Privacy Policy

«Social Club - Atypical» is operated by "Socialability SAS", a company registered in France under 921.590-550 RCS Paris registration number. We are the "data controller" for your personal information, which means we decide how and why it is used and we are responsible for protecting it under the EU General Data Protection Regulation (GDPR) and applicable national data protection law.

• Registered address: 25 rue de Longchamp, 75016 Paris, France
• Contact email: info@socialability-eu.com
• Website: www.socialability-eu.com

This policy applies to the «Social Club - Atypical» website and web application at https://www.socialclub-atypical.com and to any related pages or services that link to it. It does not cover third-party websites or services that you may reach through links on the Platform — those have their own privacy policies, which we encourage you to read.

Information you give us

• Account details: your name or username, email address, and password. Passwords are stored in encrypted (hashed) form and we never see them in plain text.
• Profile details: your avatar or profile photo, bio, location or city, and interest tags.
• Content you create: posts, comments, likes, images you upload, groups you create or join, events you create or attend, and messages you send to other users.
• Payment details (Premium membership): if you subscribe to a paid plan, your payment is processed by our payment provider, Stripe. We receive confirmation of your subscription status but we do not store your full card details — these are handled directly by Stripe.
• Communications: any messages you send us for support, feedback, or complaints.

Information we collect automatically

• Technical data: your IP address, browser type, device type, operating system, and general (approximate) location derived from your IP address.
• Usage data: how you interact with the Platform — pages viewed, features used, and actions taken — so we can keep the service working and improve it.
• Cookies and similar technologies: see Section 5 for details.

Information from third parties

• Sign-in providers: if you choose to register or log in using a third-party sign-in option (for example Google), that provider shares basic account information such as your name and email address, in line with the permissions you grant.
• Payment provider: Stripe confirms your subscription and payment status so we can activate Premium features on your account.

Under the GDPR, we must have a valid "legal basis" for every use of your personal information. The table below explains what we do with your data and the legal basis for each activity.

Cookies are small files stored on your device. We use essential cookies required to run the service. We use them for two purposes:

• Essential cookies keep you logged in and keep the Platform secure and working. These are required for the service to function, so they cannot be switched off.
• Optional analytics cookies help us understand how the Platform is used so we can improve it. When you agree, we may use Google Analytics and error-monitoring tools (such as Sentry) for this purpose. We only set these if you agree, and you can change your choice at any time.

Where optional cookies are used, we will ask for your consent through a cookie banner the first time you visit. You can also control cookies through your browser settings.

We do not sell your personal information. To run «Social Club - Atypical», we rely on a small number of trusted service providers who process data on our behalf (our "processors"). Each is bound by a contract to protect your data and use it only as we instruct.

• Hosting & delivery (Vercel): our application is hosted and served through Vercel, which processes technical data such as IP addresses to deliver the Platform to you.
• Database (MongoDB Atlas): your account, profile and content data is stored in a MongoDB Atlas database.
• Media storage (Cloudinary): images and files you upload (such as your avatar and post images) are stored and delivered through Cloudinary.
• Email delivery (Resend): transactional and, where applicable, marketing emails are sent through Resend.
• Analytics (Google Analytics): if you accept analytics cookies, Google Analytics helps us understand how the Platform is used (for example page views). IP addresses are anonymised where the tool allows it.
• Error monitoring (Sentry): if you accept analytics cookies, Sentry receives technical error reports so we can fix bugs. Session replay is limited and masked.

The following companies act as independent controllers for the data they receive — they have their own privacy policies and their own responsibilities:

• Stripe — processes subscription and payment data when you buy a Premium plan, under Stripe's Privacy Policy.
• Sign-in provider (for example Google) — if you log in with a third-party account, it handles that authentication under its own privacy policy.

We may also disclose your information where we are legally required to do so — for example, to comply with a court order, a lawful request from authorities, or to protect the rights and safety of our users.

Some of our providers (for example Vercel, Cloudinary, Stripe, Google Analytics and Sentry) are based in, or process data in, the United States or other countries outside the European Economic Area (EEA). Where your data is transferred outside the EEA, we make sure it is protected by an appropriate safeguard — usually the European Commission's Standard Contractual Clauses (SCCs) — so that your data receives an equivalent level of protection.

We keep your personal information only for as long as we need it. When you delete your account:

• Your profile and content are hidden from other users immediately.
• Your personal data is permanently deleted from our active systems within 30 days and we ask our processors to delete it too.

Some records are kept longer where the law requires it, for example:

• Payment and invoice records: kept for 10 years (the most commonly encountered retention requirement worldwide) to meet tax and accounting obligations.
• Records of consent and safety/abuse records: kept for up to 5 years to protect the Platform and its users.

We take the security of your data seriously. Passwords are stored in encrypted form, data is transmitted over secure (HTTPS) connections, and access to systems is limited to people who need it. We review our security practices regularly.

No online service can be completely secure, so we also ask you to help — choose a strong password, keep it private and log out on shared devices. If you believe your account has been accessed without your permission, contact us immediately at contact@socialclub-atypical.com.

Under the GDPR you have the following rights over your personal information:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix information that is wrong or incomplete (you can also edit most details in your profile).
• Deletion — ask us to delete your data, or delete your account yourself in your settings.
• Objection — object to processing we carry out on the basis of legitimate interest.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — where we rely on your consent (such as marketing), you can withdraw it at any time.

To exercise any of these rights, email us at contact@socialclub-atypical.com. We may ask you to confirm your identity first. We will respond within one month, as required by law.

Complaints

If you have a concern about how we handle your data, please contact us first at contact@socialclub-atypical.com so we can try to put it right. If you are still not satisfied, you have the right to lodge a complaint with your national data protection authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr, and in Greece, the Hellenic Data Protection Authority (HDPA), www.dpa.gr. If you are located elsewhere in the EU, you may complain to your local authority.

«Social Club - Atypical» is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under this age. If you believe a younger person has created an account, please contact us at contact@socialclub-atypical.com and we will remove it.

The Platform may contain links to other websites or services (for example, event pages or links shared by users). We are not responsible for the privacy practices of those sites, so please review their policies before sharing information with them.

We may update this policy from time to time. If we make significant changes, we will let you know through the Platform or by email before they take effect. The "Last updated" date at the top shows when the policy was last revised. Continuing to use «Social Club - Atypical» after a change means you accept the updated policy.

If you have any questions about this Privacy Policy or how we handle your data, contact us at: