Privacy policy

Who is responsible

Gracias a la Playa S.L.
Carrer Canaries 64 (1.6), 08800 Vilanova i la Geltrú (Barcelona), Spain
Tax ID (NIF): B56915093
Email: [email protected]
Data protection contact: [email protected]

What data we process

When you join the waiting list, we process:

• Your email address.
• The city you picked and the bigger city it counts toward.
• The language you used.
• Invite relations: your invite code, who invited you (if anyone) and who signed up with your link.
• Timestamps: when you signed up, gave your consent and confirmed your email, and when we last emailed you.
• One-time codes to check your email: only a hash, for at most a day.
• Your IP address, only briefly and in memory, to limit abuse (rate limiting). It isn’t stored.
• If you use “Detect my location”: your coordinates, only to find the nearest city. They’re never stored.

Why

• To keep your place on your city’s waiting list and show you your position.
• To confirm your email address (double opt-in), so only real sign-ups count.
• To email you about your spot and when your city opens.
• To count invites and move people up the queue accordingly.
• Emails: we only send service emails (sign-in codes, your spot, your city opening, later your matches). No newsletters or advertising without your separate consent.

We don’t sell your data and we don’t use it for advertising or profiling.

Your profile

If you fill in your profile, we store your answers (first name, gender, who you’re interested in, year of birth, preferred age range, lifestyle answers, the words you pick about yourself) to prepare your matches. Your first name is shown to friends you ask to describe you. Nothing else from your profile is shown to anyone before the app launches.

Your photos

We store the photos you upload to show them to potential matches once the app launches. They are analysed automatically: whether a person and a face are visible, image quality and a nudity screen; later also matching against other users’ taste. Hidden data such as GPS location is removed when you upload. Photos are deleted when you delete them, use “Delete my data”, or when an unconfirmed sign-up is deleted.

Photo ratings (your taste)

In your profile you rate about 60 AI-generated example photos (like / pass / super like). We use these ratings only to learn your visual taste for matching. They’re stored in our matching engine, linked to a random ID rather than your email, and deleted together with your account (“Delete my data”).

Your photos as examples for other members and to improve our matching

Your profile photos that passed our checks may be shown, without your name or any other profile details, as example photos when other members teach Ambosi their taste — only to members in other cities, never in your own. We also compute numerical descriptions of these photos (embeddings) and use them, together with the ratings they receive, to train and improve our matching model. Photos that are still being checked or were flagged for review are never used.

Legal basis: showing your photos to other members for matching is part of the service you signed up for (performance of a contract, Art. 6(1)(b) GDPR). Using them to improve our matching model is based on our legitimate interest in matching that works well for all members (Art. 6(1)(f) GDPR); we keep this to the minimum needed and never identify anyone by their face.

Your right to object (Art. 21 GDPR): you can switch this off at any time, without giving reasons, with “Use my photos to improve matching for others” on your private status page, or by writing to [email protected]. Your photos are then removed from the example pool and from future training, and the ratings other members gave on your photos are deleted from their taste profiles. You can switch it back on at any time.

Retention: as long as your account exists and you haven't objected; with “Delete my data” everything is deleted. We don't sell or share these photos.

Your intro video (optional)

If you add a short video (recorded in the browser or uploaded), we store it privately and will only show it to people you and they both said yes to (mutual matches). It's never shown to friends who describe you, never used as an example photo and never used to train or improve our AI. When you upload it, we convert it to a standard format, shorten it to at most 30 seconds and remove all hidden data such as location and recording time. A few still frames are checked automatically (is one person visible, nudity screen); frames that need a closer look are reviewed by a person. You can remove the video at any time; it's deleted with your account. Legal basis: your consent (Art. 6(1)(a) GDPR) by adding the video.

The private question

Your answer to the optional question about how often you’d like to have sex is special-category data about your sex life. We only store it with your explicit consent (Art. 9(2)(a) GDPR): the note under the question explains that answering it means you agree, and if you leave it empty or choose “Prefer not to say”, nothing is stored. We use it only for matching, and it’s never shown to anyone else. You can withdraw your consent at any time by clearing the answer in your profile; it is then deleted.

Compatibility questions

Your answers to the profile and compatibility questions (your own answer, the partner answers you accept and how important each question is to you) are used to calculate how well you and other members fit, and to filter out matches that conflict with your dealbreakers. We don't ask about religion, political views or sexual orientation, and these answers are not special-category data; the one private question is handled separately (see above). Friends who describe you only ever see your first name. The languages you speak are used for matching too: you're only matched with people who share at least one language with you. Languages aren't sensitive data.

Friends who describe you

Friends you ask can pick a few words that describe you. They verify their email first; we use it only to verify them, to prevent duplicate answers and, only if they choose to join, for their own sign-up. We store the words they picked and, optionally, how long they’ve known you. You only ever see the combined result, once at least 3 friends have answered, never who said what. Unused verification requests are deleted after 7 days; answers when you or your friend delete their data.

Invite links

If you join through someone’s invite link, that member sees how many people joined through their link and from which cities, and how many places they moved up. They never see names, email addresses or when someone joined.

Reminder emails

If your profile still needs friends’ descriptions, we send up to five reminder emails (2 to 24 days after you sign up, never more than one every two days) with your public describe link. Every reminder has a one-click link to stop them; essential emails such as log-in codes or your city opening are not affected.

Legal basis

We process your data based on your consent (Art. 6(1)(a) GDPR), which you give with the checkbox when you sign up. You can withdraw it at any time, for example with “Delete my data” on your private status page. Withdrawing doesn’t affect the processing that took place before. Exception: how your photos are shown to other members and used to improve our matching is explained in the section “Your photos as examples for other members and to improve our matching” (contract and legitimate interest; you can object at any time).

How long we keep it

You can start your profile right after entering your email. Until you confirm your email with a one-time code, your email, answers and photos are kept as an unconfirmed profile that nobody else can see. If you don’t confirm it within 7 days, we delete it, photos included; we send at most one reminder. We store only a hash of the code; codes expire after 10 minutes (24 hours for the code in the reminder) and are deleted within a day after that. Sign-ups are kept until you delete them, or until they’re no longer needed for the launch of the app in your city, whichever comes first.

Who receives your data

We use service providers for hosting and for sending emails. They process your data only on our behalf, under a data processing agreement (as processors). We don’t sell or rent your data to anyone.

Website analytics

If you agree in the cookie banner, we use Google Analytics via Google Tag Manager (Google Ireland Limited) to see how our website is used, and marketing tags to measure our ads. Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 22.2 LSSI-CE), which you can withdraw at any time under “Cookie settings”. Without consent, no Google scripts are loaded. Google may process data in the USA; transfers rely on the EU–US Data Privacy Framework and standard contractual clauses.

International transfers

We don’t plan to transfer your data outside the European Economic Area. If we ever use a provider outside the EEA, we’ll only do so with appropriate safeguards, such as the European Commission’s standard contractual clauses. Exception: if you accept analytics or marketing cookies, Google may process data in the USA (see “Website analytics”).

Your rights

You have the right to:

• access the data we hold about you;
• have it corrected (rectification);
• have it deleted (erasure);
• restrict its processing;
• receive it in a portable format (portability);
• object to its processing;
• withdraw your consent at any time.

How to exercise them

Write to [email protected] from the address you signed up with. You can also delete your sign-up yourself at any time with “Delete my data” on your private status page.

Complaints

If you think we aren’t handling your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es

Automated decisions

At this stage we don’t use automated decision-making or profiling.

The app itself

The future app (photo-based taste matching, lifestyle questions, friends’ descriptions) will come with its own, separate privacy information and will ask for your consent separately before processing any such data.