Privacy Notice

This is a translation. The Italian version prevails.

This notice explains how we process the personal data of people who use meetmysugar.com (the "Service"), under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree 196/2003.

1. Controllers

Your data is processed by the Operators as joint controllers (Article 26 GDPR).

Single contact for any privacy request: [email protected]. The joint controllers have an agreement setting out who does what. Its essence is available on request and, in any case, you can exercise your rights against each of them.

We have not appointed a Data Protection Officer (DPO) because we are not required to. If the Service is ever transferred to a company, we will tell you beforehand.

2. What data we process, why, and on what legal basis

2.1 Account data

Email, password (stored only as a hash), name, date of birth.
Purpose: creating and running your account, checking that you are at least 18, sending you service messages (email confirmation, password reset, changes to the terms).
Legal basis: performance of the contract (Article 6(1)(b) GDPR); for the age check, also our obligation not to admit minors and our legitimate interest in protecting them (Article 6(1)(c) and (f)).
We also record the date and time of every consent box you tick and the version of the Terms you accepted, so that we can demonstrate consent (Article 7(1) GDPR).

2.2 Profile data

What you choose to publish: role, city, photos, height, weight, body type, ethnic origin (if you give it), languages, income bracket, the kind of relationship you are looking for, free descriptions, preferences.
Some of this data may reveal information about your sex life or sexual orientation and your ethnic origin. These are "special categories of data" (Article 9 GDPR).
Purpose: showing your profile to other users and visitors, according to the visibility settings you choose, and making searches possible.
Legal basis: for ordinary data, performance of the contract (Article 6(1)(b)); for special categories, your explicit consent (Article 9(2)(a)), which you give by ticking the dedicated box. It appears, when you sign up or edit your profile, only if you fill in one of these fields (ethnic origin, openness to intimacy, girlfriend/boyfriend experience). All of these fields are optional. You can withdraw consent at any time with "Withdraw consent" on the Edit profile page: that data is removed from your profile at once. You can also hide your profile or delete your account. Withdrawal does not affect the lawfulness of processing before it.

2.3 Location

The city you pick from the suggestions (not an address). It appears on your profile and on the public map, moved by 1-3 km so that only the area is shown.
Legal basis: performance of the contract (Article 6(1)(b)).
If you have not picked a city, searches start from a city estimated from your IP address. This estimate is not saved to your profile.

2.4 Photo verification (optional)

A photo of your face while you hold a sheet of paper reading "meetmysugar".
Purpose: granting the "verified" badge and fighting fake profiles.
Legal basis: your consent (Article 6(1)(a)), which you give by uploading the photo.
The photo is kept in a private space, only the person reviewing it sees it, it never appears on your profile and it is deleted straight after review, whether approved or rejected. We keep only the outcome. The comparison is made by eye by a person: we do not use facial recognition or any other biometric processing.

Identity documents: we do not ask for them and do not need them. If you send us one by mistake, we delete it without looking at it and keep no copy.

2.5 Messages

The messages you exchange with other users.
Purpose: delivering them and keeping them in your inbox.
Legal basis: performance of the contract (Article 6(1)(b)).
Messages are not read by the Operators, except when they are the subject of a report or when it is necessary to establish a serious breach that has already come to light (fraud, minors, threats). In those cases the legal basis is our legitimate interest, and that of other users, in the safety of the Service (Article 6(1)(f)), plus legal obligations (Article 6(1)(c)). Unless you switch it off, we email you when you receive a message. The email does not name the sender or quote the text.

2.6 Reports and moderation

The content of reports, the details of whoever reports (if they give them), the decisions taken and their reasons.
Legal basis: legal obligations (Regulation (EU) 2022/2065, the "DSA") (Article 6(1)(c)) and our legitimate interest in the safety of the Service (Article 6(1)(f)). The identity of whoever reports is not disclosed to the reported person, unless the law or an authority requires it.

2.7 Announcement emails

From time to time we may email you news about the Service, such as new features.
Legal basis: our legitimate interest in informing members about a service they already use (Article 6(1)(f) GDPR and Article 130(4) of Italian Legislative Decree 196/2003).
You can switch them off at any time in your profile settings or with the link in every email.

2.8 Messages to support

If you write to us with the "Write to us" form or by email: your email address, the text of the message and the page you wrote from. If you are signed in, we use your account's email.
Purpose: answering you.
Legal basis: performance of the contract (Article 6(1)(b)) and our legitimate interest in answering whoever contacts us (Article 6(1)(f)).

2.9 Technical data

Server logs (IP address, browser, date and time of requests) for security and abuse prevention.
Legal basis: legitimate interest (Article 6(1)(f)).
Visits are counted with Plausible Analytics, running on our own server, without cookies and without data that identifies you. For cookies see the Cookie Policy.

2.10 Legal claims and requests from authorities

We may keep and disclose the data needed to establish, exercise or defend legal claims (Articles 6(1)(f) and 9(2)(f)), or to answer binding requests from judicial or police authorities (Article 6(1)(c)).

2.11 What we do NOT do

We do not sell your data, do not use it for advertising and do not profile you for commercial purposes.

3. Which data is required

Account data (2.1) is needed to sign up. Everything else is optional: if you do not provide it, your profile will simply be less complete.

4. Who we share data with

Other users and visitors, according to your choices:

• a published profile is visible to people who are not members too, and appears on the map in its approximate area;
• photos are visible to everyone, to members only (people who are not signed in see a blurred preview) or only to people who have exchanged messages with you, according to the setting you choose;
• your email, date of birth and verification photo are never shown to others.

Suppliers who process data on our behalf (processors, Article 28 GDPR), each only for what it needs:

• Supabase Inc.: database, authentication and photo storage, on servers in the EU (Ireland, eu-west-1);
• IONOS SE (Germany): the server the application runs on, in Frankfurt (Germany);
• Cloudflare Inc.: protecting the site and encrypting traffic;
• Brevo (Sendinblue SAS, France): sending service emails;
• Google Ireland Ltd / Google LLC (Maps Platform): suggesting places as you type in the city field. It receives the text you type and your IP address;
• OpenFreeMap: the map background. It receives your IP address.

Authorities, only when the law requires it or when it is necessary to protect a person's life or safety.

5. Transfers outside the European Economic Area

Some suppliers (or their sub-processors) are based in the United States. In those cases the transfer relies on the EU-US adequacy decision (EU-US Data Privacy Framework), for suppliers that have joined it, or on the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR). You can ask for a copy at [email protected].

6. How long we keep data

• Account and profile: while the account is active; after deletion, erased within 30 days (backups included within 30 days).
• Messages: as long as at least one of the two participants keeps their account; then erased.
• Verification photo: deleted straight after review. Only the outcome is kept.
• Documents sent by mistake: deleted as soon as received.
• Consent records: while the account is active; deleted with the account.
• Messages to support: as long as needed to handle the request, and in any case no more than 2 years.
• Server logs: up to 30 days, then deleted or anonymised.
• Reports and moderation decisions: up to 2 years; for accounts closed for serious breaches, up to 5 years, limited to the data needed to stop them signing up again.
• Longer only where needed for an ongoing dispute or a request from an authority.

7. Security

We use encrypted connections (HTTPS), store passwords only as hashes, limit access to the data to the Operators and keep non-public content in private storage. No system is 100% secure. If a data breach puts you at risk, we will notify the Italian Data Protection Authority within 72 hours and, if the risk is high, you as well (Articles 33-34 GDPR).

8. Minors

The Service is for people aged 18 and over. We do not knowingly process minors' data: if we find out, including through a report, that a user is a minor, we close the account and delete the data, except what must be kept to report the matter to the authorities.

9. Automated decisions

We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you (Article 22 GDPR). The order of search results depends on verification status and recent activity, not on profiling of your behaviour. Anti-spam limits (for example the number of new conversations a day) are the same rules for everyone.

10. Your rights

You can ask at any time for access, rectification, erasure, restriction and portability of your data and object to processing based on legitimate interest (Articles 15-21 GDPR). You can also withdraw consent at any time, without affecting processing carried out before. Write to [email protected]: we answer within one month, extendable by two months in complex cases. We may ask you to confirm the request from the email address linked to your account.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

11. Changes

If we change this notice substantially, we will tell you on the site or by email before the changes take effect.