Privacy Policy

Last updated: March 7, 2026

1. Introduction

Welcome to BestCityIndex ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

BestCityIndex is operated by Silva Node AB (Sweden), which acts as the data controller for personal data collected through this website.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when you:

• Purchase data access packages or download datasets (name, email, organisation, payment information)
• Contact us via our contact form (name, email, organisation, message — submitted via your email client and not stored on our servers)

2.2 Automatically Collected Information

When you interact with our website, we automatically collect limited technical data for the purposes described in Section 3, including:

• IP address — collected when you make a purchase, download a dataset, or submit a city rating (used solely for fraud prevention, download logging, and rating deduplication)
• Browser type and user agent
• Referring URL

2.3 Analytics Data (with your consent)

With your explicit consent, we use Google Analytics 4 to collect anonymised usage data, including pages visited, session duration, and general geographic location (country level). IP anonymisation is always enabled — your full IP address is never sent to Google. You can withdraw consent at any time via our Cookie Consent banner.

3. How We Use Your Information

We use the information we collect for the following purposes, based on the legal bases noted:

• Processing transactions — fulfilling data purchases and sending access tokens (legal basis: contract performance)
• Fraud prevention and security — IP logging on purchases and downloads (legal basis: legitimate interests)
• Rating deduplication — IP address stored to prevent duplicate city ratings (legal basis: legitimate interests)
• Analytics — understanding how visitors use the site via Google Analytics (legal basis: consent)
• Legal compliance — retaining transaction records as required by law (legal basis: legal obligation)

We do not send marketing emails, operate a newsletter, or share your data with third parties for advertising purposes.

4. Cookies and Local Storage

We use cookies and browser local storage to provide a functional experience. Details of every cookie and local storage item we use are set out in our Cookie Policy. You can manage your preferences via the Cookie Consent banner displayed when you first visit the site.

5. Data Sharing and Sub-processors

We share data only with trusted sub-processors necessary to deliver our services:

• Supabase — database and authentication infrastructure (EU data residency available)
• Stripe — payment processing (Stripe handles all card data; we never receive raw card numbers)
• Google Analytics — anonymised usage analytics (only if you have given consent)
• Vercel — website hosting

All sub-processors are contractually bound to process data only on our instructions and in compliance with GDPR.

6. Data Retention

We retain personal data only for as long as necessary:

• Payment and transaction records — retained for accounting and legal compliance purposes (typically 7 years)
• Download logs and IP address logs — retained for up to 2 years for fraud prevention
• City rating records — retained indefinitely in anonymised aggregate form; IP records retained for 6 months
• Analytics data — governed by Google Analytics retention settings (default 14 months)

7. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or UK, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data (subject to legal retention obligations)
• Right to restriction — request that we limit processing of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw analytics consent at any time via the Cookie Consent banner

To exercise any of these rights, please contact us at privacy@bestcityindex.com. We will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS/TLS), Row-Level Security on our database, and access controls limiting who can view personal data.

9. International Transfers

Silva Node AB is based in Sweden (EEA). Where data is transferred outside the EEA (e.g., to Google Analytics servers), we rely on Standard Contractual Clauses and other appropriate safeguards.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be noted by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, or wish to exercise your data rights, please contact:

You also have the right to lodge a complaint with a supervisory authority. The competent authority in Sweden is Integritetsskyddsmyndigheten (IMY) — www.imy.se.