Privacy Policy

Last updated: 5 July 2026 (Version 1.1)

Introduction

MYSOVA LTD ("MYSOVA", "we", "us", "our") operates the MYSOVA mobile application, a London nightlife social platform for discovering venues, clocking in, earning XP, and forming social connections with other users.

This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The full and authoritative version of this policy is published at https://mysova.co.uk/legal/privacy. The in-app version below is a summary and is updated alongside it.

By creating an account and using MYSOVA, you confirm you have read and understood this policy. If you do not agree, please do not use the app.

Data controller: MYSOVA LTD (company number 17154283), London, United Kingdom
Designated data protection contact: Pavel Vassiltsenko (Director)
Contact: privacy@mysova.co.uk

Data We Collect

We collect the following categories of personal data:

Account Data

• Email address (used for login and communications)
• Date of birth (used for 18+ age verification)
• Username and display name
• Profile photo(s) you choose to upload
• Subscription tier and payment status

Location Data

• Clock-in coordinates when you voluntarily clock in to a venue
• We record your approximate location within a 75-metre radius of the venue
• We do not track your location in the background or when the app is closed

Usage Data

• Venues you have visited and clock-in timestamps
• XP earned, streaks, badges unlocked, and rank history
• Challenges completed and leaderboard position
• SOVA questions and interaction history

Social Data

• Crossed Paths connections (mutual opt-in cross backs with other users)
• Messages sent within the app (one-to-one and party chats)
• Voice notes and photos you record or attach in chats — voice notes use your microphone only while you hold record, and media is stored until the message is deleted or expires
• Party membership and Mega Clock-In participation
• Social features you enable or disable in settings

Device Data

• Operating system and app version
• Crash reports and performance diagnostics (via Sentry)
• With your consent, in-app usage analytics and session replays (via PostHog — see Third-Party Services)
• Push notification device token (via Expo)

How We Use Your Data

We use your personal data for the following purposes:

Service Delivery
To create and maintain your account, enable clock-ins, calculate XP and streaks, award badges, and provide all core app features.

Personalisation
SOVA uses your interests, clock-in history, tier, and the current time to generate personalised venue recommendations and nightlife insights.

Social Features
To power the Paths matching system, facilitate messaging, support party creation, and show you activity from people you are connected with.

Push Notifications
To send you alerts about friend clock-ins, new Crossed Paths connections, event reminders, level-ups, and (with your consent) marketing messages.

Service Improvement
To analyse how the app is used in aggregate, fix bugs via crash reports, and improve features over time.

Age Verification
To verify that all users are aged 18 or over at the point of registration, as required by law.

Legal Basis for Processing

Under the UK GDPR, we process your personal data on the following legal bases:

Contract (Article 6(1)(b))
Processing necessary to deliver the core MYSOVA service you have signed up for: account creation, clock-ins, XP, social features, and messaging.

Consent (Article 6(1)(a))
Optional marketing communications (email, push notifications) and analytics. You may withdraw consent at any time in Settings > Data Preferences.

Legitimate Interests (Article 6(1)(f))
Security monitoring, fraud prevention, crash reporting via Sentry, and improving app performance, where our interests are balanced against your rights.

Legal Obligation (Article 6(1)(c))
Age verification to confirm users are 18 or over, and compliance with applicable UK and EU laws.

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Third-Party Services

We share limited data with trusted third-party processors to deliver our service. All processors are contractually bound to handle your data securely and only for specified purposes.

Supabase (database and authentication)
Your account data, clock-in records, social data, and messages are stored in Supabase's cloud database. Data is hosted within the European Union.
Privacy policy: supabase.com/privacy

Sentry (crash reporting and performance monitoring)
Crash reports may include device information, app version, and stack traces. Sentry does not receive your personal profile data.
Privacy policy: sentry.io/privacy

PostHog (product analytics and session replay — only with your consent)
If you opt in to analytics in Data Preferences, PostHog receives usage events (screens viewed, taps) and masked session replays so we can fix bugs and improve the app. Data is processed in PostHog's EU region. You can withdraw consent at any time in Settings > Data Preferences.
Privacy policy: posthog.com/privacy

Mapbox (venue map)
The city map is rendered by Mapbox, which receives your device's IP address and map tile requests needed to display the map.
Privacy policy: mapbox.com/legal/privacy

Apple App Store / Google Play (subscription payments)
Payment transactions are processed directly by Apple (App Store) and Google (Play Store). MYSOVA does not store your payment card details. You can manage subscriptions through your device settings.

Expo (push notifications)
Push notification tokens are managed via Expo's notification infrastructure. Notification payloads contain only the data needed to deliver the alert.
Privacy policy: expo.dev/privacy

Apple / Google (app distribution)
Your use of the app is also subject to the privacy policies of Apple (App Store) and Google (Play Store), which govern their own data collection.

We do not sell your personal data to third parties.

Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

• Account data (profile, settings, preferences): Retained until you request account deletion
• Clock-in history: Retained for 2 years from the date of each clock-in
• Messages: Retained for 1 year after the last activity in the conversation
• Crash reports and device diagnostics: Retained for 90 days by Sentry
• Anonymised, aggregated analytics data: Retained indefinitely (cannot be linked back to you)

When you delete your account, your personal data is permanently removed within 30 days, except where we are required to retain it to comply with a legal obligation or to resolve a dispute.

Your Rights Under GDPR

As a UK resident, you have the following rights in respect of your personal data:

Right of Access
You may request a copy of the personal data we hold about you (Subject Access Request).

Right to Rectification
You may request correction of inaccurate or incomplete personal data.

Right to Erasure ("Right to Be Forgotten")
You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you have withdrawn consent.

Right to Data Portability
You may request your data in a structured, machine-readable format to transfer to another service.

Right to Restrict Processing
You may ask us to pause processing of your data in certain circumstances (e.g. while you contest its accuracy).

Right to Object
You may object to processing based on legitimate interests, and to direct marketing at any time.

Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time in Settings > Data Preferences or by contacting us.

To exercise any of these rights, contact us at:
privacy@mysova.co.uk

We will respond within 30 days (one calendar month, in line with UK GDPR Article 12(3)). You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.

Cookies & Tracking

MYSOVA is a native mobile application and does not use browser cookies.

We use the following forms of tracking within the app:

Essential (required for the service to function) These cannot be disabled without stopping core functionality.

• Supabase session tokens to keep you logged in
• Device push notification tokens

Analytics (optional)

• Aggregated usage analytics to understand how the app is used and improve features
• You may opt out by contacting privacy@mysova.co.uk

We do not use cross-site tracking, fingerprinting, or advertising networks.

Children

MYSOVA is strictly for users aged 18 and over.

We require all users to provide their date of birth at registration. Users who do not meet the 18+ age requirement are prevented from creating an account.

If we become aware that a user under 18 has created an account, we will immediately suspend the account and delete all associated personal data.

If you believe a minor is using MYSOVA, please contact us at privacy@mysova.co.uk.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

When we make material changes, we will notify you via an in-app notification before the changes take effect. Where required by law, we will seek your consent.

Your continued use of MYSOVA after the effective date of any updated policy constitutes acceptance of the revised terms.

We use a consent_version field in your account record to track which version of this policy you have accepted. You can review the current version at any time within the app under Settings > Privacy Policy.

Contact Us

For all privacy-related enquiries, requests, or complaints:

Email: privacy@mysova.co.uk
Company: MYSOVA LTD
Company number: 17154283
Registered in: England and Wales
Location: London, United Kingdom

We aim to respond to all privacy requests within 30 days. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):
Make a complaint: https://ico.org.uk/make-a-complaint/
Website: ico.org.uk
Telephone: 0303 123 1113

Trademarks

MYSOVA and the owl device are trademarks of MYSOVA LTD, registered with the UK Intellectual Property Office (UK00004373417 / UK00004373474).