Privacy Policy

Effective from 22/10/2026

This is a translation. If the Bulgarian and English versions differ, the Bulgarian version prevails.

taina.info is built to know as little about you as possible. There are no visitor accounts, we do not ask for your email, and we use no cookies for tracking or advertising.

We count the Site’s traffic anonymously: how many visits there are, which pages are opened, and how many people search for Taina or share a secret. This happens without names, without cookies and without any data about an individual visitor (see 2.8).

This policy explains what is processed anyway, why, and for how long. It also contains the cookie information (section 8).

1. Data controller

Rostar BG OOD, company ID 175170462, 5 Kamenodelska St., Serdika district, Sofia 1202, Bulgaria.

For any question about personal data, email support@rostar-bg.com or call +359 898 775 775. We have not appointed a data protection officer.

2. What we process and why

2.1. Technical data when you visit

When you open the Site, your browser sends the server standard technical data: IP address, browser and device type, the page requested and the time.

• Who processes it: our hosting provider (Vercel), to deliver the Site and protect it from attacks.
• What we do: we do not use it to identify you. Our own application logs contain no IP addresses.
• Legal basis: legitimate interest in the security and operation of the Site (Art. 6(1)(f) of Regulation (EU) 2016/679, the “GDPR”).
• Retention: limited, per the provider’s policy.

2.2. Abuse protection

The number of Secrets, searches and login attempts from one device is limited.

• How: a one-way pseudonymous key is derived from your IP address (a cryptographic hash with a secret that changes every day). The IP address itself is not stored.
• Retention: the key is kept at most until the end of the relevant time window (up to 1 hour), then deleted.
• Legal basis: legitimate interest in preventing spam and abuse.

2.3. Secrets

When you post a Secret we store the text, the chosen category, the time and the number of times it has been shown.

• We do not store a name, email, IP address or device data. A Secret cannot be linked to you.
• Please do not include personal data, yours or anyone else’s. If a Secret contains any, we will remove it.
• What happens to it: it is shown publicly and may be used in campaign materials (see the Terms of Use).
• Automated check: before publication the text is checked automatically for links, phone numbers and profanity. When enabled, the text is also checked by artificial intelligence (Claude by Anthropic), which looks for personal data, insults, threats and other inappropriate content.
  • What is sent to Anthropic: only the text of the secret, with no other data. Under Anthropic’s terms, API content is not used to train models.
  • Outcome of the check: the AI never rejects secrets on its own. Doubtful ones are held until a staff member reviews them.
• Team notification: when a new secret arrives, the campaign team receives an email with its text so it can be reviewed quickly. The email is sent through the Resend service.
• Legal basis: legitimate interest in showing the content you chose to publish and in protecting the Site from abuse.
• Retention: for the duration of the campaign and up to 2 years after it ends, or until we delete it.

2.4. Location

“Near me” uses your device’s location only if you allow it. Distances to stores are calculated in your browser. Your location is not sent to us and is not stored anywhere.

2.5. Address search

When you search for a neighbourhood or an address, the text you type passes through our server to a geocoding service, which finds its coordinates. We use the Google Maps Geocoding API, with OpenStreetMap Nominatim as a fallback.

• What the provider sees: the request comes from our server, not from your device.
• Cache: we keep the result in temporary memory for up to 24 hours so the same search is not repeated. It is not linked to you.
• Tip: please do not type personal data into the search box.
• Legal basis: legitimate interest in finding the store nearest to the place you search for.

2.6. Bot check

When you post a Secret, Cloudflare Turnstile loads. It is an invisible check that you are not a bot. Cloudflare processes technical data from your browser (such as your IP address and browser characteristics) only for this check.

• Legal basis: legitimate interest in preventing automated spam.
• More information: Cloudflare’s privacy policy.

2.7. Map

Map tiles load directly from OpenFreeMap’s servers. Your browser connects to them, so they receive your IP address and which area of the map is shown. They set no cookies.

2.8. Anonymous statistics

To see how the campaign performs, we count events: visits, pages opened, store searches, stores opened, “Directions” clicks, “Show others” and shares.

• What is stored: daily totals only, e.g. “230 store searches on 10 Nov”. No IP address, device or cookie is stored, and nothing that links the events to you.
• Visits: a visit is counted when you open the Site from outside: a link, a QR code or directly. Moving between pages and reloading are not counted. Nothing is stored in your browser for this.
• Source: if you arrived from a QR code or a campaign link, we count where from (e.g. “QR: NDK”). If you came from another website, we count only its type: search engine, social network or other.
• Legal basis: legitimate interest in measuring the campaign’s effect.
• Retention: totals are not personal data. We keep them for up to 2 years after the campaign ends.

2.9. Administrators

For staff who manage the Site we store an email address, a hashed password and session data.

• Legal basis: performance of their work and legitimate interest.
• Retention: for as long as they have access.

2.10. Correspondence

If you write to us, we keep your email and its content so we can reply.

• Legal basis: legitimate interest.
• Retention: up to 1 year after the matter is closed.

3. What we don’t do

• We do not profile visitors.
• We do not make automated decisions about you. The automated review of secrets only holds doubtful text for review by a person.
• We do not send marketing messages.
• We do not sell data.
• We do not use third-party analytics or advertising tools (such as Google Analytics or Meta Pixel).

4. Who else processes data

We use trusted providers that process data on our behalf or independently, as described above:

• Vercel Inc.: hosting and delivery of the Site (USA; the application servers are in Frankfurt, Germany);
• Neon Inc.: database (servers in Frankfurt, Germany);
• Cloudflare Inc.: bot check;
• Google LLC / Google Ireland Ltd.: address search;
• Anthropic PBC: automated review of secret texts, when enabled (USA);
• Resend (Plus Five Five, Inc.): email notifications to the campaign team (USA);
• OpenFreeMap and the OpenStreetMap Foundation: map and fallback address search.

Where data is transferred outside the European Union (for example to the USA), this is done under the EU–US Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission.

5. Your rights

Under the GDPR you have the right:

• to access your data;
• to rectification;
• to erasure;
• to restriction of processing;
• to object to processing;
• to data portability, where applicable.

Because we do not link Secrets, searches or visits to any individual, we usually cannot determine which data relates to you (Art. 11 GDPR). If you want a Secret that concerns you removed, email us with its number and we will review it.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, kzld@cpdp.bg, www.cpdp.bg.

6. Children

The Site is not intended for people under 14, and we do not knowingly collect their data.

7. Security

• The Site is served over HTTPS only.
• Administrator passwords are stored only as cryptographic hashes.
• Access to the database is restricted.

8. Cookies and browser storage

In short: we use no cookies for tracking or advertising, which is why there is no consent banner.

Cookies are small text files a website stores in your browser. Similar technologies are local storage (localStorage) and session storage (sessionStorage). The Site uses only the following entries, all strictly necessary:

Name	Type	Purpose	Duration
taina_admin	cookie	Keeps staff signed in to the admin panel. Never set for visitors of the public site.	7 days or until sign-out
taina-phase	sessionStorage	Remembers the current campaign phase so texts don’t “flicker” between pages.	until the tab is closed
taina-seed	sessionStorage	Keeps the random order of secrets so “Show others” never repeats one.	until the tab is closed

These entries contain no personal data and are not used to recognise you. Strictly necessary entries do not require consent.

• Statistics (see 2.8) use no cookies or browser storage.
• Cloudflare Turnstile loads only when you post a secret. Cloudflare states that Turnstile does not use cookies for tracking or advertising.
• The map (OpenFreeMap) sets no cookies.
• The “Directions” buttons open Google Maps or Apple Maps, where their own rules apply.

You can delete the Site’s cookies and storage in your browser settings; the public part of the Site keeps working normally. If we ever add other cookies, for example for third-party statistics, we will first update this policy and ask for your consent where required.

9. Changes

We may update this policy. The current version is always on this page, with the date of the last change at the top.

Back to the home page