TugaMeetPrivacy policy
Administration and reports
Authorized administrators view internal identifiers, first names, roles, statuses, posts and reports needed to manage and moderate the service. Requests sent through “Report a problem” are saved for review. Administrative actions record the actor, target, date and reason. This area does not provide access to passwords, tokens or private conversations. Retention periods for reports and action logs remain to be defined.
Data controller
The data controller is Sergio DA SILVA, the individual entrepreneur operating TugaMeet. Sergio DA SILVA — 32 rue des Maugrains, 94430 Chennevières-sur-Marne, France. SIREN 131039521 · SIRET 13103952100011 · APE 5829C · RNE 05/10/2026. https://tugameet.com. Personal data contact: contact@tugameet.com.
Account and authentication
The service processes email, verification status, a hashed password when used, internal identifiers, account status and dates. It manages verification and reset tokens, sessions and, when enabled, two-factor authentication, devices and recovery codes.
Profile and matching preferences
Available fields include first name, birth date, gender, city/country, proximity coordinates, biography, height, education, relationship type and genders sought, age ranges, distance, interests, music, languages and declared ties to Portuguese regions. They support profile display and preference-based suggestions.
Potentially sensitive data
Gender and genders sought, combined with relationship type, can reveal sexual orientation. Using them to filter and rank profiles requires explicit consent separate from the terms, optional and unchecked by default, under GDPR Articles 6 and 9. The server keeps the latest grant date, wording version and any withdrawal date. In My profile, under genders sought, unchecking withdraws consent once confirmed by the server and erases those genders. They are no longer used for matching; Search’s gender filter is disabled. Other features and criteria remain available. Existing accounts are not presumed to consent. Old preferences may remain stored but are inactive and are not used without consent. Agreement alone does not reactivate them: a fresh explicit selection must accompany consent. Values still held are included in your personal data export. The proof linked to the profile is deleted with the account. Free text and media may also reveal sensitive information: avoid unnecessary intimate data. No dedicated health or religion field was identified. This notice is not consent; the personal-data contact remains available to exercise your rights.
Photos, feed and interactions
Profile photos, posts, comments, feed images and videos, reactions, Likes, Pass, matches, Olá, blocks, visibility settings, presence and quiz results support the corresponding features. Profiles accept up to 10 photos of 5 MB each. Images are optimised; feed media have their own limits.
Conversations and shared images
Messaging stores participants, text, images, dates and read status for authorised conversations, including those opened through a match or Olá. Images are stored for delivery. Blocking stops new exchanges without deleting history. End-to-end encryption is not claimed.
Events, places and proximity
The service processes proximity searches, place and event contributions, photos, reviews, comments and interest markers. City search sends the entered text, language and optionally country to Open-Meteo from the browser. No continuous movement tracking is implemented here. Public agenda and place data are also imported.
Google, Microsoft or Facebook sign-in
When you choose a provider, TugaMeet receives an account identifier, email when available and authorised name information. Links are stored for subsequent sign-ins. Observed permissions cover identity, profile and email, not contacts or provider posts. The provider also processes sign-in under its own policy.
Support and moderation
Forms send category, message, account ID and email, date, language, version and general browser/device labels to contact@tugameet.com. Feed moderation sends relevant text and images to OpenAI; videos involve extracted frames and audio transcription. Decisions, reasons, scores and identifiers are stored. This is not described as systematic analysis of private conversations.
Purposes and legal bases
Managing the requested account, profile, exchanges and content supports performance of the service. Abuse prevention and security rely on a legitimate interest that must be documented and balanced against your rights. Legal obligations may require processing. Separate consent must be obtained where required by the nature of the data; registration alone does not cover all processing.
Recipients and external services
Profiles and posts are intended for relevant members, and messages for their participants; the operator handles support and security. Identified integrations are Oracle Cloud, an SMTP provider to identify, Cloudflare Turnstile, Google/Microsoft/Meta OAuth, OpenAI for the feed, Open-Meteo, Google Fonts and browser push when enabled. External image hosts receive loading requests. Tavily may receive place/event searches if configured.
Transfers and contracts to confirm
Code does not establish the actual processing regions or provider contracts. Exclusively European hosting, absence of transfers outside the EEA or specific contractual safeguards are not asserted. The operator must identify entities, countries, processors and safeguards, including moderation, email and browser services, before final approval of this policy.
Retention: verified technical periods
Password reset links last 30 minutes and are single-use; email verification lasts 24 hours, email change 30 minutes, OAuth state 10 minutes and 2FA challenges 5 minutes. Sign-in tokens expire within 7 days, with a 1-hour server session renewed by activity. Presence expires after 5 minutes; a revocation marker lasts 8 days. These are validity periods, not guarantees that all associated database records are erased.
Retention: outstanding decisions
Login history is cleaned on sign-in and when viewed: a 30-day window and at most 20 entries after cleanup. Without new activity, daily deletion is not guaranteed. No general period is set for inactive accounts, content, conversations, reports, moderation decisions, support emails, logs or backups. Periods, justification and deletion must be defined; this does not permit indefinite retention.
Account deletion
Under “My account”, confirming SUPPRIMER disables the account and starts deletion of the profile, personal media and related records. Other members’ messages remain in their read-only conversations. Deleting posts and comments may also delete their replies. Reports and audit records may remain after removal of targeted personal fields; this mechanism does not purge backups or support emails.
Security and limitations
Personal areas require authentication, passwords are hashed, and session, anti-abuse and two-factor protections exist. Cloudflare Turnstile checks certain sign-in and registration operations. Logs may contain technical data; Facebook diagnostics include a pseudonymised email fingerprint. No system guarantees absolute security or members’ civil identity.
Your rights and requests
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, objection and portability. Consent may be withdrawn prospectively where it is the basis for processing. Contact contact@tugameet.com or use “Contact us”, privacy category. A full automatic export is not offered; requests can be sent to the operator. Proportionate identity verification may be necessary. You may complain to the CNIL at cnil.fr.
Policy changes
The dates above identify this version. Substantial changes must be brought to members’ attention. Updating the text is not additional consent or a retroactive change to processing.
Controller details
- Data controller
- Sergio DA SILVA — 32 rue des Maugrains, 94430 Chennevières-sur-Marne, France
- Legal bases by purpose
- Information being finalized
- Recipients and processors
- Information being finalized
- Retention periods
- Information being finalized
- Transfers and safeguards
- Information being finalized
- Sensitive data and safeguards
- Information being finalized