KinoLemon — Privacy Policy
Effective Date: February 10, 2026
Last Updated: February 10, 2026
1. Who We Are
KinoLemon is operated by Galactiv OOD, a company registered in Bulgaria ("we", "us", "our").
Contact for privacy matters: max@kinolemon.com
We are the data controller for all personal data processed through kinolemon.com.
2. What Data We Collect
Data you provide directly
| Data | When | Purpose |
|---|---|---|
| Email address | Signup | Account creation, login, DM notifications |
| Display name | Onboarding | Shown on your public profile |
| City | Onboarding | Matching you with nearby users |
| YouTube channel selections | Using the app | Building your taste profile for matching |
| Messages | Sending DMs | Delivering messages to other users |
| Reports | Reporting a user | Reviewing conduct violations |
Data collected automatically
| Data | Source | Purpose |
|---|---|---|
| IP address, browser type, device info | Vercel Analytics | Performance monitoring, abuse prevention |
| Pages visited, session duration | Google Analytics | Understanding how people use KinoLemon |
| Authentication tokens | Supabase Auth | Keeping you logged in |
Data we receive from third parties
| Data | Source | Purpose |
|---|---|---|
| Email, name | Google (if you sign in with Google OAuth) | Account creation |
| Channel name, thumbnail, public metadata | YouTube Data API | Displaying channel info on KinoLemon |
We do not access your YouTube account, watch history, subscriptions, or any private YouTube data.
3. Legal Basis for Processing (GDPR Art. 6)
| Processing | Legal basis |
|---|---|
| Account creation and login | Performance of contract (Art. 6(1)(b)) |
| Matching and displaying profiles | Performance of contract (Art. 6(1)(b)) |
| Delivering messages between users | Performance of contract (Art. 6(1)(b)) |
| Email notifications for new DMs | Consent (Art. 6(1)(a)) - you can opt out in Settings |
| Analytics (Vercel, Google Analytics) | Legitimate interest (Art. 6(1)(f)) - improving the Service |
| Abuse prevention and report handling | Legitimate interest (Art. 6(1)(f)) - user safety |
4. How We Use Your Data
We use your data to:
- Create and maintain your account.
- Match you with users in your city who share YouTube channels.
- Display your public profile (display name, city, channels) to other users.
- Deliver direct messages between you and other users.
- Send email notifications about new messages (if you opt in).
- Review user reports and enforce our Terms of Service.
- Monitor performance and improve the Service.
We do not:
- Sell your data to anyone.
- Show you ads or share data with advertisers.
- Use your data for automated profiling or decision-making beyond channel-based matching.
5. Who Can See Your Data
Other KinoLemon users can see:
- Your display name
- Your city
- Your YouTube channel selections
Other users cannot see:
- Your email address
- Your IP address or device info
- Your messages with other users
Service providers who process data on our behalf:
| Provider | Role | Location | Privacy info |
|---|---|---|---|
| Supabase | Database, authentication | EU (Frankfurt) | supabase.com/privacy |
| Vercel | Hosting, analytics | Global (CDN), EU processing | vercel.com/legal/privacy-policy |
| OAuth, Analytics | US (with EU data protections) | policies.google.com/privacy | |
| Resend (or applicable provider) | Email delivery | US | resend.com/legal/privacy-policy |
All processors are bound by data processing agreements.
Where data is transferred outside the EU, it is protected by Standard Contractual Clauses or equivalent safeguards.
7. Your Rights (GDPR)
As an EU resident, you have the right to:
- Access your data - request a copy of everything we hold about you.
- Rectify your data - correct inaccurate information in Settings or by contacting us.
- Delete your data - delete your account in Settings, or email us. We will erase your profile, channel selections, and messages.
- Restrict processing - ask us to limit how we use your data.
- Data portability - request your data in a machine-readable format.
- Object to processing based on legitimate interest (e.g., analytics).
- Withdraw consent for email notifications at any time in Settings.
To exercise any of these rights, email max@kinolemon.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) in Bulgaria (cpdp.bg) or your local EU supervisory authority.
8. Data Retention
| Data | Retention |
|---|---|
| Account and profile data | Until you delete your account |
| Messages | Until you delete your account (both sides' messages are deleted when either user deletes their account) |
| Reports | Up to 12 months after resolution |
| Analytics data | Per Google Analytics and Vercel default retention (up to 26 months) |
| Backups | Deleted within 30 days of account deletion |
9. Data Security
We protect your data with:
- Encryption in transit (HTTPS/TLS).
- Encryption at rest (Supabase manages database encryption).
- Row Level Security (RLS) in Supabase ensuring users can only access their own data.
- Secure authentication via Supabase Auth (bcrypt password hashing, JWT tokens).
No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities as required by GDPR (within 72 hours).
10. Children
KinoLemon is not intended for anyone under 16. We do not knowingly collect data from children under 16. If we learn that we have, we will delete it promptly.
If you believe a child under 16 is using KinoLemon, please contact us at max@kinolemon.com.
11. YouTube API
KinoLemon uses the YouTube API Services. By using KinoLemon, you also agree to be bound by the Google Privacy Policy.
We only access publicly available channel metadata (name, thumbnail, description).
We do not access your YouTube account or any private data.
12. International Transfers
Your data is stored in the EU (Supabase, Frankfurt). Some processors (Google, Resend) may process data in the US.
These transfers are protected by Standard Contractual Clauses approved by the European Commission.
13. Changes to This Policy
We may update this Privacy Policy. If we make material changes, we will notify you via email or a notice on the Service. The "Last Updated" date at the top will always reflect the most recent version.
14. Contact
For any privacy-related questions or requests:
Email: max@kinolemon.com
Entity: Galactiv OOD, Bulgaria
KinoLemon collects only what's needed to help you find your people. Nothing more.