Wassa Privacy Policy

1 Information Wassa collects

Account and sign-in information

When you sign in with Apple or Google, Wassa may receive:

• a unique identifier for your Apple or Google account;
• your email address, which may be an Apple private-relay address;
• your name, if the sign-in provider supplies it;
• the name of the sign-in provider you used; and
• authentication tokens or authorisation codes needed to verify your sign-in, maintain your session or disconnect your account.

Wassa also creates an internal user ID and records information such as when your account was created and when you last signed in. Wassa does not receive or store your Apple or Google password.

Profile and preferences

Wassa may store:

• your display name;
• whether you completed onboarding;
• whether you granted location permission;
• drinks you prefer; and
• pub features you prefer, such as a beer garden, food or live sport.

These preferences help Wassa personalise pub discovery and recommendations.

Location and search information

If you choose Use Current Locationand grant permission, Wassa receives your device's foreground latitude and longitude so it can show nearby pubs and calculate distances.

Wassa does not request background location and does not continuously track where you go. You can use Wassa without sharing your current location by searching for and selecting an area manually.

Wassa may process:

• your current latitude and longitude;
• the area name selected for discovery;
• location-search text;
• the radius used for nearby results; and
• up to five recently selected locations stored locally on your device.

If Wassa does not already have a suitable local search result, location-search text may be sent from Wassa's server to the OpenStreetMap Nominatim service. Coordinates may also be sent from Wassa's server to an OpenStreetMap Overpass service when Wassa needs to update pub coverage for an area. These requests are not sent with your Wassa user ID.

Selected and recent locations stored on your device may remain there after account deletion until you clear the app's local data or uninstall the app.

Saved pubs and activity

When you use Wassa, it may store:

• pubs you save and when you save them;
• pubs you check in to;
• the time of a visit;
• ratings;
• drinks and quantities recorded during a check-in;
• pub features you confirm; and
• an optional check-in note of up to 225 characters.

This information is associated with your account inside Wassa.

Community information

Wassa uses check-ins to calculate information such as recent confirmations, ratings, check-in totals and unique visitor counts.

If you add a check-in note, the note and visit date may be shown on the relevant pub page to other signed-in Wassa users. Your name, email address and user ID are not shown with the note. However, Wassa can still connect the note to your account internally, and a note may identify you if you include identifying information in the text.

Please do not include sensitive or confidential information in a check-in note.

Technical, security and diagnostic information

When you use Wassa, its hosting and monitoring systems may collect:

• API request routes, methods, status codes and response times;
• IP and network information;
• device, operating-system and app-version information made available with a request;
• dates and times of activity;
• error messages, exceptions and diagnostic logs;
• security and authentication events;
• performance measurements and trace identifiers; and
• request information that may include coordinates, searches or filters.

Wassa uses this information to operate, secure, troubleshoot and improve the service. Wassa does not currently use a third-party mobile advertising or behavioural-tracking SDK.

2 How and why Wassa uses your information

Where Wassa relies on legitimate interests, it uses information only where the processing is reasonably necessary and proportionate, taking your rights and expectations into account.

Wassa may use your location, preferences and activity to rank or recommend pubs. It does not use your information to make solely automated decisions that produce legal or similarly significant effects.

3 When information is required

You need an Apple or Google account and must provide the information required for sign-in if you want to create a Wassa account.

Other information is optional:

• you can search for an area instead of sharing your device location;
• you can choose whether to save pubs;
• you can choose whether to add preferences; and
• check-in notes are optional.

Some features will not work without the information they need. For example, Wassa cannot show pubs near your current position unless you provide a current or selected location.

4 Who Wassa shares information with

Wassa shares information only where needed to provide, operate or protect the service.

Microsoft Azure

Wassa uses Microsoft Azure for API hosting, database hosting, backups, application monitoring and diagnostic logging. Microsoft processes Wassa information on Wassa's behalf.

Apple

Apple processes information when you use Sign in with Apple, TestFlight, App Store services, iOS location services or Apple geocoding. Apple may act as an independent controller for its own services.

Google

Google processes information when you use Google Sign-In or disconnect Google access. Google may act as an independent controller for its own services.

OpenStreetMap services

Wassa may use OpenStreetMap Nominatim for fallback location search and an OpenStreetMap Overpass service for pub-data imports. These services may receive search text, coordinates, radius information and Wassa server network information, but Wassa does not include your Wassa user ID in those requests.

Legal and safety disclosures

Wassa may disclose information where reasonably necessary to comply with law, respond to a valid legal request, investigate fraud or abuse, protect users, or establish, exercise or defend legal claims.

If Wassa is sold, reorganised or transferred in the future, relevant information may be transferred as part of that transaction, subject to appropriate confidentiality and data-protection safeguards.

Wassa does not sell or rent your personal information to advertisers or data brokers.

5 International transfers

Some providers may process information outside the United Kingdom, including in the European Economic Area, the United States or other countries where they operate.

Where UK data-protection law requires it, Wassa relies on an approved safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism made available by the provider.

Contact privacy@wassa.co.uk if you would like more information about the safeguards relevant to your information.

6 How long Wassa keeps information

Wassa keeps personal information only for as long as it is reasonably needed for the purposes described in this policy.

When information is deleted from Wassa's live database, copies may remain in encrypted backups until the seven-day backup cycle expires. Diagnostic records may also remain for the rest of their stated retention period.

Wassa may keep limited information for longer where required by law, to resolve disputes, prevent abuse or establish, exercise or defend legal claims. Where possible, Wassa will minimise or anonymise that information.

7 Account deletion

You can initiate account deletion using Delete Account inside Wassa.

Deleting your account removes the account and its associated identity records, preferences, saved pubs, check-ins, ratings and notes from Wassa's live database. Wassa also attempts to disconnect or revoke access with your Apple or Google sign-in provider.

Some information may remain temporarily:

• encrypted database backups for up to seven days;
• diagnostic and security logs for up to 30 days; and
• selected or recent locations saved locally on your device until the app's local data is cleared or the app is uninstalled.

Information that Wassa must retain for legal reasons may be kept only for the relevant legal purpose and period.

8 Your location choices

You can:

• refuse location permission and search for an area manually;
• change Wassa's location permission in iOS Settings;
• select a different area at any time; and
• clear local app data by uninstalling Wassa.

Withdrawing device-location permission does not affect processing that already took place while permission was enabled.

9 Your data-protection rights

Depending on the circumstances and the lawful basis used, UK data-protection law may give you the right to:

• ask for a copy of your personal information;
• ask Wassa to correct inaccurate or incomplete information;
• ask Wassa to delete your information;
• ask Wassa to restrict how information is used;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent; and
• complain to the Information Commissioner's Office.

To exercise a right, email privacy@wassa.co.uk. Wassa may need to verify that the request relates to your account before acting on it.

You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. Wassa would appreciate the opportunity to address your concern first, but you do not have to contact Wassa before contacting the ICO.

10 Security

Wassa uses technical and organisational measures designed to protect personal information, including:

• encrypted connections between the app and Wassa's API;
• managed cloud access controls;
• encrypted database storage and backups;
• short-lived access tokens;
• hashed server-side refresh tokens; and
• secure device storage for authentication sessions.

No internet service can guarantee complete security. Please contact privacy@wassa.co.uk if you believe your Wassa account or information has been compromised.

11 Age restriction

Wassa is intended only for people aged 18 or over. It is not directed at children, and Wassa does not knowingly collect personal information from anyone under 18.

If you believe a person under 18 has created an account, contact privacy@wassa.co.uk so Wassa can investigate and delete the account where appropriate.

12 Other services

Apple, Google, Microsoft and OpenStreetMap operate under their own terms and privacy information. Wassa is not responsible for the privacy practices of third-party websites or services that it does not control.

13 Changes to this policy

Wassa may update this policy when the app, its providers or legal requirements change. The updated policy will show a new “Last updated” date.

If a change materially affects how Wassa uses your information, Wassa will provide an appropriate notice in the app or by another suitable method before the new use begins.

14 Contact

The data controller is:

Sam Woods, trading as Wassa

For privacy questions, requests or complaints:

privacy@wassa.co.uk