Privacy & Cookie Policy

Data controller

The controller responsible for your personal data is:

Personal data we collect

MOST only collects the information it needs to provide its services:

• Account information — your name, email address and login credentials, used to create and secure your account, authenticate you and manage your business profile and subscription (legal basis: performance of a contract)
• Business information — your business name, address, category, description, contact details, website, opening hours, photos and chosen subscription plan, used to publish your listing on MOST
• Consent records — the date and time you agreed to this Policy
• Technical information — IP address, browser and device information, and session and security logs, collected for platform security, fraud prevention, diagnostics and performance

User-generated content (MOST Tree)

MOST is introducing MOST Tree — a community space where people can voluntarily share content about local events and topics as threads and branches, more like a forum or social feed than a map. When this feature is available you may choose to publish:

• Threads and branch replies you create about events and topics
• Text descriptions, comments and reactions
• Photos you attach to your threads

Publishing is always voluntary and requires your explicit consent at the moment you post. You remain responsible for making sure anything you publish — including any photo you upload — is yours to share and does not infringe copyright, privacy rights or applicable law.

Why we collect it

We use this data to:

• Create and secure your business account
• Display your business listing to visitors, according to your plan
• Enforce the listing limits of your chosen plan
• Communicate with you about your account, such as confirming your email address
• Keep MOST secure and working reliably

Legal basis for processing

We process your data on the basis of: performance of a contract (to provide the business account and listing service you sign up for); your consent (for this Privacy Policy and for any analytics cookies, given at signup and via the cookie banner); and our legitimate interest in keeping the platform secure and functioning correctly.

Cookies

MOST uses cookies. You can accept or refuse non-essential cookies through our cookie banner, and you can withdraw analytics consent at any time.

Third-party services

MOST relies on trusted service providers that process data only as far as needed to deliver the service. MOST does not sell personal data to third parties. These providers include:

• Supabase — authentication, database and file storage
• Stripe — payment processing, once billing is enabled
• Cloud hosting providers
• Analytics providers — only with your consent

How long we keep it

Personal data is stored only for as long as necessary. We keep your account and business data while your account is active. When you delete your account, your personal information is deleted or anonymised — normally within 30 days — unless a longer retention period is required by law.

Your rights (GDPR)

Under the GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct data that is inaccurate or incomplete
• Deletion — delete your account and all associated data at any time, from the Account section of your dashboard
• Restriction — ask us to restrict certain processing of your data
• Withdraw consent — withdraw any consent you have given, at any time
• Portability — receive your data in a commonly used, machine-readable format
• Complaint — lodge a complaint with a supervisory authority

Supervisory authority

If you believe your personal data has been handled improperly, you have the right to lodge a complaint with the Estonian data protection supervisory authority:

Data security

MOST protects user data using modern security practices, including:

• HTTPS / SSL encryption
• Secure authentication
• Supabase infrastructure with Row Level Security (RLS)
• Role-based access control
• Regular security updates

Although no online service can guarantee absolute security, MOST applies industry-standard safeguards to minimise risks.

Cancelling your subscription

You can change or cancel your plan at any time from your dashboard. No payment is currently collected for any plan — this will be made clear again once billing is introduced, and you will always be able to cancel a paid subscription with no long-term commitment. Full details are set out in our Subscription Terms.

Policy updates

MOST may update this Privacy Policy for legal, technical or business reasons. The latest version is always published on this page, and where required by law we will notify you of significant changes.

Your consent

Before creating an account, every user must actively confirm that they have read and understood this Privacy Policy and consent to the processing of their personal data in accordance with it. The consent checkbox is unchecked by default, is mandatory, and prevents registration until accepted. The date and time of your consent are stored for GDPR compliance.

Contact us

For any question about this policy, or to make a data request, contact us at: