From a Friend privacy policy

1. Who is responsible

Nordic EastAsia Group AB (“we”, “us”) is the controller responsible for personal data processed through From a Friend. From a Friend is a trust-based restaurant discovery app that lets people record and share restaurant knowledge with people and groups they choose.

2. Information we process

Account and profile information

This may include your email address, authentication identifiers, username, display name, profile photo, biography and onboarding status. We also record the Terms version you accept, the Privacy Policy version shown to you and the server timestamp of that acceptance.

Authentication information

When you sign in by email and password, email magic link, Apple or Google, we process the account identifiers and profile details needed to authenticate you. Apple or Google may provide an email address, name or profile image depending on your provider settings and the permissions you grant. We do not receive your Apple or Google password.

For Sign in with Apple, we retain an encrypted Apple refresh token in restricted server-side storage so that we can revoke the Apple authorisation if you delete your account. It is removed with your account.

Reviews, lists and social activity

We process content you create or choose to store, including restaurant reviews, overall and dish ratings, dishes, notes, tips, saved restaurants and lists. We also process groups, group memberships, follows and follow requests, blocks, likes, list sharing and review visibility choices needed to provide the app’s social and trust features.

Location and maps

If you grant device permission, From a Friend obtains a one-time foreground location while the app is open to show nearby spots and your position on a map. The current app keeps that location in temporary app memory for the session and sends coordinates to the service to calculate distance and ordering; it does not save a location history or add your device location to your profile. Mapbox may also process the location needed to display your position. Location access is optional, can be changed in device settings and is not requested in the background. Mapbox's attribution control provides access to its telemetry information and opt-out control.

Restaurant and search information

During the current beta, you enter the spot name yourself. We store that name with your review and may also store spot details added by users. Automatic third-party place search and place details are not active. New review-photo uploads are not enabled in the current beta.

Support and safety reports

If you contact support, we process your contact details, message, issue details and any attachments you choose to provide. If you report a review or account, we process the reporter, reported account, reason, optional description, a snapshot of the relevant content and the status and outcome of moderation.

Technical and security information

We and our service providers may process device, app, network, request and session information—such as IP address, timestamps, app and operating-system version, authentication events and error or security logs—to operate, protect and troubleshoot From a Friend.

3. Where information comes from

We receive information directly from you, from your use of From a Friend, from Apple or Google when you choose their sign-in method, from Mapbox when map features are used, and from other users when they interact with you or submit a safety report concerning your account or content.

4. How we use information

• Create and secure your account and complete sign-in.
• Save, organise and display the restaurants and content you add.
• Apply your sharing choices and show permitted content from groups, follows and other trusted relationships.
• Let you name and find stored spots and use map features.
• Operate blocks, reporting, moderation and other safety controls.
• Prevent abuse and protect users, accounts and the service.
• Respond to support, deletion and privacy requests.
• Maintain and improve the reliability of the app.

5. Legal bases

Where the General Data Protection Regulation (GDPR) applies, we process account, content, social, search and product data as needed to provide From a Friend and perform our agreement with you. We process security, fraud-prevention, moderation, service-integrity and limited operational information for our legitimate interests in running a safe and reliable service. We process information where necessary to comply with a legal obligation or establish, exercise or defend legal claims.

Device location is used only after you choose to grant the relevant operating-system permission. You can withdraw that permission at any time in device settings without losing access to features that do not require location.

6. Visibility and sharing

From a Friend is designed around trusted sharing rather than a fully public review feed. Profile information may be visible to other signed-in users as needed for people discovery and social relationships. Review visibility depends on the sharing setting you choose, including private, group, follower or follower-and-group contexts. Blocking changes access between the affected accounts.

7. Service providers

From a Friend currently relies on service providers including:

• Supabase for the database, account authentication, file storage and server-side functions. See the Supabase Privacy Policy.
• Mapbox for map display and map-related features, which may involve map interactions, device or network information and location when you enable location-based map features. See the Mapbox Privacy Policy.
• Apple and Google when you choose their respective authentication methods. See the Apple Privacy Policy and Google Privacy Policy.
• Google Workspace for company email, including support, safety, account-deletion and privacy requests sent to our support address.
• Infrastructure and app-distribution providers needed to build, distribute, secure and operate the mobile app.

Providers process information under their own terms where they act independently, or on our instructions where they act as processors. We share only the information reasonably needed for the relevant provider function.

8. International transfers

The primary From a Friend Supabase project is hosted in Amazon Web Services' London region in the United Kingdom. The European Commission has adopted an adequacy decision covering transfers of personal data to the United Kingdom. Supabase and other providers may use subprocessors in additional countries.

Mapbox services may process limited map, device, network and location information in the United States and other countries. Where information is transferred outside the European Economic Area or a country covered by an adequacy decision, the relevant provider or we rely on approved contractual safeguards, an applicable data-privacy framework or another legally recognised transfer mechanism.

9. Advertising, analytics and subscriptions

We do not sell personal data. During the current beta, From a Friend does not use third-party advertising trackers, serve targeted advertising or use behavioural analytics to build advertising profiles.

Subscription purchasing and payment processing are not active during the current beta. If subscriptions are introduced later, we will update this policy before that processing begins and explain the relevant app store or payment provider, information processed and user choices.

10. Retention

Account information is generally retained while your account is active. Active database records for User Content remain until you delete the relevant content, delete your account or the content is removed for safety or legal reasons. Support messages and safety reports are retained for as long as reasonably needed to address the issue, document moderation, prevent repeated abuse, resolve disputes and meet legal obligations. We normally review closed support and safety records for deletion 12 months after resolution, unless an unresolved dispute, repeat-abuse investigation or legal obligation requires longer retention.

Records of Terms acceptance are retained while your account is active. Our current Supabase Pro plan retains routine platform logs for up to seven days and daily database backups for up to seven days. Database backups do not include the contents of files stored through the Storage API. Mapbox may retain limited network and telemetry information under its own published retention practices.

Some records may be kept longer where needed for security, legal compliance or backup cycles. We delete or anonymise personal data when it is no longer needed for the purpose for which it was processed.

11. Account deletion

In From a Friend, open Settings, choose “Delete account” and confirm the request. This removes your authentication account and associated profile, reviews, lists, follows, group memberships and other user-owned records from the active service.

Before the authentication account is deleted, the app removes uploaded avatar and review-photo objects belonging to the account from active file storage. If that cleanup cannot complete, the account deletion stops and you can retry or contact support.

A group you created may remain without your ownership information so other members do not lose their shared group history. A separate list copy already created by another user remains that user’s copy. Safety reports and relevant content snapshots may be retained where reasonably necessary for moderation, security or legal purposes. Limited residual copies may also remain temporarily in backups or provider logs before deletion cycles complete.

If you cannot access the app, contact support@nordiceastasiagroup.com. We may need to verify your identity before fulfilling a request.

12. Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to receive portable data. You may withdraw consent where processing relies on consent without affecting earlier lawful processing. You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

13. Security and children

We use technical and organisational measures intended to protect personal data, including access controls, server-side permission checks and restricted access to moderation records. No method of storage or transmission can be guaranteed to be completely secure.

From a Friend is a general-audience service and is not designed specifically for children. If you believe a child has provided personal data contrary to applicable law, contact us so we can review and address the situation.

14. Changes and contact

We may update this policy as From a Friend develops. Material changes will be communicated through an appropriate channel before they take effect where required, and the effective date above will be revised.

Privacy questions can be sent to Nordic EastAsia Group AB, organization number 556842-3882, Täby, Sweden, at support@nordiceastasiagroup.com.