Privacy Policy
Who controls your data?
The data controller is the operator of whostravel.ing. For data protection queries, please use the contact form with the subject "Privacy and personal data". We respond within the period required by law, which is usually up to 30 days. The email address for such matters is shown below as a graphic, without an active link.
What data do we collect?
We collect only what is necessary to provide the service:
Account data: email address, hashed password.
Card data: first name, last name, country, city, phone, public email, description — only what you enter and mark as visible.
Technical data: IP address of QR scans, User-Agent header, date and time of scan.
Messages: message content from finders, their optional name and contact details, IP address.
Why do we collect this data?
Contract performance (Art. 6(1)(b) GDPR): creating and managing your card, delivering finder messages, generating QR codes.
Legitimate interest (Art. 6(1)(f) GDPR): scan logs for internal statistics and security, abuse prevention (rate limiting).
Who can see your data?
Your card data is visible only to whoever scans your QR code. You control which fields are visible — you can hide your email, description, or accommodation details.
The card URL (UUID) is random and impossible to guess — we do not maintain a public directory of cards.
We never sell, share, or use your data for marketing purposes.
How long do we keep your data?
Account and card data: until account deletion, or 90 days after account suspension.
Scan logs: 12 months.
Finder messages: until deleted by you.
Account UUID: reserved indefinitely — QR labels are physical and we cannot deactivate them.
Cookies
We use only essential cookies:
PHPSESSID — login session, deleted when you close your browser.
lang — remembers your interface language and is necessary for the language switcher to work correctly, valid for 1 year.
We do not use any external systems for monitoring user activity, external analytics, or advertising. We do not integrate Google Analytics, Meta/Facebook, advertising pixels, or similar tracking tools. We rely only on our own internal technical logs required for the service and security.
Your rights (GDPR)
You have the right to: access your data, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection.
You can exercise these rights by logging into your dashboard (Settings → Delete account) or via the contact form with the subject "Privacy and personal data".
You also have the right to lodge a complaint with your national data protection authority.
Controller details and contact
The controller of your personal data is:
ABBA SOFT
Arkuszowa 67
01-934 Warsaw
Poland
Tax ID (NIP): 1181429820
REGON: 016248118
For data protection matters, please use the contact form with the subject "Privacy and personal data". We respond within the period required by law, which is usually up to 30 days. The email address for such matters is shown below as a graphic, without an active link:
Data security and infrastructure
Passwords are stored only as hashed values (bcrypt). All connections use HTTPS encryption. Only fields you mark as visible are shown publicly. UUID addresses are random and cannot be enumerated.
The service runs on infrastructure located in Poland and the European Union. Where necessary for payments and security mechanisms, we also rely on external providers. If this involves transfers outside the EEA, appropriate safeguards required by law are applied.
Questions?
For privacy and personal data matters, please use the contact form with the subject "Privacy and personal data".
Email address for these matters: