WANDRO Privacy Policy

Version of: 9 November 2026.

Applies from: 9 November 2026.

1. Controller and scope

The controller is „ФАЙЪР 09“ ЕООД (FIRE 09 EOOD), UIC 207134356, 28 Stefan Stambolov Blvd., Sofia 1000, Bulgaria.

Contact: contact@wandro.io, https://wandro.io, telephone +359 877 743 009.

The Policy covers the app for iOS and Android, wandro.io and correspondence.

The Company has not designated a data protection officer. Questions are to be sent to the contact details stated above.

This document provides information and does not require general consent to processing.

2. Key points

• A profile is created with an email address or through Apple/Google.
• Personal features are not public.
• Impressions are reviewed by a person.
• Optional analytics is switched off by default.
• There is no background use of location and no recording of it in the profile.
• “For You” („За теб“) uses local preferences based on the tags of liked impressions, without sending these preferences to the server infrastructure.
• Notifications are local.
• The Company does not receive full card data for in-app purchases.
• Deleting a profile does not stop the subscription in the store.

3. Categories and sources

3.1. Provided by you

We process the necessary email address, name, profile identifier, authentication data (including the time of the last sign-in to the profile), entries and photos in the diary, saved places and routes, plans, trips, visited places (“Your Path” („Твоят път“)), drafts, impressions, reports, correspondence and choices regarding technologies.

3.2. From providers

Apple/Google transmit the data necessary for the chosen sign-in, including name and email address. Apple may provide a hidden forwarding address.

We do not receive your Apple or Google passwords.

The App Stores and RevenueCat provide data on the product, the transaction, the subscription and the access entitlement.

With an in-app purchase, we do not receive full card numbers, security codes or bank details.

3.3. Technical data

When a connection is made, the necessary IP address, request, date, time and other technical records are processed.

When analytics is switched on, events and data about the device and the installation are processed.

An identifier without a name is not automatically treated as anonymous.

3.4. Local data

Location, settings, preferences for “For You” and reminders are used on the device.

Local calculation does not exclude the separate requests to Google Maps or the permitted collection of analytics events.

3.5. Technologies not used

No advertising SDKs, advertising identifier, cross-app tracking, Meta SDK or separate crash reporting tool are used. The fonts are embedded.

4. Purposes and legal bases

Each legal basis applies only to the processing that is specifically necessary. Legitimate interest does not justify operations where the rights and interests of the person concerned prevail.

4.8. In-app analytics

With consent, the automatic events and parameters of Google Analytics for Firebase are collected, including first open, session start, screen view, device, operating system, app version and approximate location.

Documentation: https://support.google.com/analytics/answer/9234069.

The WANDRO events are opening a route, opening a map, starting, saving, liking and sharing, with the route identifier.

The app does not set a User ID and does not use an advertising identifier. This does not mean that all data is anonymous or unlinkable.

4.9. Correspondence

Email provider: Google (Google Workspace — Gmail).

A copy of an identity document is not routinely required. Where there is reasonable doubt, only the necessary additional information is requested.

4.11. Website

The website does not use visit statistics tools.

The deletion page does not require sign-in and does not create an authentication session. The request is sent by email; identity is verified separately through the necessary correspondence.

The information on the purposes, legal bases, recipients, retention periods and consequences is provided in line with Article 13 GDPR.

5. Consent and choices

There is no implied consent and no consent through continued use.

The separate choices are for:

• in-app analytics;
• “For You”;
• advertising messages, if introduced;
• storage of your special categories of personal data in the diary, where you choose to provide such data — under the conditions of and through the mechanism in Section 6.1.

Analytics is managed from “Profile” („Профил“) → “Settings” („Настройки“) → “Usage statistics” („Статистика за ползването“). The choice is made with a separate box when the profile is created; the box is not ticked in advance and is not a condition for registering; an unticked box is a refusal. Until a choice is made, analytics stays switched off.

“For You” is switched on, switched off and reset through Profile → Settings → “For You suggestions” („Предложения „За теб““) (on, off and reset).

Refusal does not block unrelated features. Withdrawal is possible at any time and is as easy as giving consent. The lawfulness of prior processing is preserved. The Company keeps evidence of consent, limited to what is necessary.

6. Content, sensitive data and publicity

6.1. Special categories

Special categories of data are not required for ordinary use, but they may appear in texts and photos.

Regime for personal features and posts: special categories of data are not allowed in impressions, and such impressions are rejected at review; in the “Diary” the Company does not ask for or analyse such data — if the User records them, they are kept only for the User to see, on the basis of the User’s explicit consent (Article 9(2)(a) GDPR). Before the first entry a separate message is shown with two choices: “I agree” — the User gives explicit consent for the entries to also contain such data about the User; or “Ordinary entries only” — the diary is used without such consent and the User does not record such data. The diary works with either choice. The consent given is recorded with the date, time and version of the text. It may be withdrawn at any time from Profile → Settings → “Withdraw consent for the diary”; before withdrawal the User is told that entries with such data must be deleted, and deletion of individual entries or of all entries is offered. Individual entries may be deleted at any time. Sensitive data about other people must not be recorded in the diary; the User’s consent is not a basis for such data. Where an impression is rejected because of special categories of data, its text and photos are deleted immediately with the decision from the active systems; they disappear from the backups and from the protection against accidental deletion within 14 days (Section 10); only the decision, the reason and the dates are kept — for the appeal.

Uploading to a personal diary is not presented as manifestly making data public. Publishing does not automatically create a right to process other people’s sensitive data.

6.2. Access

Impressions are not displayed on the website and are not made available for indexing. The audience is shown before submission.

6.3. Photos

The selected photos are uploaded. Access is through the camera or the system photo picker.

EXIF: photo metadata (EXIF), including coordinates, is removed on upload.

7. Permissions and device

Location is used only actively, without background use and without being recorded in the profile. “I was here” („Бях тук“) records the chosen place and the date, not the device coordinates. Impressions are linked to the coordinates of the place.

On the map, location is displayed through the Google Maps SDK. With “How to get there” („Как да стигна“), the current coordinates are passed as the starting point and the place as the destination.

The camera and the selected photos are used when a photo is added.

Local notifications are only those You requested: reminders, events and “Tell me” („Кажи ми“). They are not sent from a server and do not advertise third parties. They are managed from “Profile” → “Settings” → “Notifications” („Известия“) and the operating system.

Refusing a permission affects the dependent features, not automatically all access.

8. Recipients and roles

The following services are used for the features described. The legal entity and the role are determined by the specific applicable contract, not only by the trade name.

Other recipients are competent authorities and parties to specific legal claims, only where there is a legal basis and necessity.

Within the Company, authorised persons have access according to their tasks. Data is not sold and is not provided for advertising purposes.

Relationships with processors are governed by the necessary contractual safeguards, including on assistance with rights and on erasure or return after completion.

9. International transfers

The region of one database does not determine all places of processing, access and onward transfer.

The status of “independent controller” is not a mechanism for international transfer. Consent to analytics is also not in itself such a mechanism.

Transfers and onward transfers take place only under the conditions of Chapter V GDPR. Information and a copy of the applicable safeguards can be obtained via contact@wandro.io.

10. Retention periods

The entire profile is not retained merely because of a purchase. The different purposes are kept separate. Undefined “operational needs” do not justify indefinite retention.

The periods are limited to what is necessary under Article 5(1) GDPR.

Local data is managed through the settings and the device. Uninstalling does not guarantee deletion of system backups.

11. Profile deletion

Deletion is requested in “Profile” or by email in accordance with https://wandro.io/en/delete-account.

Before deletion, You can request a copy of Your data with “Send me a copy” (Section 16). The archive is prepared before deletion and kept for 30 days.

The profile, the personal features, the drafts, the operational and gifted unlocks, the subscription record, the impressions, the photos, the related reports and the authentication are removed.

The minimal purchase records, the correspondence, the requests, the technical records, the backups, RevenueCat and Analytics are dealt with separately.

• RevenueCat: when a profile is deleted, the Company deletes the customer data in RevenueCat within 30 days; this does not cancel the subscription with Apple or Google.
• Analytics: the app does not set a user identifier (User ID), so the data is linked to the installation identifier; the 2-month period applies to event-level and user-level data, while aggregated reports in Google Analytics are not affected; requests are made to contact@wandro.io and handled within 1 month.
• Reports for a specific obligation or claim: restricted storage of only the necessary data until the obligation is met or the claim ends.

The absence of a set User ID does not automatically exclude identification or the handling of a rights request. Inability to identify is substantiated in accordance with Article 12(2) GDPR. The automatic erasure period does not replace the handling of the request.

Where further retention is permissible, the category, the purpose, the access and the period are limited.

Deletion does not remove the Apple/Google accounts and does not stop the subscription. Purchases are restored under Section 5.4 of the Terms of Service, without restoration of deleted personal content.

12. Security

Appropriate technical and organisational measures are applied for confidentiality, integrity, availability and protection, commensurate with the risk. Absolute security is not promised, and statutory liability is not transferred to the User.

In the event of an incident, an assessment, containment and the necessary notifications are carried out.

The measures are determined in accordance with Articles 25 and 32 GDPR.

13. Automation and recommendations

Publication, rejection and moderation decisions are made by people.

The limit of 3 impressions per 24 hours is automatic and can be reviewed if challenged.

“For You” orders recommendations based on local preferences for the tags of liked impressions. Relative importance of the parameters: the greatest weight is given to personal interest — the tags of impressions You liked; the likes, saves and views of the impression, how new it is and how close it is to You are also taken into account.

The data on local preferences is not sent to the server infrastructure and is not used for advertising. Separately permitted analytics events remain distinct.

The place of the week is the same for everyone. The personal weekend suggestion is selected based on the city You chose, the season and the places in “Your Path”. It is not used to advertise third parties.

Under the model described, no solely automated decisions with legal or similarly significant effects are taken.

14. Advertising

Current sending of advertising messages: none are sent.

For advertising email to Users, separate prior consent is obtained. The general acceptance of the contract is not used.

Every message includes an easy and free way to unsubscribe. Upon objection, direct marketing stops. Service messages on performance and security are separate.

15. Age

WANDRO is intended for persons aged 18+.

Where use by a person under 18 is established, access is restricted and the data is dealt with in accordance with the applicable rights and obligations.

A parent or guardian may write to contact@wandro.io.

16. Rights

Subject to the applicable conditions, you have the rights of:

• access and a copy;
• rectification;
• erasure;
• restriction;
• portability;
• objection;
• withdrawal of consent.

Access and the copy are provided with respect for the rights of others.

Restriction may be requested in the case of contested accuracy, of unlawful processing instead of erasure, of a need for the data for your claims or of verification of an objection.

Portability covers data provided by you and processed by automated means on the basis of consent or contract, and direct transmission where technically feasible.

Where you object, on grounds relating to your particular situation, to processing based on legitimate interest, the processing stops, unless there are demonstrated overriding grounds or it is necessary for legal claims. For direct marketing, it stops without such an assessment.

Requests: contact@wandro.io.

Copy from the app. From “Profile” („Профил“) → “Settings” („Настройки“) → “Download my data” („Изтегли моите данни“), and when deleting the profile with “Send me a copy” („Изпрати ми копие“), You receive an archive with the profile and sign-in data, the diary (text, dates and places), the photos from the diary and the impressions in the form in which they are stored, the saved places and plans, the visited places (“Your Path” („Твоят път“)), the reports, the withdrawal requests, the purchases, the unlocks and the history of consents — in a readable form and in JSON format. The archive also says what it does not include; the purposes, recipients and retention periods are in this Policy. The archive is sent as a link to the profile email address; another address is used only after confirmation with a code. The link and the archive are valid for 30 days, after which the archive is deleted automatically. This does not limit the right to submit a request to contact@wandro.io.

A response is provided without undue delay and within one month. Where necessary, the period may be extended by a further two months, with notice and reasons given within the first month.

If no action is taken, the reasons and the available remedies are communicated. Additional identification is requested only where there are reasonable concerns and to the extent necessary.

As a rule, exercising the rights is free of charge. For a manifestly unfounded or excessive request, a fee or a refusal is permitted only under the conditions of the GDPR and where the Company demonstrates this.

A complaint may be lodged with the Commission for Personal Data Protection (CPDP) — https://cpdp.bg, subject to the applicable conditions and time limits. Judicial protection is preserved.

17. Cookies and SDKs

The details are set out in the separate policy. A lack of technical support for DNT is not a ground for ignoring a valid objection or withdrawal.

18. Changes

Before a new purpose is pursued, the necessary information is provided and, where needed, separate consent is obtained.

Publishing a new policy is not consent. Material changes are communicated in an appropriate manner. Previous versions can be obtained via contact@wandro.io.

19. Contact

„ФАЙЪР 09“ ЕООД (FIRE 09 EOOD), UIC 207134356

28 Stefan Stambolov Blvd., Sofia 1000, Bulgaria

contact@wandro.io · https://wandro.io

Telephone: +359 877 743 009.