itsvegan.org
Log in Join free
Policies

Privacy policy

What itsvegan stores about you, why, who processes it and your rights under GDPR.

Last updated October 29, 2026

We never sell your dataNo data brokers, no ad networks.
Only essential cookiesSession and “keep me logged in” — no tracking.
Your data, your controlDownload or delete it any time in Settings.

This policy explains, in plain language, what personal data itsvegan.org (“itsvegan”, “we”) collects, why, and the rights you have. We follow the principles of the EU General Data Protection Regulation (GDPR): collect as little as possible, use it only for clear purposes, and keep it safe.

Who is responsible

itsvegan.org is the controller of your personal data. You can reach us about privacy at palmies@pm.me or via the contact form.

What we store

When you create an account

  • Email address — to log you in, confirm your account and send the emails you ask for.
  • Password — stored only as a secure one-way hash (we can’t see it).
  • Name and username — shown publicly on your profile and contributions.
  • Approximate country — sometimes derived from your connection at sign-up to personalise suggestions; you can change it.
  • IP address at sign-up and a record of recent login attempts — to prevent spam, abuse and account takeovers.

What you choose to add

Profile details (photo, cover, bio, headline, city, website, Instagram, “vegan since”), reviews, photos, listings, recipes, Veganpedia edits, forum posts, feed posts, comments, likes, follows, saved items, booking requests and private messages. Public content is visible to everyone; private messages and bookings are visible only to the people involved and, if needed for moderation or safety, to our admins.

Automatically

Basic server logs (IP address, browser, pages requested, time) kept for a short period for security and troubleshooting, and simple counters such as how many times a page was viewed. We do not use third-party analytics or advertising trackers.

Cookies

We use only cookies that are necessary for the site to work:

  • ivsess — a session cookie that keeps you logged in while you browse and protects forms against forgery. Deleted when you close your browser.
  • iv_token — only if you choose “keep me logged in”: a random token that keeps you logged in on that device for up to a year. Logging out deletes it.

Because these cookies are strictly necessary, no consent banner is required. We don’t use advertising or tracking cookies. Fonts and icons are loaded from Google Fonts and Cloudflare’s cdnjs, and map tiles from OpenStreetMap; these providers receive your IP address when your browser requests those files.

Why we use your data (legal bases)

  • To provide the service you signed up for (contract): your account, profile, posting, messaging, bookings and notifications.
  • Legitimate interests: keeping itsvegan safe and free of spam and fake reviews, fixing bugs, and understanding which features are used — in ways that don’t override your rights.
  • Consent: the newsletter and optional notification emails. You can withdraw consent at any time.
  • Legal obligations: when the law requires us to keep or disclose information.

Emails

We send transactional emails (confirmations, login links, password resets), notifications you can switch off in Settings, and — only if you subscribe — the newsletter. Every non-essential email has a one-click unsubscribe link. Emails are delivered by SparkPost (MessageBird / Bird), our email provider, which processes your email address and the message content on our behalf under a data processing agreement. We have switched off open and click tracking.

Who we share data with

We do not sell or rent your personal data, and we don’t share it with advertisers. We share data only with:

  • Service providers who help us run itsvegan — our web hosting provider and SparkPost for email — bound by contracts to use it only for us.
  • Other members, for content you make public or send to them.
  • Authorities, when required by law or to protect the safety of people.

Some providers may process data outside your country, including outside the EU/EEA; where that happens we rely on appropriate safeguards such as the European Commission’s standard contractual clauses.

How long we keep it

  • Account data: as long as your account exists. When you delete your account we delete your profile, reviews, photos, recipes, posts, forum posts, messages, follows and saved items immediately. Directory listings you added and Veganpedia edits stay online without your name (see our Terms).
  • Email logs: up to 60 days. Security logs and rate-limit records: up to a few days. Backups are overwritten on a rolling basis.
  • If you unsubscribe, we keep your email address on a suppression list so we never email it again.

Your rights

You have the right to access, correct, download (portability), delete, restrict and object to the processing of your personal data, and to withdraw consent. You can do most of this yourself:

For anything else, write to us — we’ll respond within one month. You also have the right to lodge a complaint with your local data protection authority.

Security

We use HTTPS, hashed passwords, hashed login and reset tokens, rate limiting, strict upload processing (every image is re-encoded, which also removes location metadata), and access controls for admins. No system is perfect, but we take protecting your data seriously and will inform you and the authorities if a breach affects you.

Children

itsvegan is not intended for children under 16, and we don’t knowingly collect their data. If you believe a child has created an account, please contact us.

Changes to this policy

We’ll update this page if our practices change, and notify members of significant changes by email or on the site.