Privacy Policy

CU Development GmbH, FN 610752 s, Grazer Straße 62, 8111 Gratwein Straßengel (hereinafter also referred to as the "Operator" or "seeu") operates mobile apps for Android and iOS as well as a web platform under the brand name "seeu Events". The Operator, as the controller within the meaning of the General Data Protection Regulation (GDPR), determines the purpose and means of data processing and is ultimately responsible for ensuring that data processing is carried out in compliance with applicable laws.

This Privacy Policy supplements our Terms of Service, which govern the use of the seeu services. Both documents are available to our Users at all times in their complete and current version on our website at www.seeu.events. In the event of ambiguity, the respectively applicable statutory provisions shall apply.

1. Preamble

Users who use the seeu platform entrust the Operator with personal data. Personal data is any type of information that can be directly or indirectly associated with a natural person or a company. This includes, among others, name, address, email address, date of birth, and biometric data. Additionally, IP addresses, location data, device identifiers, or information about usage behavior may be considered personal data.

This Privacy Policy supplements the Terms of Service and applies to the use of the seeu services and the utilization of the services offered therein. The Privacy Policy that is retrievable online at the time of a User's specific visit or specific use of services shall apply.

2. Data Collection and Processing

The Operator collects data in connection with registration and the subsequent use of the seeu services. Personal data is collected in the following ways:

2.1 Data Provided by the User

When the User creates their account or performs activities as a registered User, they share information about themselves with the Operator. Personal data in this category is actively communicated by the User, for example by completing registration, contacting support, providing feedback, creating events, uploading media, or updating their profile.

2.1.1 Registration and Authentication

Registration on seeu is performed via one of the following authentication methods:

(a) Email Authentication: Users receive either a magic link or a one-time password (OTP) sent to their email address to verify their identity.

(b) Google Sign-In: Users may register and log in using their existing Google account. In this case, seeu receives the User's name, email address, and profile picture from Google.

(c) Apple Sign-In: Users may register and log in using their existing Apple ID. In this case, seeu receives the User's name and email address from Apple. Apple may provide a private relay email address if the User chooses to hide their actual email.

Regardless of the authentication method used, the email address associated with the account must be truthful, complete, and kept up to date. seeu does not receive or store passwords from third-party authentication providers.

2.1.2 Profile Data

Upon registration and during profile completion, the following categories of personal data may be collected:

(a) Identity Data: Email address, first name, last name, display name, date of birth, gender.

(b) Profile Data: Avatar image, biographical description, hometown (country, city), interest and category preferences.

(c) Host Business Data (for Hosts only): Business type (individual, company, non-profit, government entity), business name, business address, VAT identification number (UID).

2.1.3 Partner Enquiries

On the website, anyone can ask to work with seeu as a partner host or partner DJ through a form, without a user account. The Operator processes the data entered (name, email address, an optional message and the preferred language) and technical data of the submission: the form page, the browser identifier (user agent) and the IP address. The IP address is not stored; only a cryptographic hash with a secret key is kept, which serves solely to limit how often enquiries can be sent and does not allow conclusions about the address. Before submission, Cloudflare Turnstile checks that the enquiry comes from a person (see Section 7.6).

After submission, two emails are sent through Resend (see Section 7.7): a notification with the enquiry, including the message, to the seeu team at contact@seeu.events, so the team can reply to the person directly, and a confirmation of receipt to the email address entered. The confirmation contains a fixed text addressed to the name entered, not the message. Enquiries classified as spam get no confirmation. Purpose: handling and answering the enquiry, preparing a possible cooperation and preventing misuse of the form. Legal basis: steps taken at the person's request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for the technical data and rate limiting, the Operator's legitimate interest in preventing misuse of the form (Art. 6(1)(f) GDPR). Retention: see Section 9 (k).

2.2 Data Collected During Use of Services

When using the seeu services and carrying out activities, the User transmits data that is stored by the Operator to identify the User and ensure the smooth provision of services. The Operator also stores information when the User contacts support. The following categories of data are collected during use:

2.2.1 Technical and Device Information

The Operator collects information about the User's device, including operating system type (Android/iOS), device type (mobile/tablet/desktop), app version, and browser information. This data is used for compatibility, analytics, and to adapt services to the User's device.

2.2.2 Usage and Behavioral Data

The Operator records User activities, such as event views, event likes, profile visits, last online timestamps, event attendance history, and interactions with media (likes, comments). This information is used to prevent misuse and fraud, to improve the services, and to provide the User with personalized content, recommendations, and information.

2.2.3 Location Data

When using seeu, the Operator collects the User's location based on GPS coordinates, provided the User has granted location permissions on their device. Location data is collected in the following cases:

• When browsing events, to display events near the User.
• When using the search function, to provide location-based results.
• When creating an Event Mode, to make it discoverable for nearby Users.
• When specifying a hometown in the User profile.
• Continuously during active Event Mode participation, to enable the real-time location map feature for connected Users.

Outside of Event Mode, seeu does not perform continuous background location tracking. Users may share their location with other Users through a voluntary, opt-in system with three levels: deactivated (default), all connections, or selected connections. Location sharing is subject to a reciprocity principle: a User's location is visible to another User only when both have activated sharing for each other. Location data older than 24 hours is not displayed to other Users.

2.2.4 Financial and Payment Data

When purchasing tickets or receiving payouts as a Host, the following financial data is processed through the external payment service provider: payment card last 4 digits, card country, transaction amounts, payment status, and payment timeline. For Hosts receiving payouts, additionally: bank account details and business information. Full card numbers and sensitive payment credentials are never stored by seeu; these are handled exclusively by the payment service provider in compliance with PCI DSS standards.

2.2.5 Biometric Data (Face Connect)

seeu offers an optional face recognition feature, Face Connect, to Users aged 18 or older (checked against the date of birth in the profile). A User's biometric data is processed only with their explicit consent, given in a separate, versioned consent declaration in the App. Before the User consents, the App only checks on the device that exactly one face can be seen in the reference photo; nothing is transferred or stored. After consent, the following data is processed:

• The reference photo the User takes in the App, stored privately in seeu's storage in the EU (Frankfurt am Main) and visible only to the User.
• A mathematical face model (face template) that AWS Rekognition creates from the reference photo and stores with the User's internal seeu ID, not with their name, together with a technical identifier and a confidence score. Characteristics such as age, gender or facial expression are not analysed.
• Matches: the link between the User and a photo in which they were recognized, the similarity score and the position of their face in the picture.
• Proof of consent: the time, version and language of the declaration, a checksum of its wording and, where applicable, the withdrawal.

When a photo is shared at an event on seeu (for example in Event Mode, in an event album or a recap), the faces in it are detected automatically and compared with the face models of all Users who use Face Connect, using a similarity threshold of 80%. This covers photos from all events on seeu, regardless of whether the User attended. A recognized User is tagged in the photo; everyone who may see the photo on seeu sees their first name, profile picture and position in the picture. Users who do not use Face Connect are not tagged. A wrong tag is removed once it is reported on the photo or by email. Users may pause matching in the Face Connect settings ("Find me in photos"); while paused, they are not compared with new photos, and their data and consent remain.

Photo-related facial features. To recognize Users who set up Face Connect later or replace their reference photo, AWS Rekognition stores, for 30 days, a face template for up to 15 faces in each photo shared at an event. These templates are linked to the photo, not to a name or user account. They are created for every face in the photo, including the faces of Users who do not use Face Connect and of persons who are not registered on seeu, and are used only to recognize Users who have consented. They are deleted automatically 30 days after the photo was shared, so retrospective recognition only finds photos from the last 30 days. Any person may request earlier deletion of the photo-related facial features of a specific photo at contact@seeu.events. Legal basis: our legitimate interest in offering retrospective recognition to Users who have consented (Art. 6(1)(f) GDPR).

The User may withdraw consent at any time in the App (Settings › Face Connect › Delete face data) or by email. From the withdrawal on, the User is no longer recognized in new photos, and the reference photo, the face model and all of the User's matches are deleted, at seeu and at AWS. The same applies to account deletion. A replaced reference photo and face model are deleted automatically, reference photos of an unfinished setup usually after 24 hours, and a failed deletion is repeated automatically until it is confirmed. If seeu changes the consent declaration, Users are asked to consent again and are not recognized in new photos until they do. Users who set up Face Connect before 13 October 2026 are asked to confirm the current consent declaration when they first open the updated App; if they do not confirm within 30 days, their face data is deleted. Face Connect data is processed by AWS in the EU (Frankfurt am Main, see Sections 7.2 and 7.12).

2.2.6 Social and Connection Data

When Users establish connections with other Users (via QR code, NFC, invitation link, contact invitation, or, in older app versions, photo connect), the following data is stored: connection identifier, connection method, associated chat room, timestamp, and (for photo-based connections) the connection photo. Following relationships (User follows Host) and profile visit records are also stored.

2.2.7 Chat and Messaging Data

Messages sent through the platform's chat functions are stored as follows: Direct messages, group chats, and broadcast messages are encrypted using symmetric encryption (PGP) with per-room encryption keys managed by seeu. Event Mode chats are stored in plaintext (unencrypted). Message metadata (timestamp, sender, message type) is stored alongside the content. Deleted messages are soft-deleted: the content is removed but metadata may persist for technical and legal reasons. Read receipts are tracked per message.

2.2.8 Media Data

Photos and videos uploaded during Event Modes are stored on the platform's servers. Metadata is recorded for each upload, including media type (photo/video), dimensions, file size, duration (for videos), and capture timestamp. Published media are stored in publicly accessible storage systems. Users are advised that media may be technically accessible outside the App (see Terms of Service, Section 13.3).

2.2.9 Notification Data

To deliver push notifications, the Operator stores Firebase Cloud Messaging (FCM) device tokens associated with the User's account. Notification content and delivery status may be temporarily stored for delivery purposes.

2.3 Data Collected Automatically

Certain data is collected implicitly or automatically during use of the services:

• GPS coordinates captured during event browsing (with location permissions granted).
• Last online timestamps.
• Event view and like counts.
• Face detection and photo-related facial features on photos shared at events (see Section 2.2.5).
• Automated content moderation checks on images and text.

3. Purpose of Data Processing

The Operator uses the User's data for the following purposes:

3.1 Provision of Services. Personal data is processed to provide the seeu services, including user account management, event discovery based on location, ticket purchasing and payment processing, event check-in, Event Mode features (shared albums, group chat, proximity discovery), face recognition for photo tagging (Face Connect) and, in older app versions, connecting by photo, location sharing between connected Users, and communication via chat and notifications.

3.2 Improvement and Development. The Operator uses data to improve the services, for example by analyzing usage patterns, optimizing the user experience, identifying and resolving technical issues, and testing new features (beta tests). Analyses are typically performed on aggregated and anonymized data. The Operator may also use individually attributable data to provide technical support or to better understand how individual Users use the services. Vector embeddings are generated from event data (titles, descriptions) to improve search functionality through semantic search.

3.3 Personalized Content and Recommendations. The Operator uses available information to personalize the services and offer Users relevant content. This includes event recommendations based on location, interests, and past behavior. seeu does not sell personal data to advertising networks and does not display third-party advertising within the App.

3.4 Safety, Security, and Fraud Prevention. Data is used to prevent various forms of misuse of the services, including fraudulent activities, unauthorized access, scraping, and other activities that violate the Terms of Service or applicable law. This includes automated content moderation (image analysis for prohibited content, text analysis for hate speech and harassment), rate limiting and bot protection, and the review of logs in case of suspected misuse.

3.5 Communication. The Operator uses the User's email address and push notification tokens to send transactional communications (authentication, ticket confirmations, refund notifications, invoices, and a reminder shortly before an event the User holds a ticket for or has signed up to, usually on the day of the event) and, with separate consent, marketing notifications about new events from followed Hosts. Users may deactivate push notifications at any time via device settings or the App. Event reminders concern only that event and contain no advertising; each reminder has its own unsubscribe link, which stops reminders without affecting other emails. Marketing notifications require separate consent that may be withdrawn at any time.

3.6 Legal Compliance. Data may be processed to comply with legal obligations, including tax and commercial law retention requirements, responses to lawful requests from authorities, and the establishment, exercise, or defense of legal claims.

3.7 Testing New Versions. Before a new version of the App or the platform is released, the Operator tests it on a copy of the production database, so that updates work reliably and securely with real data. The copy contains all platform data except face data (reference photos, face templates and matches), invoices, login sessions and device tokens. In the test environment, scheduled jobs, emails and push notifications are switched off, so nobody is contacted from it. Only members of the seeu team have access. The copy is kept with the Operator's hosting provider in the EU (Frankfurt am Main) and is emptied once the new version has been released. Legal basis: the Operator's legitimate interest in releasing reliable and secure updates (Art. 6(1)(f) GDPR).

4. Legal Basis for Data Processing

The Operator processes personal data on the following legal bases under the GDPR:

(a) Contract Performance (Art. 6(1)(b) GDPR): Processing necessary for the performance of the contract between the User and seeu, including account management, ticket processing, payment handling, and service delivery.

(b) Legitimate Interest (Art. 6(1)(f) GDPR): Processing necessary for the legitimate interests of the Operator, including fraud prevention, security measures, and testing new versions (Section 3.7), provided these interests are not overridden by the User's rights. Optional PostHog product analytics is based on consent under paragraph (c), not legitimate interest.

(c) Consent (Art. 6(1)(a) GDPR): Processing based on the User's express consent, in particular for biometric data processing (face recognition, Art. 9(2)(a) GDPR), marketing notifications, optional PostHog product analytics, and location sharing with other Users.

(d) Legal Obligation (Art. 6(1)(c) GDPR): Processing necessary for compliance with legal obligations, including tax retention requirements and responses to lawful authority requests.

Any processing beyond these bases occurs only with the express consent of the User or on the basis of statutory provisions.

5. Content Moderation and Automated Processing

seeu employs automated systems to review content and ensure platform safety:

5.1 Image Moderation. Photos uploaded to the platform are automatically analyzed by an external service provider prior to publication. The analysis checks for prohibited content including explicit nudity, violence, drugs, hate symbols, and other categories. The review is based on a probability assessment (confidence threshold). Photos may be incorrectly rejected (false positives) or impermissible content may not be detected (false negatives). In the course of moderation, the image data is transmitted to the external service provider.

5.2 Text Moderation. Text content (messages, comments, descriptions) may be automatically analyzed by an external service provider for violations including hate speech, violence, sexual content, and harassment. The text content is transmitted to the external service provider for this purpose.

5.3 Video Content. Video uploads are currently not subject to automated moderation. seeu reserves the right to introduce automated video moderation at a later time.

5.4 Face Detection and Recognition. When photos are shared at events on seeu, AWS Rekognition detects all faces in them, compares them with the face models of Users who use Face Connect and stores photo-related facial features for 30 days for retrospective recognition (see Section 2.2.5). Image data is transmitted to AWS in Frankfurt am Main for this purpose. Recognizing and tagging a User is based on their explicit consent, which they may withdraw at any time. A similarity of at least 80% counts as a match. Matches can be wrong; a wrong tag is removed once it is reported on the photo or by email.

5.5 Automated Decision-Making. The automated moderation systems may result in content being rejected or hidden without prior human review. Users may contact support if they believe their content was incorrectly moderated. seeu does not use automated decision-making for account suspensions; all bans are applied through manual review.

6. Data Sharing and Disclosure

The Operator shall not share, sell, transfer, or otherwise disclose personal data in any manner other than as described in this Privacy Policy, unless required by law or with the User's express consent.

6.1 Disclosure to Hosts. To the extent necessary for the execution of an event, personal data (including contact data, profile information, and ticket details) may be shared with the respective Host. The Host is responsible for the proper processing and protection of such data. For uses beyond the organization of the event, the Host requires the separate consent of the affected User.

6.2 Disclosure to Authorities. The Operator may disclose personal data to law enforcement or other authorities if there is a suspicion of unlawful conduct in connection with the use of the services, provided a corresponding court order or administrative directive exists.

6.3 Data Processors. The Operator engages external service providers (data processors within the meaning of the GDPR) to deliver its services. Data processing agreements pursuant to Art. 28 GDPR are concluded with all such providers. Processors may only process data for the purposes specified in this Privacy Policy and expressly agreed upon with the respective provider. Details on the specific service providers are set out in Section 7.

6.4 Other Users. Certain data is visible to other authenticated Users of the platform, including: public profile information (display name, avatar, bio, hometown, interests, fame score, event statistics), location data (only if mutual location sharing is activated), media uploaded in Event Modes, and, for Users of Face Connect, their tags in photos (first name, profile picture and position in the picture). Users control the visibility of their location through the sharing settings described in Section 2.2.3.

7. Third-Party Services and International Data Transfers

The Operator engages the following categories of external service providers, many of which are based outside the European Economic Area (EEA):

7.1 Payment Processing. Provider: Stripe, Inc. (United States). Data shared: Name, email, payment card details, transaction amounts, business information (for Hosts). Purpose: Processing of ticket payments, refunds, and Host payouts via Stripe Connect. Stripe processes payment data under its own privacy policy and PCI DSS compliance standards.

7.2 Face Recognition and Image Moderation. Provider: Amazon Web Services EMEA SARL, Luxembourg (AWS Rekognition), processing in the AWS data centre in Frankfurt am Main, Germany (region eu-central-1). Data shared: uploaded images, reference photos, face templates and photo-related facial features. Purpose: Face Connect setup, face matching in event photos, retrospective recognition, and automated image content moderation. AWS acts as seeu's processor (Art. 28 GDPR) and processes the data solely on seeu's instructions, not for its own purposes.

7.3 Text Moderation. Provider: OpenAI, United States. Data shared: User-generated text content submitted for review. Purpose: Detection of hate speech, violence, harassment, and other prohibited text content.

7.4 Push Notifications. Provider: Firebase Cloud Messaging (Google), United States. Data shared: Device tokens (FCM tokens), notification content. Purpose: Delivery of push notifications to User devices.

7.5 Device Attestation. Provider: Firebase App Check (Google), United States. Data shared: Device attestation tokens. Purpose: Verification that requests originate from genuine app instances (bot protection for mobile).

7.6 Web Bot Protection. Provider: Cloudflare Turnstile, United States. Data shared: Browser fingerprint data. Purpose: Protection against automated access on the web platform.

7.7 Transactional Email. Provider: Resend, Inc., United States. Data shared: Email addresses, email content (authentication links, ticket confirmations, refund notifications, invoices, event reminders, and for partner enquiries the team notification and the confirmation of receipt, see Section 2.1.3). Purpose: Delivery of transactional emails, event reminders and the emails about partner enquiries.

7.8 Error Monitoring. Provider: Sentry. Data shared: Error traces, stack traces, device information. Purpose: Detection and resolution of technical errors.

7.9 Database, Authentication, and Storage. Provider: Supabase. Data shared: All application data, user credentials and sessions, uploaded files (images, videos, PDFs, invoices), API keys and encryption keys. Purpose: Core platform infrastructure including database, authentication, file storage, and server logic.

7.10 Third-Party Authentication. Providers: Google (United States), Apple (United States). Data shared: Name, email address, and profile picture (Google) or name and email address (Apple). Purpose: User registration and login via Google Sign-In or Apple Sign-In. These providers process authentication data under their own privacy policies. seeu does not receive or store passwords from these providers.

7.11 Semantic Search. Provider: AI service provider. Data shared: Event text (titles, descriptions). Purpose: Generation of vector embeddings for improved search functionality.

7.12 International Data Transfers. The service providers listed above are partially or fully based in the United States. seeu ensures that appropriate safeguards pursuant to the GDPR are in place for all data transfers to countries outside the EEA. This is achieved through: (a) Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR; and/or (b) an adequacy decision of the European Commission pursuant to Art. 45 GDPR (including the EU-U.S. Data Privacy Framework, where applicable). This applies in particular to the processing of payment data by Stripe. Face Connect data is processed by AWS Rekognition in the EU (Frankfurt am Main); access by AWS group companies in the United States, for example for maintenance or support, cannot be entirely ruled out and is safeguarded by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. In all other cases, transfers outside the EEA occur only with the User's consent.

7.13 Optional Product Analytics. Provider: PostHog, using its EU Cloud service. With your consent, seeu sends feature usage, screen categories, action outcomes, timing information, app version, platform and language to understand how the service is used and where users encounter problems. Events use a random analytics identifier or, when you are signed in, your internal seeu account identifier. When you complete an explicit sign-in attempt, the consenting anonymous activity from that attempt may be linked to your verified seeu account. Different signed-in accounts are not linked. This information is pseudonymous, not anonymous. We do not include names, email addresses, message contents, photos, precise location, search text, payment details or authentication tokens. Session recording and automatic interaction recording are disabled. Analytics is optional and is not required to use seeu.

8. Cookies and Tracking Technologies

The seeu website uses cookies to enable all functionalities and facilitate use of the site. Cookies are small text files that allow the Operator to store specific information on the User's device while visiting the website.

8.1 Essential Cookies. These cookies are necessary for the basic functionality of the website, such as maintaining login sessions and security features. They cannot be deactivated.

8.2 Optional Analytics Storage. The website stores your analytics choice locally so it can respect that choice on later visits. Only after you allow analytics does it create a random analytics identifier and session information in the current tab's memory and send the events described in section 7.13 to PostHog. Analytics identifiers are not stored in cookies or browser storage. Opening a new tab or reloading starts a new anonymous visit; your saved consent choice is still respected. Rejecting analytics prevents this collection. No advertising cookies or advertising identifiers are used for this analytics integration.

8.3 Mobile App. The seeu mobile app does not use browser cookies. It uses device tokens for push notifications and authentication sessions for service delivery. Optional PostHog analytics has its own consent choice, stored on the device separately from sign-in and Face Connect consent. It starts only after you allow it. Screen recording is disabled, and analytics events are not kept in an offline upload queue.

8.4 Managing Your Choice. You can allow or reject optional analytics in the website banner and change your choice at any time through Privacy settings. In the mobile app, use Settings and Usage analytics. Withdrawing consent stops new analytics collection and cancels pending requests; it cannot recall information already sent. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal. Your choice applies to this browser or app installation. You can also clear browser storage or app data to remove the saved choice. Clearing essential authentication storage may sign you out.

9. Data Retention

The Operator stores personal data no longer than necessary for the fulfillment of the purposes described above or as required by statutory retention obligations. The following retention periods apply:

(a) Profile Data: Stored for the duration of the active user account. Deleted upon account deletion.

(b) Event Data: Active events are stored for the duration of their lifecycle. Archived events remain in archived form to provide permanent event histories, ratings, and event albums.

(c) Payment and Invoice Data: Stored for a minimum of seven (7) years after the transaction in accordance with Austrian tax and commercial law retention obligations.

(d) Biometric Data (Face Connect): The reference photo, face template and matches are stored until the User deletes Face Connect, withdraws consent or deletes their account, and are then deleted without undue delay at seeu and at AWS. A replaced reference photo and face template are deleted automatically, reference photos of an unfinished setup usually after 24 hours. Face data of Users who set up Face Connect before 13 October 2026 and do not confirm the current consent declaration within 30 days is deleted. Photo-related facial features (Section 2.2.5) are deleted 30 days after the photo was shared, or earlier for a specific photo on request. Proof of consent and of its withdrawal is kept as long as it is needed to demonstrate the consent (Art. 7(1) GDPR) and to defend against claims.

(e) Location Data: Stored for the duration of the active user account. Deleted upon account deletion. Location data shared with other Users expires after 24 hours.

(f) Chat Messages: Deleted messages have their content removed; metadata (timestamp, sender) may persist for technical reasons. All messages are removed upon account deletion.

(g) Media (Photos/Videos): Deleted media are marked as deleted and become inaccessible. All media are removed upon account deletion, except media included in a Host's event album, which may persist pursuant to the Terms of Service (Section 12.5).

(h) Notification Data: Stored for the duration of the active user account. Removed upon account deletion.

(i) Error Logs: Success logs are retained for 48 hours; error logs are retained for 7 days.

(j) Optional Product Analytics: Analytics events are stored separately in PostHog for analysis of feature usage, completion of user journeys and recurring reliability problems. Retention is assessed against those purposes and applicable erasure requests. Withdrawing consent stops future collection but does not automatically delete earlier events. PostHog's plan-dependent event query window is not an automatic deletion deadline. You may request deletion of analytics associated with your account using the data protection contact in section 14; we handle that request separately with PostHog. The seven-day error-log period above does not apply to product analytics.

(k) Partner Enquiries: Enquiries classified as spam are deleted automatically after 30 days, all others 24 months after receipt, unless a contractual relationship results from them. The person may request deletion at any time.

(l) Test Copies: The copy of the production database used to test a new version (Section 3.7) is emptied once that version has been released.

10. Account Deletion

Users may delete their account at any time via the settings in the App. If open obligations exist at the time of the deletion request (e.g., valid tickets for upcoming events, active Co-Host roles, or pending payouts), the account is first deactivated. During deactivation:

• The User's profile is no longer visible to other Users.
• All active platform features are unavailable to the User.
• Personal data is no longer actively processed (no marketing, no feed, no recommendations).

The final deletion of the account and associated data in seeu's application database occurs automatically once all open obligations have been fulfilled, but no later than seven (7) days after the last obligation expires. This process removes the application records described above, including biometric data, location data, chat content, media, connections, and notification records. It does not automatically purge earlier PostHog analytics events; requests to erase those events are handled separately as described in section 9(j). Data subject to statutory retention obligations (e.g., payment records for tax purposes) is retained for the legally prescribed period and deleted promptly thereafter.

11. Security Measures

The Operator employs state-of-the-art technical and organizational security measures to protect User data against unauthorized access, manipulation, or loss:

(a) Encryption in Transit: All API communications are secured via TLS/HTTPS.

(b) Encryption at Rest: Direct messages, group chats, and broadcast messages are encrypted using symmetric PGP encryption with per-room keys stored in an encrypted key vault. Event Mode chats are stored in plaintext.

(c) Payment Security: Payment data is handled exclusively by the payment service provider (PCI DSS compliant). Only the last 4 digits of the card number and the card country are stored locally.

(d) Authentication: JWT-based session authentication with custom claims. Session tokens are issued and managed by the authentication provider.

(e) Device Verification: Mobile devices are verified through device attestation (Firebase App Check). Web access is protected against bots through challenge-based verification (Cloudflare Turnstile).

(f) Access Control: Row-Level Security (RLS) policies on all database tables ensure that Users can only access data they are authorized to view. The database schema separates public API access from internal data.

(g) Rate Limiting: Per-role request quotas prevent abuse (e.g., 100 to 1,000 requests per 5-minute window depending on user role).

(h) Anti-Abuse Measures: Slot-level locking prevents ticket overselling. Reservation timeouts automatically clean up abandoned purchases. HMAC time-based signatures secure internal service-to-service communication.

(i) Secrets Management: API keys and encryption keys are stored in an encrypted vault, not in application code.

12. Children and Minimum Age

The seeu platform is intended for Users aged 16 and above. Users provide their date of birth during registration. seeu restricts access based on the stated date of birth but cannot guarantee complete verification of actual age. The collection and processing of personal data of children under 16 is not intentional. If the Operator becomes aware that data has been collected from a person under the age of 16, the corresponding account will be suspended and the data deleted. Parents or guardians who believe their child under 16 has provided personal data to seeu may contact the Operator to request deletion.

13. User Rights

Under the GDPR, Users have the following rights regarding their personal data:

13.1 Right of Access. Users have the right to obtain information about whether and which personal data the Operator processes about them and to receive copies of such data. Requests may be submitted via the support chat or by email. Identity verification is required. seeu shall respond within 30 days.

13.2 Right to Rectification. Users have the right to request the correction or completion of inaccurate or incomplete personal data. Profile data may be corrected directly by the User in the App settings.

13.3 Right to Erasure. Users have the right to request the deletion of their personal data (Art. 17 GDPR). This right is exercised through account deletion in the App settings (see Section 10). The Operator may defer erasure where processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

13.4 Right to Restriction of Processing. Users have the right to request the restriction of processing of their personal data under certain circumstances, for example while the accuracy of data is being verified.

13.5 Right to Data Portability. Users have the right to receive the personal data they have provided to seeu in a structured, commonly used, and machine-readable format (Art. 20 GDPR). Requests for a data extract may be submitted via the App settings or through support. seeu shall provide the extract within 30 days.

13.6 Right to Withdraw Consent. Where processing is based on consent (in particular face recognition, marketing notifications, optional product analytics, and location sharing), Users may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. Face recognition consent is withdrawn via the App settings (see Section 2.2.5). Marketing notification consent is withdrawn via the App settings. Location sharing is deactivated via the location sharing settings. Optional product analytics consent can be withdrawn through the controls described in section 8.4.

13.7 Right to Object. Users are entitled to object to the processing of their personal data under certain circumstances, in particular where processing is based on legitimate interest.

13.8 Right to Lodge a Complaint. Users are entitled to lodge a complaint with the competent data protection authority. For Austria: Austrian Data Protection Authority (Datenschutzbehörde), www.dsb.gv.at.

14. Data Protection Contact

For all questions regarding data protection or the exercise of your rights, please contact:

CU Development GmbH

Grazer Straße 62, 8111 Gratwein Straßengel, Austria

E-Mail: contact@seeu.events

15. Changes and Notifications

The Operator reserves the right to update this Privacy Policy as needed. The current version is available at all times on our website at www.seeu.events/privacy. By continuing to use the seeu services, Users acknowledge their agreement with the current version of the Privacy Policy. In the event of material changes, Users will be informed by email or by a prominent notice on the website or in the App.