Privacy Policy

The data controller is GLOBAL EYE COMPANY S.L., NIF B12986022, with registered address at Calle Manuel Segarra Ribes 9, Entresuelo 2, Castellon de la Plana, Spain.

Privacy and data-rights contact: moayad_al_anzi@tu.edu.iq. Please write "Experio Privacy" in the subject line.

• Account data: user ID, email address, authentication provider, sign-in and security records.
• Profile data: username, display name, biography, avatar, country, interests and profile preferences.
• User content: posts, captions, comments, reactions, saved items, photographs and other media you upload.
• Social and communication data: follows, followers, notifications and messages, including delivery metadata.
• Safety data: reports, blocks, moderation decisions, appeals and evidence needed to investigate misuse.
• Technical and usage data: device and app information, IP address, timestamps, language, session activity, diagnostics, crash data and security logs.
• Support and rights requests: correspondence and information used to verify and answer your request.

Please do not upload sensitive personal data unless it is necessary and you have a lawful right to share it. Do not post another person's data without permission or another valid legal basis.

• Provide the service and account: to authenticate you, maintain your profile, publish content, enable social features and deliver messages. Legal basis: performance of our contract with you.
• Safety, security and moderation: to prevent fraud, abuse, illegal content and security incidents, investigate reports and enforce our rules. Legal bases: legitimate interests, performance of the contract and compliance with legal obligations.
• Service operation and improvement: to diagnose failures, measure performance and improve accessibility and features. Legal basis: legitimate interests; consent where required for non-essential tracking.
• Communications: to send essential account, security, moderation and service notices. Legal basis: performance of the contract and legitimate interests. Marketing communications, if introduced, will rely on consent where required.
• Legal compliance and claims: to respond to authorities, protect rights and preserve evidence. Legal basis: legal obligations and legitimate interests.

Where processing relies on legitimate interests, we balance those interests against your rights and reasonable expectations. You may withdraw consent at any time without affecting earlier lawful processing.

Information you make public, such as your public profile, posts, comments and follower relationships, can be viewed and reshared by other users according to available privacy settings. Messages are visible to their participants and may be reviewed only when necessary for safety, support or legal compliance.

We may disclose data to:

• hosting, database, authentication, storage, notification, analytics, security and support providers acting under contract;
• other users as required by the social feature you choose to use;
• authorities or other parties when required by law or necessary to protect users, the public, Experio or legal rights;
• a successor in a merger, restructuring or transfer, subject to applicable safeguards.

We do not sell personal data.

Experio Social uses Supabase for services that may include authentication, PostgreSQL database hosting, file storage and real-time functionality. We may also use the operating-system and platform services of Apple, Google and Expo for sign-in, app delivery, notifications, diagnostics or build infrastructure, depending on the device and features enabled.

Service providers may process data in the European Economic Area and in other countries. When personal data is transferred outside the EEA to a country without an adequacy decision, we use an approved transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You may contact us for information about the relevant safeguards.

• Account, profile, content and social data are normally retained while your account is active.
• Deleted content may remain in encrypted backups for up to 90 days before being overwritten, unless earlier removal is technically possible.
• Security, access and diagnostic logs are normally retained for up to 12 months.
• Reports and moderation records may be retained for up to 24 months, or longer when reasonably necessary for repeat-abuse prevention, disputes or legal claims.
• Verified legal, tax, fraud-prevention or litigation records may be retained for the period required by applicable law.

When a retention period ends, data is deleted or irreversibly anonymised. Specific records may be preserved when required by law, court order or the establishment, exercise or defence of legal claims.

We use proportionate technical and organisational safeguards, including access controls, authentication, row-level authorisation, encrypted network connections, provider security controls, backups, logging and restricted administrative access. No online service can guarantee absolute security. You are responsible for protecting your device and sign-in account and for reporting suspected unauthorised access promptly.

Subject to applicable law, you may request access, correction, deletion, restriction, portability of data you provided, or object to processing based on legitimate interests. You may withdraw consent and lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

Send a request from the email associated with your account to the privacy contact above. We may request proportionate information to verify identity. We normally respond within one month, subject to lawful extensions for complex requests.

Experio Social is not directed to children under 16. We do not knowingly allow a child under 16 to create an account. Where local law permits a lower age for independent consent, we will apply that rule only after implementing the required age and parental-consent safeguards. If you believe a child has provided personal data improperly, contact us so we can investigate and delete it.

You can initiate deletion inside the app from Profile > Settings > Safety & Privacy > Delete Account. You can also request deletion from our public Account Deletion page after uninstalling the app.

Verified deletion removes or irreversibly anonymises the account, profile, posts, uploaded media, comments, reactions, saved items, follows, notifications and messages attributable to the account, except information that must be retained for legal, security or dispute-resolution reasons. Content copied or reshared independently by another user may remain as part of that user's content.

Experio does not currently make decisions producing legal or similarly significant effects based solely on automated processing. Automated signals may help detect spam or abuse, but significant moderation actions can be reviewed or appealed.

We may update this policy when the service, providers or law changes. Material changes will be communicated in the app or by another appropriate method. The effective date and version appear at the top.