Privacy policy.

The controller of your data is Dtudo S.U., tax number (NIF) 296369594, with its registered seat in Praia, Cabo Verde. For any question about your data, write to suporte@fluxxo.cv.

This policy covers the Fluxxo app, the Fluxxo+ app and the fluxxo.cv website, including the organiser panel. We process your data under Cabo Verde's data protection law (Law no. 133/V/2001 of 22 January, as amended by Law no. 41/VIII/2013 and Law no. 121/IX/2021). We give the same rights to every user, wherever they are.

What you give us

• Account: email, password (stored hashed) or the Google or Apple account you sign in with, name, username, date of birth and gender.
• Profile (optional): profile and cover photo, bio, phone, social networks and links, interests, areas you follow and your island.
• Content: stories, photos, videos, messages, voice notes, polls, meetups, tips, reviews and reports.
• Fluxxo Band: the photo taken when you pair the band with your account.
• Organisers, hosts and vendors: the business account request (contacts, business name, island, links, photos and documents), bank details (holder, bank and IBAN) and the events, listings and stores you manage.
• Support: what you write to us and our replies.

What comes from using the service

• Purchases and payments: tickets, orders, bookings, movements of your Balance and wristbands, refunds, resales, instalments and points. Card details are entered on SISP's page and never reach us.
• Entries: scans of tickets and wristbands at the door and the bar, with the time, the entrance and the staff member who scanned.
• Location: explained in detail in the next section.
• Activity: who you follow, your circle, events you save or go to, and interests inferred from how you use the app, to suggest events to you.
• Device and technical: IP address, device type and system, language, identifiers for notifications, error and operation logs.
• Website purchases: from the IP address, the country, the city and an approximate location, to prevent fraud.

What other people give us

An organiser can add you to a guest list with your name and email. Other users can mention you, gift you tickets or add you to chats.

The app only accesses your location while it is in use and if you allow it in your phone's settings. Never in the background. You can withdraw permission at any time: the location features then stop working.

• Radar lights: with the app open, your position is sent every four minutes, rounded to a 50-metre area. Others only see how many people are in each area, never who. We delete each position after two hours. Cabo Verde only.
• Current area: we keep the last area you were in, replaced with each update, to show you what's happening near you and send nearby suggestions.
• Presence at events: with an active ticket and during the event, your circle can see that you are there, if you checked in or are within 200 metres. We keep that presence for 90 minutes. It is on by default and you can turn it off in your circle sharing settings.
• Stories: we keep the place where you post a story, which is shown with it.
• Meetups and meeting points: the place you choose is shown to whoever sees the meetup or the chat.

• Providing the service you ask for (performance of the contract): creating and managing your account, selling and validating tickets, processing payments, the Balance, wristbands, orders, bookings, refunds and payouts to organisers, chats and social features.
• Security and fraud prevention (legitimate interest and legal obligation): checking purchases, detecting abuse, moderating Content, protecting accounts and handling reports.
• Improving and personalising (legitimate interest): suggesting events and places based on your interests and your area, measuring use in aggregate and fixing errors.
• Notifications (consent): sending push notifications, which you can turn off.
• Location (consent): the features described above.
• Legal obligations: accounting, taxes, requests from the authorities and defending rights.

We do not use your data for third-party advertising and we do not sell it. We do not make decisions with legal effects about you based solely on automated processing. We use automated tools to analyse photos and videos in stories and to hide Content with several reports until it is reviewed.

• Everyone: your name, username, photo, bio, how many people are in your circle (but not who they are) and public Content, such as stories, reviews, meetups and tips. Also the events you go to, unless you hide them in settings, and your place on leaderboards, unless you leave them.
• Your circle: your presence at events (if it is on) and your activity at events, according to your sharing settings.
• Chats: participants see what you send there. Your online status is shown.
• Organisers and their teams: your name, username, ticket type and status, time of purchase and entry and, at the door, your profile photo. On tickets sent by email, they also see the email. When they scan your QR code at the bar, they see your available Balance, to charge you. When you pay with the Fluxxo Band, they see the photo taken when you paired it. Organisers also receive aggregated statistics about buyers (area, age and gender).
• Boita hosts and vendors: the details of your bookings and orders they need to serve you.

We use providers that process data on our behalf, under contracts that require them to protect it:

• SISP (Cabo Verde): card payments;
• Amazon Web Services: storage of photos and videos (US), content delivery, automated analysis of story images and sending emails (European Union);
• MongoDB Atlas and Railway: database and servers;
• Google Firebase: authentication and real-time orders;
• Google and Apple: sign-in, if you choose it, and app stores;
• Expo: push notifications and app updates;
• Mapbox and Google Maps: maps;
• Sentry: error reports (European Union);
• Vercel: website hosting and aggregated visit statistics, without cookies;
• Zoho: email and customer support;
• MaxMind: database for approximate location by IP address.

We also share data with organisers, hosts and vendors, as explained above, and with the authorities when the law requires it. If Fluxxo's business is transferred to another company, the data goes with it, under this policy.

Some providers store or process data outside Cabo Verde, in the European Union and the United States. We make those transfers under the data protection law, with appropriate contractual safeguards and, where required, with authorisation from the National Data Protection Commission (CNPD).

• Account and profile: while the account exists. After you delete it, we delete or anonymise the data within 30 days, except what we must keep as set out below.
• Photos and videos: deleted from our servers within 90 days of you deleting them or your account.
• Purchases, payments, Balance and payouts to organisers: for the period required by tax and commercial law.
• Stories: visible for 24 hours and kept for 30 more days to check for abuse.
• Radar lights: two hours. Presence at events: 90 minutes.
• Notifications: 90 days.
• Meetup chats: deleted 14 days after the meetup ends. Team chats: archived 14 days after the event.
• Messages in other chats: while the chat exists. If you delete your account, what you sent may remain visible to the other participants, without your profile.
• Reports and moderation: for as long as needed for users' safety and to defend rights.
• Technical and error logs: for short periods, for security and fixing errors.

We protect data with encrypted connections, access control, hashed passwords and signed QR codes that change every 30 seconds. No system is infallible: if a data breach affects you, we report it to the CNPD and, where the law requires, to you.

Chats are not end-to-end encrypted, and notifications may show the text of messages on the screen. Protect your phone with a screen lock.

You have the right to:

• know what data we process and receive a copy (access);
• correct inaccurate data (rectification);
• ask us to delete your data (erasure);
• object to processing based on our legitimate interest;
• withdraw consent at any time, for example by turning off location or notifications, without affecting what was done before;
• receive your data in a commonly used format.

You can change much of your data directly in the app. For other requests, write to suporte@fluxxo.cv from your account's email. We reply within 30 days and may ask you to confirm your identity.

If you think we have not handled your data properly, you can complain to the National Data Protection Commission (CNPD): www.cnpd.cv, cnpd@cnpd.cv.

You can delete your account in the app (Settings, Delete account) or ask for deletion without the app. We explain what is deleted and what is kept in Delete account.

We send push notifications about your chats, tickets, events and suggestions, which you can turn off in the app's or your phone's settings. By email, we only send messages the service needs, such as confirmations, receipts and password recovery. We do not send advertising emails without your consent.

Fluxxo is for over-18s only. We do not knowingly collect data from minors. If we learn that a minor has created an account, we close it and delete the data. If you know of a case, write to us.

We may update this policy. We tell you in the app or by email before important changes take effect. The date this version took effect is at the top of this page.