Privacy Policy

Who we are

Vardenia is a printed magazine and an online directory of places in Lebanon.

Not settledthe registered legal entity, its company number and its registered address.

If you want to ask about anything in this policy, get in touch.

Write to [email protected].

What we collect

Only what the site needs to do the things you ask it to.

• If you open an account: your name, your email address, and a phone number if you choose to give one. Your password is stored only as a hash and cannot be read by us or recovered.
• If you make a booking: the date and time, how many people, and anything you write in the notes field. We also keep a reference number so you and the business can identify the booking later.
• If you scan a printed code: the code, the time, your city and country, and whether you were on a phone or a computer. We do not record your precise location, and we do not store your IP address at all - it is hashed in memory to spot repeated scans and never written down.
• If something breaks: a record of the error, with email addresses, passwords and access tokens automatically removed before it is stored.
• When you read any page: which pages were visited, which site the visit came from, the country it came from, and whether it was a phone or a computer. This is measured for us by an analytics provider, it sets no cookie, and it is counted rather than tied to you.

We use no advertising trackers, we do not build a profile of you, and nothing here follows you to another site.

A note about the booking notes field

The notes box on a booking form invites you to tell the business about a dietary requirement, an anniversary, or an accessibility need. Some of that is health information, which the law treats as more sensitive than the rest.

We pass whatever you write to the business you are booking with, because that is the point of the field, and we keep it with the booking. Please only write what you are comfortable sharing with that business, and leave it blank if you would rather tell them in person.

Not settledwhether an explicit consent tick is needed on the booking form for health-related notes, or whether the field should be relabelled to discourage them - a question for a lawyer, since this is special category data under GDPR Article 9

Why we are allowed to hold it

• To do what you asked. Making a booking, running your account, and sending you the confirmation are all part of the arrangement between us.
• To run the business. Counting scans of a printed code tells an advertiser whether their placement worked. Those figures are aggregated and never identify a reader.
• To keep the site working and safe. Rate limiting, spotting automated abuse, and recording errors.

Who else sees it

• The business you book with sees your name, your phone number if you gave one, the details of the booking and your notes. They need those to hold your table and to call you if something changes. They do not see your email address.
• Our suppliers, who process data on our behalf and are not allowed to use it for anything else: our database and file storage host, our website host, the service that sends our email, and the service that counts page visits.

Not settlednaming those suppliers explicitly, which is generally expected - currently Supabase for the database, Netlify for hosting, Resend for email, and Umami for analytics.

We do not sell your information, and we do not share it for anyone else's marketing.

Where it is kept

Our database is hosted in the European Union, in Frankfurt, and our page-visit figures are held in the European Union too. Our website host and our email provider may process data outside it.

Not settledthe transfer mechanism relied on for suppliers outside the EU, and whether a full record of processing activities is needed

How long we keep it

Bookings are kept as a record of what was agreed, because that is what a disagreement about a missed reservation is settled from.

Not settledactual retention periods - a proposal to review: bookings for 24 months after the date, accounts until you close them, scan records for 24 months, error records for 90 days. None of these is enforced in the software yet

What you can ask for

You can ask us for a copy of what we hold about you, to correct it, to delete it, to send it to you in a portable form, or to stop using it in a particular way.

Ask us, and we will answer within one month.

Write to [email protected].

If you are unhappy with how we have handled it, you can complain to your national data protection authority.

Cookies

Two small cookies, and only once you sign in. One keeps you signed in; the other only tells the page to show your account link instead of Sign in. Neither is used to track you, neither is shared, and there is no advertising or analytics cookie on this site.

That last part is deliberate. We do count page visits, and we chose a provider that needs no cookie to do it, so measuring how the site is read costs you nothing and asks you nothing.

Because both are strictly necessary to provide something you asked for, there is no consent banner. If we ever add anything that is not strictly necessary, there will be.

Children

Vardenia is not aimed at children and we do not knowingly collect anything about them. If you believe a child has given us information, write to us and we will remove it.

Changes

If we change this policy in a way that matters, we will say so on this page and update the date at the top. Older versions are recoverable on request.