This is a translation. If the Greek and English versions differ, the Greek version prevails.
The three things that matter:
Your location is never stored. We only check whether you are inside the venue and delete it immediately.
No one sees where you are — only that you are at the same place.
You can delete your account from within the app or from here, whenever you want.
1. Who we are
The “EyesLocked” service is operated by Verticom — Dimitrios P. Giannikos (sole proprietorship; in Greek: Δ. Γιαννίκος Παν. Δημήτριος), Evmolpidon 23, 118 54 Athens, Greece, Tax ID (ΑΦΜ) 044041981, which is the controller of your data. Contact for any personal data matter: info@verticom.gr.
Your account here is completely separate from any other service of ours (Dradera, Bearkl). It is not linked or cross-referenced with them.
2. What we keep
Account: your email. There is no password — you sign in with a one-time code that we send you.
Profile: display name, date of birth, gender, two lines of text, photos.
Preferences: which gender and which age range you want to meet (see §4).
Presence: which venue you said you are at and when your presence expires.
Matches and messages with the people you matched with.
Blocks and reports that you made or that concern you.
Technical: IP address in the server logs, for security and to prevent abuse.
3. Your location
The app asks for your location only while it is open on your screen. Never in the background.
When you say that you are at a venue, your device sends your coordinates to the server. There they are compared with the venue’s location and discarded. They are not written to any database, not logged and not returned to anyone. The only thing that remains is: “this user said they are at this venue, until this time”.
We do not keep a history of your movements. Legal basis: your consent (Article 6(1)(a) GDPR), which you give on the device itself and can withdraw from its settings whenever you want.
4. Who you want to meet — special category
Which gender you want to meet may reveal your sexual orientation, which Article 9 GDPR gives special protection. That is why:
We ask you on a separate screen, with an explicit question and an equally prominent “No” — never hidden in the terms.
The legal basis is your explicit consent (Article 9(2)(a)).
It is used only to choose which cards you see and who sees yours.
It is not shown to any other user and is never given to third parties.
You withdraw it from Account in the app, as easily as you give it. Your preferences are then deleted immediately.
If you say “No”, or withdraw later, you keep using the app normally. We keep nothing about who you want to meet and we show you everyone at the same venue who wants to meet someone like you, regardless of gender.
5. Why we process it — legal bases
Account, profile, matches, chats: to provide the service you asked for — performance of a contract (Article 6(1)(b) GDPR).
Checking that you are at the venue: your consent (Article 6(1)(a), see §3).
Which gender you want to meet: your explicit consent (Article 9(2)(a), see §4).
Security, reports, blocks, logs: our legitimate interest, and that of all users, in preventing fraud, harassment and abuse (Article 6(1)(f)). You can object; we will reassess your particular case.
Reporting content involving minors to the authorities, and DSA obligations: legal obligation (Article 6(1)(c)).
Defence of legal claims: legitimate interest and, where special category data is concerned, Article 9(2)(f).
6. Automated decisions
We do not take any decision about you with legal or similarly significant effects based solely on automated processing (Article 22 GDPR). No account is closed without a human.
Which cards you see is chosen by the app using simple rules that are the same for everyone: people who are at the same venue right now and with whom you match mutually on gender and age range, excluding anyone either of you has blocked. There is no attractiveness score and no one pays to appear first.
7. What we don’t do
We don’t sell your data to anyone.
We have no ads and no third-party tracking or analytics tools in the app.
We don’t keep who viewed your profile, nor “yes” signals that did not become mutual.
We don’t leave hidden data in photos: every photo you upload is re-created on the server, to remove the GPS coordinates that phone photos carry inside them — otherwise every profile would give away an address.
8. How long we keep each item
Presence at a venue: expires on its own after 90 minutes. It is permanently deleted.
A “yes” that did not become a match: deleted together with the presence.
Match and messages: 24 hours, unless both of you keep it. When it expires, the messages are deleted too.
Account: for as long as you want it. After deletion, a 7-day grace period, and then everything is deleted, including photos. The same applies to an account that we closed. After a ban we keep only an irreversible fingerprint of the email, to prevent re-registration with the same address.
Reports: kept even after the account is deleted, where they concern security or illegal content, because the authorities may need them.
Server logs: up to 30 days.
On your device only the sign-in key remains, so that you don’t need a code every time. It is deleted when you sign out. The app sets no advertising or analytics cookies; the website uses only the strictly necessary cookies for the deletion form.
9. Who it is shared with
No one, apart from the providers needed for the service to work, who process data only on our behalf:
Hosting: our server in the European Union.
Sending email (sign-in codes): Amazon Web Services, Frankfurt.
Maps: venue locations come from OpenStreetMap. When you open the “What’s on” map, the map images are loaded from OpenStreetMap’s servers (OpenStreetMap Foundation, United Kingdom), which see your device’s IP address and the area you are viewing — as with any web page that shows a map. We do not send them your coordinates. If you don’t open the map, nothing is loaded from them.
If we add paid features, payment will be handled by Apple or Google as separate controllers; we will only see that the subscription is active, not card details.
Outside the EU: our data is stored in the EU. Amazon Web Services is a US company; our contract with it includes the European Commission’s standard contractual clauses and the company is certified under the EU-US Data Privacy Framework. We will send you a copy of the safeguards if you ask us.
Authorities: we provide data only in response to a lawful request from a competent authority (for example a prosecutor’s or court order), after checking that it is lawful, and only what is needed. Where permitted, we inform you. Because presence is deleted after 90 minutes, messages after 24 hours and location is never stored, we usually do not have any location history or old chats to provide.
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, as well as to withdraw any consent. Write to info@verticom.gr and we will reply within one month.
If you believe we are breaking the law, you can lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, Kifisias 1-3, 115 23 Athens, dpa.gr).
11. Age
The service is strictly for adults (18+). It is not aimed at minors and we do not knowingly collect their data. If we learn that an account belongs to a minor, we close it and delete the data. See also our child safety standards.
12. Changes
If anything material changes, we notify you in the app and by email before it takes effect. For any new purpose that requires consent, we ask you separately — we do not assume it because you keep using the app.