What we collect, why we are allowed to, and what you can make us delete.

ANDIAMO SOFTWARE SRL, a company incorporated in Romania ("Lovele", "we", "the controller"), is the controller of the personal data described in this policy. The identification details of the controller are listed under Company information at the end of this policy. The controller may be contacted by electronic mail at legal@lovele.app or in writing at the registered office. This policy applies to the website at lovele.app, to the Lovele applications for Android and for iOS, and to every account created on any of them.

The controller processes the following categories of personal data. Account and identity data: the mobile telephone number in international format, which identifies the account and is confirmed by a code sent to it by SMS, together with the line type reported by the provider that sends the code; where the account holder sets one, a six digit PIN, stored only in hashed form; an electronic mail address, only where the account holder adds one; for accounts created before sign in by telephone number, the electronic mail address and the password in hashed form, and the identifier of the account at Google, Facebook, Telegram or Apple where the account was linked to one of them; display name, username, date of birth, profile photograph, interface language, self declared country, time zone, trust tier, account status, and registration and last activity timestamps. Content data: posts, comments, reactions, photographs and videos attached to posts, and the encrypted contents of private messages, including photographs, videos and voice messages sent in a conversation, together with the message metadata described in section 5. Location metadata embedded in an uploaded photograph, such as satellite positioning coordinates, is removed on the device when the photograph is uploaded from the website, and on the server before the original file of a photograph is retained; the copy that is published is produced by the controller and carries no such metadata. Relationship data: friend requests, mutual friendships, blocks, discovery and contact preferences, per pair interaction counts used for ordering the feed, and the referral relationships between accounts. Activity and reward data: reward claims and the factors applied to each, activity days, streak state, wheel spins and the seed pairs that make them verifiable, advertisement view durations, offer completions, prize pool entries, and every entry in the account ledger. Advertising data: for each advertisement shown in the service, being a banner, a sponsored post in the feed or a video shown before a reward, the record of a validated impression, with the campaign and the placement, the time the advertisement was visible on the screen, whether a video was watched to the end, a tap on the advertisement, the country, the class of device and a keyed one way hash of the internet protocol address. These data are collected by the controller's own servers, on the website and in the applications, including the iOS application, and are used to credit the points earned from an advertisement, to bill the advertiser only for impressions validated as seen, and to detect invalid traffic. Advertisements are served by the controller and not by a third party advertising network, none of these data is shared with an advertising network, and the applications do not read the advertising identifier of the device, being the Apple identifier for advertisers (IDFA) or the Google advertising identifier. Financial data: point balance and lifetime totals, redemption requests with amounts, method and status, the redemption destination stored in encrypted form together with a masked hint of it; and, for an account that buys advertising, the advertising balance and each top up of it with its amount, method, status and the reference of the payment at the payment processor, the details of the wallet used being entered on the payment processor's own page and not received by the controller, and, where unspent balance is refunded, the wallet address, the crypto asset and the network to which the refund is sent, or the bank account to which a top up made by bank transfer is returned. Technical and device data: device identifier supplied by the application, platform, application version, device model, notification token, on an iPhone the token for incoming calls, the subscription created by a web browser for notifications where the account holder allows them, the internet protocol address most recently seen for a device and the address recorded on a web session together with the browser user agent string, session and token records, the record of each device trusted after a successful sign in, held as a one way hash of the token kept on that device, the evidence of device integrity sent by the applications, being, on Android, the integrity token produced by Google Play Integrity and, on iOS, the attestation and the signed assertions produced with Apple App Attest, together with the identifier and the public key of the key attested for that installation of the application and the counter of its assertions, kept in order to check later assertions, and, for anti abuse purposes, keyed one way hashes of the device identifier, the internet protocol address and the telephone number, including, for each sign in or account deletion code sent, the keyed hash of the number, its international calling code, the time and whether the code was confirmed. The code itself is generated and checked by the provider that sends it and is not stored by the controller. For a redemption to PayPal, the PayPal address is the redemption destination; where the account holder asks, it is also kept encrypted on the account until removed in the settings, and, to prevent abuse, a keyed one way hash of its canonical form links accounts that redeem to the same PayPal account or to an address for which PayPal blocked or reversed a payment. Safety and integrity data: reports submitted and received, moderation cases and decisions, appeals, a record of how often reports submitted by an account were upheld, risk indicators, and the account groupings produced by abuse detection. Identity verification data: the outcome of the verification of identity described in section 16, the form of verification chosen, the reason codes returned with it, the identifiers of the verification sessions, the number of attempts and the time of each step; the images and videos of the identity document and, in the form with a face scan, the video of the face are held by the processor named in that section and are not copied to the systems of the controller. Support and administrative data: the support emails the account holder sends to contact@lovele.app and the replies of the controller, kept in the mailbox of the controller and not in the account, terms acceptances, consent decisions and their history, data export and deletion requests, and administrative action records. Diagnostic data: error reports sent by the website and by the applications, only where consent has been given under section 10, and records of errors that occur on the server; identifying fields are removed from both before they are stored, and neither is linked to an account or to an internet protocol address.

Processing is carried out on the following bases. Under Article 6(1)(b) of Regulation (EU) 2016/679, for the performance of the contract concluded when an account is created: creating and authenticating the account, delivering messages and feed content, maintaining friend relationships, operating the points programme and its ledger, including the crediting of points earned from advertisements, executing redemption requests, operating advertising campaigns bought by an account holder and the advertising balance that pays for them, sending sign in codes by SMS and service messages such as address verification, balance correction and redemption confirmation, and answering support requests. Under Article 6(1)(c), for compliance with legal obligations to which the controller is subject: retention of accounting records relating to amounts paid to or received from account holders, for the period required by Romanian accounting law; preservation of material depicting the sexual abuse of children and of the record of the incident, and reporting of it to the competent authorities, under the Romanian law that applies to that material; and retention of the records required to demonstrate compliance with this Regulation, including the consent record required by Article 7(1) and the record of the version of the terms accepted by each account holder. Under Article 6(1)(f), for the legitimate interests of the controller and of other account holders: prevention of fraud and of abuse of the reward programme, which Recital 47 of the Regulation recognises as a legitimate interest; protection of the service against automated access and against unauthorised use, including challenge verification, rate limiting and administrative audit records; verification of the type and reputation of the telephone line presented for sign in, and limits on the number of codes sent to a number, a network, a device and a country, which protect the service against abuse of text messages; content moderation and the handling of reports; billing advertisers only for impressions validated as seen, and detecting invalid advertising traffic; recording errors that occur on the server, in order to keep the service secure and working; the publication on the website of a masked record of completed redemptions, being the first two and the last two characters of the username, the amount and the time the redemption took; and the publication of the results of rewards pools, with the masked usernames of the recipients, on the page of each pool and on the public Lovele channel described in section 6. Under Article 6(1)(a), on the basis of consent given separately for each purpose and withdrawable at any time: crash and error diagnostics, product usage statistics, and promotional notifications. Also under Article 6(1)(a), at the choice of the account holder: where the account holder shares the proof of a completed redemption, the publication, on a public page at a link generated for it and in the preview images of that page, of the amount, the method and the date of that redemption and, only where the account holder chooses, their first name or its initial. Such a page is excluded from indexing by search engines, and the account holder can turn the link off at any time, which removes the page and deletes its images. The verification of identity required before the first redemption, which involves biometric data only in the form with a face scan, is carried out on the bases stated in section 16. Personal data are not processed for any purpose incompatible with the purpose for which they were collected.

The controller operates automated processing that evaluates the risk associated with an account, with the device it is used from, and with the network origin of a request. The evaluation uses information about the account itself, such as its age, verification state and tier; information about the device and about the network origin, including whether the internet protocol address belongs to an anonymising network, a virtual private network, a hosting provider or a data centre, which is assessed on the controller's own servers against published address lists and, where it is configured, a database of network ownership; and information about relationships observed between accounts. This processing may, without human involvement at the moment of the decision: refuse a reward claim for the remainder of a day; credit a claim while placing the account under closer observation; suspend the ability to earn rewards; and place a redemption request in review instead of executing it. A redemption request above a defined per request amount is always placed in review. Where a decision produces legal effects concerning an account holder or similarly significantly affects them, the account holder has the right under Article 22(3) of Regulation (EU) 2016/679 to obtain human intervention, to express their point of view and to contest the decision. That right is exercised through the appeal available in the application when earning is suspended, and by electronic mail to contact@lovele.app in every other case; in both routes the outcome is decided by a person and the account holder is informed of the general category of the finding, and where the route is the appeal the decision is also sent by electronic mail. The controller does not publish the individual signals, thresholds or weights used in the evaluation, because doing so would allow the conduct it exists to prevent to be calibrated against it; Article 15(1)(h) entitles the account holder to meaningful information about the logic involved, which this section provides, and not to the parameters of the model.

Private messages are encrypted on the sending device and decrypted on the receiving device. The controller stores the ciphertext and the associated nonce, and performs no cryptographic operation on message content at any point. The account holder's private key material is stored only in a form encrypted under a key derived from a chat passphrase, which the account holder chooses on the device the first time messaging is used and which is never sent to the controller, and, where a recovery phrase has been set, under a second key derived from that phrase; where messaging was set up before the chat passphrase was introduced, the first key is derived from the account password until the account holder chooses a chat passphrase. The derivation is performed on the device and the controller does not hold, and cannot compute, the key needed to open either envelope. Session keys are stored sealed to the public key of each recipient device and are served only to the recipient they are addressed to. The controller does process the following data relating to private messages: the identities of the participants, the time each message was sent, its position in the conversation, its type, the size of the ciphertext, delivery and read markers, the account holder's read receipt and typing indicator preferences, mute and archive state, the media expiry period chosen for the conversation and who last changed it, key fingerprint changes and their acknowledgement, and, for each day and each conversation, the number of messages exchanged and the distinct hours in which they were exchanged, which are used to determine eligibility for reward features. Photographs, videos and voice messages sent in a conversation are encrypted on the device before upload; the controller stores the resulting object, its storage identifier, its size and the time at which it expires, and does not hold the key needed to decrypt it. There is one circumstance in which the controller holds readable message text: when an account holder reports a message, their device decrypts that message and submits it together with a signature made with their own key, so that the report can be reviewed and its authenticity verified. That submission is limited in size, is retained separately from the conversation for the period stated in section 8, and is the only place in the system that contains readable message content. Changing or resetting the account password has no effect on message history. Where the chat passphrase is forgotten and no recovery phrase has been set, messaging can be reset, which makes the existing message history permanently unreadable, including for the controller. Voice and video calls made in a conversation, including shared screens, are encrypted end to end on the participants' devices with keys the controller does not hold, and are not recorded. The controller processes the following data relating to calls: the conversation, the participants and who invited whom, the type of call, the time each participant was invited, joined and left, and the start, end and duration of the call; this data is used to connect the call, to show call notices in the conversation and to keep the service safe.

The controller uses the following processors and recipients. Each acts on documented instructions under a contract meeting the requirements of Article 28 of Regulation (EU) 2016/679. In use today: Cloudflare, Inc., which receives the challenge token and the internet protocol address of a request in order to distinguish automated from human access when a sign in code is requested, when deletion of an account is requested without signing in, and at reward claim; which stores, in its object storage located in the European Union, profile photographs, feed photographs and videos, the original files of published photographs and videos for the period stated in section 8, and the encrypted bytes of conversation photographs, videos and voice messages together with their storage identifiers and their sizes; which delivers published photographs and videos through its network and checks the photographs, and for each video its cover image and one frame for each second of it, against known child sexual abuse material with its scanning tool, an item that matches being removed from view, preserved as evidence and reported; and which receives the metadata of every request to lovele.app, including the internet protocol address, in order to deliver the site and protect it against attack; Twilio Inc., the provider of text messages, which receives the telephone number in international format each time a sign in code or an account deletion code is requested, in order to send the code by SMS, check it and report the type of line; Resend, which delivers transactional electronic mail and receives the electronic mail address and the content of the message; Expo, Inc., which receives the application version and the platform when the application checks for an update, and which delivers notifications to the applications, through Google LLC, with Firebase Cloud Messaging, on Android, and through Apple Inc., with the Apple Push Notification service, on iOS; for each notification, they receive the notification token of the device, the title and text of the notification, which may contain the display name of the person or the name of the group it is about and, for a redemption to PayPal, the amount and a masked electronic mail address, but never the content of a message, and internal identifiers of the conversation or call it concerns; Apple Inc., through the Apple Push Notification service, which receives directly from the controller, when an iPhone receives a call, the call notification token of that device, the name of the caller and internal identifiers of the call, so that the phone can ring; the push service of the web browser used by the account holder, operated by the maker of that browser, such as Google, Mozilla, Microsoft or Apple, which receives a notification encrypted for that browser, which it cannot read, and only where the account holder has allowed notifications in it; LiveKit, Inc., which relays the audio, video and screen sharing streams of calls, encrypted end to end on the participants' devices with keys it does not hold, so that it cannot decrypt them; which receives, for each call, a room name generated for that call that reveals nothing about the conversation or the participants, the account identifier of each participant, without a name or any other profile data, and the internet protocol address of each participant's device; which tells the controller when a participant joins or leaves a call and when a call ends; and which may process these data outside the European Union under the standard contractual clauses adopted by the European Commission; Didit Identity Spain, S.L., of Barcelona, Spain, which carries out the verification of identity described in section 16; which receives from the controller the account identifier and the interface language; which collects directly from the account holder, on its verification page or in its module within the application, images and short videos of the identity document and the data printed on it, in the form with a face scan a video of the account holder's face recorded during the session, without sound, and the internet protocol address and technical data of the device used; which uses them to read the document and, in the form with a face scan, to establish that a live person is present and to compare the face with the photograph on the document; which processes these data in the European Union; which acts only as a processor of the controller and does not use these data to train or improve its own models; and which returns to the controller only the outcome and short reason codes; Reloadly, which receives, when points are redeemed for a gift card, the product, its value, the country and an internal order reference, the code of the card being delivered by the controller and not by Reloadly, and, when points are redeemed for a mobile top-up, the telephone number to be credited, which is the verified number of the account or another number in the same country entered by the account holder, and its country, in order to credit that number; and which may process these data outside the European Union under the standard contractual clauses adopted by the European Commission; and the provider that hosts the servers and the database, which holds all data stored by the service. Configured but not yet transferring any data: NOWPayments, which will receive the amount and an internal reference of a top up of an advertising balance paid in crypto assets; the offer partners AdGem, ayeT-Studios, BitLabs, CPX Research, MyChips and Torox, which will receive an account identifier and offer completion data; PostHog, in its European region, which will receive usage events without identifying fields; IPQualityScore, LLC, which will receive the internet protocol address of a reward claim or of a sign in code request, and the telephone number to which a sign in code is requested, and return a reputation score and indicators of proxy, virtual private network, data centre origin and internet telephony numbers; Google LLC, which will receive the device integrity token produced by the Android application, in order to establish that the application is running on a genuine device, including when a sign in code is requested from the application; Apple Inc., through its App Attest service, which will receive from the iOS application the request to attest a key generated on the device for that installation of the application, in order to establish that requests come from a genuine copy of the application on a genuine Apple device, the attestation and the signed assertions made with that key being checked at reward claim on the controller's own servers, for the prevention of fraud and abuse; Telegram, which will receive the results posted on the public Lovele channel: for each rewards pool, the number of rewards, the points of each reward, the number of entries and participants, the values that allow the selection to be checked and the masked usernames of the recipients in the order in which they were selected, and, for each round of the invite challenge, the number of qualifying accounts, entries and rewards given, without any name; and Cloudflare, Inc., for checking images before they are published and for image classification, which will receive image bytes. The database of network ownership referred to in section 4 is supplied by MaxMind, Inc., and is downloaded to and queried on the controller's own servers, so that no personal data is sent to MaxMind. Where points are redeemed to a PayPal account, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, receives the electronic mail address entered, the amount and currency, an internal reference, the subject and note of the payment message and, for an address without a PayPal account, the language of that message, in order to make the payment; PayPal acts as an independent controller, not under Article 28.

Several of the recipients listed in section 6 are established outside the European Economic Area, principally in the United States. Where personal data are transferred to such a recipient, the transfer is made on one of the following bases: an adequacy decision adopted by the European Commission under Article 45 of Regulation (EU) 2016/679, including the adequacy decision covering organisations certified under the EU-US Data Privacy Framework, where the recipient is so certified; or the standard contractual clauses adopted by the European Commission under Article 46(2)(c), supplemented where necessary by additional measures identified in a transfer impact assessment. PayPal, named in section 6, is established in the European Economic Area and transfers data outside it within the PayPal group, as controller, under binding corporate rules approved under Article 47. A copy of the safeguards relied on for a given transfer, and the identity of the basis relied on for a given recipient, may be requested at the address in section 13.

The following periods are applied automatically. An account for which deletion is requested is deactivated immediately and permanently deleted or anonymised fourteen days later, by a task that runs daily; logging in during those fourteen days cancels the deletion and restores the account. Points do not expire: the point balance is kept for as long as the account exists, however long the account goes without activity, and is then treated as stated in section 9. Access tokens issued to the mobile application expire fifteen minutes after issue and refresh tokens are rotated on use. A sign in, on the application or on the website, does not end on its own: it lasts until the account holder signs out or revokes it, until it is revoked for a security reason or because the account is suspended or deactivated, and at most until ten years pass without use. On the website, a remember me token kept in the browser signs the account holder back in when the session record expires, until sign out. A device trusted after a successful sign in stays trusted for ten years without use, and stops being trusted when the account holder signs out on it. The records of sign in and account deletion codes described in section 2, which hold no code and no readable number, are deleted ninety days after the code was requested, by a task that runs daily. Access tokens and web sessions are deleted when an account is deactivated. Photographs, videos and voice messages sent in a conversation are deleted from storage when they expire, by a task that runs every minute: twenty four hours after upload, or earlier where a shorter period has been chosen for the conversation, being twelve hours, one hour or five minutes after sending, or five minutes after every recipient has opened the item; a storage rule that removes any such object older than twenty four hours applies as a second safeguard. The readable copy of a reported message described in section 5 is deleted thirty days after it is submitted, by a task that runs daily, except while the report it belongs to is still open or escalated, or where it concerns an account that is the subject of a child sexual abuse incident. The original file of a published photograph or video is kept in private storage for up to thirty days after publication while the published copy is checked for child sexual abuse material, and is then deleted by a task, unless it has become evidence in such an incident, in which case section 9 applies. The periods that apply to the data of the verification of identity are stated in section 16. Personal data for which no period is stated above are retained for as long as the account exists, and are then subject to section 9.

On request, the account is deactivated at once: the profile stops being visible and searchable, all sessions and tokens are revoked, and no further access is possible. If the account holder logs in within fourteen days, the account and its content are restored to the state they were in. After fourteen days the following are permanently destroyed: the conversation history, the photographs, videos and voice messages sent in conversations and the encryption keys, including the key envelope that makes the history readable; posts, comments, reactions, appeals and post photographs and videos; friendships, friend requests, blocks, privacy preferences and the reward state derived from conversations; the profile photograph and any photographs uploaded but not published, including the stored objects themselves; the referral code and the invitation link; the record of lifecycle electronic mail and of consent decisions; the record of the verification of identity, the controller asking the processor named in section 16 at the same time to delete every verification session of the account, including the images, the videos and the extracted data; and web session records. Payout destinations, device records, trusted devices, the PIN, two factor credentials and recovery codes are deleted at the same time. The PayPal address remembered on the account is deleted with them; the address recorded on a completed redemption is kept, encrypted, with the record of that redemption, and its keyed hash with the records used to prevent fraud. Support emails are kept in the mailbox of the controller, outside the account, and are deleted at the same time where the law allows, or earlier at the request of the account holder. Any remaining point balance is forfeited, by an entry recorded in the ledger rather than by deleting the ledger. Where the account has financial history, the account record itself is anonymised rather than erased, because the following categories must be retained and the retention would be meaningless if the identifier holding them together were removed. The controller retains, after deletion: the double entry ledger, the account and the balance record, on the basis of Article 17(3)(b) of Regulation (EU) 2016/679 and the accounting obligations of the controller, for the period required by Romanian accounting law; the records of completed redemptions; the referral relationships and the commissions already credited, which are the record of another account holder; the underlying records of each reward credited and the seed pairs that allow a wheel result to be verified, from which the device and network identifiers are removed; the records used to prevent fraud, including keyed hashes of device, network and telephone identifiers and the groupings derived from them, on the basis of Article 6(1)(f) and Recital 47, for two years after the deletion of the account, without which an account operated abusively could remove its traces by deleting itself and register again on the same telephone and the same device; safety records, including reports, moderation cases and decisions, for two years after the case they belong to is closed, and preserved evidence of child sexual abuse material, on the basis of Article 17(3)(e) and of the reporting obligation, since a report submitted by a departing account holder is evidence about the person reported and does not disappear with the person who submitted it; the original files of photographs and videos still within the period stated in section 8, until that period ends; and the administrative record of the deletion itself, which is the proof that it was carried out. Preserved evidence of child sexual abuse material is not deleted before the incident is closed with a reference from the competent authority, and is then kept for a further period set in the service configuration, currently three hundred and sixty five days.

Article 5(3) of Directive 2002/58/EC, transposed in Romania by Legea 506/2004, permits the storing of information in, or the gaining of access to information already stored in, the terminal equipment of a user only with that user's consent, except where it is strictly necessary in order to provide a service explicitly requested by the user. The controller stores the following on the basis of strict necessity, without consent: a session identifier, without which an authenticated session cannot be maintained; a token used to protect requests against cross site request forgery; the selected interface language; the selected colour theme; after a successful sign in on the website, a token that marks the browser as trusted, so that a sign in code is not requested on every visit; the record of the choice made in the cookie banner, being the version of this policy, the moment of the choice and the categories chosen, which is kept so that the question is not asked again on every page; for members of the controller's staff only, the language of the administration panel; and, in the storage of the browser, the data that the features used by the account holder need in order to work, such as the chat keys and unsent messages of that device, unfinished drafts and dismissed hints, which are not read for any other purpose. The name, purpose and duration of each of these are set out in the table in this section. The challenge verification provider named in section 6 stores information in terminal equipment while a challenge is being solved, and that storage is strictly necessary for the security purpose it serves. The controller stores nothing else in terminal equipment, and gains access to nothing else stored there, without consent obtained beforehand. Consent is requested separately for each of the following purposes and may be withdrawn at any time with the same ease with which it was given: crash and error diagnostics, which are sent only to the controller's own servers; product usage statistics; promotional notifications; and, on the website, partner cookies. Partner cookies are the cookies and other storage that the offer partners named in section 6 (AdGem, ayeT-Studios, BitLabs, CPX Research, MyChips and Torox) may place in terminal equipment when their content is loaded inside the service; those third parties decide what they store and for how long. Advertiser pages in Paid Views are not loaded inside the service: they open in a separate browser tab, like any other website, where the advertiser's own cookie rules apply. On the website, crash and error diagnostics and product usage statistics are presented together as Analytics and diagnostics. Promotional notifications are push notifications, in the application and in browsers in which the account holder has turned notifications on, about new offers, invitation promotions and rewards pools the account holder has entered; consent to them is given or withdrawn with the Offers and news switch in the notification settings, the account holder is asked about them once, after the first reward the account holder receives, and notifications about the account holder's own account do not depend on that consent. Every optional purpose starts refused. Where partner cookies are refused, the offer walls are not loaded at all; no other feature depends on any consent. The choice is asked again when this policy changes in a way that affects it. Consent, and its withdrawal, are recorded together with the moment of the decision and the version of this policy in force at that moment: on the device, in the record described above, and, for a signed in account holder, with the account, so that the same choice applies on every browser in which the account holder signs in.

The service is offered only to persons who have reached the age of 16 years. A date of birth is requested when an account is created and is stored with the account, and an account is not created where the date given is below the minimum age. The controller does not otherwise verify the date given. The controller does not knowingly process the personal data of a person below the minimum age; an account identified as belonging to such a person, whether through a report submitted by another account holder or by any other means, is suspended and its data deleted in accordance with section 9. A parent or guardian who becomes aware that a person in their care has created an account may write to the address in section 13, and the account will be removed.

Under Regulation (EU) 2016/679 the account holder has the right of access (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), to object to processing based on legitimate interests (Article 21), and, where consent is the basis, to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3)). These rights are exercised as follows. Access and portability: the data screen in the application produces, on request and without stating a reason, a machine readable file containing the account record, the point balance, the ledger, the redemption requests, the redemption destinations in masked form, the friend list, the terms acceptances and the full history of consent decisions. A PayPal address remembered on the account appears in full. Support emails are not part of that file, because they are kept in the mailbox of the controller and not in the account; a copy of them, or their deletion, can be requested by electronic mail to contact@lovele.app. Rectification: display name, username, profile photograph, interface language, country and time zone are edited directly in the profile settings; the electronic mail address, the date of birth and the verified telephone number cannot be changed in the application and are corrected on request at the address in section 13. Erasure: the delete account screen, or, without signing in, the page at lovele.app/delete-account, which sends a code by SMS to the telephone number of the account and asks for that code before the deletion is confirmed, in both cases subject to section 9; deletion is refused while a redemption is still in progress, and may be requested again once it completes. Restriction and objection: in writing at the address in section 13. An objection to processing carried out for the prevention of fraud will be assessed against Article 21(1), and the controller may continue that processing where it demonstrates compelling legitimate grounds. Withdrawal of consent: the consent controls described in section 10, and, for the verification of identity, as described in section 16. The controller responds within one month of receipt of a request, extendable by two further months where necessary in view of the complexity or number of requests, in which case the account holder is informed within the first month.

Questions about this policy and requests under section 12 are addressed to legal@lovele.app. An account holder who considers that the processing of their personal data infringes Regulation (EU) 2016/679 has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, under Article 77 of that Regulation. The supervisory authority competent for the controller is the National Supervisory Authority for Personal Data Processing (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal). The right to lodge a complaint does not affect any other administrative or judicial remedy.

Where the account holder chooses, in the mobile application, to find other account holders among the contacts stored on their device, and only after the account holder has granted the device permission to read contacts, the application converts each telephone number in the device address book to the international E.164 format and computes on the device a SHA-256 hash of it. Only these hashes are transmitted to the controller, in batches, and only while the account holder is using the feature; names, electronic mail addresses, photographs and any other contact details remain on the device, and the address book is never read or transmitted in the background. The controller compares the hashes with the hashes of the telephone numbers that other account holders have verified and have not excluded from being found by telephone number, returns to the account holder the accounts that match, together with the hash that matched, and discards every hash received, matched or not, once the response has been sent. The hashes are not stored, not written to logs or error reports, not used for any other purpose, and not disclosed to any third party. The controller keeps only the number of hashes received and the number of matches, per account and per day, in order to enforce the limits that prevent the feature from being used to test whether arbitrary telephone numbers belong to account holders. A hash of a telephone number does not make the number anonymous, and the controller treats it as personal data for as long as it is processed. The processing takes place at the request of the account holder, on the basis of Article 6(1)(b) of Regulation (EU) 2016/679 as regards the account holder, and of Article 6(1)(f) as regards the persons whose numbers are in the address book, whose interests are protected by the immediate discarding of every number that does not match and by the absence of any contact with them. The feature is optional and no other part of the service depends on it. The account holder may withdraw the device permission at any time in the settings of the device. Any account holder may prevent being found by telephone number, both in search and through the contacts of others, with the setting Let people who have my number find me, in the privacy settings of the account. That setting alone decides whether an account can be found by its telephone number and whether a friend request can be sent to it on the strength of that number, as described in section 15.

The controller does not show any account holder the friends of another account holder: there are no suggestions of other account holders, no count of mutual friends and no list or count of another account holder's friends; each account holder sees only their own friend list. The only exception is a tag: the people an author tags in a post are shown to everyone who can see that post, because tagging is the author's choice. A friendship is established only (a) when a person creates an account through a single-use personal invitation link sent by an existing account holder, in which case the two become friends without a request, or (b) by a friend request that the recipient accepts, which can be sent only by an account holder who supplies the recipient's verified telephone number, its hash obtained as described in section 14, or the recipient's invitation code. A friend request based on a telephone number is accepted only while the recipient's setting Let people who have my number find me is switched on; that setting is switched on by default. Searches by name or username return only the existing friends of the person searching. The telephone number itself is never shown to anyone. The processing is necessary for the social features the account holder uses, on the basis of Article 6(1)(b) of Regulation (EU) 2016/679.

Before the first redemption of points, the controller asks the account holder to verify their identity once, in order to confirm that the account is held by a real person and to prevent fraud and abuse of the reward programme, including the operation of several accounts by one person. The verification is carried out by the processor Didit Identity Spain, S.L., Barcelona, Spain (Didit), on its verification page shown on the website or in its module within the application, and the account holder chooses one of two forms. The first form consists of three checks: the reading of an identity document from images of it, without reading the chip of the document; a passive liveness check, in which a short video of the face is recorded during the session, without sound, to establish that a live person is present; and the comparison of the face in that video with the photograph on the document. The comparison of faces processes biometric data for the purpose of uniquely identifying a natural person, a special category of personal data under Article 9(1) of Regulation (EU) 2016/679. The second form, offered to every account holder who prefers not to have their face scanned, consists only of the reading of the identity document, without reading the chip of the document: Didit captures images of the document and may record short videos of it, which show the photograph printed on the document and may show whatever else is in view of the camera. In this form the controller's configuration switches off the liveness check, the comparison of faces and any comparison of the photograph on the document with an image from the camera, so that no face is recognised or compared and no biometric data are processed; Didit's verification page may nevertheless show its general notice that it uses facial recognition and records a session video, which describes its verification flows in general and not this form. The second form gives a lower level of assurance than the first. Its outcome is decided automatically by Didit; a session that Didit would hold for manual review is treated as not passed, and the account holder may try again within the attempts described below. Each form is carried out only with the consent of the account holder, under Article 6(1)(a) and, for the biometric data of the first form, with explicit consent under Article 9(2)(a), given by ticking a box that describes the processing of the chosen form before the verification opens; the controller records the consent, the form chosen, the version of this policy in force and the time it was given. The consent to the processing of biometric data is not a condition of redemption: an account holder who refuses it may verify their identity with the second form and redeem in the same way. Didit stores and processes the images, the videos and the data extracted from the document in the European Union, keeps them for six months after the verification session and then deletes them automatically; the facial template computed for the comparison of faces is deleted together with the session. The controller does not copy them to its own systems; a person on the controller's team may view a session in Didit's console in order to review it. The controller keeps only: the outcome of the verification, the form chosen, the reason codes returned by Didit, which name the check that was not passed and contain none of the data on the document, the identifiers of the verification sessions, the number of attempts, the time of each step, and whether the decision was made by Didit or by a person on the controller's team. It keeps them for as long as the account exists, on the basis of Article 6(1)(f) for the prevention of fraud described in section 3, including after a withdrawal of consent, and includes them in the data export described in section 12. An account may open at most three verification sessions in total, in either form. Where a verification is rejected or the attempts are used up, a person on the controller's team reviews it on a request sent to contact@lovele.app, and may approve it. The consent may be withdrawn at any time by writing to the address in section 13, without affecting the lawfulness of the processing carried out before the withdrawal; the controller then asks Didit to delete the verification sessions of the account. As a verification in one of the two forms is a condition of redemption, an account holder who gives consent to neither form, or withdraws it before the verification is approved, cannot redeem points; the account, the points and every other part of the service remain available. When the account is deleted under section 9, the controller deletes its record of the verification and asks Didit to delete every verification session of the account, including the images, the videos and the extracted data.