Privacy policy
1. Who handles your data
The website toilerate.com (ToileRate) is operated by, and the data controller is, [not set], company code [not set], [not set]. Privacy questions and requests: simonas.rudaminas@gmail.com.
2. What we collect and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You create an account | username, display name, email, password (stored only as a hash), language, account type; for businesses — company name | account, login, email confirmation, notices about your content | contract (terms of use) |
| You rate a place | scores, comment, visit date, photos; your display name is shown publicly | publishing reviews and ranking places | contract |
| You upload a photo | the photo; where and when it was taken is read from it (camera GPS and time), then removed from the file. We keep the coordinates and time separately, non-public; publicly we show only a “taken on site” badge and the date. Until approved the photo is kept non-public | illustrating the place; checking that the photo was really taken at this place and recently (against fake photos) | contract, legitimate interest |
| You tap “Works”, “Not let in”, QR “Clean / Not clean” without an account | a keyed hash of your IP address — not the IP itself, time | preventing repeated voting and abuse | legitimate interest |
| Error report, new place suggestion | report text, your account (if logged in) | keeping the catalogue correct | legitimate interest |
| A business asks to manage a place | contact person, role, email, phone, proof | checking that the applicant represents the business | contract, legitimate interest |
| You email us | name, email, message, our replies | answering you | legitimate interest |
| You search “Near me” or by address | coordinates or the address typed (used for the search only, not stored) | showing the nearest places | your request (contract) |
| Security | IP address, browser data and failed login attempts (in server and security logs, up to 90 days) | protection against attacks and spam | legitimate interest |
| Business contacts | a venue's work email from public sources (e.g. its website, OpenStreetMap) | a one-off offer to manage the place in the catalogue; reply STOP and we never write again | legitimate interest |
| Statistics and advertising | cookies and similar technologies (see section 7) | measuring visits, showing ads | your consent |
3. Artificial intelligence (AI)
An AI model (DeepSeek) helps us moderate content and draft replies. It receives only the text needed for that: the review or report text and scores, the account age and number of earlier reviews, business claim details, the content and sender of an incoming email. It never receives passwords, photos or your precise location.
The AI may settle clear cases (e.g. an advert or a proper review) by itself; every doubtful case is decided by a person. Business claims and closing places are always approved by a person. If your review is rejected, the email gives the reason; reply to it and a person will review the decision.
4. Who receives data
- Hosting and email providers — the website and data are kept in the European Union.
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) — the AI processing described in section 3. The European Commission has not adopted an adequacy decision for China, so we send only the necessary minimum and rely on standard contractual clauses or other safeguards under Article 46 GDPR.
- Map services (OpenStreetMap Foundation, United Kingdom, or MapTiler AG, Switzerland) — your browser loads map images from them; address search sends the typed address. Both countries have an EU adequacy decision.
- Cloudflare (if Turnstile bot protection is on) — checks that a form is filled in by a human.
- Advertising and analytics partners — only if you accept the related cookies.
- Public authorities — only when the law requires it.
We do not sell data.
5. How long we keep it
- Account, reviews, photos — while you have an account. Deleting your account (on the account page) also deletes your reviews, photos, reports and emails, and place scores are recalculated.
- Rejected reviews — 12 months.
- Votes without an account (“Works”, QR ratings) — up to 12 months.
- Business claim proof and phone — 180 days after the decision.
- Resolved reports, emails, action log — 24 months; AI decision log — 12 months.
- Your cookie choice — 6 months (in your browser).
6. Your rights
You have the right to access, correct and delete your data, restrict processing, receive it in a portable format, object to processing based on legitimate interest and withdraw consent at any time (for cookies — “Cookie settings” at the bottom of the page). Most of this you can do yourself in your account; otherwise write to simonas.rudaminas@gmail.com — we reply within 30 days.
If you believe your data is processed unlawfully, you may complain to the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt) or the authority of your country.
Accounts are for people aged 14 and over.
7. Cookies
We always use necessary cookies; others only with your consent, which you can change at any time: Cookie settings.
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
| wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | login | necessary | session or 14 days (“Remember me”) |
| tr_consent | your cookie choice | necessary | 6 months |
| ct_* (if anti-spam is used) | protecting forms from bots | necessary | up to 6 months |
| analytics cookies (e.g. _ga) | measuring visits | statistics — consent only | up to 2 years |
| advertising partner cookies | showing and measuring ads | advertising — consent only | per partner |
Advertising on the site is always labelled and never affects place ratings or positions in lists.
8. Changes
When our data handling changes we update this policy and its date. We announce material changes on the site or by email.