Legal
Privacy Notice
Last updated 19 September 2026. Claim Your City is operated by Zakaryae Alaoui, who is the data controller for the personal data described here and decides how and why it is processed.
1. Who we are
Zakaryae Alaoui, trading as Claim Your City, is the controller of your personal data. You can reach us through the contact details published on this site for any privacy question or request.
2. Personal data we collect and why
Account data (email address, authentication identifiers from Google or Apple sign-in): to create and secure your account and let you manage your claims — legal basis: performance of our contract with you. Published content (display name, emoji, short message, optional image or website link, claimed tile positions and city): to display your claim publicly and generate your shareable card — legal basis: performance of our contract with you. Order data (order reference, claim number, amount, tile count, the email used at checkout): to link your purchase to your account, provide support and keep accounting records — legal basis: contract and legal obligation. Usage and technical data (page views, tile selections, checkout and share events, a random session identifier, device and browser type, IP address as processed by our hosting provider): to keep the service secure, prevent fraud and abuse, and understand and improve how it is used — legal basis: our legitimate interest in operating a secure, working product. Support messages: to answer you — legal basis: contract and legitimate interest.
3. What is public and what is not
Your display name, emoji, message, optional links and tile positions are shown publicly on your claim page, on the city map and on share cards. Your email address, account identifiers and order details are never published.
4. Who we share data with
Merchant of Record: Paddle.com Market Ltd acts as reseller and Merchant of Record for all orders and processes payments, subscription management where applicable, tax compliance, invoicing and refunds. Card details are collected and handled by Paddle and never reach our servers. Paddle acts as controller for the payment data it collects — see paddle.com/legal/privacy. Service providers (processors): our hosting, database, authentication, email and analytics providers, and the map and geocoding services used to display places. Professional advisers: legal and accounting advisers where necessary. Authorities: where required by law or to protect our legal rights. We do not sell your personal data.
5. International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the EEA, the UK or Switzerland, transfers rely on an adequacy decision or on Standard Contractual Clauses with appropriate additional safeguards.
6. How long we keep data
Account data: for as long as your account exists, then deleted within 90 days of closure. Published content: until you delete it or your account closes, then removed from public pages within 30 days. Order and accounting records: 10 years, as required by tax and accounting law. Usage and analytics events: 14 months, then deleted or aggregated into anonymous statistics. Support messages: 24 months. Data is deleted or anonymised once it is no longer needed for these purposes.
7. Security
We apply appropriate technical and organisational measures: encryption in transit (HTTPS), encryption at rest for our database, row-level access rules so records are only readable by their owner or by our server, access controls and least-privilege credentials for administrative access, and secrets kept outside the application code. No system is perfectly secure, but we review these measures as the product evolves.
8. Your rights
Subject to applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests or withdraw consent where consent applies. You can edit the name, emoji and message of each claim directly from your account. Contact us to exercise any right; we reply within one month. If you are in the EEA, the UK or Switzerland you may also complain to your supervisory authority.
9. Cookies and similar technologies
We use strictly necessary cookies and local storage to keep you signed in, to hold your tile reservation and to remember recent places. We use privacy-friendly product analytics with a random session identifier and no advertising cookies. You can clear or block cookies in your browser settings, although sign-in and checkout will not work without the necessary ones.
10. Children
The service is not directed at children under 16. If you believe a child has provided personal data, contact us and we will delete it.
11. Changes to this notice
We may update this notice as the product changes. The date at the top of the page shows the current version, and significant changes will be announced in the app.