Privacy Policy

Rezonect ("we", "us", "our") is committed to protecting your personal data in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and all applicable European Union and Romanian data protection legislation. This Privacy Policy explains what information we collect when you use the Rezonect mobile application and related services (the "Services"), why we collect it, how we use and share it, and your rights regarding it.

We provide you with meaningful control over your data, including the ability to download a portable copy of your personal data and to permanently delete your account and all associated data directly from within the app — no request to support is required.

Please read this Policy carefully before using the Services. By using Rezonect, you acknowledge that you have read and understood this Policy.

Rezonect SRL is the data controller of your personal data as described in this Policy.

Registered address: Dumbravita 307160, Timis, Romania
Contact email: dpo@rezonect.com

As a data controller established in Romania, a Member State of the European Union, we operate under Romanian law and are fully subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and all applicable European Union data protection legislation. We are committed to lawful, transparent, and fair processing of your data.

The Services are not directed to children under 13. You must be at least 13 years old to create an account or use Rezonect, unless a higher minimum age applies to you under applicable law.

In European Union member states, the minimum age to use the Services without verifiable parental consent is set by each country's GDPR digital-consent rules (typically 13, 14, 15, or 16). At registration we ask for your age and use your approximate country (inferred from your IP address) to apply the minimum age for your location. If you do not meet the applicable minimum age, you cannot create or maintain an account.

We do not knowingly collect personal data from anyone below the applicable minimum age. If we become aware that a user does not meet the minimum age for their location, we will delete their account and associated data promptly.

For child safety standards and how to report concerns, see https://rezonect.com/child-safety/.

Granting or denying these permissions is your choice. Denying certain permissions will limit specific features.

When you grant Contacts permission, we use submitted contact phone numbers only to check whether those numbers already belong to existing Rezonect accounts. We do not store your address book as a server-side contacts list and we do not upload contact names. Contact numbers are processed for matching and anti-abuse controls, including temporary in-memory rate-limit/abuse data.

Contact numbers provided for friend discovery are used only to perform account matching and abuse/rate-limit protection. We do not sell them and do not share them with third parties for their own marketing or advertising purposes.

We do not use your emotion data for advertising profiling.

Chat functionality in Rezonect is powered by GetStream, Inc. ("Stream"), a third-party service provider. This means:

• Your chat messages, media, and chat metadata are transmitted to and stored on Stream's infrastructure.
• Stream processes this data as a data processor acting on our behalf, under a Data Processing Agreement.
• Stream may have its own data retention policies and security practices. We recommend reviewing Stream's Privacy Policy at https://getstream.io/legal/privacy-policy/.
• We do not use your chat content for any purpose other than delivering the messaging feature.
• In the event of a data incident on Stream's side, our ability to notify you and limit exposure depends on information Stream provides us.

All providers are bound by data processing agreements. We do not sell your personal data to third parties.

We retain your personal data for as long as your account is active and as necessary to provide the Services or comply with legal obligations.

If your account is inactive for 24 consecutive months, we will notify you and delete your account if no action is taken.

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• JWT-based authentication with automatic token refresh
• Secure token storage using device-level secure storage (iOS Keychain / Android Keystore)
• Encrypted data transmission (HTTPS/TLS)
• Session invalidation controls for multi-device security

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you use the Services at your own risk.

As a data subject under Romanian law and European Union GDPR (Regulation (EU) 2016/679), you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal obligations. You can delete your account directly from the Settings section of the app, which triggers erasure of all your personal data in accordance with the retention periods described in Section 9.
• Right to restriction: Request that we restrict processing of your data in certain circumstances.
• Right to data portability: Receive your personal data in a structured, machine-readable format. You can request an export of your personal data directly from the Settings section of the app. The standard export includes your account data, profile data, emotion history, moments, and chat messages authored by you. If you need broader chat-thread context, you can submit an additional request.
• Right to object: Object to processing based on legitimate interest, including for profiling.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: File a complaint with the Romanian data protection authority (ANSPDCP – Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) at www.dataprotection.ro, or with any supervisory authority within the European Union.

Your data may be processed by service providers located outside Romania and the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place, such as:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to providers covered by an adequacy decision
• Data Processing Agreements with all third-party processors

Rezonect processes emotional state information that you voluntarily share. We treat this data with care:

• Emotion data is shared only with friends you have explicitly connected with, unless you activate privacy controls.
• We do not use emotion data for advertising, profiling for commercial purposes, or share it with advertisers.

We use Amplitude (https://amplitude.com) to collect product analytics that help us understand how the app is used and improve it over time. Our Amplitude integration is configured as follows:

• We send a pseudonymous user identifier (an internal account ID that we assign to your account). This allows us to analyse usage patterns per user (e.g. retention, feature adoption) without sending your name, email address, phone number, or any other directly identifying information.
• We send your device's IP address with analytics events so that Amplitude can derive approximate location (country and region) for aggregate analytics (e.g. understanding where our users are based). We do not use this for individual tracking or advertising.
• Cookies are disabled
• Data is processed exclusively on EU-region servers

Analytics events (e.g. feature interactions, screen views, app errors) are linked only to this pseudonymous ID. When you delete your account, we take steps to ensure your analytics data associated with that ID is deleted or anonymised in line with our retention and erasure practices.

We do not use third-party advertising trackers or sell advertising inventory.

We use Firebase Cloud Messaging (Google) to deliver push notifications. You can disable push notifications at any time via your device's OS settings or within the Rezonect app settings. Note that in-app notifications (delivered while the app is open via our real-time connection) may still be shown regardless of OS notification settings.

Rezonect is not intended for anyone below the minimum age that applies to them (see Section 3). We do not knowingly collect personal data from children below that age. If you believe a child has registered in breach of the minimum age rules, please contact us at dpo@rezonect.com or safety@rezonect.com and we will delete the account and associated data promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the current version.

For questions, requests, or complaints regarding your personal data:

Rezonect SRL
Dumbravita 307160, Timis, Romania
Email: support@rezonect.com

For any further information regarding data protection, you may contact us at dpo@rezonect.com.

For illegal Content reports and moderation appeals: safety@rezonect.com
For copyright and intellectual property infringement notices: support@rezonect.com (subject line: "IP Notice")

For data protection authority complaints (Romania):
ANSPDCP – www.dataprotection.ro