Privacy Policy

1. Controller & Contact

The data controller for personal data processed through our services is:

Throughout this policy, "MYSOVA", "we", "us", and "our" refer to MYSOVA LTD. "You" and "your" refer to the individual using our services, whether as a consumer or venue owner.

Data Protection Officer. MYSOVA LTD has fewer than 250 employees and does not carry out large-scale processing of special-category data or systematic monitoring on a scale that triggers the statutory obligation under UK GDPR Article 37 to appoint a Data Protection Officer. The Director acts as the accountable owner for data protection and is the contact point for all enquiries.

2. Scope

This privacy policy applies to all personal data processed through:

• MYSOVA App — our consumer mobile application for nightlife discovery, check-ins, and social features (iOS and Android)
• MYSOVA Business — our web-based dashboard for venue owners to manage analytics, events, promotions, and operations
• mysova.co.uk — our marketing website and landing pages
• Support channels — email, in-app support, and any other channels through which you contact us

This policy does not cover third-party websites or services linked from our platform. We encourage you to review the privacy policies of any third party you interact with.

3. Eligibility

MYSOVA is a nightlife platform. All users must be aged 18 or over to create an account or use our services. We enforce this through an age gate at signup and reserve the right to verify your age at any time. If we discover that an account belongs to someone under 18, we will terminate it immediately and delete all associated personal data.

4. Data We Collect

We collect the following categories of personal data, depending on how you use our services:

5. Purposes & Lawful Basis

Under UK GDPR, we must have a lawful basis for each purpose we process your data. The table below sets out each processing activity, its purpose, and the lawful basis we rely on.

Where we rely on consent, you may withdraw it at any time by adjusting your settings in the app or contacting us at privacy@mysova.co.uk. Withdrawal does not affect processing carried out before you withdrew consent.

6. Social & Location Disclosures

7. AI Processing

MYSOVA uses artificial intelligence to enhance your experience. We are transparent about how AI is used and what safeguards are in place.

8. Third-Party Processors

We share personal data with the following third-party processors, solely to provide and operate our services. Each processor is bound by a data processing agreement.

We do not sell your personal data to any third party. Data is shared with processors only as strictly necessary to deliver our services. We maintain a current internal subprocessor register and will update this policy when new processors are added or removed. Each processor operates under a written data processing agreement (typically the processor's standard DPA, accepted electronically). Copies are available on request.

9. International Transfers

MYSOVA is a UK-based company and our primary database is hosted in the EU (Frankfurt). However, some of our third-party processors operate in the United States, as indicated in the table above.

Where personal data is transferred from the UK to countries without an adequacy decision, we implement appropriate safeguards including:

• UK International Data Transfer Agreement (IDTA) — the post-Brexit transfer mechanism issued by the Information Commissioner's Office
• EU Standard Contractual Clauses (SCCs) with the UK Addendum — used in the alternative where a processor's template DPA is built around the EU SCCs
• Data processing agreements with each processor, specifying security measures and data handling obligations
• Transfer risk assessments where required, evaluating the legal framework of the recipient country and supplementary measures (e.g. encryption, pseudonymisation)

You may request a copy of the relevant transfer safeguards by contacting privacy@mysova.co.uk.

10. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law. The table below sets out our specific retention periods.

When retention periods expire, data is securely deleted or irreversibly anonymised. Aggregated, anonymised data (which cannot identify you) may be retained indefinitely for statistical and research purposes.

11. Cookies & Similar Technologies

We use a small number of cookies and similar browser storage technologies. Under the UK Privacy and Electronic Communications Regulations (PECR), we ask for your explicit consent before setting any non-essential cookies. You will see a cookie banner the first time you visit a public page; your choice is remembered in your browser.

Essential cookies (always on)

These are strictly necessary to deliver the service you have requested. They do not require consent under PECR.

• Supabase authentication cookies (sb-*-auth-token) — keep you signed in and manage your session securely
• Venue selection cookie — remembers which venue you selected across page navigations
• CSRF protection — prevents cross-site request forgery attacks on form submissions
• Cookie consent record (mysova-cookie-consent-v1, localStorage) — remembers your cookie choices so we don't ask again on every visit

Analytics cookies (consent required)

Set only if you accept Analytics in the cookie banner. Used to understand which pages are visited and how the site performs in aggregate.

• Vercel Analytics (_vercel_analytics, page-view counters) — anonymous usage stats. No cross-site tracking; no advertising profile.
• Vercel Speed Insights — collects Core Web Vitals (LCP, FID, CLS) so we can fix slow pages.

Performance / debugging cookies (consent required)

Set only if you accept Performance Replay in the cookie banner. Used to reconstruct error sessions so engineers can fix bugs.

• Sentry Session Replay — records a masked playback of pages where an error occurred. All text is masked, all media blocked, and the recording is sent only to our error-tracking provider (Sentry GmbH).

Changing or revoking your choice

You can change your mind at any time:

• If you are signed in, open Settings → Privacy in the dashboard and adjust your cookie preferences.
• If you are not signed in, clear the mysova-cookie-consent-v1 entry from your browser's site data (DevTools → Application → Local Storage), then reload the page — the consent banner will reappear.
• You can also block cookies entirely via your browser settings; essential features that depend on cookies (e.g. staying signed in) will not work in that case.

We do not use advertising cookies, ad-network tracking pixels, or any third-party cookies that build a profile across other sites. The MYSOVA mobile app does not use cookies (it uses secure token-based authentication).

12. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

To exercise any right, email privacy@mysova.co.uk. We will respond within one calendar month of receipt, in line with our obligation under UK GDPR Article 12(3). We may ask for proof of identity before processing your request. There is no fee unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse the request (in which case we will tell you why and how to complain).

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption at rest — all personal data stored in our database is encrypted at rest using AES-256
• Encryption in transit — all data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Least privilege access — database access is restricted through Row Level Security (RLS) policies, ensuring users can only access their own data
• Authentication security — passwords are hashed using bcrypt; session tokens are rotated regularly
• Audit logging — access to sensitive data and administrative actions are logged for security review
• Rate limiting — API endpoints are rate-limited to prevent brute force and denial-of-service attacks
• Vulnerability monitoring — we use automated tools to detect and remediate security vulnerabilities in our dependencies

No system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@mysova.co.uk.

14. Age Restrictions

MYSOVA is a nightlife platform and our services are intended exclusively for individuals aged 18 and over. We implement the following measures:

• An age gate at account registration requiring date of birth confirmation
• Accounts created by individuals under 18 are terminated and data is deleted
• We reserve the right to request additional age verification at any time
• Venue owners are required to be at least 18 and authorised to represent their business

If you believe someone under 18 is using MYSOVA, please report it to privacy@mysova.co.uk and we will investigate promptly.

15. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our services, legal requirements, or operational practices. When we make changes:

• The version number and effective date at the top of this page will be updated
• For material changes, we will notify you via email and/or an in-app notification at least 14 days before the changes take effect
• Previous versions of this policy will be available upon request
• Continued use of our services after the effective date constitutes acceptance of the updated policy

16. Contact & Complaints

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the UK supervisory authority:

We encourage you to contact us first so we can try to resolve your concern directly.