Privacy policy

Niceo · last updated 7 September 2026 · draft, not yet reviewed by a lawyer

Niceo is a networking app for business events. You fill in one badge, join the room for an event with a code, and swipe through the people who are in that same room. This page says exactly what we keep, why we are allowed to keep it, who else touches it, and how to make it go away.

Who is responsible

The controller is DX Machina s. r. o., Kukučínova 14, 831 03 Bratislava, Slovakia, company ID 53146051. Write to privacy@niceo.app about anything on this page. We are not required to appoint a data protection officer and have not appointed one, so that address reaches the people who run Niceo.

The short version

• Your badge is visible to people in the same room, and nowhere else.
• Nobody ever sees your swipes. Not the other person, not the organiser, not us in the app. It is enforced in the database.
• The event organiser gets no access to your profile, your swipes or your matches.
• No analytics, no advertising, no third-party tracking, no data sold or shared.
• You can export everything and delete your account from inside the app, in two taps.

What we store, why, and on what basis

Under the GDPR every purpose needs a legal basis. Here is ours, item by item.

• Your email address. It is how you sign in — there is no password, we email you a six-digit code. Basis: performance of our contract with you.
• Your badge: name, role and company, and optionally a photo, sector, one line about you, and a link. This is what the room sees. Basis: contract. The optional fields are yours to leave empty.
• Per event: what you are looking for, what you are here as, and your one line about why you came. Basis: contract.
• Your swipes. Who you passed on and who you said yes to, so the room does not show you the same person twice and so a match can be made. Basis: contract.
• Matches and messages. Basis: contract. Keeping a conversation readable to the other person after you leave is a legitimate interest — those messages are their record of the meeting as much as yours.
• Blocks and reports, including the reason and anything you type into a report. Basis: our legitimate interest in keeping the room safe, and our legal obligations where a report concerns unlawful content.
• Notification subscriptions. If you turn on notifications, we store the address your browser gives us for its push service and the keys needed to encrypt a message to it. Basis: your consent, which you withdraw by turning notifications off.
• Notification emails. We email you when a room you joined fills up, at most a handful of times per event. Basis: legitimate interest in a service you asked for by checking in. Every one of them carries a one-click unsubscribe, and stopping them stops all of them.
• Event code attempts. Which code you tried, whether it worked, and when. Basis: legitimate interest in stopping people guessing their way into a room they were not invited to. Kept for 30 days.
• A sign-in cookie. Strictly necessary to keep you signed in, which is why this site has no cookie banner: there is nothing else to ask you about.

We do not collect location, contacts, advertising identifiers, device fingerprints or usage analytics. There is no profiling and no automated decision-making that produces legal effects for you — a swipe is a person deciding, not a machine.

Who sees what

Your badge and your event note are visible only to people who are in the same room as you. Not publicly, not to other events, not to search engines, not to anyone who has not entered that event’s code.

Your swipes are visible to nobody but you. The person you passed on is never told. This is enforced by database rules, not only by the app.

The event organiser buys a room and hands out its code. Through Niceo they get no access to your profile, your swipes, your matches or your messages. Whatever they already know about you from selling you a ticket is their own relationship with you, and for that they are a separate controller — ask them, not us.

Who else touches it

These are our processors. They act on our instructions and nobody else’s.

• Supabase — database, sign-in and photo storage. Data is held in the EU (Frankfurt).
• Resend — sends your sign-in codes and notification emails. EU region (Ireland).
• Vercel — runs the application. The code that touches your data runs in the EU (Frankfurt). Vercel is a US company, so support access from outside the EU is possible; that transfer is covered by the European Commission’s standard contractual clauses.
• Apple and Google — only if you switch notifications on. Their push services carry the message to your device. We encrypt the contents so the push service cannot read them, but it does learn that a message was sent to your device.

We do not sell your data, and we do not share it for anyone else’s advertising.

How long we keep it

• Your badge and account: until you delete them.
• Event code attempts: 30 days.
• Reports: up to 12 months after they are resolved, so a pattern across several events is still visible.
• Messages: they stay in the other person’s conversation. See the next section for what happens to your name on them.

Deleting your account

Open Your badge in the app and choose to delete. It happens immediately and we do not ask you to email anyone. If you no longer have the app installed, use the account deletion page.

Deleting removes, straight away and for good:

• your name, photo, role, company, sector, bio and link;
• every swipe you made and every swipe about you;
• your membership of every room, and your badge numbers;
• your blocks, your code attempts and your notification subscriptions;
• your email address, which is scrambled so the account cannot be signed into again.

What stays, and why. Messages you sent remain in the thread of the person you sent them to, shown as coming from a deleted account with no name, photo or profile attached. That conversation is their record of a meeting they had, and we do not think one side should be able to erase the other side’s copy. An empty row remains in our sign-in system purely to keep those threads intact; it holds no name and no address.

Backups and logs

Deletion takes effect immediately in the live database — the row is gone, not flagged. Where a backup of that database exists, a copy can survive inside it until the backup is overwritten, never longer than seven days. A backup is only ever used to bring the service back after a failure, never to look something up about a person.

Emails we send you — sign-in codes and room notifications — are stored by Resend for 30 days and then deleted. Beyond that, our providers keep short-lived technical logs: the time of a request, the network address it came from, the browser that made it, and anything that went wrong. They exist to spot abuse and to fix faults, we build nothing from them, and they age out on their own within 30 days.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, and to receive it in a portable form. Two of those are buttons rather than emails: Your badge gives you a full export as a file, and deletion as described above. For the rest, write to privacy@niceo.app and we will answer within one month.

Where we rely on your consent — notifications — you can withdraw it at any time without giving a reason, and withdrawing does not affect what happened before. Where we rely on legitimate interests, you can object and we will stop unless we have grounds that override yours.

If we get it wrong you can complain to the Slovak supervisory authority, Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, Bratislava — dataprotection.gov.sk. You may also complain to the authority where you live.

Keeping it safe

Everything travels over HTTPS and is encrypted at rest. Photos live in a private store and are served through links that expire. Who can read which row is enforced by the database itself, so a mistake in the app cannot hand your data to the wrong person. Only the people who run Niceo can reach the production database, and they use it to fix things, not to read conversations. If a breach ever puts you at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay.

Age

Niceo is for people doing business at professional events. You must be 18 or over to use it. We do not knowingly collect anything about children, and if we learn that an account belongs to one we delete it.

Changes

If this page changes, the date at the top changes with it. If a change materially affects what we do with your data, we will email you before it takes effect.