Privacy Policy

1. Who we are (data controller)

This policy explains how NYXOS HOLDINGS LTD (company number 17414515, registered office 128 City Road, London, EC1V 2NX, United Kingdom) — "Lovadora", "we", "us" — collects and uses personal data when you use the Lovadora website and services. We are the data controller. Data protection questions: privacy@lovadora.com.

2. Data we collect

• Identity & account data — name/username, e-mail address, date of birth, gender, password (stored only as a salted hash).
• Profile data — the details you choose to add (location, physical attributes, lifestyle answers, interests, photos, "about me"), together with your per-field visibility choices.
• Usage data — pages viewed, profiles liked or favourited, messages sent, coins earned and spent, purchases, session times.
• Communications — messages you exchange on the platform and correspondence with support. Messages are private but are accessible to our moderation and operator teams for the operation of the Service (see the Terms, Section 3).
• Payment data — handled by our payment providers; we receive only transaction confirmations, amounts and a token. We never store full card numbers.
• Technical data — IP address, device and browser type, operating system, referral URLs, cookie identifiers, approximate location derived from IP.

3. How we collect it

Directly from you (registration, profile, purchases, messages, support), automatically (cookies and server logs), and from our payment providers (transaction outcomes only).

4. Purposes & legal bases

• Operating your account, conversations and coin balance — performance of our contract with you.
• Age verification and fraud, chargeback and abuse prevention — legitimate interests and legal obligation.
• Moderation and safety, including scanning for illegal content — legitimate interests and legal obligation.
• Personalising which profiles we show you — performance of the contract / legitimate interests.
• Service e-mails (receipts, security, account notices) — performance of the contract.
• Marketing e-mails — consent, or the "soft opt-in" for our own similar services; every message contains an unsubscribe link.
• Advertising measurement (including the Meta Pixel) — consent given via the cookie banner.
• Accounting, tax and record-keeping — legal obligation.

5. Who we share data with

• Processors who help us run the Service under contract (each bound by a data-processing agreement): Supabase (database, authentication and file storage — EU region, Frankfurt), Vercel (application hosting and delivery), Cloudflare (bot protection on sign-up and login), our e-mail delivery provider, our payment processor (card data is entered on their secure page and never touches our servers), and analytics/support tooling.
• Affiliates/partners — only aggregate attribution data (that a referred account made purchases and the commissionable amount). Never your identity beyond an internal reference, never your conversations.
• Group companies and professional advisers — for administration, audit and legal advice.
• Authorities — where required by law, court order, or to report suspected child sexual abuse material or other serious crime.
• We never sell personal data.

6. International transfers

Where data is processed outside the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses with supplementary measures.

7. Security

• TLS encryption in transit; encryption at rest for stored data.
• Passwords hashed with a modern algorithm; payment card data never touches our servers (PCI-DSS compliant providers).
• Role-based access controls: staff see only the data their role requires, and access to production data is logged.
• We will notify you and the regulator of any personal data breach where legally required, without undue delay.

8. Retention

• Account and profile data — for the life of the account. When you delete your account, profile, photos, conversations and wallet are erased immediately; residual copies in backups are cycled out within 30 days.
• Security and audit logs (staff actions, sign-ins, coin movements) — 12 months, then deleted.
• Transaction records — kept 6 years for tax and accounting law.
• Fraud/chargeback evidence and enforcement records — up to 6 years.
• Backup copies persist for a limited period before being cycled out.

9. Your rights

• Access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests.
• Withdraw consent at any time (e.g., cookie settings, unsubscribe links) without affecting prior processing.
• Self-service: in Settings → Your data you can download a complete copy of your data (JSON) and permanently delete your account yourself, instantly. Or e-mail privacy@lovadora.com.
• You may complain to your supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); EU/EEA residents may contact their national authority.

10. Cookies

We use three categories, controlled via the cookie banner:

• Strictly necessary — login/session, security, cookie-choice memory. Always on.
• Analytics/performance — anonymous usage statistics to improve the Service.
• Advertising — including the Meta (Facebook/Instagram) Pixel, used to measure ad performance and build audiences. Off by default; only set if you opt in.

Analytics and advertising cookies are opt-in. You can change or withdraw your choice at any time via Settings → Cookie preferences (or by clearing cookies for this site); withdrawing does not affect processing that already happened.

11. Discretion

Purchases appear under a neutral billing descriptor. We never post to any social account, never disclose your membership for marketing, and e-mails from us use neutral sender names where possible.

12. Children

The Service is strictly 18+. We do not knowingly process data of minors; any such account is deleted on discovery and verified reports are actioned immediately via the Complaints page.

13. Changes of business ownership & to this policy

If our business is sold or transferred, data may be transferred to the new owner under this policy's protections; you will be notified of any such change. We may update this policy from time to time — material changes are announced in the Service, and the "last updated" date above always reflects the current version.