Privacy policy

Who is responsible

Bouvale Group Ltd (reg.nr HE 489968) is the data controller for the processing described here. You can reach us at jonathan@acction.app.

Address: Aristovoulou 27, 3085 Limassol, Cyprus.

What we collect

When you create an account: your email address, a password stored hashed and never in plain text, and sign-in times.

Your profile: display name, portrait, city, language, short bio, professional description, birth year, interests, and whether you want to appear in suggestions of people to meet. Everything but the name is optional.

Your contact details: phone number, Instagram or LinkedIn if you choose to add them, and who they should be visible to — nobody, your friends, or people you have checked in with. Nothing is shared automatically.

When you join an evening: whether you are coming alone, whether you have allergies or other practical needs (see the next section), what you hope to get out of the evening, whether it is fine for you to appear in photos and film, and when you accepted the terms. After the evening: check-in and check-out times.

Payment: when you pay for an evening or your membership we store the amount, currency, status and Revolut’s order number for the payment and any refund. You enter your card details in the app, either in a card form run by Revolut (their SDK) or through Apple Pay — they never pass through us and are not stored by us.

What you write: messages in the evening’s channel, reactions, reviews and ratings, friend requests and invitations.

Safety: who you have blocked and reports you have made, with the person’s name and picture as they were at the time.

Technical: device tokens for notifications if you have enabled them, and events describing how the service is used. Analytics events carry only fields from a fixed, closed list — never free text.

If you are a member: your membership status and which clubs you belong to.

If you apply for membership: name, company, phone number and email address. This is emailed to us so we can contact you about the application, and kept until the application has been handled.

If you save a card: we store Revolut’s ID for you as a customer and for the card, the card brand, the last four digits, the expiry date, and — if you choose Company — the company name and registration number. This is kept until you remove the card in the app. If you pay with Apple Pay, Apple gives us no card information at all.

Sensitive data — please read this

When you join we ask: *"Do you have allergies or other practical needs?"* If you answer yes, we ask you to tell us briefly. If you write something about diet or accessibility, it may reveal your religion or your health. Such data is specially protected by law (Article 9 of the GDPR).

So three things apply. The field is optional — skip it if you prefer. We process it only with your explicit consent, given by writing in the field, and you can withdraw that at any time by clearing it or cancelling. And it is visible only to the host of that evening, never to other guests.

We never log the contents of that field — not in analytics, not in error reports.

Why we process your data

To give you a place at an evening and manage your registration. Legal basis: our contract with you.

To make the evening work — so the host knows who is coming, can check you in and reach you in the channel. Legal basis: contract.

To take payment and refund you under the cancellation rules, for the membership’s monthly fee, and for accounting. Legal basis: contract, and for accounting a legal obligation.

For safety — blocking, reporting and preventing misuse. Legal basis: legitimate interest.

To send notifications about your bookings, evenings and friends. Legal basis: your consent, given in your phone’s settings and withdrawable there.

To improve the service through statistics on how it is used. Legal basis: legitimate interest.

For practical needs per the section above. Legal basis: explicit consent.

To manage your membership — approving or pausing it and determining which evenings and clubs you can book. Legal basis: our contract with you.

To handle your membership application and contact you about it. Legal basis: steps taken at your own request, prior to a contract.

To save a payment method, so you can pay without entering the card again, and so the membership fee can be charged automatically. Legal basis: your consent, given when you save the card, which you withdraw by removing it (a card the membership fee is charged from is removed by cancelling the membership).

Who sees what

Access is restricted in the database, not just in the interface.

Before an evening, other signed-in guests see your first name and picture — never your profile, never your email, never your practical needs. Someone who is not signed in sees only how many are coming.

The host of an evening sees guests’ names, pictures, answers to the registration questions, practical needs, the photo-and-film choice, and whether the place is paid — never card details.

The exact address of an evening is shown only once your place is confirmed.

Other guests’ profiles are visible to you only if you actually checked in to the same evening.

Your birth year is never shown. It is used only to show the age range of the guest group, rounded to five-year bands, and only when at least three guests have given a year.

Your contact details are shown only to those you have chosen: nobody, your friends, or people you have checked in with.

If you block someone it is filtered in the database so that you are not shown to each other in the service. A person you report never sees the report.

We never sell your data, and we do not share it for marketing.

Who processes data on our behalf

Supabase — database, authentication and file storage. Servers in Stockholm.

Vercel — hosting for acction.app. Servers in Stockholm.

Revolut — payments, including the membership’s monthly fee, and saved cards. You enter your card details in the app, in a card form run by Revolut (their SDK) — we never see them, only the amount, status, Revolut’s order number, the card brand, the last four digits and the expiry date. If you pay with Apple Pay, Apple gives us no card information. Revolut processes your card details as a controller in its own right and may process data outside the EU/EEA; Revolut is responsible for doing so lawfully. See Revolut’s privacy policy.

Resend — outgoing email: codes, confirmations, notices about your evenings and — if you email a membership application — the application email itself to us.

Expo, Apple and Google — push notifications, if you have enabled them. A notification travels via Expo’s push service to Apple or Google, which may mean your device token is processed outside the EU/EEA.

The database and the website are in Stockholm, and we are established in Cyprus, within the EU. Transfers outside the EU/EEA may occur at Revolut and for push notifications, and then with the safeguards the GDPR requires — the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep it

Your profile, registrations and what you have written are kept for as long as you have an account.

Payments are kept for as long as accounting rules require, even after the account is deleted — but then without any link to you.

Safety data — reports concerning you — is kept as long as needed to protect other guests.

Notifications and analytics events are kept while the account exists. Analytics events remain, anonymised, when the account is deleted.

A membership application is kept until it has been handled, and for twelve months after that — even if you delete the account in the meantime.

A saved card is kept until you remove it in the app; a card the membership fee is charged from can only be removed once the membership has been cancelled.

What happens when you delete your account

You delete the account yourself in the app, under Profile. It happens immediately. Gone are your profile, name and picture, your registrations with answers and practical needs, your messages and reactions, your friends and invitations, your interests and contact details, your device tokens, your blocks, reports you made yourself, notifications you received, emails waiting to be sent, your membership and your club membership.

But not everything goes, and you should know what stays:

Reviews you wrote stay, but anonymised — the name becomes "Deleted account" and the picture is removed. The text and rating remain, so other guests can still judge an evening.

Reports concerning you stay, including the name and picture you had when the report was made. We need that to protect others.

Payments stay as anonymous records — amount, status and Revolut’s reference — for accounting. The link to you is removed.

Statistics stay, but the link to you is removed. In notifications others received about you, your name is removed.

An already-submitted membership application stays until it has been handled plus twelve months, even though the account is gone.

You cannot delete your account while you host an evening that is published or ongoing — complete or cancel it first.

Your rights

You have the right to know what data we hold about you, to have it corrected, to have it erased, to object to certain processing, to request restriction, and to receive it in a machine-readable format.

Where you have given consent — as for practical needs, photos and film, or notifications — you can withdraw it at any time. That does not affect what has already happened.

Write to jonathan@acction.app. We answer within one month.

If you are not satisfied you can complain to a supervisory authority. In Sweden that is the Swedish Authority for Privacy Protection, imy.se. As we are established in Cyprus you may also contact the Office of the Commissioner for Personal Data Protection, dataprotection.gov.cy.

Cookies and tracking

We use no marketing cookies and no tracking across other websites. The website sets only what is needed to keep you signed in and to remember your language.

We never store your precise location. City and neighbourhood, nothing more.

Children

Acction is not for children. You must be at least 18 to use the service.

Changes and version

If we make a material change to this policy we will tell you in the app or by email before it takes effect.

Version 1.0, effective 2026-09-18.