Privacy Policy

Data controller and contact

XIAOXIONG LDA
Edifício Atlantis, Av. Dom João II 44 C, Piso 3
1990-095 Lisboa, Portugal

Email: comercial@xiaoxiong.pt
Phone: +351 968 815 050

1. Data we collect

Account: the email address you give when signing in, and your sign-in session. Content you submit: bench records and photos, footprints, restaurant claims and business applications (including operator name, role, phone, work email and proof documents), website requests and the details you fill in; feedback you send (the email you give and your message; the email is used only for the confirmation and to reply to you); coupons: the coupons you hold, points exchanges, and redemption records (place, time, merchant account, request IP and device details), kept to prevent abuse and to reconcile with restaurants. Location: only if you grant permission in your browser and use the location feature; the browser uses it on your device to match the nearest city and it is not stored on our servers. Technical data: the request IP address, used for security and rate limiting, not for advertising profiles. AI guide: the questions you type and the context of the page you are viewing.

2. Purposes and legal bases

To provide sign-in and your account (performing the service you request); to store and show the benches, footprints and claims you submit; to verify businesses and applications; to prevent abuse and keep the service secure (legitimate interests); to answer guide questions; and to meet legal obligations. We do not sell personal data and do not use third-party advertising or behavioural tracking.

3. Cookies and local storage

We use only cookies needed to run the site: the Supabase sign-in session, the return path after sign-in, language and home-city preferences (xiaoxiong-home-city, 30 days if chosen manually, 1 day if set by location) and the AI guide panel state. The AI guide conversation stays only in the current browser tab and is cleared when you close it. These are essential and not used for advertising, so we show no cookie consent banner.

4. Service providers (processors)

Supabase (authentication, database and file storage); Cloudflare (hosting, network and rate limiting); OpenRouter and the model services behind it (AI guide, which process your questions and relevant site data; this site’s servers do not store the conversation); Google (maps, routes and ratings, see the Google ratings page; opening a Google Maps link takes you directly to Google, whose privacy policy applies); sign-in codes are emailed through Supabase Auth, and feedback confirmations and notifications through Resend; before feedback is sent, Cloudflare Turnstile checks that you are human (it processes your IP address and browser signals to detect automated traffic). Some providers may process data outside the European Economic Area, relying on safeguards such as standard contractual clauses.

5. Retention

Your account and submitted content are kept until you ask for deletion or they are no longer needed; business applications and proof documents during review and the legal retention period; the Google ratings cache for about 15 days; rate-limiting counters are short-lived.

6. Your rights

Under the GDPR and Portuguese law you may access, correct or erase your personal data, restrict or object to processing, and request portability, and you may withdraw consent at any time where processing relies on it. Contact us at the email below. You may also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

7. Children

This site is for general travellers and is not directed at children under 16; we do not knowingly collect their personal data.

8. Changes

We may update this policy and will show the last-updated date at the top. Material changes will be highlighted on the site.