Privacy policy

Under Regulation (EU) 2016/679 (GDPR). Last updated: [to be completed: date]

Data controller

[to be completed: company name], [to be completed: address], email [to be completed: privacyEmail].

Data we process

• Account: email, password (stored only as a cryptographic hash), date of birth (to check you are an adult), language and time zone (to send you emails in your language and with the right times).
• Public profile: name, tagline, description, link, category, city and an optional profile photo. This data is public by the user's choice. Metadata, including GPS location, is removed from uploaded photos.
• Purchases: amounts, dates and order status. Payment details are processed directly by Stripe and never pass through our servers.
• Identity verification (optional): the ID document and selfie are collected and checked by Stripe Identity. We only receive the result of the verification.
• Email: we send service messages and, unless you turn them off, alerts when another profile passes you.
• Free activities: the hearts you give, the profiles you follow, your predictions and completed missions. They are public only in aggregate form (follower counts, prediction percentages), with two exceptions: if you give hearts to a profile your name may appear among its fans, and if you guess winners your name may appear in the predictions ranking. In both cases only if your profile is public.
• Reports: whoever reports content gives us an email (and optionally a name) to receive the outcome.
• Statistics: aggregate counts of profile views and clicks. To avoid counting the same view twice in a day we use a record kept in your browser; we don't store IP addresses. Our hosting providers may process them in their technical logs.
• Cookies and local storage: one technical cookie (flexed_lang) with your language choice, and in your browser the sign-in session, the light/dark theme preference and the profiles already viewed today. No profiling or third-party cookies.

Purposes and legal bases

• Providing the service, handling purchases and sending service emails (performance of the contract).
• Meeting tax and accounting obligations (legal obligation): orders are kept for 10 years.
• Handling reports of illegal content (legal obligation, EU Regulation 2022/2065).
• Preventing fraud and abuse, moderating content, sending overtake alerts (legitimate interest; you can object by turning them off).

Retention

Account data is kept as long as the account is active. Links sent by email expire after one hour (password recovery) or seven days (confirmation). Database backups are kept for a limited period and then overwritten.

Your rights

You can access your data, correct it, request its portability or deletion, and object to processing based on legitimate interest. You can download a copy of your data (JSON format) from your dashboard, under "Limits and account", and delete your account at any time from the same page: profile data and photo are deleted, while orders are kept for 10 years in minimal form to meet accounting obligations. You can also send any request to [to be completed: email]: we answer within one month. You can lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali).

Providers

Stripe (payments and identity verification), Cloudflare (website and email delivery), Supabase (database and accounts). Some providers may process data outside the European Union, with the safeguards required by the GDPR.