Privacy & Cookie Policy

Who is responsible for your data

The controller of personal data processed on most-estonia.ee is:

What data we process

We only collect what a specific feature needs:

• Account data — email address, name or nickname, and the date and time you accepted this policy. You sign in with a one-time code sent to your email: we do not store passwords.
• Business profile data — if you create a business profile: name, address, category, description, contact details, website, opening hours, photos and profile settings. This information is published on the site, because that is what the profile is for.
• What you send us yourself — suggested events (including email verification), reports about listings, support requests, ratings, favourites and enquiries to specialists in the Kids section.
• Business listing ownership requests — your name and role, the verified email used to sign in, an explanation of your connection to the business and up to three optional supporting images. Do not send identity documents. These materials are not published and are accessible only to MOST Center administrators.
• Ask MOST questions — the text of your question and the earlier messages of that conversation. See “Ask MOST” below.
• Event news subscription — email address, language and time of consent, if you subscribe.
• Technical data — IP address, browser and device information, request times and error logs. The IP address is used for security and abuse prevention; for rate-limit counters it is stored only as an irreversible hash.
• Analytics data — only with your consent (see “Cookies”).

Why we use data

We use personal data to:

• create your account, let you sign in and keep it secure;
• publish business profiles, events and other information you submitted for publication;
• handle and answer reports, support requests and applications;
• verify requests to manage an existing business listing using the business’s independent contact details, so a listing is not transferred to the wrong person;
• answer questions in Ask MOST;
• send the emails you asked for: sign-in codes, confirmations, event news;
• keep the site secure and protect it from spam and abuse;
• with your consent, understand how the site is used and improve it.

Legal bases

We process data on the following bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)) — your account, sign-in, business profile and the features you choose to use.
• Consent (Art. 6(1)(a)) — analytics, the event news subscription, Ask MOST answer ratings and enquiries to Kids specialists. You can withdraw consent at any time; this does not affect processing carried out before the withdrawal.
• Legitimate interest (Art. 6(1)(f)) — security, abuse prevention, moderation of published content, processing Ask MOST questions and technical logs. You can object to this processing.
• Legal obligation (Art. 6(1)(c)) — where the law requires us to keep or disclose certain data.

Ask MOST — AI assistant

Ask MOST is an automated assistant that answers questions about cities, places and events.

• To prepare an answer we send your question and the earlier messages of the conversation to Google's Gemini model. To check current information, a web search via Tavily is sometimes performed.
• Questions are not linked to your account. Please do not enter personal data in the chat: names, phone numbers, ID numbers or health information.
• Answers are generated automatically and may contain mistakes. Please confirm important details — opening hours, prices, availability — with the venue itself.
• If you press 👍 or 👎 under an answer, we store that question, the answer, the language, city and topic. Email addresses and phone numbers are removed automatically. Only the MOST team sees ratings. After review and editing, good answers may become style examples for similar questions, without your personal data. Unreviewed ratings are deleted after 180 days.

Cookies and browser storage

We use cookies and local browser storage. Optional technologies are switched on only after your consent. You can change or withdraw your consent at any time with the button below.

Who receives data

We share data only with providers who help us run MOST, and only as much as they need. They act on our behalf under data processing agreements:

• Supabase — database, sign-in and file storage (servers in the EU, Ireland).
• Vercel — website hosting and server functions (processing in the EU; global content delivery network).
• Google (Gemini API) — Ask MOST answers and text translation.
• OpenAI — automated checking of texts and photos of suggested events before publication.
• Tavily — web search to check current information in Ask MOST.
• Resend — sending emails: sign-in codes, confirmations, notifications.
• Google Analytics 4 — visit and interaction statistics only after your consent; Google may receive the page URL and browser and device information.
• OpenStreetMap and Open-Meteo — maps and weather. Your browser loads them directly, so these services see your IP address.
• Data may also be disclosed to public authorities where the law requires it.

Transfers outside the EU

Some providers (Google, OpenAI, Tavily, Resend and Vercel's parent company) are based in the United States or process data outside the European Economic Area. Such transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for certified companies, or on the EU Standard Contractual Clauses (Art. 46 GDPR) with supplementary measures. You can request a copy of these safeguards at privacy@most-estonia.ee.

How long we keep data

We keep data no longer than necessary:

• Account and business profile — while you use them. You can delete your account yourself in your account settings. After deletion, data is erased or anonymised within 30 days, and from backups when their retention period ends.
• Suggested events — while the event is published or until you delete the submission in “My Submissions”.
• Reports, support requests and other applications — as long as needed to handle them and document the action taken. You can ask us to delete them unless the law requires us to keep them.
• Business listing ownership requests — optional images are deleted 30 days after a decision, or 90 days after submission if the request is still pending. The request text and the copy of your verified email stored with it are removed 180 days after submission, or 180 days after a decision if one is made.
• Event news subscription — until you unsubscribe or ask us to delete your address.
• Ask MOST answer ratings — up to 180 days. Approved examples are kept without personal data.
• MOST analytics summaries — up to 90 days. Google Analytics 4 event-level data — up to 14 months, depending on the property setting. Rate-limit counters with hashed IP — from a few minutes to one day. The site error log (page address, error text, browser details; no account or IP address) — up to 90 days. Hosting technical logs — a short period set by the provider.

Your rights

Under the GDPR you can at any time:

• get information about your data and a copy of it (Art. 15);
• correct inaccurate data (Art. 16);
• have your data erased (Art. 17), including by deleting your account in its settings;
• restrict processing (Art. 18);
• receive your data in a machine-readable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent — this does not affect processing before the withdrawal;
• lodge a complaint with a supervisory authority (see below).

Write to privacy@most-estonia.ee. We will reply without undue delay and within one month at the latest; for complex requests this may be extended by two further months, and we will tell you if so. This is free of charge. To protect your data, we may ask you to confirm that the request comes from you.

Children

MOST is not intended for children under 13. Under the Estonian Personal Data Protection Act, a child can consent to online services from the age of 13; for younger children, consent is given by a parent or guardian. The Kids section is designed for parents looking for activities and specialists for their child. If you believe we have received a child's data without the necessary consent, please write to us and we will delete it.

Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Suggested events are checked automatically for prohibited content before publication. If your event is declined, you can ask for it to be reviewed by a person. Ask MOST answers are generated automatically and are for information only.

Supervisory authority

If you believe your data is processed unlawfully, you can lodge a complaint with the Estonian Data Protection Inspectorate or with the supervisory authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first, so please write to us.

Security

We protect data with technical and organisational measures:

• encrypted connections (HTTPS) across the whole site;
• sign-in with one-time codes, without storing passwords;
• database-level access control (Row Level Security) and role-based access;
• team access limited to the data needed for the task;
• IP addresses for rate limits stored only as irreversible hashes.

No online service can guarantee absolute security. If a breach creates a risk to your rights, we will notify the Data Protection Inspectorate and, where required, you, within the deadlines set by the GDPR.

Changes to this policy

We may update this policy when the site's features or legal requirements change. The current version and its date are always shown on this page. We will announce material changes visibly on the site and, where appropriate, by email.

Contact us

Send questions about personal data and requests regarding your rights to: