Legal
Privacy
What we process, why, and how to get rid of it.
Last updated: 7 August 2026
In short
This site sets no analytics or marketing cookies, embeds no trackers and sells no data. That is also why there is no cookie banner.
If you are signed in, your session lives in the browser’s localStorage — strictly necessary to keep you logged in, and cleared when you sign out.
Controller
The controller for data processing on this website within the meaning of the GDPR is:
Gerald StroblSeitenstettengasse 5/37
1010 Wien, Austria
ahoi@gstrobl.at
What we process
- User account
- Email address and password. The password is stored only as a cryptographic hash at our authentication provider; we never see it in clear text. Timestamps for registration and last sign-in are stored alongside. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
- Market listings
- Name, description, address, dates, table fee and optionally contact email, phone number, website and photos. Contact details are shown publicly only if you explicitly enable that in the form. Legal basis: Art. 6(1)(b) GDPR.
- Reviews
- Star rating and free text. To limit abuse, the IP address is evaluated transiently in memory (at most five reviews per hour) — it is not stored with the review. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in abuse-free operation).
- Location
- The “Nearby” feature asks your browser for your location, and only after you actively confirm the prompt. The coordinates are sent to our API to search for markets within the chosen radius; they are neither stored nor logged there. Legal basis: Art. 6(1)(a) GDPR (consent), revocable in your browser at any time.
- Server logs
- Loading the site produces technical logs at our hosting providers (IP address, timestamp, requested resource, user agent). They serve operation and attack mitigation and are deleted there automatically. Legal basis: Art. 6(1)(f) GDPR.
- Emails
- Confirmation, password-reset and email-change messages are sent through Amazon SES, which processes the recipient address and delivery information such as bounces. Legal basis: Art. 6(1)(b) GDPR.
Recipients and processors
We do not run this site on our own hardware. The following providers process data on our behalf, each under a data processing agreement:
| Service | Purpose | Processing location |
|---|---|---|
| Vercel Inc. | Hosting and delivery of the website | Frankfurt am Main (fra1), Deutschland |
| Railway Corp. | Operation of the application programming interface (API) | EU |
| Supabase Inc. | Database, user accounts and photo storage | Irland (West EU) |
| Amazon Web Services EMEA SARL | Delivery of account emails (Amazon SES) | Frankfurt am Main (eu-central-1), Deutschland |
Transfers to third countries
Some of the providers above are US companies, but the regions we use run inside the EU. Where processing outside the EU nevertheless occurs, it relies on the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
Retention
Account data is kept until you delete the account. Market listings and reviews remain until you delete them or we remove them for editorial reasons. Past market dates are kept as an archive so links do not break. Server logs are deleted automatically by our providers after a short period.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) at any time. Consent once given can be withdrawn at any time with effect for the future.
An informal email is enough for any of this: ahoi@gstrobl.at