Version 2026-11 · Last updated: 3 November 2026. The Greek text is the binding one; this is a translation.
1. Who we are
This Privacy Policy explains how the Wisp mobile app (the "App"), the website wispending.com and their connected services collect, use, share and protect your personal data, under the General Data Protection Regulation (GDPR), Greek law 4624/2019 and Greek law 3471/2006 on electronic communications.
The data controller is:
ProfCheck P.C. (ProfCheck Ι.Κ.Ε.), General Commercial Registry (Γ.Ε.ΜΗ.) no. 193099502000
Account: your Greek mobile number, verified by SMS at sign-up and at every sign-in, which is your account (one account per number, no password), and your display name. Optionally, an email address you verify with a code we send you: it is an alternative way to sign in and the way to recover the account if you lose your number. Also your plan (Basic, Plus or Premium) with its renewal date and, optionally, a friend's referral code.
The sign-up confirmation: that you are 15 or older, have read this policy and accept the terms of use, together with the version of both documents we showed you and the moment of the confirmation.
Preferences: the categories you are interested in and how often you shop in them, the hours you usually go out, how you want deals suggested to you, and the avatar you picked from the app's collection.
Location: your device's position, only if you grant the permission on your phone. It is sent rounded to about 100 metres with every search for deals and stores, so we can show what is near you, and is not stored on your account. For the "when you pass a shop" notifications see section 4.
Coupons and savings: the coupons you claim and redeem (store, date, status, amount saved), your stamp cards (loyalty) and the deal bundles you use.
Interactions: the shops you follow (favourites), which deals you opened, your reviews (stars and an optional comment) and the problem reports you submit, with an optional photo.
Notifications: the identifier (token) your device receives from Google's or Apple's notification service, with its operating system, the app's version and its language, so we can send notifications in your language; the history of notifications we sent you (which, when); and your choices for each kind of notification, with the history of their changes (what, when and against which version of the wording).
Technical data: the IP address and the app's language, which reach our server with every request.
Businesses (brands)
The business account's details (email, name), the brand profile (name, description, website, logo, cover), the stores (address, phone, Google Maps link) and the content you publish (deals, photos, stories, stamp cards, events).
Device permissions
Location: for nearby deals ("while using the app") and, only if you choose it, for the notifications when you pass a shop ("always"), as described in section 4.
Notifications: so your phone can show the notifications you choose in section 4.
Camera: for businesses to scan coupon QR codes. The camera image is not stored.
Photos: only when you pick a photo to upload (in a problem report or, for businesses, in deals and the store profile). The photo's metadata (EXIF, such as where it was taken) is removed before upload.
What we do not collect
We do not collect advertising identifiers, contacts, date of birth or payment details. The app and the website contain no third-party advertising, tracking or analytics tools. The only device identifier we hold is the notification token of section 2, which serves nothing else.
3. Why we use it and on what legal basis
Running your account and the app (sign-in, nearby deals, coupons, stamp cards, favourites, savings, exporting your data): performance of our contract with you (article 6(1)(b) GDPR). For access to the device's location we always ask your phone's permission.
Phone and email verification: the SMS to your number and the code to your email are the way to sign in: performance of the contract. The "one account per number" rule and the free first month being granted once per number, so that deals cannot be abused with many accounts: legitimate interest (article 6(1)(f)).
Deal suggestions based on distance, your preferences and your history: performance of the contract. No automated decisions with legal or similarly significant effects are made about you.
Notifications about your account (coupons, rewards you earned, security): performance of the contract. You can switch them off in the settings.
Notifications about brands you follow, about deals and news, and location-based ones: only with your consent (article 6(1)(a) GDPR and article 11 of law 3471/2006), separate for each, which you withdraw at any time from the app's notification settings. Details in section 4.
Email updates (newsletter): only with your consent, which you withdraw from the account settings.
Reviews and problem reports: quality control of deals and protection of users: legitimate interest.
Security: protection against attacks and abuse (such as limits on sign-in attempts) and server logs: legitimate interest.
Legal obligations and proof of the consents and confirmations you gave us: legal obligation (article 6(1)(c), article 7(1) GDPR).
4. Notifications
Wisp sends four kinds of notifications. Each has its own switch in the app's notification settings and, on Android, its own channel, so you can also mute it from the phone itself.
Account and coupons: a coupon redeemed, a reward you earned, security matters. On by default, because it concerns the running of your account; switched off in the settings.
Brands I follow: a shop you follow posted a new deal or started an event of theirs. Only with your consent, asked inside the app. At most one notification per shop per day, never between 22:00 and 09:00.
Deals and news: deals ending soon, events and suggestions. Only with your consent. At most one a day, never between 22:00 and 09:00.
Deals near me (when you pass a shop): described below. Only with your consent. At most one a day and one per store a week, never between 22:00 and 09:00.
In all, we never send you more than three notifications a day, whichever kinds you have on.
How the notifications when you pass a shop work
If you choose it, Wisp uses your device's location even when the app is closed, to notify you when you pass near a store of one of our partners, or of a business you follow, that has an active deal. The feature requires your device's "Always" location permission and is turned on only by your explicit choice inside the app.
The watching is done by your phone's operating system, around up to twenty points the app picks based on where you are. To pick those points, the app sends your position rounded to about 100 metres; we do not store it. When you enter the 150-metre circle around a store, the app sends only that store's identifier, so we can choose which deal to show you. We keep the history of these notifications (which store, when) for 30 days, so we never bother you more than once a day and once a week per store. You can turn the feature off at any time from the app's notification settings or from your phone's location settings; the app then immediately stops watching any point.
The permission you grant your phone (notifications, location) lets the device show or locate; it is not your consent to the kinds of notifications above. That consent you give separately, inside the app, and we record it with the date and the version of the wording you saw.
5. Who we share data with
We do not sell or rent your personal data.
Businesses (brands): they see only aggregate figures, such as their average rating, how many coupons were redeemed and how many people opened a deal. Your name, email and phone are not shared with businesses, neither at redemption nor in reviews. Review comments are read only by us.
Providers processing data on our behalf:
Google Cloud: hosting of our server in Frankfurt (European Union) and the request logs.
Neon: our database, in Frankfurt (European Union).
Google Firebase Authentication: sending the verification SMS to your mobile, at sign-up and at every sign-in. To make sure the request comes from the app, Firebase may receive technical details of your device. The temporary account created there is deleted right after verification (within an hour at most).
Google Firebase Cloud Messaging and Apple Push Notification service: the delivery of notifications to your device. They receive the device token and the text of each notification.
Resend: sending the emails with verification and sign-in codes. It receives your email address and the code.
Cloudflare: storage of images (deal photos, logos, report photos) in Eastern Europe (European Union), their delivery, and the hosting of the website wispending.com.
Mapbox: the app's maps. Your device downloads the map area you are looking at from Mapbox, so Mapbox receives your IP address and that area. Mapbox telemetry is switched off.
Google Places: looking up a store's address when a business adds it. No user data is involved.
OpenRouter (with Google Gemini models): analysis and translation of the texts businesses write for their deals and profiles and, when a business asks for it, enhancement of its deal photos. Only business content and photos are sent, never user data, with the instruction that they are not to be retained or used to train models.
For legal reasons: when the law, a court or another public authority requires it, or to protect our rights and the safety of users.
6. Transfers outside the European Economic Area
Our server, database and images are in the European Union. Some of the providers above (Google, Apple, Cloudflare, Mapbox, OpenRouter, Resend) may also process data outside the EEA, mainly in the USA. In those cases the transfer rests on the GDPR's safeguards: the EU-U.S. Data Privacy Framework, where the provider is certified, or the European Commission's Standard Contractual Clauses.
While the account is active. On deletion, see below.
History of notifications we sent you
12 months
History of "when you pass a shop" notifications (which store, when)
30 days
The device's notification token
Until sign-out or deletion; or 12 months after the app last refreshed it
Which deals you opened
12 months
Problem report photo
12 months after the report was reviewed
Email verification codes
10 minutes, stored only hashed
Sign-in credentials (refresh tokens)
While the sign-in is active, and 12 months after they expire
History of consents and confirmations
No time limit, anonymised after deletion, as proof that we honoured your choices
Server logs (IP address, requests, with the approximate position of searches)
Up to 30 days. For sign-in attempt limits we keep only a cryptographic fingerprint of the IP address for one day.
Backups
Up to 30 days, then deleted automatically
When you delete your account we erase the phone number, email, name, preferences, favourites, review comments, the text and photo of your reports, the notification tokens and history, and your sign-ins; active coupons expire and every notification is switched off. Coupon history, star ratings, stamp cards and the reason of reports remain only anonymised, with no link to you, so that businesses' statistics stay correct. Of the phone number we keep only an irreversible cryptographic fingerprint (hash), which reveals neither the number nor whose it was: for 35 days after deletion, so it cannot be used at once for a new account, and without time limit as a record that the number has already had the free first month. Details on the Delete account page.
8. Security
All communication between the app and the server is encrypted (HTTPS). User accounts have no password: sign-in uses a one-time code to your phone or email, stored only hashed. Business passwords are stored only hashed (bcrypt). The phone number is stored encrypted (AES-256-GCM) and sign-in credentials are kept in the device's secure storage (Keychain / Keystore). Access to data is limited to the people who need it to run the service.
9. Your rights
Under the GDPR you have the right:
Of access to your data and to a copy of it. Inside the app, under Account settings, "Download my data" gives you at once a file with everything we hold about you.
To rectification of inaccurate details, also directly from your profile in the app.
To erasure: users delete their account from the app's Profile, confirming by SMS to their number or by a code to their verified email; businesses by email. See the Delete account page.
To restriction of processing and to portability of your data (the export file is in JSON format).
To object to processing based on our legitimate interest.
To withdraw your consent at any time: each kind of notification from the app's notification settings, the newsletter from the account settings, and for location, notifications, camera and photos from your device's settings. Withdrawing is as easy as giving, and does not affect the lawfulness of processing before it.
To lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).
Wisp is for people aged 15 and over, the age set by Greek law 4624/2019 (article 21) for consent to information society services. At sign-up you confirm that you are at least 15 and we keep that confirmation. If we find that an account belongs to someone under 15, we delete it.
11. The website wispending.com
The website is hosted by Cloudflare, which receives your IP address in order to serve it. It uses no cookies and loads nothing from third parties: the fonts are served by us. The only thing it stores on your device is the language you chose (in the browser's localStorage), so it remembers it next time; this is strictly necessary for the service you asked for and needs no consent. The "Open in the app" pages (wispending.com/app/…) look nothing up on our server; they only point to the app or the app stores.
12. Changes to this policy
If the way we process your data changes, we will update this page and the version and date at its top, and for significant changes we will notify you inside the app. Where processing rests on your consent and its wording changes, we will ask for it again.
What changed in version 2026-11: sections added on notifications (kinds, consents, limits), on the notifications when you pass a shop, on the website and on the sign-up confirmation; the description of location corrected (sent rounded, not stored); Neon, the notification services and photo enhancement added to the providers; the retention table and the in-app data export added.