Privacy Policy

Who we are

BestIn is operated by Bestin Ltd ("we", "us"), the data controller for personal data processed through the BestIn website and apps. Contact: legal@bestin.live.

What we collect

• Account data: email address, display name, username, password hash (never the password itself), preferred language, and profile picture and identifier if you sign in with Google or Apple.
• Content you post: lists, places, notes, reviews, ratings, photos, logos, votes, reports and business claims (including the business contact details you provide).
• Security data: a one-way hash of your IP address and a hashed device signal, used only to prevent fraud and vote manipulation. We do not store raw IP addresses with your votes.
• Usage data: pages viewed and actions taken, collected without cookies unless you accept analytics.
• Location: only when you press "Near me", and only in your browser to sort results. We do not store it.

Why we use it (legal bases)

• To provide the service and your account (performance of a contract).
• To keep rankings fair, prevent spam and abuse, and keep the platform secure (legitimate interests).
• To moderate content automatically and by humans (legitimate interests; legal obligations).
• Analytics cookies and similar storage (consent, which you can withdraw at any time).
• Transactional emails such as verification and password reset (performance of a contract). We do not send marketing email without consent.

Service providers

We use processors who handle data on our behalf under contract: Fly.io (hosting), our managed PostgreSQL provider (database), Tigris (image storage and delivery), OpenAI (automated content moderation and translation of submitted text and images), Resend (email delivery), Mapbox (maps and place search), PostHog (product analytics), Sentry (error monitoring), Cloudflare (bot protection), and Google/Apple if you choose them for sign-in. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

International transfers

Providers may process data outside your country, including in the EU and the United States. Where required we rely on adequacy decisions or Standard Contractual Clauses, and on the transfer mechanisms permitted under the Saudi PDPL.

Retention

We keep account data while your account is active. When you delete your account we delete your profile, votes, reviews, photos, claims and reports. Lists and places you created stay on BestIn without your name, because other people's contributions depend on them. Security logs are kept for up to 12 months; backups roll over within 30 days.

Your rights

Depending on where you live, you can access, correct, export, delete or restrict the processing of your data, object to processing based on legitimate interests, and withdraw consent. You can download your data and delete your account at any time in Settings. For anything else, email legal@bestin.live. You may also complain to your local data protection authority (for example the SDAIA in Saudi Arabia or your EU/UK supervisory authority). California residents have the right to know, delete, correct and opt out of sale/sharing (we do neither), and will not be discriminated against for exercising these rights.

Cookies

Essential cookies keep you signed in and remember your language. Analytics storage is only used after you accept it in the cookie banner; until then analytics run in memory without identifiers.

Children

BestIn is not intended for children under 13 (or under 16 where local law requires parental consent). We delete accounts we learn belong to children below these ages.

Changes

We will post changes here and, for material changes, notify signed-in users before they take effect.