Privacy Policy

This Privacy Policy explains how Experience Buddies (the "service") collects, uses and protects your personal data, and the rights you have over it. It applies to the website and, once released, the mobile apps. We follow the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller of your personal data is Experience Buddies SRL, a company registered in Romania with the Cluj Trade Register, sole registration code (CUI) 54255526, EUID ROONRC.J2026017117001, with its registered office at Bulevardul 21 Decembrie 1989 no. 21, 1st floor, ap. 5, Cluj-Napoca, Cluj County, Romania.

For any privacy or data-protection request, please use our data protection (DPO) form at Contact - Data protection.

2. What data we collect

We only collect the data we need to run the service. This includes:

• Account data - your email address and name. Passwords are never stored in plain text; they are held as a secure hash by our authentication provider. If you sign in with Google, we receive basic account details from Google instead of a password.
• Profile data - your display name, profile photo, description, preferences (such as favourite categories or destinations) and your chosen interface language.
• Content you create - the experiences you publish (title, description, category, dates and location), the photos you upload, the message you attach to a join request, and your 1-on-1 chat messages with people you are matched with.
• Social data - your buddy connections and the join requests you send and receive.
• Technical data - log data and your IP address, used to keep the service secure and prevent abuse, and your cookie choice.

We do not collect precise device geolocation. The locations shown on experiences are simply the places that organizers type in when they create an experience; we do not track where you or your device are.

3. Why we use your data and our legal bases

We use your personal data for the following purposes:

• Running the service - creating and managing your account, publishing your experiences, handling join requests, enabling chat between matched members and keeping the service working. Legal basis: performance of our contract with you, GDPR Art. 6(1)(b).
• Transactional emails - such as email verification, welcome messages, and notifications about join requests and new chat messages. Legal basis: performance of our contract and our legitimate interest in keeping you informed, GDPR Art. 6(1)(b) and 6(1)(f). You can turn off each group of notification emails from your Account settings.
• Security and abuse prevention - detecting, preventing and investigating fraud, spam, harassment and other misuse, and protecting members and the service. Legal basis: our legitimate interest in a safe service, GDPR Art. 6(1)(f).
• Analytics and marketing cookies - only ever set with your consent, GDPR Art. 6(1)(a). We do not use any analytics or marketing cookies today; the service currently uses essential cookies only. For details on the cookies we use, see our Cookie Policy.

4. Who processes data on our behalf

We rely on a small number of trusted service providers (processors) to run the service. They process data only on our instructions and under a data processing agreement. Our infrastructure is hosted in the EU.

5. How long we keep your data

We keep your account and the data linked to it for as long as your account exists. When you delete your account, your personal data is deleted completely. The only exception is the chat messages you sent: these are anonymized rather than removed, so that the conversations of the other people you talked to stay readable and intact. You can export your data at any time before you delete (see your rights below).

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting processing done before you withdrew it). In practice:

• you can export all your data as a JSON file and delete your account yourself, at any time, from your Account settings;
• you can manage your cookie consent at any time via "Cookie preferences" in the footer;
• for any other request (access, rectification, restriction, objection), use our data protection (DPO) form at Contact - Data protection.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), https://www.dataprotection.ro.

7. International transfers

Our infrastructure is hosted in the European Union. Where one of our providers could process data outside the EU, we rely on the European Commission's standard contractual clauses (SCCs), together with any additional safeguards required, to protect your data.

8. Children

The service is only for adults: creating an account requires you to be at least 18 years old, as set out in our Terms of Service. The service is not directed at minors and is not intended for them. If we learn that we have collected data from a person under 18, we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect new features or legal requirements. When we do, we will publish the updated version on this page and change the "Last updated" date at the top. If the changes are significant, we will let you know in the app or by email.