Privacy Policy
Last updated: 27 August 2026
1. Data controller
The personal data controller is AMBITIOUS NOMAD MEDIA SRL, fiscal code (CUI) 47086491, Trade Registry no. J13/3906/2022, headquartered in Constanța, Romania, e-mail contact@umblam.ro. For any question about your data, write to contact@umblam.ro.
2. Data categories
Account data: e-mail address, username and, if you use Google sign-in, the identifier and name provided by Google. Content data: the trips and places you choose to log (place, date, journal note, photos), proposed places and visibility settings. Technical data: IP address, browser type and server logs strictly necessary for operation and security. The Service does not request or collect device location: every trip is entered manually by you.
3. Purposes and legal bases
Providing the Service (account, journal, map, ranks (contract performance, art. 6(1)(b) GDPR). Security and abuse prevention) rate limiting, technical logs (legitimate interest, (f)). Waitlist and launch communications (based on your sign-up ((b)). The weekly community summary, e-mailed to accounts with a confirmed address (legitimate interest, (f)): it is on by default and you can unsubscribe any time, in one click, from the e-mail or from Settings. Usage statistics via analytics cookies) only with your consent ((a)), which you can withdraw at any time from Cookie settings.
4. Retention
Account data and your content are kept for as long as the account exists. On account deletion, personal data is deleted or anonymised within 30 days, except data we are legally required to keep (e.g. billing records, 10 years). Technical logs are kept for at most 12 months. Waitlist addresses are deleted on request or 12 months after launch.
5. Recipients and processors
We use providers that process data on our behalf under contract: Vercel Inc. (application hosting), Neon Inc. (database), Resend Inc. (sending sign-in and notification e-mails), Google Ireland Ltd. (authentication, only if you choose Google sign-in) and Stripe Payments Europe Ltd. (payment processing for the Partener Local subscription, card details go directly to Stripe and the Operator never stores card data). Only with your consent to analytics cookies do we also use Google LLC (Google Analytics). Transfers outside the EEA rely on the European Commission's standard contractual clauses or, for certified US providers, on the EU-US Data Privacy Framework. We do not sell your data and do not use it for behavioural advertising.
6. Content visibility
The default trip visibility is "public" and trips publish immediately, with no delay. If you would rather not, you can change visibility (public, followers, private) at any time and pick a publish delay of 24, 48 or 72 hours — so nobody can infer your current location — per trip or as defaults, in Settings. Public profiles expose only trips marked public and already published.
7. Support access to your account
To answer support requests, the umblăm team may temporarily enter your account: they see the app exactly as you see it, including private trips and trips still hidden by the publishing delay you chose. The only thing they can change is your account settings (visibility, publishing delay, notifications, profile details) — precisely what you would ask us to adjust when you cannot find the option. They cannot write anything in your name: no logging trips, no following anyone, no voting, no deleting your account, no downloading your data archive and no opening the billing portal. Each access lasts at most 15 minutes, requires a written reason, and is recorded in our internal activity log together with the operator, the account, the time and, separately, every setting changed; that log is kept for 12 months. The legal basis is our legitimate interest in providing support (art. 6(1)(f) GDPR). You can ask us at any time, at contact@umblam.ro, for the list of accesses to and changes made in your account.
8. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting prior processing. You can exercise erasure directly from Settings (the "Delete account" button) and access and portability there too (the "Download my data" button, which gives you a copy of your data as JSON). For any other request, write to contact@umblam.ro and we will reply within 30 days. You also have the right to lodge a complaint with the Romanian supervisory authority ANSPDCP (www.dataprotection.ro).