Privacy Policy

Mingle Meetup IRL (the "app") is a social activity app operated by Mingle Labs Ltd. ("we", "us"), based in Ireland. Mingle Labs Ltd. is the data controller responsible for your personal data. If you have any questions about this policy or how your data is handled, contact us at privacy@mingle.ie.

This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have. We have tried to write it in plain language - if anything is unclear, please get in touch.

We collect the following categories of personal data:

• Account information - the email address associated with the social account you use to sign in, and your date of birth (used to confirm you are 18 or over). The app does not create or store a password of its own - you sign in through a social provider.
• Profile information - photos you upload, a short bio, gender, sexuality, and the activities you are interested in. Some of this - specifically sexuality - is classified as special category (sensitive) data under GDPR and is processed only with your explicit consent.
• Verification selfie - if you choose to verify your profile, a single selfie photo you capture in the app. See the “Photo verification and face data” section below for exactly how this is handled.
• Location data - location data collected from your device, which may be precise or approximate depending on your device settings and the permissions you grant. This is used to show you people and events nearby. Location is only collected while you are using the app and is never shared with other users in its raw form.
• Messages - conversations you have with other users through the app. Messages are encrypted in transit and at rest on our servers.
• Device and usage data - device type, operating system, app version, and general usage patterns. This is used to fix bugs and improve the app.
• Push notification tokens - a device token used to send you notifications. You can disable notifications at any time in your device settings.

The app offers an optional photo verification feature that lets you earn a verified badge by taking a selfie in the app. Verification is never required to use the app. This section explains exactly what happens to that selfie and to face data.

• What we collect - a single selfie photo that you capture in the app. During capture, the app uses on-device face detection (Google ML Kit) solely to check that a face is present and positioned correctly before allowing the photo to be taken. This detection runs entirely on your device: camera frames and face measurements are never transmitted to us or anyone else, and no faceprint, facial geometry, or biometric template is ever created, stored, or shared - on your device or on our servers.
• How we use it - the selfie is used for one purpose only: a member of our team compares it against your profile photos to confirm your profile is genuine. We do not run automated facial recognition or face matching on our servers, and the selfie is never used for advertising, profiling, or any other purpose. It is never visible to other users.
• Where it is stored - the selfie is encrypted in transit and stored in our media storage (Cloudflare R2, configured to store data in the European Union) until it is reviewed. Access is restricted to the review process.
• Sharing - we do not share your selfie or any face data with third parties. The only party other than us that handles it is our storage provider (Cloudflare), acting as a processor under a data processing agreement that requires it to protect your data to the same standard as this policy.
• How long we keep it - the selfie is deleted from storage immediately after review, whether your verification is approved or rejected. We keep only the outcome (your verification status and the review dates), which contains no image and no biometric data. If you delete your account, any stored selfie and your verification record are deleted as part of account deletion.
• Consent and deletion - verification is processed on the basis of your explicit consent, given when you choose to submit a selfie. You can withdraw consent and have your verification data deleted at any time by deleting your account or by emailing privacy@mingle.ie, and we will remove any stored selfie and your verification status.

We rely on the following legal bases under GDPR Article 6 (and Article 9 for sensitive data):

• Performance of a contract (Art. 6(1)(b)) - most processing is necessary to provide the service: creating your account, showing you people and events nearby, delivering messages, and sending notifications.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) - we ask for your consent before processing sensitive profile data such as sexuality, and before processing your verification selfie. You can withdraw this consent at any time by deleting the relevant information from your profile; for verification data, see the “Photo verification and face data” section above.
• Legitimate interests (Art. 6(1)(f)) - we process certain data to keep the app safe, prevent abuse and fraud, and improve the service. We have balanced these interests against your rights and concluded they do not override them.
• Legal obligation (Art. 6(1)(c)) - we may retain or disclose data where required by law.

We do not sell your personal data. We share data only with the following processors, each bound by a data processing agreement:

• Hetzner Online GmbH (Germany) - hosts our servers and database. All user data - including profiles, messages, and location - is stored and processed on these servers. As an EU-based provider, no cross-border data transfer safeguards are required.
• Vercel Inc. (United States) - hosts this website only and provides Vercel Web Analytics, a cookieless, privacy-friendly analytics tool for the website. No user account data, messages, profile information, or location data passes through Vercel. It may process visitor IP addresses and request logs for the marketing site, and collects only anonymous, aggregated website analytics.
• Cloudflare, Inc. (United States) - provides two services. First, object storage (Cloudflare R2, configured to store data in the European Union) for media you upload: profile photos, event and club images, photos shared in chats, and verification selfies. Second, DNS, content delivery, and security (proxy and bot protection) for this website, for which it processes visitor IP addresses and request metadata. Cloudflare does not receive your messages, location, or other account data. Where any data is accessible to Cloudflare outside the EU, it is transferred under Standard Contractual Clauses.
• Resend Inc. (United States) - handles transactional and service emails, such as account and safety notices. They receive your email address and the content of emails we send you. Data transferred under Standard Contractual Clauses.
• Google LLC - Firebase Cloud Messaging (United States) - delivers push notifications to your device. FCM receives only a device token and a notification nudge (e.g. “You have a new message”). Message content is never included in the notification payload and is fetched directly from our servers when you open the app. Data transferred under Standard Contractual Clauses.
• Social sign-in providers - we let you sign in through social providers such as Apple, Google, Facebook, and Microsoft. When you sign in, you authenticate with the provider you choose and we receive basic account details such as your email address; their own privacy policies govern that sign-in. Apple and Google also distribute the app via the App Store and Google Play. None of these providers have access to your messages or your activity within the app.

We may disclose your data to law enforcement or regulatory bodies where we are legally required to do so.

Mingle Meetup IRL is a social app, so parts of your profile are visible to other users to help you connect. Other users can see the details you choose to put on your profile - such as your photos, the name shown on your profile, your age, bio, and the activities you are interested in - along with an approximate distance from you. Your exact location, email address, date of birth, and the social account you sign in with are never shown to other users. Messages are visible only to the people in that conversation.

The majority of your personal data is stored and processed within the European Union on our German servers. Some processors are based in the United States - including Cloudflare (website delivery and security), Resend (email), and Google Firebase Cloud Messaging (push notifications) - and for these we rely on Standard Contractual Clauses approved by the European Commission as the transfer safeguard. When you sign in with a social provider, that authentication is handled by them under their own privacy policies. Media you upload - including profile photos and verification selfies - is stored in Cloudflare R2 configured for European Union data storage. Vercel processes only website visitor data - such as IP addresses, request logs, and anonymous analytics - and does not handle personal data from app users.

You can request a copy of the relevant safeguards by emailing privacy@mingle.ie.

• Account and profile data - retained for as long as your account is active. If you delete your account, your profile and photos are deleted after 30 days.
• Verification selfies - kept only until a member of our team reviews your submission, then deleted from storage immediately, whether approved or rejected. Only your verification status and review dates are retained.
• Usage and device data - retained for up to 12 months for analytics and bug-fixing purposes.
• Legal and safety logs - we may retain limited data for up to 3 years where required for safety investigations or legal obligations.

Under GDPR, you have the following rights:

• Access - request a copy of the personal data we hold about you.
• Rectification - ask us to correct inaccurate data.
• Erasure - ask us to delete your data (“right to be forgotten”), subject to legal retention requirements.
• Restriction - ask us to limit how we process your data in certain circumstances.
• Portability - receive a copy of your data in a structured, machine-readable format.
• Objection - object to processing based on legitimate interests.
• Withdraw consent - where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@mingle.ie. We will respond within one month. You will not be charged for making a request.

This website does not use cookies at all. We set no functional, advertising, or tracking cookies, and there is no cookie consent banner because none is required. Our website analytics (Vercel Web Analytics) operate without cookies entirely.

The mobile app does not use browser cookies. For more detail, see our Cookie Policy.

Mingle Meetup IRL is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please contact us at privacy@mingle.ie and we will delete the account promptly.

We may update this policy from time to time. When we make material changes, we will notify you by email or via an in-app notice before the changes take effect. The date at the top of this page always reflects when it was last updated.

If you are unhappy with how we handle your data, please contact us first at privacy@mingle.ie and we will do our best to resolve the issue.

You also have the right to lodge a complaint with the Data Protection Commission (DPC), the supervisory authority for data protection in Ireland:

• Website: dataprotection.ie
• Phone: +353 57 868 4800
• Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28