Privacy Policy

Last updated: June 2026 · Version 1.2
Data Controller: Agustín Gallea / MyNEXO Group · Málaga, Spain · NIF: Z0604987T · support@mynexoapp.site

1. Data we collect

• Account: name, email, profile photo, pronouns, LGBTQI+ identity (optional — special category data under art. 9 GDPR, explicit consent required)
• Profile: city, bio, interests, preferred energy, Instagram handle (optional)
• Activity: events created, attendance, ratings, chat messages, photos shared in private event chats
• Technical: push notification token, approximate IP, operating system, app version
• Payments: managed via RevenueCat through App Store / Google Play — we do not store card data or banking information
• Content moderation: cover photos and profile photos are submitted to Google Cloud Vision SafeSearch for automated prohibited-content detection; images are not stored or indexed by this service

2. What we use your data for

• Provide the service (account, events, chat)
• Send push notifications about your plans and community activity
• Detect your approximate location to suggest nearby events (only with your permission)
• Automatically moderate images to prevent prohibited content (Google Cloud Vision SafeSearch)
• Manage payments and subscriptions through RevenueCat (App Store / Google Play)
• Improve the platform through aggregated, fully anonymous analysis
• Comply with legal obligations, including reporting illegal content to the competent authorities

3. Legal basis (GDPR)

• Contract (art. 6.1.b): provision of the service
• Legitimate interest (art. 6.1.f): security, anti-fraud and service improvement
• Consent (art. 6.1.a): push notifications, location, LGBTQI+ identity, profiling preferences
• Legal obligation (art. 6.1.c): transaction retention (5 years), reporting CSAM to authorities

4. External providers (data processors)

5. International data transfers

All providers listed above operate primarily from the United States, a territory without a general adequacy decision from the European Commission. Transfers are carried out under:

• Standard Contractual Clauses (SCC) approved by the European Commission (art. 46.2.c GDPR) for Supabase, RevenueCat, Expo and Google Cloud Vision
• EU-US Data Privacy Framework (Adequacy Decision 2023/1795) for Apple and Google, both of which are certified members

6. Data retention

• Active account: as long as you use the app and do not request deletion
• After account deletion: 30-day recovery period, then permanent and irreversible deletion of profile, messages and photos
• Chat photos: deleted when you delete the individual message or your account; automatic deletion 90 days after the event they belong to ends
• Financial transactions: 5 years (legal tax obligation)
• Security and anti-fraud logs: maximum 12 months

7. Your rights (GDPR arts. 15–22)

You have the right to access, rectification, erasure, portability, restriction and objection regarding the processing of your data, as well as the right to withdraw consent at any time, free of charge and without retroactive effect.

Exercise your rights at: support@mynexoapp.site — subject line: "GDPR RIGHTS REQUEST" (response time: 30 days)

8. Security

We apply HTTPS/TLS 1.3 encryption on all communications, short-lived JWT token authentication, Row Level Security (RLS) in the database, and private photo storage with signed temporary URLs. No system is 100% secure — please use a strong, unique password.

In case of a data breach posing risk to users' rights and freedoms, we will notify the AEPD within 72 hours of detection and affected users without undue delay when there is a high risk (arts. 33–34 GDPR).

9. Minors

MyNEXO is strictly prohibited for anyone under 18. We do not knowingly collect data from minors. If we detect a minor's account, we delete it and all associated data immediately.

10. Local storage

The app stores on your device: language and theme preferences, distance unit, and an event cache for offline use. Temporary image files are created during the upload process and deleted afterwards. We do not use tracking cookies or advertising SDKs.

11. Changes to this policy

We will notify you of significant changes via the app or by email at least 15 calendar days in advance. Continued use after notification implies acceptance of the updated version. A history of prior versions is available upon request.

12. Contact

📧 support@mynexoapp.site

App: Profile → Settings → Contact support

13. Latin America — Supplemental provisions

If you reside in a Latin American country, the following additional provisions apply according to the legislation of your country:

Brazil — LGPD (Lei Geral de Proteção de Dados, Law 13,709/2018)

Users in Brazil have the right to: confirmation of processing existence, access, correction, anonymization or deletion of unnecessary data, portability, information on third-party sharing, and objection to processing.

• Legal basis: consent (art. 7, I), contract performance (art. 7, V) and legitimate interest (art. 7, IX).
• Sensitive data (sexual orientation, gender identity) is only processed with explicit consent (art. 11, I).
• You may exercise your rights before the ANPD: gov.br/anpd

Argentina — Law 25,326 on Personal Data Protection

Users in Argentina may access, rectify, update and delete their personal data. Sensitive data (LGBTQI+ identity) receives special protection and may not be processed without express consent.

• Exercise your rights before the AAIP: argentina.gob.ar/aaip
• MyNEXO does not transfer personal data to third parties without your consent, except as required by law.

Mexico — LFPDPPP

Users in Mexico have ARCO rights: Access, Rectification, Cancellation and Objection. To exercise them, send a request to support@mynexoapp.site.

• Sensitive data (sexual orientation, gender identity) is only collected with express written consent.
• You may file a complaint with the INAI: inai.org.mx

Other Latin American countries

In Colombia (Law 1581/2012), Chile (Law 19,628), Peru (Law 29,733) and Uruguay (Law 18,331), MyNEXO applies the same principles of lawfulness, purpose, proportionality and data security. Users may exercise their rights by contacting support@mynexoapp.site.

14. United States — Supplemental provisions

California — CCPA / CPRA

If you reside in California, you have the following additional rights under the CCPA/CPRA:

• Right to know: what personal data we collect, use, disclose and sell about you.
• Right to delete: you may request deletion of your personal data, subject to legal exceptions.
• Right to correct: you may request correction of inaccurate data.
• Right not to be discriminated against for exercising your CCPA rights.
• We do not sell or share your data for advertising purposes (art. 1798.120 CCPA).

Other US states — State privacy laws

MyNEXO provides all US users the following rights: access and portability, correction of inaccurate data, deletion of personal data, and objection to targeted advertising (not currently applicable — we do not serve targeted ads).

COPPA (Children's Online Privacy Protection Act)

MyNEXO is not directed at children under 13 and does not knowingly collect data from children under 13. If you are a parent or guardian and believe your child has provided personal information, contact support@mynexoapp.site immediately and we will delete that information.

International data transfers — US users

Data from US users is stored on Supabase servers in the United States and may be accessed by the Operator located in Spain (EU). Such transfers are carried out with appropriate safeguards (Standard Contractual Clauses).

MyNEXO — Platform for the LGBTQI+ community
© 2026 Agustín Gallea / MyNEXO Group · Version 1.2
Applicable law: GDPR (EU) 2016/679 · Spanish LOPDGDD 3/2018 · Spanish LSSI 34/2002