Privacy Policy

Sentiko

Version 1.0, last updated 23 April 2026

Sentiko is an emotional barometer for cultural venues. People use it to log how a concert, an exhibition, or a film made them feel. We treat those feelings with care. They are not merchandise.

This policy explains, in plain language, what data we handle, on what legal basis, and what rights you have. It applies to every Sentiko surface, including the consumer app at sentiko.app, the about page at about.sentiko.app, the B2B landing at sentiko.org, and tenant dashboards at [client].sentiko.art.

1. Who we are, data controller

The data controller under the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") is:

Markevitch Media GmbH, trading as ikono, operator of the Sentiko service.
Contact for any privacy matter: privacy@sentiko.app or markevitch@ikonotv.art.

Markevitch Media GmbH has not appointed a statutory Data Protection Officer, as the thresholds under Article 37 GDPR are not met. A named privacy contact is reachable at the addresses above and will respond to every request personally.

2. Our starting point, data minimisation

Sentiko is designed so that you can participate without identifying yourself. You do not need an account to scan a QR code and log an emotion. We do not ask for your location. We do not ask for your contacts. We do not place advertising cookies.

If you choose to create an account, you do so to keep a private garden of your own reactions over time. That is the only reason an account exists.

3. What we process, and why

a. Anonymous emotion logs

When you scan a Sentiko QR code and select an emotion, we record:

• The emotion you selected and, where offered, its intensity.
• The venue, exhibition, or work the QR code is tied to.
• The timestamp of the log.
• Minimal technical metadata (app version, general device type) for reliability.

Legal basis: legitimate interest under Article 6(1)(f) GDPR, namely running and improving a cultural feedback service whose output is only ever aggregate. The risk to you is low because the log is not linked to an identifier, your name, your email, or your device's permanent identifiers.

b. Account data, "private garden"

If you choose to sign in, we receive and store:

• Your name and email address, as passed by your sign-in provider (for example Google or Apple).
• A Sentiko user identifier, linked to the emotion logs you choose to save to your garden.

Legal basis: performance of a contract with you under Article 6(1)(b) GDPR (we cannot give you a personal garden without an account), and your consent under Article 6(1)(a) GDPR where the sign-in step itself constitutes an explicit choice.

c. Aggregate signals shared with venues

Cultural institutions that host Sentiko see only aggregate emotional patterns across their programme. They do not see your name, your email, your individual log, or any identifier that could single you out. A museum or concert hall sees the shape of a room's emotional response, not the people in it.

Legal basis: legitimate interest under Article 6(1)(f) GDPR. Because the shared output is aggregated and non-identifying, it does not constitute personal data about you under Article 4(1) GDPR.

d. Technical and security logs

Our infrastructure keeps short-lived technical logs (IP address, request time, error traces) to defend the service against abuse and to diagnose outages. These logs are access-controlled and are not used for profiling.

Legal basis: legitimate interest under Article 6(1)(f) GDPR (network and information security, in line with Recital 49).

4. What we never do

We do not sell your data. Not to advertisers, not to data brokers, not to cultural institutions, not to anyone. This is not a clause we might revise later to make money. It is the foundation of the service.

We do not use GPS or geolocation prompts. Context comes from the QR code you scan, nothing else.

We do not run behavioural advertising trackers, nor embed third-party analytics that profile you across sites.

5. Sub-processors

We rely on a small set of trusted providers to operate Sentiko. Each is bound by a data processing agreement under Article 28 GDPR.

If we add or change a sub-processor, we will update this list and note the change in Section 13.

6. Where your data is stored

Sentiko is an EU-hosted service. Firebase Authentication and Firestore are configured to EU regions. Some sub-processors (for example Vercel's edge network) operate globally. Where personal data leaves the European Economic Area, transfers rely on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and, where applicable, supplementary measures such as encryption in transit and at rest.

7. Cookies and local storage

Sentiko uses the minimum storage required to make the service work:

• Authentication tokens stored by Firebase in your browser's local storage, only if you sign in. These keep you logged in and are removed when you sign out.
• Service worker cache storing the app shell so the PWA loads quickly.
• Preference keys such as language choice.

Sentiko does not set advertising cookies and does not use cross-site tracking technologies. Because no non-essential cookies are deployed, a cookie consent banner is not required under Article 5(3) of the ePrivacy Directive.

8. How long we keep data

• Anonymous emotion logs: retained as part of aggregate datasets. Because individual logs are not tied to an identifier of yours, they cannot be isolated and deleted on request, but they also cannot be used to identify you.
• Account data and your private garden: retained while your account is active. Deleted within 30 days of account deletion, save for residual backups that expire on a rolling 90-day cycle.
• Technical and security logs: retained no longer than 90 days.

9. Your rights under GDPR

If you are in the European Union, the United Kingdom, or another region with equivalent rules, you have the right to:

• Access the personal data we hold about you (Article 15).
• Request correction of inaccurate data (Article 16).
• Request deletion of your data (Article 17).
• Receive your data in a portable format (Article 20).
• Object to or restrict processing based on legitimate interest (Articles 18 and 21).
• Withdraw consent at any time, without affecting prior lawful processing (Article 7(3)).
• Lodge a complaint with a supervisory authority in your member state (Article 77).

To exercise any of these rights, write to privacy@sentiko.app. We will respond within 30 days, as required by Article 12(3) GDPR. We may ask for minimal information to verify the request, but no more than necessary.

10. Children

Sentiko is not directed at children under 16. Accounts are not knowingly created for them. If you believe a child has created an account, write to us and we will remove it without delay.

11. Security

We apply industry-standard safeguards, TLS in transit, encryption at rest on Firebase and Firestore, authenticated access to administrative tools, and least-privilege internal permissions. No system is perfect, but we treat this data as something we have been trusted with, not something we own. In the event of a personal data breach likely to result in a risk to you, we will notify the competent supervisory authority within 72 hours as required by Article 33 GDPR, and, where the risk is high, we will also notify you directly.

12. Automated decisions and profiling

Sentiko does not use your personal data to make automated decisions that produce legal or similarly significant effects concerning you, within the meaning of Article 22 GDPR.

13. Changes to this policy

If we update this policy, we will post the new version at this URL and update the version number and date at the top. Material changes will be communicated inside the app or by email to account holders, as appropriate.

14. Contact

Privacy questions, access or deletion requests, concerns: write to privacy@sentiko.app. A human will read it.