1. Who we are (Data Controller)

The data controller responsible for processing your personal data is:

2. What personal data we collect

We collect only the personal data necessary to operate the Platform.

2.1. Account and profile data

When you create an account, we may process:

• email address
• full name or display name
• profile photo (optional)
• short bio or interests (optional)
• basic account identifiers (user ID)

2.2. Activity and interaction data

When you use the Platform, we may process:

• activities you create or join
• messages and chat content
• participation status (joined, left, approved)
• notifications related to activities

2.3. Technical and usage data

We may automatically collect:

• IP address
• browser type and device information
• pages visited and interactions
• timestamps and session data

This data is used for security, analytics, and service improvement.

2.4. Location-related data (optional)

If you choose to use location-based features:

• you may search for places or select locations using Google Maps services
• precise device location is accessed only if you explicitly allow it

We do not continuously track your location and do not store location history.

2.5. Camera and photo library access

Mellon may request access to your device's camera and photo library to allow you to upload images when creating or joining activities.

Photos are only used within the app to display activities and user-generated content. We do not access your camera or photos without your permission, and we do not sell or share your images with third parties.

If you have any questions, you can contact us through the app's support section.

2.6. User-generated content

Users may voluntarily share personal information (for example, phone numbers) in chats or activity descriptions. This information is provided entirely at the user's discretion.

We do not request, verify, or require such information and are not responsible for what users choose to disclose.

3. What personal data we do NOT collect

We do not intentionally collect:

• payment or financial information
• government identification numbers
• health data
• biometric data
• political, religious, or other special-category data

Users should avoid sharing sensitive personal information on the Platform.

4. Why we process personal data (purposes)

We process personal data to:

• create and manage user accounts
• enable users to create, join, and communicate around activities
• provide messaging and notifications
• ensure platform security and prevent abuse
• understand how the Platform is used and improve it
• provide location-based functionality when requested

5. Legal bases for processing

We process personal data under the following legal bases:

• GDPR Art. 6(1)(b) – performance of a contract (providing the Platform)
• GDPR Art. 6(1)(f) – legitimate interest (security, functionality, improvement)
• GDPR Art. 6(1)(a) – consent (analytics cookies, optional location access)

6. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy, including:

• strictly necessary cookies (authentication, security)
• analytics cookies (Google Analytics, with consent)
• functional local storage

You can manage your cookie preferences at any time through your browser settings.

7. Data storage and service providers

We use third-party service providers to operate the Platform, including:

• Base44 – platform infrastructure, authentication, database and file storage
• Google – analytics and maps services
• Resend – transactional email delivery

These providers process data only as necessary to provide their services.

8. International data processing

Some service providers used by the Platform may process personal data outside the European Union.

Where such processing occurs, we rely on the safeguards and contractual measures implemented by the relevant service providers, where applicable, in accordance with GDPR requirements.

Users are informed during onboarding that personal data may be stored or processed outside the EU, and by using the Platform they acknowledge and accept this.

9. Data retention

We retain personal data only for as long as necessary to provide the Platform and fulfill the purposes described in this Policy.

• account data is retained while your account is active
• messages and activity data are retained until deleted by you or upon account deletion
• technical logs are retained for limited periods for security and debugging

You may request deletion of your account and associated data at any time.

10. Your rights under GDPR

You have the right to:

• access your personal data
• request correction of inaccurate data
• request deletion of your data
• request restriction of processing
• object to certain processing
• request data portability (where applicable)
• withdraw consent at any time (where processing is based on consent)

To exercise your rights, contact us at team@mellon.life.

You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP).

11. Account deletion

You may delete your account at any time through the Platform (if available) or by contacting us.

Upon deletion:

• your account and profile data will be removed
• associated activity and message data will be deleted or anonymised where technically feasible

12. Security

We take reasonable technical and organisational measures to protect personal data, including:

• access controls
• authentication mechanisms
• secure infrastructure provided by our service partners

No system is completely secure, and we cannot guarantee absolute security.

13. Children

The Platform is intended only for users aged 18 and over. We do not knowingly collect personal data from minors.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we do, we will update the "Last updated" date at the top of this page. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.