Privacy Policy

Last updated: 31 July 2026

KalyKala is an online service — a website providing a guide and directory covering the island of Kalymnos, Greece — operated by KalyKala LLC(“KalyKala”, “we”, “us”, “our”), a limited liability company organised under the laws of the State of New Mexico, United States, at:

KalyKala LLC
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110
United States

This policy explains, in plain terms, the personal data KalyKala handles, why, who else touches it, and the rights you have. It covers the KalyKala website at kalykala.com.

KalyKala LLC is the data controller for that data, and hello@kalykala.com is the contact point for all data questions and requests, including any of the rights set out below.

KalyKala is delivered entirely online and is available to people in many countries; it is not a local service provided in any one of them. Because it is offered to people in the European Union and the United Kingdom, European data protection law (the GDPR, and the UK GDPR) applies to their data, even though KalyKala LLC is established in the United States.

To keep things simple, we apply this policy to everyone who uses KalyKala, wherever you are. Where it describes a right that exists only under a particular law — such as the GDPR rights below — that right is available to the people that law covers, and we will not refuse a reasonable request from anyone else on the ground that they live somewhere different.

The short version

We set no analytics, advertising or tracking cookies, run no fingerprinting, and show no consent banner — on purpose. The only cookies on the site are essential ones — set by our sign-in provider so the site knows whether you are signed in, and by the service that protects the sign-in system from abuse.
We do not sell, rent, or trade your personal data, and we do not use it for advertising or profiling.
We collect only what a specific feature actually needs: a business owner’s email so they can manage their own listing, a name and email if you choose to send us a message, and your name if you sign in to join an activity.
Some links on the Service are affiliate or referral links, and some features may be paid or sponsored. That does not change what data we collect about you — see “Commercial features and affiliate links” below.
You can ask us to show you, correct, or delete your data at any time by emailing hello@kalykala.com.
KalyKala is not directed at children.

What we collect, and why

We only hold personal data in a few specific places. Here is all of it.

1. Business owner emails

When a business is listed on KalyKala, an owner email can be attached to that listing. We use this email for two things and nothing else:

To let the right person edit their own listing.When you sign in, we check whether your verified sign-in email matches the email on a listing (compared ignoring upper/lower case). If it matches, you can edit that business’s page. This is the whole of our “ownership” mechanism — there are no accounts or roles beyond this match.
To send that owner practical notifications about their own listing— for example, “your page is now live,” a reminder that a daily special is about to expire, or a confirmation that a submitted listing was received.

An owner’s email is never shown publicly. (A business’s own published contact details — the phone, WhatsApp, website, email, and address it wants customers to see — do appear on its public page, but that is business contact information the business chose to publish, not the private owner login email.)

2. Messages you send us (feedback and contact)

If you use the contact form, we store your message, and — only if you choose to fill them in — your name and email. Name and email are optional; the message is required. We use this solely to read and respond to what you sent. These messages are visible only to the site administrator. When a message comes in, its contents are also emailed to the administrator so it isn’t missed (see “Email” below).

If you report an activity to us for moderation while signed in, that report is stored the same way, and it includes your sign-in name and verified email so the administrator can follow up.

3. Signing in (Google, via Clerk)

Signing in to KalyKala is done only through Google sign-in, handled by our authentication provider Clerk. When you sign in, Clerk provides KalyKala with your name and email addressfrom your Google account, plus an internal account identifier. We use this to know who you are for the features that need sign-in (editing a listing you own, joining an activity, posting in an activity thread, or reporting content). We don’t receive your Google password, and the account itself lives with Google and Clerk, not with us.

4. Joining an activity — please note this is partly visible to others

Activities and events on KalyKala let signed-in visitors join and, on some, chat in a thread. This is the one place where something you provide is shown to other people, so we want to be clear about exactly who sees what:

Anyone (even signed out) can see how many people have joined an activity — a count only, never names.
When you join an activity, the display name you choose is shown to every other signed-in person who has also joined that same activity, and to that activity’s coordinator. If there is a discussion thread, your posts and the name you post under are visible to those same fellow attendees. Please treat the name you join with as semi-public within that activity.
A signed-in visitor who has not joined an activity sees only the count — not the attendee names and not the thread. Joining is what unlocks the names and the conversation.
Your internal account identifier is never shown to anyone — not to other attendees, not to coordinators. Only the display name you pick is shown.

These rules are enforced on our server for every request, not merely hidden in the page. If you remove yourself from an activity (“un-join”), your signup is deleted — but anything you already posted in that activity’s thread stays up, under the name you posted it with. A coordinator or the administrator can also remove an attendee, which deletes that signup andhides that person’s thread posts. Thread posts that are removed are hidden rather than permanently erased.

An activity’s own coordination details — a “reveal to contact the organiser” method, or a group-chat link the organiser pasted — are provided by the organiser and may be shown publicly on the activity. These are the organiser’s own contact choices, and any conversation that happens through them happens off KalyKala, between you and the organiser directly.

5. Photos and other content you upload

Images uploaded to KalyKala (a business’s photos, logo, or activity images) are stored in our database’s file storage. These are content, not personal data about you — but if you choose to upload a picture that shows or names a person, that personal data lives inside the file you uploaded.

Analytics, cookies, and QR scans

KalyKala uses no analytics cookies, no advertising cookies, no fingerprinting script, and shows no cookie/consent banner. That no-banner state is deliberate — we built the site so there is nothing to consent to.

The site does set a small number of essential cookies, and we would rather tell you than pretend otherwise:

Sign-in cookies.Our authentication provider, Clerk, sets a few first-party cookies so the site can tell whether you are signed in and keep you signed in as you move between pages. Because they load on every page, they are present even before you sign in — at that point they simply record “not signed in.” They are notused for analytics, advertising, profiling, or tracking you across other websites, and no other site can read them. They are essential to the sign-in feature; there is no version of “sign in and stay signed in” without them.
Security cookies. The infrastructure that serves our sign-in system sets a small number of short-lived cookies to tell ordinary visitors apart from automated traffic and protect sign-in from abuse. Like the sign-in cookies, they load on every page and are present even if you never sign in. They are a security measure, not analytics: they are not used to profile you or to track you across other websites.

We measure the site in only two privacy-preserving ways, neither of which identifies you:

Umami Cloud gives us basic, aggregate analytics: which pages are viewed, and a handful of interaction counts — for example that someonetapped “call”, “WhatsApp”, “website”, “book”, “view on map”, or a card on the home page. Those interaction events carry the name of the page or place involved, never anything about you. Umami is cookieless — no cookies, no cross-site identifiers, no fingerprinting, and nothing stored on your device.
QR-code scans. When someone scans a KalyKala QR code, our redirect records one row containing only which code was scanned (a place/listing identifier) and the time it happened. Nothing else — no IP address, no browser details, no cookie, no device data, nothing that could identify a person. These counts are visible only to the administrator and are used to understand which printed codes are being used.

Like any website, the technical services that serve KalyKala’s pages (see below) briefly process ordinary connection information such as your IP address in their server logs, simply to deliver the page to you. We don’t set analytics cookies or build any profile from this.

Why we are allowed to hold it (our legal basis)

European data protection law asks us to name a “lawful basis” for each purpose. Ours are:

What	Why we hold it	Lawful basis
A business owner’s email on a listing	So the right person — and only that person — can edit their own listing, and so we can send them practical notices about it	Legitimate interests: operating an accurate directory and keeping listings in the hands of the businesses they belong to. Where the business submitted the listing itself, we are also acting at their request.
Your name and email if you write to us	To read your message and reply to it	Legitimate interests: answering people who contact us. You choose whether to give a name and email at all.
Your name and email from Google sign-in	To provide the signed-in features you asked for — editing your listing, joining an activity, posting in a thread, reporting content	Performance of our agreement with you: you cannot use these features without an account, and you chose to sign in.
Your display name on an activity you joined	So the other people going, and the organiser, know who is coming	Performance of our agreement with you: joining an activity is what you asked to do, and being visible to fellow attendees is the point of it.
Aggregate analytics and QR-scan counts	To understand which pages and which printed codes are actually used	Legitimate interests: operating, maintaining and improving the Service. Neither identifies you.

We do not rely on consent for any of the above, which is why there is no consent banner — but you can object to anything based on legitimate interests at any time by emailing hello@kalykala.com.

Who else processes data (our service providers)

KalyKala is a small site built on a handful of trusted services. Each one only ever sees the data it needs to do its job:

Convex— our database and file storage; this is where the site’s data and uploaded media live. The production database is hosted in the EU (Ireland, eu-west-1 region).
Vercel — hosts and serves the website itself.
Clerk — handles Google sign-in and tells us your name and email when you sign in.
Resend — delivers the emails we send from hello@kalykala.com (so recipient addresses and message contents pass through Resend to be delivered).
Umami Cloud — our cookieless analytics, described above. It receives page and interaction counts, not personal data.
Google Places API — used onlyas an optional autofill helper when a business listing is being filled in: on the “list your business” form, and in the listing editor used by us and by business owners. It saves retyping details that are already public. When used, it pre-fills blank fields with a strictly limited set of facts: business name, address, location, phone number, website, and opening hours, plus a place identifier. We deliberately never request or store ratings, reviews, or photos from Google. It is never triggered for ordinary visitors browsing the site.

Where your data goes

The production database and its file storage are hosted in the European Union (Ireland, eu-west-1), so the site’s stored data — listings, messages, signups, uploaded images — sits in the EU.

However, KalyKala LLC is established in the United States, and some of the providers above are also based outside the EU. So your personal data is accessed from, and in some cases processed in, the United States. Where personal data leaves the EU, those transfers rely on the safeguards available under EU law — such as the European Commission’s Standard Contractual Clauses and, where a provider is certified, the EU–US Data Privacy Framework. You can ask us at hello@kalykala.com which safeguard applies to a particular provider.

We do not send your personal data to anyone beyond the providers listed here, with one ordinary exception: email you send to hello@kalykala.com(and our replies) passes through standard email infrastructure — our domain’s mail forwarding service and the receiving mailbox provider — the way any email does. We do not use any of your data for advertising.

Commercial features and affiliate links

Some outbound links on the Service — for example links to ferry booking — are affiliate or referral links, meaning we may receive a commission if you go on to book or buy through them. We may also offer paid, promoted, or sponsored placements and other paid features from time to time.

This does not change anything in this policy about your data:

Following an affiliate link takes you to that third party’s own site, where their privacy policy and cookies apply, not ours. We do not pass them any personal data about you; the link simply identifies KalyKala as the referrer.
We do not sell, rent, or trade your personal data, and we do not build advertising or profiling data about you — including for any paid or sponsored feature.
If we ever introduce a feature that requires us to handle personal data differently — for example taking payment — we will update this policy first and describe it here.

Email we send

We send only practical, plain-text emails, all from hello@kalykala.com via Resend:

To a business owner: that their page is now live, a reminder that a special is expiring, or a confirmation that their submitted listing was received.
To the administrator: an alert that a new business was submitted, that a shared trip was created, or that someone used the contact form — in which case the sender’s name, email, and message are included so we can reply.

We don’t send newsletters or marketing email, and there is nothing to unsubscribe from.

How long we keep things

KalyKala is small, and today data is kept for as long as the related listing, message, or record exists — there is no automatic expiry:

Messages you send us(contact and reports) are kept indefinitely. When an administrator “removes” one it is hidden from the admin list rather than erased — the row, including any name and email you gave, stays in the database until we delete it by hand.
Activity signupsare kept until you remove yourself (“un-join”) or a coordinator/administrator removes the attendee. This is the one piece of self-service deletion built into the site: you can take yourself out of an activity at any time while signed in, and that signup row really is deleted. Note that un-joining does notremove anything you posted in that activity’s discussion thread — those posts, and the name you posted under, stay visible to the people still in that activity. Ask us at hello@kalykala.com if you want them taken down too.
Activity thread posts that are removed are hidden rather than permanently erased.
Business listings, including the owner email attached to them, are kept for the life of the listing; when a listing is taken down it is archived rather than hard-deleted.
QR-scan counts are kept indefinitely, but as noted they contain nothing that identifies anyone.

If you want your data actually deleted rather than just hidden, email hello@kalykala.comand we’ll do it by hand.

Your rights

Under the GDPR you can, at any time:

See what personal data we hold about you;
Correctanything that’s wrong;
Deleteyour data (“right to erasure”);
Restrict or object to how we use it, and ask for a copy to take elsewhere.

To use any of these, email hello@kalykala.com. Most are handled manually; we will respond within one month, as the GDPR requires. If you signed in via Google, note that your underlying Google/Clerk account is managed by those services; we can delete what KalyKala holds, and you control the Google account itself. If you believe we’ve mishandled your data and you are in the EU or the UK, you also have the right to complain to the data protection supervisory authority where you live, where you work, or where the problem happened.

Children

KalyKala is a general-purpose guide and directory and is not directed at children. We don’t knowingly collect personal data from children. If you believe a child has provided us personal data, contact hello@kalykala.comand we’ll remove it.

Changes to this policy

If we change this policy, we’ll update it on this page and change the “Last updated” date at the top. For anything significant, the change will be reflected here rather than sent to you, since we don’t hold a general mailing list. Please check back from time to time.

Contact

Questions, requests, or concerns about privacy — or anything else — go to hello@kalykala.com, or by post to KalyKala LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States.