Privacy Policy

01 Data controller

The data controller for parea.cy is IPLUS Technologies (no. EE56534), address: Tassou Papadopoulou 1, Engomi, Nicosia, Cyprus. Email: [email protected].

02 What we collect

Account data: name, email, password (stored hashed with bcrypt — never in plain text), city and bio if you provide them.

Content: posts, messages, gifts you sent or received.

Technical: IP address on login attempts (for security), last activity time, language.

Profile verification (optional): we keep only a verification flag (verified), status and result date — not ID photos/selfies in our database.

03 Identity verification (Didit)

Identity checks are performed by a third-party partner: Didit (data processor). If you choose verification, Didit’s flow opens for momentary verification (selfie + ID document).

parea.cy does not store or archive the original document or verification images on our own servers. We only receive the outcome (e.g. approved / declined) and show a blue checkmark when approved.

After a final outcome (approved / declined / expired / abandoned), the platform immediately requests deletion of the session/documents from Didit via API (privacy erasure) — we do not wait months. Any retention setting in the Didit Console is only a fallback if immediate purge fails. Verification is optional and aims to deter bots and impersonation.

Legal basis: your consent before the Didit flow starts, and legitimate interest in community safety.

04 Why we process it

To run the service (performance of a contract), to keep the platform secure and prevent abuse (legitimate interest), and to meet tax obligations on payments (legal obligation).

05 How long we keep it

Account data is deleted when you delete your account. Login attempts are deleted after 30 days. Payment records are kept for as long as tax law requires.

For verification: the verified flag remains while the account exists (or until removed). Documents/selfies at Didit are deleted immediately after the final outcome via our API purge; any Didit Console retention is only a fallback.

For privacy and data security, private messages (DMs) between users are permanently deleted from our servers 7 days after they are sent.

06 Private messages

Private messages are only for chatting on the platform. We do not store media (photos/files/videos) inside private messages. Management does not browse your chats as a routine.

If you report a message or if automated detectors flag suspicious content (e.g. external links, phone numbers, signs of fraud, harassment, criminal activity or behaviour that seriously threatens safety), management may review the related messages (and limited surrounding context) to protect users.

Such reported or safety-flagged messages are kept for up to 3 months, solely for investigation, community protection and — where there are serious indications — possible cooperation with the competent authorities. They are then deleted.

In serious cases we may restrict or close an account.

07 Who we share it with

Our hosting provider, our payment provider, our identity-verification provider Didit (only if you start verification), and authorities where the law requires it. We do not sell your data to anyone.

Where required, we sign / accept data processing agreements (DPAs) with processors.

08 Your rights

You have the right to access, rectify, erase, restrict, port and object. Send a request to [email protected] and we will reply within 30 days.

If you are not satisfied, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus.

09 Security

We use HTTPS, bcrypt password hashing, CSRF protection and login rate limiting. No service is 100% secure; in the event of a breach affecting you, you will be notified in line with the GDPR.