Privacy Policy

Last updated: 26 September 2026

This English version is provided for convenience. The legally binding version is the German one at halal-spots.de/datenschutz.

Data Controller

Happy Octopus Labs UG (haftungsbeschränkt)
Biedermannplatz 14
22083 Hamburg
Germany
Represented by its managing director: Shehroz Ahmed Khan

This privacy policy applies to our website halal-spots.de, the business portal business.halal-spots.de and the “Halal Spots” app for iOS and Android (see Using the App).

Email: salam@halal-spots.de
Imprint: halal-spots.de/en/impressum

Overview of Processing

Types of data processed

  • Master data (e.g. name or display name, contact details).
  • Contact data (e.g. email addresses, phone number for owners).
  • Content data (e.g. form input, reports, spot suggestions, photos).
  • Usage data (e.g. visited pages, favorites).
  • Location data (only in the app and only with your permission).
  • Device and diagnostic data (e.g. device model, operating system, crash reports).
  • Meta, communication and procedural data (e.g. IP addresses, timestamps).
  • Log data (e.g. server log files).
  • Anonymous usage events in the app (e.g. opening a listing, tapping "Route", "Call", "Website", favoriting, sharing).

Anonymous usage events in the app are collected without any personal reference: we only store which listing received which interaction at what time — with no user ID, device ID, IP address or location data. It is therefore impossible to identify individual persons. These statistics help us improve the service and, in the future, provide statistics to the operators of listed places.

Categories of data subjects

  • Website users (visitors).
  • App users (with and without an account).
  • Owners of listed places (business portal).
  • Communication partners.

Purposes of processing

  • Provision of our online offering and user-friendliness.
  • Provision of app features (map, search, distances, prayer times, favorites).
  • Managing user accounts and account-related communication.
  • Handling reports and spot suggestions.
  • Error and crash analysis.
  • Information technology infrastructure.
  • Direct marketing (newsletter for beta signup).
  • Security measures.
  • Anonymous reach and usage measurement in the app.

Legal Basis

The following provides an overview of the legal bases under the GDPR on which we process personal data:

  • Consent (Art. 6(1)(a) GDPR): The data subject has given consent to the processing for one or more specific purposes.
  • Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract (e.g. using the app with an account under our terms) or for steps prior to entering into a contract.
  • Legitimate interests (Art. 6(1)(f) GDPR): Processing is necessary for the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the data subject’s rights.
  • Legal obligation (Art. 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation.

German national rules: In addition to the GDPR, the German Federal Data Protection Act (BDSG) and applicable state data protection laws apply. Storing and accessing information on your device (e.g. in the app) is also governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Security Measures

We take appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with legal requirements and the state of the art.

Securing online connections via TLS/SSL (HTTPS): All connections between the browser and our server are encrypted via TLS/SSL. The certificate is issued via Let’s Encrypt (managed by Vercel) and renewed automatically. The app also communicates exclusively over encrypted connections (HTTPS).

Sharing of Personal Data

As part of our processing, personal data may be shared with other parties, in particular with the IT service providers we use as data processors (Vercel, Supabase, Sentry, Brevo, ImprovMX — see the respective sections). We have entered into data processing agreements (Art. 28 GDPR) with these processors.

When you use the app, Apple or Google (map display, place name) also receive data. They do not act on our behalf but as independent controllers (details in Using the App). We do not sell personal data or share it for advertising.

International Data Transfers

Where we transfer data to a third country (outside the EU/EEA), this is always done in accordance with legal requirements.

For transfers to the United States, we rely primarily on the EU-US Data Privacy Framework (DPF), recognised as an adequate legal framework by the EU Commission’s adequacy decision of 10 July 2023. In addition, we have agreed Standard Contractual Clauses under Art. 46 GDPR with our processors.

Data Storage and Deletion

We delete personal data once consent is withdrawn or no further legal basis for processing exists. Exceptions apply where legal obligations or legitimate interests require longer storage.

Statutory retention periods under German law:

  • 10 years — accounting books, financial statements, inventories (§ 147 AO, § 257 HGB).
  • 8 years — accounting documents such as invoices.
  • 6 years — other business records, including received and sent business correspondence.
  • 3 years — data needed to consider potential warranty or damage claims (§§ 195, 199 BGB).

Specific retention periods: How long we keep the data of each service (e.g. account data until the account is deleted, crash reports for at most 90 days, server log files for at most 30 days) is stated in the section for that service. We do not store your location.

Rights of Data Subjects

You have several rights under the GDPR (in particular Art. 15-21):

  • Right to object (Art. 21): You have the right at any time to object to processing based on legitimate interests, including for direct marketing purposes.
  • Right to withdraw consent: You may withdraw consent at any time.
  • Right of access (Art. 15): You have the right to obtain confirmation as to whether your data is being processed, and access to it.
  • Right to rectification (Art. 16): You may request correction of inaccurate data.
  • Right to erasure and restriction (Art. 17, 18): You may request deletion or restriction of processing.
  • Right to data portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
  • Right to lodge a complaint (Art. 77): You have the right to lodge a complaint with a supervisory authority (see below).

To exercise your rights, an email to salam@halal-spots.de is sufficient. You can also delete your app account yourself at any time in the app (see halal-spots.de/en/konto-loeschen).

Using the App “Halal Spots”

This section describes which data our iOS and Android app processes. You can use the app without an account: the map, search, listings and prayer times work without signing in. You only need an account for favorites, reports and spot suggestions.

At a glance:

  • No ads, no ad tracking, no advertising ID, no sale of data.
  • Your location is not sent to our servers and not stored by us. The app calculates distances on your device.
  • Prayer times and the Islamic date are also calculated on your device — your location does not leave the device for this.
  • For the map and the place name, data goes to Apple (iOS) or Google (Android).
  • Crash reports are collected without being linked to your account.
  • You can delete your account yourself in the app at any time.

Storage on your device

The app stores in your device’s protected storage (iOS Keychain or Android Keystore): the chosen app language and appearance (light/dark), a display name entered during onboarding (also without an account), the Ramadan setting, your crash report choice and — if you are signed in — your sign-in session and, until sign-up is complete, your acceptance of the terms and of email recommendations. This data does not leave your device; the sign-in session is only sent to our server to identify you as signed in.

Legal basis:
Section 25(2) no. 2 TDDDG (strictly necessary for the service you requested).
Retention:
Until you change the setting, sign out or delete the app.

User account (optional)

For an account we process your email address, your password (only as an encrypted hash, never in plain text), optionally display name and city, your app language (so emails reach you in your language), your favorites, the time you accepted the terms, and the times of sign-up and sign-in. You sign in with a password or a sign-in link (magic link) sent to your email address.

When signing up you can optionally agree to occasionally receive recommendations and updates by email. We store this consent with a timestamp. You can withdraw it at any time by emailing salam@halal-spots.de.

Purpose:
Providing account features (favorites, reports, suggestions), sign-in and account-related communication.
Legal basis:
Art. 6(1)(b) GDPR (user agreement under our terms); for email recommendations Art. 6(1)(a) GDPR (consent).
Retention:
Until the account is deleted. You can remove favorites yourself at any time.
Recipients:
Supabase (database and sign-in, see below) and Brevo (sending confirmation and sign-in emails, see the Newsletter section) as processors.

Data processor: Supabase (database, sign-in, file storage)

We store the data of the app and the business portal (accounts, favorites, reports, suggestions, photos, anonymous usage events) with Supabase, Inc. (USA). The database is located in a data centre in Ireland (EU) (Amazon Web Services as sub-processor). For every request from the app, Supabase technically processes your IP address and briefly logs requests and sign-in events for security purposes.

Legal basis:
Art. 6(1)(b) GDPR (providing the app) and Art. 6(1)(f) GDPR (secure operation).
Third-country transfer:
Data is stored in the EU. For access from third countries (e.g. support, sub-processors) we have concluded a data processing agreement with Supabase including Standard Contractual Clauses (Art. 46 GDPR).

Supabase privacy policy: supabase.com/privacy

Location

The app asks for permission to access your location — only while you use the app, never in the background. We use it to show spots near you and their distance, to center the map on your position, to calculate prayer times for your location and to show the name of your town.

The app calculates distances on your device. Your location is not sent to our servers and not stored by us — not even in the anonymous usage statistics. Prayer times are also calculated on the device. Your coordinates only go to Apple’s or Google’s place lookup to show the name of your town (see “Map and place name”).

Without permission the app keeps working and uses a fixed default location (Hamburg city centre).

Legal basis:
Your consent by granting location permission (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
Retention:
Only in memory while the app is running. We do not store it permanently.
Withdrawal:
At any time in your device settings: on iOS under Settings → Halal Spots → Location, on Android under Settings → Apps → Halal Spots → Permissions. Withdrawal takes effect for the future.

Prayer times

The app calculates prayer times and the Islamic date on your device (Muslim World League method, Umm al-Qura calendar). Neither your location nor any other data is sent to us or to third parties for this; the calculation also works offline. Without location permission the app uses the default location.

Map and place name (Apple, Google)

The map is provided by Apple’s map service (Apple Maps) on iOS and by the Google Maps SDK on Android. Map tiles are loaded from the respective provider, which receives your IP address and the map area shown. Your position (blue dot) is drawn by the map on your device.

According to Google, the Google Maps SDK on Android additionally collects device and SDK information (e.g. operating system, device model), SDK crash data, an SDK-specific pseudonymous identifier to count active users, and map interactions such as panning and zooming (Google’s disclosure).

The app determines the name of your town (e.g. “Hamburg”) from your coordinates using the operating system’s place lookup. For this, the coordinates go to Apple on iOS and to Google on Android.

Purpose:
Displaying the map, showing the place name.
Legal basis:
Art. 6(1)(f) GDPR (legitimate interest in a working map display); for transmitting your location, your consent by granting location permission (Art. 6(1)(a)).
Recipients:
Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — each as an independent controller.
Third-country transfer:
Processing by the parent companies Apple Inc. or Google LLC in the USA is possible. Both are certified under the EU-US Data Privacy Framework.
Retention:
According to Apple’s or Google’s policies.

Privacy policies: Apple, Google

Reports, spot suggestions and photos

With an account you can report errors in a listing (“Report a problem”: affected listing, selected attributes, optional free text) and suggest new spots (place details such as name, address, city, category, attributes and notes, optionally up to 3 photos of at most 3 MB each). We store your account ID and the time.

The app only accesses the camera or photo library when you add a photo, and only with your permission. Photos are uploaded unchanged and may therefore contain metadata (e.g. time taken, device and — depending on camera settings — the location where the photo was taken).

Only we can see reports, suggestions and photos; other users never see them. Photos are kept in non-public storage. If, after review, we add details or a photo to a public listing, we do so without your name and without any link to your account.

Purpose:
Accurate and complete listings; reviewing and handling your input.
Legal basis:
Art. 6(1)(b) GDPR (using the features under our terms); for showing your photos in the app, the consent you give when uploading (Art. 6(1)(a)).
Retention:
Until your account is deleted. We delete individual reports or suggestions earlier on request.
Recipients:
Supabase as processor.

Crash reports and error analysis (Sentry)

If the app crashes or an error occurs, it sends an error report to the Sentry service. It contains the error message and program flow, device model, operating system and version, app version, time, technical device details (e.g. language, memory) and the last technical events before the error (e.g. network requests). For about 10 % of sessions, loading times are also measured. Of network request addresses, the app only transmits the part without parameters — any details contained there do not end up in the reports. To count crash-free sessions, Sentry uses a random installation identifier.

Reports are not linked to your account: we transmit neither a user ID nor an email address, and the app is configured so that Sentry does not store an IP address with the report.

Purpose:
Detecting and fixing errors, improving the stability and speed of the app.
Legal basis:
Art. 6(1)(f) GDPR (legitimate interest in an error-free app); Section 25(2) no. 2 TDDDG.
Retention:
At most 90 days, then deleted automatically.
Recipients:
Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, as processor.
Third-country transfer:
Reports are stored in the EU (Frankfurt am Main). For access from the USA, Sentry is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses apply in addition.
Objection:
You can switch crash reports off at any time in the app (“Me” tab → Settings → Crash reports). The app then no longer sends any reports. Alternatively, email salam@halal-spots.de (Art. 21 GDPR).

Sentry privacy policy: sentry.io/privacy

Anonymous usage statistics

The app anonymously counts how often a listing is opened or, for example, “Route” or “Call” is tapped — without user or device ID, IP address or location (see Overview of Processing). This data is not personal data.

Links to other services

When you tap “Route”, “Call”, “Website”, a social media link, “Add to calendar” or “Share”, the app opens the respective app or website (e.g. Google Maps, Google Calendar, phone, browser). The route link only contains the coordinates of the destination, not your location. From then on, the privacy terms of the respective provider apply.

Deleting your account

You can delete your account at any time in the app (“Me” tab → “Delete account”) or request deletion by emailing salam@halal-spots.de. We then delete your account, favorites, reports and spot suggestions including uploaded photos, as well as owner data. Backups of our database provider are overwritten after 30 days at the latest. Details: halal-spots.de/en/konto-loeschen.

Provision of the Online Offering and Hosting

We process user data in order to make our online services available. For this purpose we process the user’s IP address, which is required to deliver content and functionality to the user’s browser or device.

Data Processor: Vercel Inc. (Hosting)

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

US transfer: Vercel is certified under the EU-US Data Privacy Framework (DPF). In addition, we have concluded Standard Contractual Clauses with Vercel under Art. 46 GDPR. Static content is primarily delivered from EU edge nodes (incl. Frankfurt).

Vercel privacy policy: vercel.com/legal/privacy-policy

Server log files

Access to our online offering is logged in server log files. This may include URLs accessed, date and time, transmitted data volumes, browser type and version, operating system, referrer URL, and IP address.

Purpose: Stability and security (in particular protection against DDoS attacks).
Legal basis: Art. 6(1)(f) GDPR (legitimate interests).
Retention: Log information is stored for a maximum of 30 days, then deleted or anonymised.

Newsletter and Electronic Notifications

We send newsletters and electronic notifications only with the recipient’s consent. To sign up, your email address is sufficient. You may optionally provide your city.

Newsletter content: Information about the launch of the beta app on TestFlight (iOS) and Google Play (Android), updates on app availability, and occasional notes about app development.

Legal basis: Art. 6(1)(a) GDPR (consent).

Opt-out: You can cancel the newsletter at any time, i.e. withdraw your consent. Email salam@halal-spots.de or use the unsubscribe link that will appear in future messages.

Retention: We may retain unsubscribed email addresses for up to three years on the basis of our legitimate interest in proving that consent was previously given. Processing is limited to potential defence against claims.

Data Processor: Brevo (Sendinblue)

Sending and managing newsletter recipients is handled by Sendinblue SAS (brand name “Brevo”), 7 rue de Madrid, 75008 Paris, France.

Data processing takes place within the EU. No third-country transfer occurs. We have concluded a data processing agreement (Art. 28 GDPR) with Brevo.

Data processed: email address, optionally city, signup timestamp, and IP address as evidence of consent.

Account emails: We also use Brevo to send the confirmation and sign-in emails for the app and the business portal (sender noreply@halal-spots.de). Brevo processes your email address, the email content and delivery and, where applicable, click data. Legal basis: Art. 6(1)(b) GDPR.

Brevo privacy policy: brevo.com/legal/privacypolicy

Email Forwarding (Contact)

Emails sent to addresses on our domain (e.g. salam@halal-spots.de) are forwarded to our private inbox via ImprovMX (provider: Vinz B.V., Netherlands; see provider site for the official imprint).

A data processing agreement (Art. 28 GDPR) is in place with ImprovMX. Where any technical processing steps occur outside the EU/EEA, they are protected by Standard Contractual Clauses (Art. 46 GDPR).

ImprovMX privacy policy: improvmx.com/policies/privacy

Business Portal and Owner Claim Requests

Owners of listed places (restaurants, mosques, shops) can request to take over their listing via our business portal (business.halal-spots.de, “This is my spot”) and manage it themselves after approval. As part of a claim request we process: name, role in the business, phone number, the email address of the user account and an optional message; for places not yet listed, additionally the business data (name, address, type of business).

Purposes: verifying that the applicant actually is the owner, setting up owner access and communication about the request. The access link is sent by email via our delivery provider Brevo (see the Newsletter and Electronic Notifications section).

Legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests in preventing fraudulent takeovers (Art. 6(1)(f) GDPR).

Retention: rejected requests are deleted after 90 days. Approved requests are kept as a record of the verification decision for as long as the associated owner access exists.

Competent Supervisory Authority

Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)
Ludwig-Erhard-Straße 22, 7. OG
20459 Hamburg, Germany
Phone: +49 40 428 54-4040
Email: mailbox@datenschutz.hamburg.de
Website: datenschutz-hamburg.de

Changes and Updates

Please check this privacy policy regularly. We update it when changes to our processing make this necessary. We will inform you whenever changes require a cooperative action on your part (e.g. renewed consent).

Created with Datenschutz-Generator.de by Dr. Thomas Schwenke, then adapted and extended for our setup.

← Back to homepage