Privacy Policy
1. Data controller
The data controller for personal data collected through the Barside application is:
Via Ghirza, 1 – 00198 Rome, Italy
VAT/CF: 18642451001 · REA: RM-1798024 · Share capital: €3,000.00
Email: privacy@barsidetonight.app
For any questions relating to the processing of your personal data, please contact us at the email address above.
2. Data we collect
Data provided directly by the user
| Data | When collected | Notes |
|---|---|---|
| Display name (display_name) | Registration | Does not need to be your real name |
| Email address | Registration | Used for login and service communications |
| Home city (home_city) | Registration | Used to trigger La Catena notifications when you are travelling |
| Age declaration | Registration (onboarding step 2) | Self-certification via checkbox pursuant to artt. 46–47 DPR 445/2000. Only the declaration flag (identity_verified) and its timestamp are stored |
| Bancone photo (optional) | Event creation (PR only) | Only for users managing venues |
| Bancone messages | Event participation | Visible to all other event participants |
| Preferences (interests) | Onboarding | Used to personalise the discovery feed |
Automatically collected data
| Data | When | Purpose |
|---|---|---|
| Approximate geographic location | When you open the app (only with consent) | Show you nearby events |
| Push notification token (FCM) | Upon notification consent | Sending app notifications |
| Aggregated usage data | During app use | Analysis and service improvement |
| Error logs | In case of crash or anomaly | Technical debugging — no personal content |
Data received from social login providers (Google, Facebook)
If you choose to register or log in via Google or Facebook, the provider transmits a subset of your profile data to Barside. Barside receives and uses exclusively:
| Data | Purpose |
|---|---|
| Email address | Identify or create your Barside account |
| Name | Generate the initial display_name (first name only) |
| Provider unique ID | Link the provider to your Barside account for future logins |
When logging in with Facebook, the platform displays an authorisation dialog that also mentions your profile photo: this is behaviour imposed by Facebook and cannot be changed. Barside does not request, receive, or store your Facebook profile photo.
user_id, IP, or device identifiers.3. How we use your data
- Providing the service: registration, login, event participation, virtual bancone, brindisi and private chat.
- Personalising the discovery feed: showing relevant events based on declared interests and location (if authorised).
- La Catena: notifying your connections when you are in a city different from your home city. Your home_city is never shared with other users — they only receive "X is in [current city] tonight".
- Moderation and safety: managing reports, preventing abuse, protecting the community.
- Service communications: account verification emails, system notifications. We do not send marketing emails without explicit consent.
- Improving the product: aggregated and anonymised analysis of app usage.
- Growing the community: if you have location enabled and you are in a city not yet covered by Barside, we show a banner that lets you signal interest in that city. If you opt in, we increment an aggregated per-city counter — without storing your user ID, IP address, device data, or GPS coordinates. The counter helps us decide which cities to launch next.
4. Legal basis (GDPR)
| Processing | Legal basis | GDPR article |
|---|---|---|
| Account registration and management | Performance of contract | Art. 6.1.b |
| Home city and La Catena notifications | Performance of contract | Art. 6.1.b |
| Geolocation for discovery | Consent | Art. 6.1.a |
| Push notifications | Consent | Art. 6.1.a |
| Marketing emails | Consent | Art. 6.1.a |
| Usage analytics and security | Legitimate interest | Art. 6.1.f |
You have the right to withdraw your consent at any time via the app settings, without affecting the lawfulness of processing based on consent before its withdrawal.
5. Third parties and data processors
Barside uses third-party providers to deliver the service. All of them process data exclusively on Barside's behalf, under data processing agreements compliant with the GDPR, with servers located in the European Union or in countries with adequate safeguards.
| Provider | Service | Data shared |
|---|---|---|
| Google Cloud (GCP) | Hosting, database, push notifications (FCM) | Encrypted user data, system logs |
| Cloudflare | CDN, media storage, DNS | Bancone photos, static assets |
| Upstash | Cache and job queues | Temporary session data |
| Stripe | Payments (partner venues only) | Venue billing data — not end-user data |
| Sentry | Error monitoring | Anonymous error logs |
We do not sell, rent, or transfer your personal data to third parties for marketing purposes.
6. Data retention
- Active account: data is retained for the duration of the contractual relationship.
- Deleted account: identifying data is removed within 30 days of the request. Bancone messages are anonymised (not deleted, to preserve the integrity of other participants' conversations).
- Geographic location: not retained. Only the declared home_city is kept as a profile data point.
- System logs: retained for a maximum of 90 days for security and debugging purposes.
7. Your rights
As a data subject under the GDPR, you have the following rights:
- Access: obtain confirmation that your data is being processed and receive a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): request deletion of your data in certain circumstances.
- Restriction: request suspension of processing in certain circumstances.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: at any time, for processing based on consent.
To exercise these rights, write to privacy@barsidetonight.app. We will respond within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) (garanteprivacy.it), or with the supervisory authority of your country of residence within the EU.
8. Minors
Barside is reserved exclusively for people who are 18 years of age or older. We do not knowingly collect data from minors. If we become aware that a user is underage, their account will be suspended and their data deleted without delay.
If you are a parent or guardian and believe your minor child has created an account, please contact us immediately at privacy@barsidetonight.app.
9. International transfers
Data is processed primarily on servers located in the European Union (Google Cloud europe-west region, Cloudflare EU). Any transfers to third countries are carried out in compliance with the safeguards required by the GDPR (Adequacy Decisions or Standard Contractual Clauses).
10. Changes to this policy
We reserve the right to update this Privacy Policy when the service or applicable regulations change. In the event of material changes, we will notify you via the app or email with at least 14 days' notice. The updated version will always be available on this page with the date of last modification.
11. Contact
🔒 privacy@barsidetonight.app — GDPR requests, data subject rights, data deletion
📧 support@barsidetonight.app — technical support & account
🌐 barsidetonight.app/support
Italian Data Protection Authority (Garante): garanteprivacy.it