Privacy Policy Version 5 (archived)

Privacy Policy of MITRA

Deutsche Fassung: Datenschutzerklärung.

Controller

Controller (GDPR Art. 4(7))
RS Community App UG (haftungsbeschränkt)
Kolonnenstr. 8, 10827 Berlin, Germany
Tax number: 13749951197
Primary email: contact@24mitra.com
Additional: raul.simea@24mitra.com, simea_raul@yahoo.com
Phone: +49 1514 0130236
Provider details: Impressum

This Privacy Policy explains how we process personal data when you use the MITRA app (Android, iOS), 24mitra.com and host.24mitra.com. By creating an account you confirm that you have read it. Where we rely on your consent, we ask for it separately, and you can withdraw it at any time (GDPR Art. 7(3)) without affecting processing before the withdrawal.

1. Information we collect

1.1 Personal identification information. Name, phone number, email address, date of birth, gender, nationality, profile photo and similar identifiers. Sources: you (sign-up, profile), device/app usage and, where applicable, social sign-in.

1.2 Profile and activity information. Interests, skill levels, activity preferences, tags, bio, messages, reviews; activities you create or join (time, location, attendance, statistics). Purpose: matching, discovery, safety features and platform operations.

1.3 Location information. Precise geolocation (real-time GPS) and location history to enable matching, map features and safety. You can disable location at device level and/or in the app; some features will then be limited. We never collect location when you have turned off device location services for the app.

1.4 Device and log information. Device model, operating system, app version, unique device identifiers, browser type, IP address, language, time zone, crash and diagnostic logs and usage metadata. Used for security, fraud prevention and performance.

1.5 Communications. Messages between users, support requests and email content. We process metadata to operate features and enforce safety and our Terms. We do not read private messages for advertising; automated tooling may scan for abuse, spam or illegal content as described in our Terms.

1.6 Optional matching preferences (special categories of data, GDPR Art. 9). During onboarding, and later in Settings → Preferences, you may choose to answer the following questions. They are optional; MITRA works without them.

• “What are you here for?” (friends only / friends and dating / dating through activities) and “Who would you like to meet?” (women / men / non-binary). Taken together, these answers can reveal your sexual orientation. If you choose “Friends only”, or skip the question, no orientation is recorded.
• Your religion – asked only if you tick “same religion”; “Prefer not to say” is available. This reveals religious beliefs.
• Your country of birth – asked only if you tick “same culture”. This can reveal ethnic origin.

Legal basis: your explicit consent (GDPR Art. 9(2)(a) together with Art. 6(1)(a)), which you give by choosing to answer. You can withdraw it at any time (Art. 7(3)); withdrawal does not affect processing before it.

Purpose: only to suggest people to each other (matching). We do not use these answers for advertising or analytics, we do not sell them, and we do not share them with third parties. They are stored on MITRA’s own servers, hosted in the EEA by our processor under GDPR Art. 28, and transmitted only over encrypted connections (HTTPS/TLS).

Deleting them: Settings → Preferences → “Delete my answers” removes them at any time. Deleting your account removes them too. Backup copies are purged on the rolling schedule in §13.

Sensitive categories: apart from the optional matching preferences in §1.6, we do not intentionally collect special categories (e.g. health, biometrics) unless you voluntarily disclose them in free-text fields. Precise geolocation is treated as sensitive and requires opt-in.

1.7 Paid activities and payments. When you book or host a paid activity, we process:

• As a participant: your bookings (activity, number of places, ticket price, time of booking), payment and refund status, the card fee Stripe charged for your payment, your cancellations and their timing, reports you make about an activity, and chargebacks. Your card details are entered on Stripe’s payment page; MITRA does not store full card numbers.
• As a host: your declaration whether you host as a private person or as a business, the paid activities you publish, the version of the Host Terms you accepted and when, bookings, card fees, MITRA fees, payouts, refunds, reports and chargebacks. You verify your identity and bank account directly with Stripe (Stripe Connect); this identity and bank data goes to Stripe, not to MITRA. We receive from Stripe the status of your account (for example whether payouts are enabled).
• Platform tax reporting: where the law requires it, we collect the identification and tax data of hosts and report hosts and their earnings to the German Federal Central Tax Office (Bundeszentralamt für Steuern) under the Platform Tax Transparency Act (PStTG, implementing EU Directive 2021/514 “DAC7”).

Legal bases: performance of the contract with you (GDPR Art. 6(1)(b)); legal obligations, in particular tax, accounting and platform reporting duties (Art. 6(1)(c)); our legitimate interest in preventing fraud and defending chargebacks and legal claims (Art. 6(1)(f)). To run a booking, the host receives the participant data they need for their activity (for example your name and number of places).

2. Legal bases for processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)) – providing MITRA, matching, messaging, bookings, payments and payouts, service messages.
• Consent (Art. 6(1)(a)) – optional analytics, cookies and similar technologies beyond what is strictly necessary, precise location, certain profiling, and marketing that is not covered by §12.2.
• Legal obligation (Art. 6(1)(c)) – tax, accounting, platform tax reporting, responding to lawful requests from authorities.
• Explicit consent for special categories (Art. 9(2)(a)) – the optional matching preferences in §1.6.
• Legitimate interests (Art. 6(1)(f)) – service security, fraud prevention, debugging, product improvement, non-intrusive analytics, community safety, and the weekly plans email to account holders (§12.2) — always balanced against your rights.

We apply data minimisation and purpose limitation (GDPR Art. 5).

3. Data protection officer

A formal data protection officer is not required at this time (GDPR Art. 37 assessment). For privacy questions, contact contact@24mitra.com or write to Kolonnenstr. 8, 10827 Berlin, Germany. We review this assessment periodically.

4. How we use your information

• Account creation and authentication
• Matching users by interests, availability, location and skill levels
• Recommendations, discovery feeds and content personalisation
• Safety features (trusted contacts, optional live location)
• Messaging, notifications, emails (§12) and customer support
• Bookings, payments, refunds and host payouts for paid activities (§1.7)
• Enforcing our Terms, abuse prevention and community integrity
• Analytics (product KPIs), debugging and performance optimisation
• Fraud detection and information security

We do not use private message content for ad targeting.

5. User-generated content

Visibility depends on your settings. By posting content, you grant us a worldwide, non-exclusive, royalty-free licence to host, reproduce, display and distribute it within MITRA for operational purposes and (with your consent where required) for promotional purposes. You can delete your content; cached or backup copies may persist for a limited period for security and legal reasons.

6. Third-party services and integrations

• Amazon Web Services (AWS) – hosting and infrastructure in the AWS region Frankfurt (eu-central-1); Amazon Simple Email Service (SES) – sending our emails.
• Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland) – card payments, refunds, host payouts and host identity verification (Stripe Connect). Stripe processes payment and verification data partly on our behalf and partly as an independent controller, for example for its own legal duties on fraud prevention and anti-money laundering. Stripe’s privacy policy: stripe.com/privacy.
• Google Firebase Cloud Messaging (Google Ireland Limited) – push notifications to your device.
• Google Maps – maps and routing.
• Google Calendar / similar – scheduling and sync.
• Analytics providers – performance and product metrics.

Legal bases for sharing: contract performance (Art. 6(1)(b)): hosting, payments, routing, authentication, emails and notifications; legitimate interests (Art. 6(1)(f)): analytics, fraud prevention, security; consent (Art. 6(1)(a)): marketing tags and cookies, non-essential analytics; legal obligation (Art. 6(1)(c)): regulatory or request-based disclosure.

We require third parties to use data only for the contracted purposes and to protect it under data processing agreements (GDPR Art. 28).

7. Processors and joint controllers

We work with processors and, where applicable, joint controllers under GDPR Art. 28 with signed data processing agreements and Standard Contractual Clauses where data leaves the EEA. Examples:

• AWS – hosting, infrastructure, email delivery (Amazon SES)
• Stripe – payments and payouts (see §6)
• Google – analytics, maps, authentication, push notifications (Firebase Cloud Messaging)
• Project tools (e.g. Atlassian Trello, Asana) – internal coordination

The current list is available on request: contact@24mitra.com. We will inform you of material changes before adding or replacing critical processors.

8. Cookies and similar technologies

Strictly necessary cookies and similar technologies (for example login and session) do not need consent (§ 25(2) No. 2 TDDDG). All others — analytics, marketing, social — are used only with your consent (§ 25(1) TDDDG, GDPR Art. 6(1)(a)). Details: Cookie Policy (app) and Cookie Policy (EU) (website). We honour Global Privacy Control (GPC) signals for U.S. users (see §18).

9. Automated decision-making and profiling

We use algorithms to recommend activities and connections based on interests, behaviour and (with consent) location. These processes do not produce legal or similarly significant effects within the meaning of GDPR Art. 22. You may request human review, express your view or contest outcomes: contact@24mitra.com.

Events list. When you use the Events section of the app, we remember which events we showed you and what you did with them (for example: opened, saved, shared, added to your calendar, tapped “Get tickets” or planned), and from that which of nine broad categories you prefer (music, stage, film, exhibitions, talks, tours, festivals, social, sport). We use this only to keep your Events list varied (an event you saw on several days without doing anything is no longer shown, and you can bring it back) and to order it by your interests. We do not use this history or your preferred categories for advertising, we do not pass them on to partners or analytics services, and we derive no sensitive information from them. (Separately, and not as part of this history, the app reports usage of the Events section to our analytics provider — for example that an event page was opened, an event was saved, or a filter was changed; see our analytics disclosure in sections 4 and 6.) Legal basis: our legitimate interest in a relevant, varied list (Art. 6(1)(f) GDPR). You can object at any time by writing to us (see section 11); we then delete this history, stop recording it, and show you the general order.

How we order the people you see (1-on-1)

To show you people you are likely to want to meet, MITRA puts the 1-on-1 list in an order. To do this we use:

• Your profile answers: whom you want to meet, your gender and age, and how far apart you live.
• The days you opened the app. We keep only the date, never the time or what you did, and delete it after 30 days.
• Whether you answer invitations: whether you answered at least half of the 1-on-1 invitations you received in the last 30 days.
• How often your own invitations are accepted in the last 30 days, compared with people of your gender who invite the same gender as you. This is worked out when a list loads and is not stored.
• An automatic check of your profile photo by Amazon Rekognition (Amazon Web Services, Frankfurt). It measures:
  • how sharp and bright the photo is, and how much of it your face fills;
  • whether you smile, your eyes are open, and your face is visible and turned to the camera (sunglasses do not count against you);
  • whether the photo was taken outside, in a city, or with a car, motorbike or boat.
  We keep these scores for your current profile photo.
• Whom the list has already shown you, and when, so that you see new people first, and, in the same record, to whom you were shown. We keep this for 30 days.

No other user sees these scores. They only change the order in which people appear.

Protecting your location

To protect everyone’s location, you can move your home point at most 3 times in 24 hours. We keep only the times of your last 3 moves, never the places. Searches for activities and people are limited per day: we keep only how many searches you made today, and the count starts again every day.

10. Sharing and disclosure

• Limited profile data with other users, according to your settings;
• Participant data with the host of an activity you book, as far as needed to run it (§1.7);
• Processors and partners for hosting, payments, analytics and communications (§§6–7);
• Authorities, where legally required (including platform tax reporting, §1.7);
• Trusted contacts, if you enable safety sharing.

We do not sell personal data (EU meaning). For U.S. definitions of “sell” and “share”, see §18.

11. Your rights and choices

• Access and portability (GDPR Art. 15, 20)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Withdrawal of consent at any time (Art. 7(3))
• Complaint to a supervisory authority (Art. 77)

How to exercise your rights: email contact@24mitra.com with the subject “Data Request”. We respond within one month (Art. 12(3)) and may verify your identity. Export and deletion are available in the app where supported, or by email.

Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59–61, 10555 Berlin, Germany – datenschutz-berlin.de. You may also complain to the authority in the EU country where you live or work.

12. Emails and direct marketing (GDPR + UWG)

12.1 Service messages. We send you messages you need to use MITRA: account and security notices, messages about your activities, bookings, payments, refunds and payouts, and legal notices — by email, push or in-app notification (Art. 6(1)(b) and (c)). You cannot opt out of essential service, security and legal notices.

12.2 The weekly plans email. From 27 October 2026, we send every account holder a weekly email with a selection of plans and activities on MITRA in their city. We use the email address of your MITRA account for this. Legal basis: § 7(3) of the German Act against Unfair Competition (UWG) and our legitimate interest in promoting MITRA’s own services (GDPR Art. 6(1)(f)). You can object to it at any time, free of charge other than your normal connection costs: use the unsubscribe link in every such email, the Email notifications page in the app’s Settings (in app versions that have it), or write to contact@24mitra.com.

12.3 Invitation emails. If another user invites you to a plan in the app and you have not answered after about an hour, we may email you about the invitation — at most three such emails a day. Legal basis: Art. 6(1)(b) and (f). Each of these emails has its own unsubscribe link, which stops invitation emails only.

12.4 Unsubscribe records. When you unsubscribe, we record when and how you did it (an email link or the app’s switch) and which emails it stops. The record keeps your account and a one-way hash of your email address, not the address itself. We keep it so that we can honour your objection and prove it (Art. 6(1)(c) and (f)).

12.5 Other marketing. Any other advertising by email or push notification — for example offers of third parties — is sent only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not use dark patterns. Where we ask for consent, the request is specific, freely given and separate from our Terms.

13. Data retention

We keep data no longer than necessary (GDPR Art. 5(1)(e)):

After deletion, backups are purged on a rolling schedule (at most 90 days) unless a legal hold applies.

14. Minimum age

MITRA is only for people aged 18 and over. We do not knowingly process data of anyone under 18. If we learn that a person under 18 has created an account, we will delete the account and the related data. For U.S. users under 13, see §18.10.

15. International data transfers

Where data is transferred outside the EEA or the UK, we rely on adequacy decisions (including the EU-U.S. Data Privacy Framework for certified recipients) or Standard Contractual Clauses (and the UK IDTA where applicable), and assess the transfer. Our primary hosting is in the EEA (Frankfurt); some processors may also process data in the U.S. We require equivalent protection and challenge unlawful access requests where legally possible.

16. Technical and organisational security measures

• TLS encryption in transit; encryption at rest where feasible
• Role-based access, least privilege, multi-factor authentication on admin systems
• Regular audits, logging and anomaly detection
• Vendor security due diligence and data processing agreements
• Secure development lifecycle and vulnerability management
• Training and confidentiality commitments

Data breach notification (GDPR Art. 33/34): if a breach is likely to put your rights at risk, we notify the competent authority and, where required, you without undue delay.

17. Changes to this policy

We post updates here and, for material changes, notify you in the app or by email at least 7 days before they take effect (unless urgent for legal or compliance reasons). Earlier versions stay available: Version 2.

18. U.S. state privacy notice (CPRA/CA, VCDPA/VA, CPA/CO, CTDPA/CT, UCPA/UT)

This section supplements the Policy for residents of California, Virginia, Colorado, Connecticut and Utah.

18.1 Categories collected (past 12 months). Identifiers (name, email, phone, device IDs, IP); customer records (account profile, preferences); commercial and usage data (app interactions, activity participation, bookings and payments); geolocation (precise location, opt-in); internet and network activity (logs, crash data); inferences (interest and skill clusters for recommendations); sensitive personal information (sexual orientation, religious beliefs and national/ethnic origin through country of birth) — only if you choose to provide them (§1.6), used only for matching, never sold or shared.

18.2 Purposes of use. Providing services, matching, communications, payments, security and fraud prevention, analytics, debugging and (as described in §12) marketing.

18.3 Sources. You (account, in-app), your device, analytics tools, Stripe (payment and account status), and (if enabled) calendar and maps integrations.

18.4 Disclosure for business purposes. We disclose to service providers and processors (hosting, payments, analytics, communications) under written contracts restricting use to business purposes.

18.5 “Sale” or “sharing” (CPRA). We do not sell your personal information for money. We may “share” (CPRA term) limited identifiers for cross-context behavioural advertising only with your consent (cookie banner). You may opt out at any time and through Global Privacy Control (GPC) signals, which we honour.

18.6 Targeted advertising and profiling (VA/CO/CT/UT). We engage in targeted advertising only with your consent where required. You may opt out in settings. We do not use automated decisions producing legal or similarly significant effects without additional safeguards.

18.7 Your U.S. state rights. To know and access the categories and specific pieces collected; to correct inaccuracies; to delete personal information; data portability; to opt out of sale/sharing, targeted advertising and certain profiling; non-discrimination for exercising rights. Submit requests to contact@24mitra.com (subject “U.S. Privacy Request”) or in the app where available. We will verify your identity and respond within the statutory timeframe. Authorised agents may submit requests with proof of authorisation.

18.8 Appeals (VA/CO/CT). If we deny your request, you may appeal by replying to our decision email within 30 days. If unresolved, you may contact your state Attorney General.

18.9 Non-discrimination. We will not deny services, charge different prices or degrade quality because you exercised a privacy right. We do not offer financial incentive programmes for personal data.

18.10 Children (COPPA/CPRA). We do not knowingly collect data from children under 13. If discovered, we will delete it. We do not sell or share data of consumers under 16.

19. Contact

RS Community App UG (haftungsbeschränkt)
Kolonnenstr. 8, 10827 Berlin, Germany
Primary: contact@24mitra.com
Raul.Simea@24mitra.com
Phone: +49 1514 0130236