PRIVACY AND DATA
Privacy policy
This policy explains which data Zanpico processes, why it is used, who receives it and how to exercise your rights.
1. Data controller
- Service publisher
- DEBEAUMONT JOHANN — sole trader registered in Poland in the CEIDG register, trading as DECADEUS
- Business address
- ul. Stanisława Leszczyńskiego 4, lok. 25, 50-078 Wrocław, Poland
- Registration
- NIP : 1231580469 · REGON : 541698875
- Contact
- contact@decadeus.com · +48 503 333 148
DEBEAUMONT JOHANN, trading as DECADEUS, is the controller of Zanpico data. Privacy questions may be sent to contact@decadeus.com.
2. Data processed
Account and profile
Identifier, email address and information received from the login provider, nickname, avatar, language, theme and optional year of birth.
Fishing journal
Species, size, weight, date, time, weather, temperature, water type, method, rig, leader, notes and other entered information.
Photos and lures
Up to two photos per catch, avatar, personal lures, dimensions, weight, visual configuration and rendered images.
Location
Place label and precise coordinates chosen for a catch or a spot to try. Access to the device location is optional.
Subscription
Plan, entitlement status and technical transaction identifiers supplied by Apple, Google and RevenueCat, without full payment-card details.
Technical data and support
Platform, version and build number, security data and the content of support requests.
3. Purposes and legal bases
- Create, save and synchronise the journal: performance of the contract or pre-contractual steps.
- Display the map, select photos and determine a place: user action and permission granted on the device.
- Manage plans and restore purchases: performance of the contract and entitlement verification.
- Secure, diagnose and improve the service: DECADEUS’s legitimate interest, respecting user rights.
- Answer requests and comply with the law: performance of the contract, legitimate interest or legal obligation as applicable.
4. Photos, location and sharing
Catches, photos and places are private by default and are not published automatically. Precise coordinates are stored to position a catch or spot, but they are not displayed numerically in the app or added to the sharing card.
Uploaded photos are compressed and re-encoded to remove embedded metadata, including possible GPS coordinates. Sharing takes place only after a deliberate user action, and the user selects which record elements to include.
5. Recipients and providers
Data is accessible to the user and, where necessary, authorised DECADEUS personnel or the following providers:
- Supabase: authentication, database, server functions and private storage for photos, avatars and lure images; the main project is hosted in London, United Kingdom;
- RevenueCat: subscription validation and entitlement synchronisation;
- Apple and Google: chosen login method, app distribution, payment, invoicing and purchase management;
- OpenStreetMap: map tiles; when a map is displayed, the service may receive the IP address and technical information required for the request;
- ChatGPT Sites and Cloudflare: publication and technical delivery of zanpico.com and its technical logs. The personal journal remains stored by the data service described above;
- Vercel: hosting of the separate decadeus.com website and its technical logs.
Zanpico does not sell personal data, show targeted advertising or currently include advertising or behavioural-analytics SDKs.
6. Retention periods
| Data | Period |
|---|---|
| Account and journal | While the service is used, followed by deletion of active data after a verified deletion request within the applicable legal period. |
| Technical backups | Residual copies may remain temporarily in rolling backups before automatic overwriting under the provider’s policy. |
| Transactions and legal obligations | For the period required by tax or accounting obligations or to defend legal rights. |
| Support and security | For as long as needed to process the request, prevent incidents and preserve evidence, followed by deletion or anonymisation. |
7. Security and international transfers
The service uses encrypted communications, private storage, temporary media links and access rules restricting each account to its own data. No system is risk-free, and DECADEUS maintains incident-management and remediation measures.
The main Supabase project is hosted in the United Kingdom, which the European Commission recognises as providing adequate protection. Providers may also process data outside the European Economic Area; where necessary, transfers rely on an adequacy decision, standard contractual clauses or another safeguard recognised under the GDPR.
8. Data stored locally
Preferences such as language, theme and certain settings are stored on the device. Their deletion depends on app features and, where applicable, uninstalling the app or clearing its local data.
9. Your rights
Under the GDPR, you may request access, correction, deletion, restriction, portability or objection to certain processing, and withdraw consent without retroactive effect. Requests should be sent to contact@decadeus.com and may require reasonable identity verification.
The procedure is described on the Delete account page. You may also complain to the authority in your country or to the President of the Polish Personal Data Protection Office (UODO).
10. Children
Zanpico is not specifically directed at children. Where parental authorisation is required by the law of the user’s country, a minor must use the service under the responsibility of their legal representative.
11. Policy updates
The version date appears at the top of this page. Material changes to processing will be announced in the app or by an appropriate means before they take effect where required by law.