Legal
Privacy Policy
What we collect when you use New Around, why we collect it, and what you can do about it. Written to satisfy Articles 13 and 14 of the GDPR.
Draft — not yet complete. The operator details on this page are still placeholders. Fill in lib/legal.ts before this site is treated as legally compliant.
The short version
You can browse New Around without an account, and we do not set advertising cookies or track you across other websites. What we do collect is the technical data every web server receives, aggregated visitor statistics, and error reports that help us fix things when the site breaks. One of those error reports can include a recording of your session — details in section 5.
1. Who is responsible
We are a small operation and have not appointed a data protection officer, as we are not required to under Article 37 GDPR.
2. Server log data
Every time a page is requested, our hosting provider records the IP address, the browser and operating system, the requested URL, the referring page and a timestamp. This is technically necessary to deliver the site and to defend it against attacks and abuse.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a secure and functioning website.
Retention: Log data is kept by our hosting provider for a short period and then deleted or aggregated.
3. Rate limiting
To stop automated abuse of our public forms and API endpoints, we store your IP address together with the endpoint you called and a timestamp in our own database. Entries are deleted automatically once the relevant time window has passed — a matter of minutes.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in protecting the service from abuse.
4. Analytics
We use Vercel Web Analytics and Vercel Speed Insights to understand which pages are visited and how quickly they load. These tools do not set cookies, do not store a device identifier and cannot follow you to other websites. What we see is aggregated: page paths, referrer, country, device category.
Because no information is stored on or read from your device, this does not require consent under § 25 German Telecommunications Digital Services Data Protection Act (TDDDG).
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in understanding and improving how the site is used.
5. Error tracking and session replay
We use Sentry to find out when something goes wrong. When an error occurs, Sentry receives the error details, the URL, your browser and your IP address. Data is processed in Sentry's European data region.
Sentry also records session replays: a reconstruction of what happened in the page — clicks, scrolling, navigation — so we can see how an error came about. This is applied to roughly one in a hundred sessions at random, and to sessions in which an error occurs. Text content and form inputs are masked by default by Sentry's replay integration, but a replay is still a detailed record of your visit.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a stable, debuggable service. If you object to session replay, tell us at contact@newaround.com, or use your browser's “Do Not Track” setting or a script blocker.
6. Submitting a place
If you use our submission form, we process what you enter — the venue details, any photographs you upload, and the contact details you choose to provide. We use this to review the submission and, if we publish it, to display the listing. Your name and contact details are not published unless you ask us to credit you.
Legal basis: Article 6(1)(b) and (f) GDPR — handling the submission you asked us to consider, and our legitimate interest in maintaining an accurate directory.
Retention: Submissions are kept as long as the listing is published or for as long as we need them to document where a listing came from.
7. The map
Our map page loads map tiles from Mapbox. When you open it, your IP address is transmitted to Mapbox in the United States so the tiles can be delivered to your browser. Other pages do not load Mapbox.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in offering a usable map.
8. Accounts
The public site has no user accounts. Authentication via Clerk applies only to administrators signing in to manage content, and to users of our mobile app. If that applies to you, Clerk processes your email address, session identifiers and IP address on our behalf.
Legal basis: Article 6(1)(b) GDPR — performance of the agreement under which you were given access.
9. Storage on your device
The site itself does not store anything in your browser for regular visitors. The error-monitoring service described in section 5 may keep a short-lived session identifier in your browser's session storage, which is cleared when you close the tab. Administrators additionally receive a session cookie when signed in.
None of this is used for advertising or profiling. You can clear it at any time through your browser settings.
10. Fonts
The typefaces used on this site are served from our own servers. No connection to Google Fonts is made from your browser, and no data reaches Google when you load a page.
11. Who processes data on our behalf
The following providers process personal data for us. Where a provider is located outside the European Economic Area, transfers are based on the European Commission's Standard Contractual Clauses under Article 46 GDPR and, where applicable, the EU–US Data Privacy Framework.
Vercel
- Provider:
- Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
- Purpose:
- Hosting and delivery of the website
- Data:
- IP address, user agent, requested URL, referrer, timestamp (server logs)
- Processed in:
- USA / EU (edge network)
- Privacy policy:
- https://vercel.com/legal/privacy-policy
Vercel Web Analytics & Speed Insights
- Provider:
- Vercel Inc., USA
- Purpose:
- Aggregated visitor statistics and page performance measurement
- Data:
- Page path, referrer, country, device type, browser — no cookies, no cross-site identifier
- Processed in:
- USA / EU
- Privacy policy:
- https://vercel.com/docs/analytics/privacy-policy
Supabase
- Provider:
- Supabase Inc., 970 Toa Payoh North, Singapore
- Purpose:
- Database and file storage for place data, photos and rate limiting
- Data:
- Content data, uploaded images, IP address (rate limiting, stored short-term)
- Processed in:
- Australia (ap-southeast-2)
- Privacy policy:
- https://supabase.com/privacy
Sentry
- Provider:
- Functional Software Inc. (Sentry), USA — EU data region
- Purpose:
- Error tracking, performance monitoring and session replay
- Data:
- Error details, URL, user agent, IP address, and — for a small sample of sessions — a recorded reconstruction of the page interaction
- Processed in:
- EU (de.sentry.io)
- Privacy policy:
- https://sentry.io/privacy/
Mapbox
- Provider:
- Mapbox Inc., 740 15th Street NW, Washington DC 20005, USA
- Purpose:
- Interactive map on /map (loaded only when that page is opened)
- Data:
- IP address, map viewport, requested tiles
- Processed in:
- USA
- Privacy policy:
- https://www.mapbox.com/legal/privacy
Clerk
- Provider:
- Clerk Inc., 660 King St, San Francisco, CA 94107, USA
- Purpose:
- Authentication — administrator login and mobile app sign-in only
- Data:
- Email address, session identifiers, IP address
- Processed in:
- USA
- Privacy policy:
- https://clerk.com/legal/privacy
Google Maps Platform
- Provider:
- Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
- Purpose:
- Address lookup and place metadata — called from our server, never from your browser
- Data:
- Search terms and coordinates entered in the editor; no visitor data is transmitted
- Processed in:
- EU / USA
- Privacy policy:
- https://policies.google.com/privacy
Cloudflare
- Provider:
- Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA
- Purpose:
- DNS resolution for newaround.com and email routing for contact@newaround.com
- Data:
- DNS queries, email metadata and content sent to our contact address
- Processed in:
- USA / global network
- Privacy policy:
- https://www.cloudflare.com/privacypolicy/
12. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Article 15)
- have inaccurate data corrected (Article 16)
- have your data erased (Article 17)
- have processing restricted (Article 18)
- receive your data in a portable format (Article 20)
- object to processing based on legitimate interest, including the analytics and session replay described above (Article 21)
- withdraw any consent you have given, with effect for the future (Article 7(3))
To exercise any of these, write to contact@newaround.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority (Article 77), in the EU member state where you live, work, or where you believe an infringement occurred.
13. Changes to this policy
We update this policy when the services behind the site change. The date at the bottom of this page tells you which version you are reading.
Last updated: 2026-10-13