Mates Privacy Policy
Effective date: 21 October 2026.
1. Who is responsible for your data
Operator of Mates and controller of personal data: Ministry Design Agency Sp. z o.o., ul. Hoża 86 lok. 410, 00-682 Warszawa, Polska, KRS 0001177457, NIP 7011264249.
Questions about personal data, requests to exercise your rights and support: hello@ministrydesign.agency. Website: ourmates.eu.
2. What the app does
Mates helps adults find and organise meetups in Warsaw: browse meetup cards, sign up, get to know other guests, talk in meetup chats and add people as friends. Mates may be used from the age of 18. You decide what to publish in your profile, in meetups and in chats.
3. What data we process
| Data | Source | Purpose |
|---|---|---|
| The email address to which the one-time sign-in code is sent; for Sign in with Apple, your Apple user identifier and, if you have allowed it to be shared, your name and email address. You can hide your email address, in which case we receive an Apple relay address. For sign-in with LinkedIn or Google, your identifier in that service, name, email address and a link to your profile photo there, if you have one; the name is filled into your Mates profile, and the photo is offered at the "Photo" step during sign-up and becomes your profile photo only if you keep it | You, when signing in by email; Apple, when you sign in with Apple; LinkedIn or Google, when you sign in with them | To create your account, sign you in and contact you about your account |
| Name, profile photo, bio, languages, city, occupation, interests, social media links, profile style, the "I am 18 or over" confirmation | You | To show your profile to other users and to suggest meetups |
| Meetups you have created: title, description, cover (photo or video), date, address and map pin, terms of participation | You, as host | To publish and run the meetup |
| Requests, participation, invitations, saved meetups, friends, blocks, invitation via a link from another user | Your actions in the app | Meetup sign-ups, connections between people and protection against unwanted contact |
| Messages in meetup chats: text, photos, videos, voice messages, video notes, polls and responses to them, reactions, pinned messages | You and other chat members | Communication between meetup guests |
| Chat settings for the host: chat photo, welcome message, admins, blocklist | The host | Managing the meetup chat |
| Record of your attendance at a meetup and the stamps and rewards received for it | Your "Check in" action | To count the visit, the meetup streak and profile rewards |
| Location at the moment you check in at a meetup: the coordinates are sent to the server once; the server compares them with the meetup point (no more than 300 m away) and does not store them. Only the fact and time of the check-in are stored | Your device, only when you check in and have allowed access | To verify that you are near the meetup location |
| Gifts, Mates, Premium subscription and purchase history: Apple transaction identifier, product purchased, date, subscription status and refund information | Apple and your actions | To provide what you have paid for and to account for refunds |
| Reports, support requests and decisions on them | You and other users | Support, handling of violations and safety |
| Device token for push notifications (issued by Apple) and the app language | Your device, if you allow notifications | To notify you of new messages in meetup chats and private messages. The token is deleted when you sign out and when you delete your account |
| Technical logs: IP address, time and address of the request, response code, browser or app information and account identifier | Our servers and infrastructure providers | Operation of the service, security and bug fixing |
Mates does not receive your bank card number: in-app payments are processed by Apple.
Mates does not determine your location in the background and does not track your movements. Location is requested only at the moment you check in at a meetup. The meetup pin set by the host is the address of the venue, not your location.
The camera and microphone are used only when you yourself take a photo, video or video note or record a voice message. Write access to your photo library is needed only when you save a photo or video from a chat.
Early access request on the website. If you submit an early access request on ourmates.eu, we receive your name, email address and, optionally, your Telegram username, as well as the language and address of the page from which the request was sent. We use them only to notify you when Mates is released on the App Store and to give you the first month of Premium free of charge. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form. You can withdraw it at any time by writing to hello@ministrydesign.agency, and we will delete your request.
4. Legal bases for processing
For users to whom the GDPR applies: your account, profile, meetups, chats and purchases are processed for the performance of the contract for the use of the service (Art. 6(1)(b)). Security, handling of reports and protection against abuse are our legitimate interest (Art. 6(1)(f)). Retention of accounting records of purchases is compliance with a legal obligation (Art. 6(1)(c)), where such an obligation applies.
If an optional feature requires consent, we will ask for it separately. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before its withdrawal.
5. Who can see your data
- Your profile is visible only to registered Mates users. Without signing in, it is possible to open a meetup card, but not profiles or the full guest list. Social media links in other people's profiles are visible to users with Premium; to everyone else they are shown hidden.
- There is no separate public history of your attendance. The guests and the host of a meetup can see that you have signed up for it. Upcoming meetups in another person's profile are visible only to their friends.
- Chat messages are visible to the members admitted to that meetup's chat. The host and the admins they appoint can pin and delete messages and restrict members.
- Gifts are not shown in chats. A profile displays three gifts chosen by its owner; other gifts received are on a separate profile tab. The recipient can hide a gift.
- Reports and support requests are seen only by authorised staff and by the providers that help us handle them.
- A host may use information about guests only for the purpose of running the meetup.
Do not publish in your profile or in chats anything you do not want to show to other users. Whatever you yourself share with people outside Mates is governed by the rules of the relevant services.
6. Providers and third-party services
We share data only with providers that are necessary for Mates to work:
- Account, database and file infrastructure: Supabase (policy): accounts, the database and files are stored in the EU, in Ireland (Amazon Web Services infrastructure).
- Account sign-in: Apple (policy) for Sign in with Apple: Apple learns that you have signed in to Mates and passes to us only the information listed in section 3. LinkedIn (policy) for sign-in with LinkedIn: you sign in on the LinkedIn page, LinkedIn learns that you have signed in to Mates and passes to us only the information listed in section 3. Google (policy) for sign-in with Google, in the same way as LinkedIn. For sign-in by email, we send the email with the code ourselves: it is generated by our automation system (n8n) and sent from hello@ourmates.eu via the GoDaddy email service (policy). The n8n server is hosted by Hostinger; server location (country): Germany (Frankfurt). GoDaddy and this hosting provider receive your email address and the content of the email.
- Hosting of the ourmates.eu website: Vercel Inc. (policy). When you open the website, Vercel receives your IP address and browser information and keeps technical request logs. The app does not transfer data via Vercel.
- Apple — distribution of the app and in-app purchases. Apple's policy.
- Google Maps — the map on the meetup page, the host's selection of the meetup location and directions. When the map loads, your device connects directly to Google's servers. Google receives your IP address, information about your browser and device, the address or coordinates of the meetup location and the map language, and may use its own cookies under its own rules. We do not share your name, profile or location with Google. The "Directions" and "Open" buttons open Google Maps outside Mates. Google's policy. The map loads as soon as you open the meetup page. It cannot be turned off in the settings: if you do not want your device to connect to Google, do not open a meetup page with a map.
- Push notifications: Apple Push Notification service (Apple's policy). The server passes Apple the device token and the notification text: the sender's name and the message text. You can turn notifications off in the iPhone settings.
- Automatic content check: OpenAI Ireland Ltd (policy), the OpenAI Moderation service. After a meetup or profile is published or changed, the server sends only its text (title, description, meetup place, name, "What you do", "About me") and the cover or profile photo for checking. Email, contacts and other account data are not sent. Under OpenAI's API terms this data is not used to train models.
- Early access requests from the website: the form is sent via Vercel to our n8n automation server (Hostinger, Germany), which forwards the request as a message to the team's private work chat in Telegram (policy). n8n does not keep requests after sending them, except for the error log (up to 14 days). Telegram may process data outside the EU; there is no European Commission adequacy decision for this transfer, so it is based on your explicit consent in the form (Art. 49(1)(a) GDPR).
There are currently no other recipients. If we add a new service, for example for sending emails or push notifications, we will add it to this list before we start sharing data with it. We do not sell personal data and do not share it with advertising networks or data brokers. Data is disclosed to public authorities only where there is a legal basis for doing so.
7. Where and for how long data is stored
Mates accounts, the database and files are stored only in the EU, in Ireland, and we do not transfer them outside the EU. The companies listed in section 6 that receive data directly from your device (Apple for sign-in and purchases, LinkedIn for sign-in with LinkedIn, Google for sign-in with Google and when displaying the map, Vercel when you open the website), the OpenAI content check service, the GoDaddy email service when sending the sign-in code, and Supabase as a US company may process certain data in the United States. In such cases the following apply: the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework of 10 July 2023 (for companies certified under it) and, in other cases, the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914) included in these companies' data processing agreements. A copy of the safeguards can be requested at hello@ministrydesign.agency.
| Data | Retention period |
|---|---|
| Account and profile | For as long as the account exists; deleted immediately when the account is deleted |
| Messages in meetup chats | 2 years after the meetup ends, then deleted automatically |
| Direct messages | 2 years after being sent, then deleted automatically |
| Meetups and participation | For as long as the host's or guest's account exists |
| Uploaded photos and videos | As long as they are in your profile, a meetup or a message. You can delete them earlier; when you delete your account they are deleted immediately |
| Reports | 12 months after the decision on the report, then deleted automatically |
| Support requests and security information | 2 years after the last email or event |
| Purchases and accounting records | 5 years, as required by accounting and tax laws. After the account is deleted, the records are kept in anonymised form |
| Technical logs | Server logs (Supabase) are kept for 7 days. The log of sign-in emails (n8n) is kept for up to 14 days |
| Backups | Daily database backups are kept for 7 days and are used only to recover from a failure. Deleted data disappears from them within 7 days at the latest |
| Early access requests | Until the app is released and the free Premium month is granted, but no longer than 12 months from the request; then deleted, including from the Telegram chat |
When data is no longer needed and the law does not require us to keep it, we delete it or irreversibly anonymise it.
8. Data on your device
Mates stores on your device your settings, the draft of a meetup you are creating, the interface cache and the media files you have added. Deleting the app erases this data from the device, but does not delete your account on the server and does not cancel your Apple subscription. Mates does not use the device's advertising identifier. Optional storage technologies and third-party services: Mates does not use cookies or advertising technologies. When you open the map, it is loaded from Google’s servers, and Google receives your IP address and browser information.
9. Your rights and account deletion
You may request access to your data and a copy of it, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest.
You can delete your account in the app itself: the “Profile” tab → at the bottom “Delete account” → “Delete account forever”. After you confirm, we delete your account, profile, meetup sign-ups, friendships and the meetups you have created. Your messages in meetup chats and direct messages, your reactions and your poll votes are also deleted. Uploaded photos and videos: deleted from the server immediately together with the account, including photos and videos in all chats of the meetups you organised; they disappear from backups within 7 days at the latest. Gifts you have sent remain with their recipients without your name; reports you have submitted remain with us without your name; purchase records are kept in anonymised form for as long as the law requires.
Deleting your account does not cancel your Apple subscription: cancel it in your Apple Account settings.
Send any other requests to hello@ministrydesign.agency. We may ask you to confirm that the account is yours, but we will not ask for more data than necessary. We will respond within the time limit set by law.
You have the right to lodge a complaint with a data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych): uodo.gov.pl.
10. Age, automated decisions and changes
Mates is intended for people aged 18 and over. We do not check identity documents: users confirm their age themselves. If we learn that a minor is using the service, we will take action, up to and including deleting the account.
Automated decisions with legal or similarly significant effects: none. Sorting and filtering of meetups are not such decisions. Only content can be hidden automatically: a meetup, cover, photo or profile text, if the OpenAI check finds adult content, violence or hate, or if three people report it. Accounts are not blocked automatically. A moderator reviews the decision, and you can appeal it at hello@ministrydesign.agency.
If we change how we process data, we will update this document and its effective date. If a new purpose requires consent, we will ask for it separately.