (Hetzner, Falkenstein, Germany). Photos and backups are stored with Cloudflare (R2). Processors we use:
| Processor | Purpose | Location/transfer safeguard |
|---|---|---|
| Hetzner Online GmbH | hosting, database | EU |
| Cloudflare, Inc. | CDN, photo storage, bot protection, web analytics, email routing | EU/US — EU–US Data Privacy Framework & SCCs |
| Google (Firebase Auth, Crashlytics, Analytics, AdMob) | sign-in, crash/usage data, ads | EU/US — Data Privacy Framework & SCCs |
| Apple / Google Play | app distribution, billing | per their own policies |
| Resend, Inc. | delivery of website contact-form email | US — SCCs |
We do not sell personal data. Public map content (places, reviews, photos, first names/display names on contributions) is visible to all app users by design.
3. Retention
- Account data: until you delete your account.
- Account deletion is available in the app (Profile → Settings → Delete account) and removes your sign-in and personal details. Contributions you made remain in the database in anonymized form, attributed to “deleted user” — keeping the map accurate is why contributions exist, and this is stated in our Terms. If you no longer have the app, you can ask us instead: Delete your account explains both routes.
- Crash/analytics data: per Firebase defaults (max ~14 months), aggregate after.
- Advertising identifier and ad interaction data: held by Google under its own retention rules. We store none of it ourselves.
- Per-install request counts: daily totals only, pruned on a rolling window.
- Support email: up to 24 months, then deleted.
- Backups: rotated on a 30-day cycle.
4. Your rights
Under the GDPR you can request access, correction, deletion, restriction, portability, and object to legitimate-interest processing. Contact with support — we answer within 30 days. Where processing is based on consent you can withdraw it any time (OS permissions, ad-consent settings in the app, newsletter unsubscribe).
You may lodge a complaint with your supervisory authority; ours is the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).
5. Children
Fontavio is not directed at children under 13, and we do not knowingly collect their data. Contribution features require an account, which requires the minimum age for digital consent in your country (13 in Finland).
6. Changes
We will post changes here and, for material changes, notify you in the app before they take effect.