Privacy Notice

• Account and sign-in data: email address, account identifier, authentication credentials or sign-in-provider information, and session data. We use these to create and secure accounts, authenticate users, and provide password recovery. The legal bases are performance of our contract with you and legitimate interests in account security.
• Profile and preference data: display name, biography, disciplines, location or country, website, career stage, travel preferences, and language preference where you provide or select them. We use these to provide your profile and account preferences. The legal basis is contract performance.
• Saved calls and alerts: saved-call references, alert preferences, and alert/read timestamps. We use these to deliver the saved-call and notification services you choose. The legal basis is contract performance.
• Contact and submission data: name or organiser name, email, messages, call details, links, and any files or supporting information you submit. We use these to answer enquiries, review advertised or spotted calls, check accuracy and duplicates, and handle complaints. The legal bases are taking steps at your request, contract performance where applicable, and legitimate interests in operating and moderating the platform.
• Membership data: payment-provider customer and subscription identifiers, subscription status, and billing-period information. We use these to grant and manage paid access and handle billing enquiries. The legal bases are contract performance and applicable legal obligations. Card payment details are handled by Paddle, not stored by us as full card details.
• Technical and security data: IP addresses, device or browser information, request/error logs, and service-use information processed by our hosting and service providers. We use these for service delivery, diagnosing faults, abuse prevention, and security. The legal basis is our legitimate interest in maintaining a reliable, secure service; legal obligations may also apply.

Access is limited to those who need it for the purposes described above. Recipients may include:

• Our authorised platform administrators and service providers for hosting, account authentication, data storage, email delivery and support, including Lovable Cloud and connected email services.
• Google when you choose Google sign-in, under its own privacy terms.
• Paddle, our Merchant of Record, for selling the membership, subscription management, payments, tax compliance, and invoicing. Paddle also processes data under its own Privacy Policy.
• Research and verification services where needed to check submitted opportunity information or source links. Do not include unnecessary sensitive personal data in call information or uploaded materials.
• Professional advisers, including legal and accounting advisers, where necessary; public authorities where required by law.

Approved call information may be published as a listing. Your sender email and private submission contact details are not included in that public listing. Personal information already contained in organiser source materials may remain part of the opportunity information.

We retain account, profile, saved-call, and preference data while needed to provide your account; enquiry and submission records while needed for responses, moderation, disputes, and follow-up; and membership records while needed for access management, accounting, and legal obligations. Technical records are kept only as needed for operations and security. Retention depends on the purpose, applicable statutory requirements, and any unresolved dispute. We delete or anonymise data when it is no longer needed; backups may remain until their normal replacement cycle. You may delete your account from Account settings after identity verification and explicit confirmation. Recurring billing must stop successfully before deletion. Approved editorial opportunity listings and legally necessary billing records are retained without retaining your personal profile. You may also request assistance through the Contact page. Data needed for legal obligations or legitimate claims may be retained after an account closes.

Some service providers may process personal data outside Cyprus or the European Economic Area. Where a transfer to a country without an applicable adequacy decision occurs, appropriate safeguards are required, such as European Commission Standard Contractual Clauses and additional measures where necessary. You may contact us for information about safeguards applicable to your data.

Under the GDPR, where applicable, you may request access, correction, erasure, restriction of processing, or portability of your personal data. You may object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting earlier lawful processing.

Send requests through the Contact page. We may need to verify your identity. We respond within one month, subject to lawful extensions for complex or numerous requests. You may complain to the Cyprus Commissioner for Personal Data Protection or your local supervisory authority.

We use appropriate technical and organisational measures, including encrypted connections, access controls, and restricted administrative access, to protect personal data. No online system can guarantee absolute security. Keep your account credentials confidential and notify us of suspected unauthorised access.

The service uses essential session and authentication storage and browser storage for preferences such as language. Interface preferences may also use cookies. These support sign-in, security, and your chosen settings. Payment checkout may use storage operated by Paddle under its own privacy and cookie information.

We do not currently add analytics or advertising cookies to the platform. If non-essential tracking is introduced, we will update this notice and obtain consent where required. You can manage cookies and local storage through your browser settings; clearing or blocking essential storage may sign you out or prevent some features from working.

We may update this notice as the service or legal requirements change. The date above identifies the current version. For privacy questions or rights requests, contact Charis Poullaidou, the controller operating Κυψέλη, through our Contact page.