Privacy Policy

Last updated: November 12, 2026

GDPR · LOPDGDD (Spain)

1. Controller

WEEBEE DESIGN, S.L.
Calle Gremi de Fusters 33, Local 6
07009 Palma de Mallorca, Spain
Email: fabian@hiddin.app
Tax ID: ESB01597624

2. What Data We Collect

We collect the following personal data when you use Hiddin:

  • Restaurant owners: Name, email address, business name, address, phone number, payment information (via Stripe)
  • Influencers: Name, email address, TikTok, Instagram, Facebook Page and YouTube profile data (display name, follower/subscriber counts, engagement of recent posts, avatar), bank account details (IBAN) for payouts
  • Super-Influencers: Name, email address, phone number, IBAN, tax status, tax identification number, country of residence, VAT identification number (for recruitment commissions)
  • Scouts: Name, email address, phone number, IBAN, tax status, tax identification number, country of residence, VAT identification number (for recruitment commissions)
  • Newsletter subscribers: Email address, first name, city (optional), preferred language, subscription source
  • All users: IP address, device information, usage data, cookies

3. TikTok Integration (TikTok Login Kit)

When you connect your TikTok account to Hiddin, we access the following data via the TikTok Login Kit API:

  • user.info.basic: Your TikTok open ID, display name and profile picture. Used to identify the connected account inside Hiddin.
  • user.info.profile: Your TikTok username (@handle). Shown on the connected card so you can see which account is linked.
  • user.info.stats: Your follower count, following count, likes count and video count. Follower and video counts are shown in the app and feed your Hiddin Score.
  • video.list: Like, comment and share counts of your last 20 public videos. Used only to compute your average engagement rate.

We do not post content on your behalf. We do not store your TikTok credentials. You can disconnect your TikTok account at any time in Hiddin (Settings → Social Media → TikTok → "Disconnect"); we then revoke the token and delete the stored TikTok data.

4. Instagram Integration (Instagram API with Instagram Login)

When you connect your Instagram Business or Creator account to Hiddin, we access the following data via the Instagram API (Business Login for Instagram):

  • instagram_business_basic: Your Instagram username, profile picture, account type (Business/Creator), follower count, media count and the engagement of your recent posts. Used to display your verified influencer profile inside Hiddin.
  • instagram_business_manage_insights: Reach over the last 28 days, follower change over the last 30 days and the cities and countries of your followers. Used to calculate your "Hiddin Score" (0–100) which restaurant owners see when browsing the influencer marketplace. Restaurants never see raw insight data, only the score, its parts and the share of your followers in the region (German federal state or Spanish autonomous community) of the restaurant concerned.

5. Hiddin Score and Automated Decision-Making

Hiddin calculates a Hiddin Score (0–100) for each influencer profile. It is calculated separately for each restaurant and shows how well your followers match the location of that restaurant, so your score can differ from one restaurant to the next. The score determines the order and the visibility in the search. It is made up of the following parameters (maximum points):

  • Share of your Instagram followers who live in the restaurant's region (German federal state or Spanish autonomous community, e.g. Islas Baleares, determined from the restaurant's postcode): 60 points. If no region is known, the city counts. If no value is available, the share in the restaurant's country counts for at most 15 points.
  • Engagement rate: 15 points
  • Follower count: 10 points
  • Estimated share of genuine followers: 10 points
  • Lead rate (confirmed leads per click on your promotion link): 5 points

We only receive the location data of your followers if you connect your Instagram account and Instagram provides this data for your account. Without it, the points for local followers do not apply.

This is an automated individual decision under Article 22 of the GDPR. If your score for a restaurant is below 40, you are not shown to that restaurant in the search. You have the right to request a manual review of your score by a Hiddin staff member, in the app or by email to fabian@hiddin.app. Requests are processed within 14 days, and you will receive the reasoning.

6. Facebook Page Integration (Facebook Login for Business)

When you connect a Facebook Page you manage to Hiddin, we access the following data via the Meta Graph API:

  • pages_show_list: The list of Facebook Pages you manage, so you can pick the Page to connect.
  • pages_read_engagement: The Page's follower and like counts and the engagement of its recent posts. Used to calculate your Hiddin Score.

What we do NOT do (Instagram and Facebook): We do not post on your behalf, we do not read your DMs, we do not access your contacts, we do not manage ads on your account. We do not sell your data to third parties.

Storage & Refresh: Access tokens are encrypted (AES-256-CBC) and stored only on our EU-hosted backend. Insights are refreshed on demand ("Refresh") and cached on our servers. Tokens can be revoked at any time.

Disconnect: You can disconnect your Instagram account or Facebook Page at any time inside Hiddin (Settings → Social Media → "Disconnect") or via your Facebook Settings → Apps and Websites → Hiddin → Remove. We then permanently delete all Instagram and Facebook data within 30 days, as confirmed by our Data Deletion Callback.

7. YouTube Integration (YouTube Data API)

Hiddin uses YouTube API Services. When you connect your YouTube channel to Hiddin (Settings → Social Media → "Connect with YouTube"), you sign in with Google and grant the read-only scope youtube.readonly. We then access the following data via the YouTube Data API:

  • Your channel title, custom URL and thumbnail. Used to show the connected channel inside Hiddin.
  • Your channel statistics: subscriber count, video count and total view count. Used to calculate your Hiddin Score.
  • Like, comment and view counts of your most recent videos. Used only to compute your average engagement rate.

We do not upload, edit or delete videos, we do not read comments' contents or private data, and we do not post on your behalf. Restaurants only see the aggregated Hiddin Score, never your raw YouTube data.

Google API Services User Data Policy: Hiddin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting your YouTube channel you also agree to the YouTube Terms of Service; Google's handling of your data is described in the Google Privacy Policy.

Storage & Refresh: Google access and refresh tokens are encrypted (AES-256-CBC) and stored only on our EU-hosted backend. Channel statistics are refreshed on demand ("Refresh") and cached on our servers for up to 30 days.

Disconnect: You can disconnect your YouTube channel at any time inside Hiddin (Settings → Social Media → YouTube → "Disconnect"); we then revoke the token and delete the stored YouTube data. You can also revoke Hiddin's access in your Google Account security settings.

8. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Hiddin service
  • Legitimate interests (Art. 6(1)(f) GDPR): Fraud prevention, platform security, analytics
  • Consent (Art. 6(1)(a) GDPR): Newsletter subscriptions, marketing cookies, social media connections
  • Legal obligation (Art. 6(1)(c) GDPR): Tax records, invoicing

9. How We Use Your Data

  • Providing and improving the Hiddin platform
  • Matching influencers with restaurant campaigns
  • Processing payments and payouts
  • Sending transactional emails (password reset, payout notifications, invoices)
  • Sending newsletter campaigns (only with explicit double opt-in consent)
  • Fraud prevention and platform security
  • Legal compliance and tax obligations

10. Data Sharing

We share your data only with:

  • Stripe: Payment processing (USA — Standard Contractual Clauses apply)
  • Resend: Email delivery (EU — based in EU)
  • Anthropic: AI-powered features (USA — Standard Contractual Clauses apply)
  • OpenAI: Voice transcription (USA — Standard Contractual Clauses apply)
  • Wise / PayPal: Payouts to influencers (EU/USA — Standard Contractual Clauses apply)
  • Meta Platforms: Analytics and advertising (USA — Standard Contractual Clauses apply)

We never sell your personal data to third parties.

11. Data Retention

  • Account data: Retained for the duration of your account + 3 years after deletion
  • Invoice and payment data: 10 years (Spanish tax law requirement)
  • Newsletter subscriptions: Until you unsubscribe or request deletion
  • Server logs: 90 days
  • Error reports (own error logging): 90 days after the last occurrence

12. Your Rights

Under GDPR and LOPDGDD, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Portability: Receive your data in a machine-readable format
  • Objection: Object to certain types of processing
  • Restriction: Request restricted processing

To exercise your rights, contact us at fabian@hiddin.app or use our Data Deletion Request page.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es

13. Cookies and similar technologies on our website

On hiddin.app we only store or read information in your browser (cookies and local storage) when this is strictly necessary for the site or when you have consented (Art. 5(3) ePrivacy Directive as implemented by Art. 22(2) LSSI and § 25 TDDDG, Art. 6(1)(a) GDPR). On your first visit, a notice asks for your choice: "Accept all", "Reject all" or "Settings", where you can switch each category on or off individually. Optional categories are off by default. Before you consent, the site loads no optional service.

Changing or withdrawing your choice: at any time via the "Cookie settings" link at the bottom of every page (open cookie settings now). Withdrawal takes effect for the future; we then delete the Meta cookies _fbp and _fbc and reload the page so the pixel stops immediately. We store your choice with a version number and timestamp in your browser and ask again after 12 months or when we add services.

  • Necessary (always on): hiddin_consent (your choice with version and time, 12 months); hiddin_lang (only if you choose a language yourself, until you change it or clear the site data); hiddin_scout_ref and hiddin_si_ref (only if you arrive via an invitation link, so your sign-up is credited to the person who invited you, 30 days). All are kept in your browser's local storage and are not shared with third parties. Legal basis: Art. 22(2) LSSI, § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is running the site in your chosen language and crediting invitations correctly.
  • Statistics (only with consent): Hiddin Statistics, our own measurement script running on our server at Hetzner Online GmbH in the Nuremberg data centre (Germany); no third party receives the data. Purpose: understanding how the site is used and improving it. For each page view we record the page visited, the previous page (referrer) and campaign parameters, language, window size, device type, operating system and browser, how long the page was visible, how far you scrolled, and clicks on links, buttons, text, form fields (their name only) and empty areas with their position on the page (never any text you type). The script also measures how quickly the page loads and responds in your browser (time until the largest content appears, response time to clicks, layout shifts) so we can make the site faster. The script sets no cookies and stores nothing in your browser. Your IP address is used only briefly to determine country and region and to form a non-reversible visitor key that changes daily; it is not stored. Retention: 13 months. Legal basis: your consent, Art. 22(2) LSSI, § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw at any time via "Cookie settings"; measurement stops immediately.
  • Server log (without consent): Like every web server, ours technically logs each request (time, address, status code, browser identifier, referring page shortened to its domain). From this we count page views, sources, device type, country and region. Your IP address is used only to determine country and region and for a non-reversible visitor key that changes daily; it is not stored in the statistics. Nothing is read from or written to your device. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure website that meets visitors' needs. Retention of the counts: 13 months.
  • Marketing (only with consent): Meta Pixel by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (pixel ID 808552888395713), on the home page, the pages for restaurants, influencers, scouts and super influencers, and campaign landing pages. Purpose: measuring whether our ads on Facebook and Instagram work. Your browser sends page views (PageView), views of specific pages (ViewContent) and clicks on the app store links (Lead) to Meta, together with your IP address, browser and device details, the visited address and the cookies _fbp and _fbc (90 days each). If your browser is logged in to Facebook or Instagram, Meta can link the data to your account. We are joint controllers with Meta for the collection and transmission (Art. 26 GDPR; Meta's joint controller addendum); Meta alone is responsible for any further processing. Meta may transfer data to Meta Platforms Inc. in the USA; Meta Platforms Inc. is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Legal basis: your consent, Art. 6(1)(a) GDPR. More from Meta: Privacy Policy.

Rejecting has no disadvantage for you; all content and functions of the site remain available.

14. Signing in with Apple and Google

You can sign in to Hiddin with an email address and password, with your Apple ID ("Sign in with Apple"), or with your Google account. When you sign in with Apple or Google, we receive your name and email address and an identifier that lets us recognise your account. We never receive a password.

If you choose Apple's "Hide My Email" option, we only receive the relay address Apple generates. The legal basis is Art. 6(1)(b) GDPR (performance of a contract: providing your account). Apple's and Google's own processing is governed by their privacy policies: Apple and Google. You can revoke the connection at any time in your Apple or Google account settings.

15. Hosting and Processors

Our servers are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in their Nuremberg data centre. Hetzner processes the data solely on our behalf. The fonts on our websites are served from our own servers (hiddin.app); your browser does not connect to Google. If a restaurant chooses a Google Fonts typeface for its guest form, our server fetches it from Google and passes it on; Google receives no data about you, in particular not your IP address.

We also use the following service providers. Each receives only the data required for its task:

  • Stripe – credit top-ups and card payments.
  • PayPal – payouts to influencers, super-influencers and scouts.
  • Wise – payouts by bank transfer.
  • Resend – delivery of our emails, including newsletters to guest contacts.
  • Anthropic – analysis of images and text for newsletter creation and design checks, and drafting replies to Google reviews.
  • Expo – delivery of push notifications (see section 18).
  • api.qrserver.com – generation of QR code images. Only the link contained in the code is transmitted, never names or email addresses.

Where a provider is located outside the EU, transfers are covered by the European Commission's Standard Contractual Clauses. We conclude data processing agreements under Art. 28 GDPR with all providers.

Own error logging. We log technical errors ourselves, without a service provider, on our server at Hetzner in Germany. When the app crashes, an error occurs in the app, the server or the admin area, or a screen or request takes longer than 3 seconds, we store the error message and the technical trace (code location), the screen or the address without parameters, the duration, app version, operating system and version, device model, the time and, for signed-in users, the internal account ID. We do not store names, email addresses or form content; access keys, email addresses and links with one-time codes are removed before storage. We use the IP address only briefly to protect against overload and do not store it. Identical errors are grouped and deleted 90 days after their last occurrence. The purpose is to find and fix errors and improve slow parts; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in a stable service). Only the Hiddin team can see this data.

16. Reviews

When a restaurant connects its Google Business Profile, we retrieve the publicly visible details of its Google reviews – text, star rating, the reviewer's displayed name and the date. We use them to draft reply suggestions and, if the restaurant has switched on automatic replies, to publish replies on its behalf. Replies are drafted with Anthropic (see section 15). The legal basis is Art. 6(1)(f) GDPR (the restaurant's legitimate interest in responding to reviews).

When a guest has redeemed an offer at the restaurant via QR code, we send them an email about two hours later asking them to review the restaurant on Google. For this we use their first name and email address. The legal basis is Art. 6(1)(f) GDPR (the restaurant's legitimate interest in feedback from its guests).

We do not report reviews to Google and do not request deletions.

17. Advertising via Meta

On request we set up and manage advertising campaigns on Meta (Facebook and Instagram) for a restaurant. We process the restaurant's details about the offer, budget and target area, together with its ad account identifier.

Audiences are defined by location, age and interests. We do not transfer guest contacts, email addresses or customer lists to Meta, and we do not build Custom Audiences from your data. Campaign figures (reach, clicks, cost) are retrieved from Meta in aggregate and shown to the restaurant. The legal basis is Art. 6(1)(b) GDPR in relation to the restaurant. Meta is independently responsible for processing within its own systems; see the Meta Privacy Policy.

18. Push Notifications

If you use our app and allow notifications, your device generates a random identifier (push token) which we store in order to alert you to new guest contacts, payouts or messages. Delivery runs through Expo and the systems operated by Apple and Google.

The token is not linked to a person and carries no content. The legal basis is your consent, Art. 6(1)(a) GDPR. You may withdraw it at any time by turning notifications off in your device settings or in the app; we then delete the token.

19. Referral codes and assignment to the referrer

If you come to Hiddin through the link or code of a Scout, Super Influencer or Influencer, we assign your registration to that person. This is used to settle the referral and for the referrer's statistics. We count clicks only as a number; we do not use IP addresses, device identifiers or browser characteristics to assign you to a referrer. The legal basis is our legitimate interest in settling referrals correctly, Art. 6(1)(f) GDPR. You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR) by email to fabian@hiddin.app.

The referrer receives a notification (push) that a restaurant or an influencer has registered through their link or code; for an influencer, the referrer can see the influencer's @handle. We keep the assignment for as long as it is needed to settle the commission and afterwards for the statutory retention periods.

On the page hiddin.app/code the code is copied to your device's clipboard. At first the app only checks whether the clipboard contains text, without reading its content. It reads the content only during registration, after you have chosen your role, tapped "Continue" and iOS has asked for your permission. If you tap the system "Paste" button instead, the app reads the clipboard without a further prompt, because tapping it is your own action. The app accepts only text in the format of a Hiddin code (8 characters, e.g. ABCD-EFGH) and discards any other content immediately, without storing, sending or displaying it. The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by tapping "Continue" and allowing the iOS prompt, or by tapping "Paste". You can withdraw it at any time by declining the prompt, entering the code by hand or not allowing Hiddin to paste from other apps in the iOS settings.

On that page you can voluntarily enter your email address so that, when you register with the same address, we can assign your registration to the referrer. We store the address together with the code as an assignment hint for 14 days. After that we delete the hint in our daily clean-up, at the latest one day after it expires. If the same address is entered via the codes of several referrers, we store a separate hint for each of them (at most 10 per address); a later hint does not replace an earlier one. If you register with this address, we delete the hints immediately: if the address was entered no more than 6 hours earlier and only via the code of a single referrer, we assign you automatically. If it was entered longer ago or via the codes of several referrers, we do not assign you automatically but create a report for manual review by Hiddin for each of these referrers. Each report contains your address, an explanatory note and a reference to your account. We keep it until our decision and for 90 days afterwards; then we remove the personal details (address, name, note). The reference to your account remains as a record of the decision until your account is deleted. If you are already assigned through a link or code, that assignment stays. The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by entering the address voluntarily. You can withdraw it at any time by email to fabian@hiddin.app; we will then delete the address without delay.

Referrers can also report to us that a restaurant or influencer came through them. To do so, they provide that person's email address or name and a note; we therefore receive these details from the referrer, not from the person concerned. We review the report and assign manually or reject it. The legal basis is our legitimate interest in settling referrals correctly, Art. 6(1)(f) GDPR. We keep the report until our decision and for 90 days afterwards; then we remove the personal details (email address, name, note). If we have not decided on a report within 180 days, we reject it automatically in our daily clean-up; in that case too, the 90 days run from the day of that rejection. The same applies to reports created from an email hint. If the account of the reported person or of the referrer is deleted, we remove the details earlier. If you have been reported as a restaurant or influencer, you can request access to these data, ask for their deletion and object to the processing, in each case by email to fabian@hiddin.app.

20. Email information with consent (double opt-in)

On hiddin.app/anmelden you can sign up as a restaurant or as a food creator to receive emails from Hiddin. Restaurants receive information on how to win new guests through food creators, along with offers and news from Hiddin; food creators receive collaboration offers from restaurants and news about Hiddin. For this we process your email address, the role and language you choose and, if you provide them, your name or the name of your business and your city. If you reach the page through an ad, a letter, a Scout, a collaboration request (section 21) or a referral link, we store that origin and, where applicable, the referral code. The legal basis is your consent, Art. 6(1)(a) GDPR.

After you submit the form we send you an email with a confirmation link. Your sign-up only takes effect once you open the link and confirm it there; the link is valid for 7 days. Without confirmation you will not receive any further emails from us, and we delete the details 30 days after the last confirmation email. If you agree during a phone call with us, we enter your address with a short note about the conversation and send you the same confirmation email; in that case too, the consent only applies after you confirm.

So that we can prove that and how you consented, we store for each sign-up the exact wording and version of the consent text, as well as the time, IP address and browser identifier (user agent) of the sign-up and of the confirmation click and, if you add the call consent later, also of that addition and its confirmation click. The legal basis is our obligation to be able to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR) and our legitimate interest in defending ourselves against claims over unsolicited advertising (Art. 6(1)(f) GDPR).

You can voluntarily enter a phone number and agree, in a separate box, that we may call you to present offers and news from Hiddin, including with an AI phone assistant. Such an assistant identifies itself as AI at the start of the call. This consent is independent of the email consent and also only takes effect with the confirmation click; without it we do not store a phone number. Even with this consent, we only call you once your phone number has been confirmed. We store the number together with the wording and version of this consent and use it only for these calls; we record the exact wording as it stands at the time of your confirmation. The legal basis is your consent, Art. 6(1)(a) GDPR. If we use a provider's AI phone assistant for the calls, we will name it in section 15 beforehand.

You can withdraw your consents at any time with effect for the future. The unsubscribe link in every email withdraws the email consent and the call consent together. By email to fabian@hiddin.app you can withdraw both or only the call consent. Emails that belong to a Hiddin account, such as password emails, are not affected.

We keep the details for as long as your consent is in place. After a withdrawal we immediately delete the browser identifiers as well as the name, city, referral code and notes on the conversation. We keep the rest of the proof (address, wording, times and IP addresses) for 3 more years and then delete it; we delete a phone number 3 years after the call consent is withdrawn. Our daily clean-up applies these periods.

We send the emails through Resend (see sections 10 and 15); Resend receives your email address and the content of the email for this purpose. The details are stored on our servers at Hetzner (section 15). We do not use any tracking or advertising tools on the sign-up page.

21. Collaboration requests to creators

We email creators individually if their public Instagram, TikTok or YouTube profile gives an email address expressly for collaborations. Each message contains a specific offer from a restaurant, with the service, the payment and the period. We send at most one request to the same address in 30 days. For this we store your handle, the platform, the profile URL, the address given, your city and follower count, the wording of your profile description with the time we retrieved it, and the offer. These details come from your public profile or from exports of creator databases such as Heepsy or Modash, not from you directly. We keep the wording of the profile description so that we can show you had given the address for collaborations.

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest, and that of the restaurant, in proposing a specific collaboration to you through the address you yourself published for such requests.

If you accept a request, the restaurant that sent it receives your handle, the platform and your email address so that it can arrange the collaboration with you. This happens at your request; the legal basis is Art. 6(1)(b) GDPR.

We delete drafts and failed attempts 90 days after they were last changed, and sent and accepted requests after 12 months. You can object to this processing at any time using the link in the email or by emailing fabian@hiddin.app (Art. 21 GDPR); after that we will not contact you again. To make sure of this, we keep only your address and the related times on a block list and delete all other details. The legal basis for this is our legitimate interest in permanently respecting your objection (Art. 6(1)(f) GDPR).

22. Invitations to restaurants

Influencers, Scouts and Super Influencers can invite a restaurant to Hiddin by email from the app. To do so they enter the business's email address, optionally its name, and the language of the invitation, and confirm that the business has allowed Hiddin to send it this invitation by email. We then send a single invitation from Hiddin that shows the first name of the person inviting. We receive these details not from the restaurant itself but from the person inviting.

We store the email address, the restaurant's name (if given), the language, who sent the invitation, the time of the invitation, and the time, text version and wording of the confirmation that the business agreed. The purpose is to send you the invitation and to assign your restaurant to the person inviting if you register with Hiddin using exactly this address within 90 days and are not already assigned through another link or code (section 19). After 90 days the invitation no longer assigns anything. The person inviting sees the address, the name and the status of the invitation (invited, registered, expired or unsubscribed) in their app and receives a notification when your restaurant registers.

The legal basis for the invitation is your consent as a business, Art. 6(1)(a) GDPR, which the person inviting confirms to us. We send the invitation only once and do not send reminders; we do not write to existing Hiddin accounts or blocked addresses. You can withdraw your consent using the unsubscribe link in the invitation or by emailing fabian@hiddin.app. We then add your address permanently to our block list and send you no further invitations. The legal basis for the block list is our legitimate interest in permanently respecting your withdrawal (Art. 6(1)(f) GDPR).

Invitations that do not lead to a registration are deleted 12 months after they were sent; until then the person inviting can see their status. After that, another person can invite you again if you have allowed them to. If your restaurant registered through the invitation, we keep it as proof of the attribution for as long as your restaurant account and the account of the person inviting exist. If the account of the person inviting is deleted, we delete their invitations with it. If your restaurant account is deleted, we remove the link between the invitation and your account and delete the invitation 12 months after it was sent. We send the invitation through Resend (section 15).

Invitations to the Super Influencer programme. Hiddin invites individual people by email to the Super Influencer programme when they have allowed us beforehand to send them this invitation; our team records this when sending it. We store the email address, the language, who sent the invitation, the time, version and wording of that confirmation and whether the invitation was used. The purpose is to send you the invitation and to show you the offer if you sign up as an influencer with exactly this address within 30 days. The legal basis is your consent, Art. 6(1)(a) GDPR. You can withdraw it through the unsubscribe link in the invitation or by emailing fabian@hiddin.app; we then add your address permanently to our block list (Art. 6(1)(f) GDPR). Invitations that are not used are deleted 12 months after they were sent; used ones are kept for as long as your account exists. We send the invitation through Resend (section 15).

23. Contact

For any privacy-related questions:
Email: fabian@hiddin.app
Address: WEEBEE DESIGN, S.L., Calle Gremi de Fusters 33, Local 6, 07009 Palma de Mallorca, Spain