Privacy Policy

Last updated: 21 July 2026 | Applies to UK & EU users (UK GDPR / EU GDPR)

This policy explains what personal data Kluvr collects, why we collect it, how we use it, and your rights. We take your privacy seriously and will never sell your data to advertisers.

1. Who We Are (Data Controller)

Kluvr is operated by Gherasima, United Kingdom.
Data Protection contact: privacy@Kluvr.com

2. What Data We Collect & Why

Data	Why we collect it	Legal basis (UK GDPR)	Kept for
Username, email, password hash	Account creation & login	Contract	Until account deleted
Phone number	Optional — account recovery	Consent	Until account deleted
Postcode & country	Show local deals & suggestions	Consent	Until account deleted
Posts, comments, likes	Core social features	Contract	Until deleted by user or account
Messages	Private chat between users	Contract	Until deleted
Deals posted	Deals marketplace	Contract	Until deleted
IP address	Security, fraud prevention, deal click tracking	Legitimate interest	90 days
Last seen timestamp	Online status for chat	Legitimate interest	Overwritten on each login
Notification history	In-app notifications	Contract	30 days or until cleared

3. Cookies

We use minimal cookies. See our Cookie Policy for full details. We do not use advertising or tracking cookies.

Session token — stored in localStorage, not a cookie. Used to keep you logged in.
Cookie consent — remembers your cookie preference.

4. Who We Share Your Data With

We do not sell your data. We may share data with:

Railway.app — cloud hosting provider (servers may be in the EU/US). See their Privacy Policy.
Cloudflare — CDN and DDoS protection. See their Privacy Policy.
Email provider (SMTP) — used only to send password reset emails.
Law enforcement — only when legally required (e.g. court order or CSAM report).

5. Your Rights Under UK/EU GDPR

💾 Right to Access

Download all your data from Settings → Download My Data.

🗑 Right to Erasure

Delete your account and all data from Settings → Delete Account.

✏ Right to Rectification

Update your details anytime from Edit Profile.

🔒 Right to Restrict Processing

📤 Right to Portability

Download your data in JSON format from Settings.

🚫 Right to Object

Object to processing based on legitimate interest by contacting us.

To exercise any right, email privacy@Kluvr.com. We will respond within 30 days as required by law.

You also have the right to lodge a complaint with the ICO (UK) or your local data protection authority.

6. Data Retention

When you delete your account, we delete all your personal data within 30 days. Some anonymised data (e.g. aggregate deal click counts) may be retained for analytics.

7. International Transfers

Your data may be processed on servers outside the UK/EU. Where this occurs, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

8. Children's Privacy

Kluvr is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has an account, please contact us at privacy@Kluvr.com and we will delete it immediately.

9. Security

We use industry-standard security measures including:

Passwords hashed using pbkdf2_sha256 (never stored in plain text)
JWT tokens with expiry for authentication
HTTPS encryption in transit
Access controls limiting who can access the database

10. Changes to This Policy

We will notify you of significant changes by email or in-app notification at least 14 days in advance.

11. Contact

Privacy questions: privacy@Kluvr.com
Response time: within 30 days (usually much faster)