Privacy Policy

1. Who is responsible for your data?

Budget Explorer is a personal independent website project operated by Emmanouil Parsonoglou, not a company. For this website, the person who determines why and how personal data is processed is generally the data controller, subject to the facts of the actual processing. For privacy questions and requests, contact Emmanouil Parsonoglou at budgetexplorer2026@gmail.com or use the website’s Contact form. Budget Explorer is operated by a natural person and is not presented as a company. No company registration number is provided because the project is not represented as an incorporated company. Where applicable law requires further contact or identification details, the operator will provide the information legally required; no postal address or registration details should be inferred from this notice.

2. Personal data we may process

• Account and authentication: email address, account identifier, authentication/session information and security-related records.
• Profile: profile photo and profile information you choose to provide.
• Saved content and trips: saved places, preferences, itineraries and trip details you choose to store or synchronise.
• Suggestions and ratings: place details, review/rating content, moderation status and technical information used to prevent abuse.
• Contact communications: name, email address, subject, message and information needed to respond.
• Search and location: destination, search terms, approximate or precise location if you choose to provide it or request location-based functionality. The site does not intend to continuously track your location in the background.
• Technical and security data: IP address, device/browser information, request logs and diagnostics that may be processed by hosting, authentication, security or network providers.
• Advertising and referral data: information processed by Google advertising technologies or affiliate networks/merchants when those technologies are used or you follow a partner link.

3. Purposes and legal bases

The legal basis depends on the specific purpose and the data involved. The operator will not rely on a single general legal basis for every activity.

• Account creation, authentication and account features you request: performance of a contract or steps taken at your request before entering a contract, where necessary to provide the requested feature.
• Saving trips, places and preferences: performance of a contract where storage is necessary for a feature you choose; otherwise, the applicable basis will be assessed for that feature.
• Receiving and handling suggestions, ratings and contact messages: steps taken at your request and, where appropriate, legitimate interests in operating, moderating and protecting the website. Public display of a submission is limited to the purpose explained by the relevant feature.
• Security, abuse prevention, troubleshooting and service integrity: legitimate interests in protecting the website, accounts and users, balanced against users’ rights and expectations.
• Keeping records or responding to lawful requests: compliance with a legal obligation where one applies, and establishment, exercise or defence of legal claims where necessary.
• Optional advertising cookies, non-essential device storage or personalised advertising: consent where required by applicable law. Refusing optional consent should not be treated as consent, and consent can be withdrawn through the available privacy controls.
• Affiliate referrals: a click may be processed by TradeDoubler or the merchant to attribute a referral. Any consent required for storing or accessing information on a user’s device must be obtained before that technology is used; the third party’s own processing is also governed by its notices.
• Google Maps/Places requests: information is processed to return the place-search or location feature requested by the user; the relevant provider may process the request under its own terms and privacy notice.

Where legitimate interests are relied upon, the relevant interest is limited to the purpose described above and is subject to an assessment of the user’s rights and reasonable expectations. Where consent is the basis, it may be withdrawn at any time; withdrawal does not affect processing lawfully carried out before withdrawal.

4. Local storage, cookies and consent evidence

The application uses browser storage for operational preferences and requested features. The privacy-choice mechanism stores the selected choice, notice version and a random pseudonymous consent ID in local storage. Each choice change is also recorded in a server-side Netlify Blobs audit store with event ID, selected categories, policy version, language, page, timestamps and limited browser user-agent information. The site does not intentionally include an IP address in this event. Audit records are accessible only to an authenticated administrator. These records help evidence the choice and timing but do not independently identify a named person. Authentication providers may set cookies or similar mechanisms to maintain a secure sign-in session. Clearing browser site data may remove local preferences and may sign you out; it does not automatically delete an audit event already received by the server. See the Cookie Policy for details.

5. Service providers, recipients and tools

The following is the provider list identified from the current website project files. The live deployment and provider settings should be checked before relying on this list as exhaustive; features or configuration may change.

• Netlify: static website hosting, deployment, serverless functions, identity/authentication and the server-side handling or storage used by account features. Netlify may process technical request data and data sent to the site’s functions.
• Google Maps Platform / Google Places: place search, place details, photos, geocoding and related travel-planning functions. Requests may contain search terms, place identifiers or location/address details.
• Google AdSense and Google consent-related tools: advertising and consent management where enabled. Depending on configuration and consent, Google may process device identifiers, cookie data, ad interactions and technical information for ad delivery, measurement or personalisation.
• TradeDoubler: affiliate referral routing, attribution and partner-offer delivery. When an affiliate offer is clicked, referral identifiers and technical click information may be processed.
• Affiliate merchants, including Wolt, Epapoutsia.gr, MODIVO and DJI GR: receive visitors who follow their links and may process referral information and any information the visitor provides directly to them.
• Browser module delivery: the site currently loads the Netlify Identity client library from esm.sh. The delivery provider may receive standard technical request information when the library is requested.
• Authorities, professional advisers or other recipients: only where required by law or reasonably necessary to protect rights, safety or the service.

Analytics: a separate Google Analytics, Matomo, Plausible, Umami or similar standalone analytics integration was not identified in the current project files reviewed for this notice. This is not a guarantee about every live hosting or advertising setting. Netlify logs, Google AdSense measurement and TradeDoubler referral attribution may still involve technical or performance information. The live site should be scanned periodically to confirm this statement remains accurate.

Where a provider acts as a processor, it should be subject to appropriate contractual safeguards. Some third parties, including advertising providers, affiliate networks and merchants, may act as independent controllers for some of their processing under their own notices. We do not sell personal data as a standalone data-broker product.

6. Affiliate links and partner offers

Some links in Deals/Offers and other areas are affiliate links, including links routed through TradeDoubler for partners such as Wolt, Epapoutsia.gr, MODIVO and DJI GR. If you click a partner link, you leave Budget Explorer and the partner/network may record that the visit came from our website. If you complete an eligible action, we may earn a commission at no extra cost to you unless the offer states otherwise. The partner’s own privacy notice and terms apply after you leave our site. Affiliate tracking is not the same as the account data we store for operating Budget Explorer.

See our Affiliate Disclosure. We recommend reviewing the destination’s privacy and purchase terms before sharing information or completing a transaction.

7. AI, automated processing and profiling

AI model training: Based on the current website project files reviewed for this notice, Budget Explorer does not intentionally submit account data, profile photos, saved trips, suggestions, ratings or contact messages to an AI provider to train AI models. The project files reviewed did not identify an AI model-training integration. If an AI feature or provider is added in the future, this notice must be updated before the feature is used, including to explain the data involved, purpose, provider and applicable legal basis.

Automated decision-making: Budget Explorer does not intend to make decisions about users that produce legal effects or similarly significant effects solely by automated means within the meaning of GDPR Article 22. The Travel Planner produces informational travel suggestions using website logic and place information; it does not decide a person’s legal rights, eligibility or access to essential services. Suggestions or ratings may be moderated or approved/rejected by the site operator. Routine technical processing, sorting or displaying results should not be understood as a decision with legal or similarly significant effects.

Profiling: The current project files reviewed did not identify a system that builds profiles of users to make decisions about them. Third-party advertising providers may use their own technologies for ad personalisation or measurement where enabled and permitted by the applicable consent choices; consult the relevant provider notices and cookie controls.

8. Public content and profile visibility

Place suggestions, approved listings, ratings, reviews or profile information may be displayed publicly where the feature indicates that purpose. Do not include sensitive personal data or personal data about other people in public submissions. Account-only data should not be made public unless you choose to submit it for publication or the feature clearly explains that outcome.

9. International transfers

Some providers may process data outside the European Economic Area. Where the GDPR applies, transfers must rely on an applicable legal mechanism, such as an adequacy decision or appropriate safeguards, with supplementary measures where required. Check the relevant provider’s privacy notice and transfer information for details of its processing and safeguards.

10. Retention

Data is retained only for as long as reasonably necessary for the purpose for which it was collected, the operation and security of the relevant feature, applicable legal obligations, and the establishment, exercise or defence of legal claims. Retention can differ by data type and provider. Some records may remain in backups or security logs for a limited period after deletion from active systems. The operator should maintain and apply a documented retention schedule for each data category.

11. Your rights

Where the GDPR applies and its conditions are met, you may request access, rectification, erasure, restriction of processing, data portability, or object to processing. Where processing is based on consent, you may withdraw it. You may also complain to a competent supervisory authority. In Greece, this is the Hellenic Data Protection Authority (HDPA).

To make a request, use the Contact form and identify the relevant account or request. We may need proportionate information to verify identity before disclosing or changing personal data. We will respond within the time required by applicable law.

12. Children

Budget Explorer is not designed to knowingly collect personal data from children in circumstances where parental consent or other special safeguards are legally required. If you believe a child has provided personal data unlawfully, contact us so we can assess and address the request.

13. Security and incident handling

Reasonable technical and organisational measures are used to protect the service, including access controls and server-side checks. No internet service can guarantee absolute security. If a personal data breach occurs, the controller will assess its obligations to document, notify the supervisory authority and/or inform affected individuals as required by law.

14. Changes and contact

This notice may be updated when features, providers or legal requirements change. The date above indicates the latest revision. For privacy requests or questions, email budgetexplorer2026@gmail.com or use the Contact form on Budget Explorer. The operator will keep this notice accurate as the website and its data processing change, and will provide the information required by applicable law. This personal project is not described as a company; its actual activities, including any affiliate monetisation, determine which legal duties apply.