EEA & UK Privacy Notice
Lawful bases, representatives, transfers and your GDPR rights.
The operator has not yet published: legal entity name, registered address, governing law / jurisdiction, legal contact address, privacy contact address. Each missing item is marked in the text below. Until they are published this service should not be taking money from the public.
This notice supplements the Privacy Policy for people in the European Economic Area, the United Kingdom and Switzerland. Where it differs from the general policy, this one applies to you.
1. Who the controller is
[not yet published: legal entity name], of [not yet published: registered address] ([not yet published: country of establishment]), is the controller of your personal data.
| EU representative (GDPR Art. 27) | [not yet published: EU representative (GDPR Art. 27)] |
|---|---|
| UK representative | [not yet published: UK representative] |
| Data protection officer | Not appointed. We are not a public authority, and our core activities are not large-scale monitoring or large-scale processing of special category data, so Art. 37 does not require one. Write to [not yet published: privacy contact address] and it reaches the person who does this work. |
2. Our lawful basis for each purpose
Article 6 requires a basis for every purpose, not one for the service as a whole.
| Purpose | Lawful basis |
|---|---|
| Carrying your messages, calls and files | Art. 6(1)(b) — performance of the contract you entered into |
| Account, sign-in and security | Art. 6(1)(b) — contract |
| Marketplace orders, escrow and payouts | Art. 6(1)(b) — contract |
| Keeping tax and payment records | Art. 6(1)(c) — legal obligation |
| Sanctions screening | Art. 6(1)(c) — legal obligation |
| Preventing abuse, fraud and spam | Art. 6(1)(f) — legitimate interests. Ours and other users’ interest in a service that is not used to defraud or harass them. Balanced against your interests and recorded; you may object under Art. 21. |
| Diagnosing faults from error reports | Art. 6(1)(f) — legitimate interests in a service that works |
| Measuring how the app performs and which parts are used | Art. 6(1)(f) — legitimate interests in a service that works and is worth using. No advertising or profiling; no third-party analytics; nothing you typed. You can switch it off in Settings, we honour Global Privacy Control and Do Not Track, and you may object under Art. 21. |
| Reporting child sexual abuse material | Art. 6(1)(c) and Art. 6(1)(d) — legal obligation and the vital interests of another person |
We do not process your data for advertising or profiling, so no basis is claimed for it. Special category data (Art. 9) is not requested and not inferred.
3. Your rights
You may ask for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable form. Access, export and deletion are built into the app under Settings — you do not have to ask us. Write to [not yet published: privacy contact address] for the rest.
You may complain to your supervisory authority. In the UK that is the Information Commissioner’s Office; in the EEA it is the authority for the country you live in. We would rather you told us first, but that is your right and not a precondition.
4. Sending data outside the EEA and the UK
Our servers and subprocessors are listed in Subprocessors & Transfers, with the country each one holds data in. Transfers outside the EEA or the UK rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and on an adequacy decision where one is in force for that country.
5. How long we keep it
Every category and its period is in Data Retention. Nothing is kept “indefinitely” without a period being stated there.
6. Automated decisions
Two automated checks can refuse you: the age gate and sanctions screening. Neither produces a legal effect that cannot be reviewed by a person — write to [not yet published: legal contact address] and a human will look. There is no profiling, scoring or automated content moderation that acts on your account without review.
7. Digital Services Act contact
Our point of contact for users, and for authorities acting under the DSA, is [not yet published: legal contact address]. Notices may be sent in English. How we handle reports of illegal content, and how to challenge a decision about your own content, is described in Acceptable Use and Dispute Resolution.
What has changed
30 August 2026 · version 1
- First published.