Privacy policy

Who is responsible

Bouvale Group Ltd (reg.nr HE 489968) is the data controller for the processing described here. You can reach us at jonathan@acction.app.

Address: Aristovoulou 27, 3085 Limassol, Cyprus.

What we collect

When you create an account: your email address. We do not use passwords — you sign in with a link sent to your address.

Your profile: display name, portrait, city, language, short bio, professional description, birth year and your interests. Everything but the name is optional.

When you join an evening: whether you are coming alone, whether it is your first evening, what you hope to get out of it, practical needs (see the next section), whether you consent to being filmed, and when you accepted the terms.

What you write: messages in the evening’s channel, reactions, reviews and ratings.

Technical: device tokens for notifications, and events describing how the service is used. Analytics events carry only fields from a fixed, closed list.

Sensitive data — please read this

When you join we ask: *"Anything we should know? Diet, accessibility, practical things."* If you answer something about diet or accessibility, it may reveal your religion or your health. Such data is specially protected by law (Article 9 of the GDPR).

So three things apply. The field is optional — skip it if you prefer. We process it only with your explicit consent, given by writing in the field, and you can withdraw that at any time. And it is visible only to the host of that evening, never to other guests.

We never log the contents of that field — not in analytics, not in error reports.

Why we process your data

To give you a place at an evening and manage your registration. Legal basis: our contract with you.

To make the evening work — so the host knows who is coming, can check you in and reach you in the channel. Legal basis: contract.

For safety — blocking, reporting and preventing misuse. Legal basis: legitimate interest.

To improve the service through statistics on how it is used. Legal basis: legitimate interest.

For practical needs per the section above. Legal basis: explicit consent.

Who sees what

Access is restricted in the database, not just in the interface.

Before an evening, other guests see your first name and picture — never your profile, never your email, never your practical needs.

The host of an evening sees guests’ names, pictures and practical needs, plus the answers to the registration questions.

The exact address of an evening is shown only once your place is confirmed.

Other guests’ profiles are visible to you only if you actually checked in to the same evening.

We never sell your data, and we do not share it for marketing.

Who processes data on our behalf

Supabase — database, authentication and file storage. Servers in Stockholm.

Vercel — hosting for acction.app. Servers in Stockholm.

Apple and Google — push notifications, if you have enabled them.

An email provider for sign-in links and confirmations.

Data is stored within the EU/EEA — the database and the website are in Stockholm. We are established in Cyprus, also within the EU, so no transfer to a third country takes place.

How long we keep it

Your profile and registrations are kept for as long as you have an account.

Registrations for completed evenings are then kept as long as needed for accounting and to handle disputes.

Safety data — blocks and reports — is kept as long as needed to protect other guests.

What happens when you delete your account

You delete the account yourself in the app. Most of it goes immediately: your profile, registrations, messages, friends, interests and device tokens.

But not everything goes, and you should know what stays:

Reviews you wrote stay, but anonymised — the name becomes "Deleted account" and the picture is removed. The text and rating remain, so other guests can still judge an evening.

Reports about you stay, including the name and picture you had when the report was made. We need that to protect others.

Statistics stay, but the link to you is removed.

You cannot delete your account while you host an evening that is published or ongoing — complete or cancel it first.

Your rights

You have the right to know what data we hold about you, to have it corrected, to have it erased, to object to certain processing, to request restriction, and to receive it in a machine-readable format.

Where you have given consent — as for practical needs or filming — you can withdraw it at any time. That does not affect what has already happened.

Write to jonathan@acction.app. We answer within one month.

If you are not satisfied you can complain to a supervisory authority. As we are established in Cyprus that is the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy) — but you always have the right to go to the authority in the country where you live instead. In Sweden that is the Swedish Authority for Privacy Protection, imy.se.

Cookies and tracking

We use no marketing cookies and no tracking across other websites. The site sets only what is needed to keep you signed in and to remember your language.

We never store your precise location. City and neighbourhood, nothing more.

Children

Acction is not for children. You must be at least 18 to use the service.

Changes

If we make a material change to this policy we will tell you in the app or by email before it takes effect.