## Who is responsible

**Nexora AI Lab, SL**. Full details in the [Legal Notice](/legal/en/legal-notice/).
Privacy contact: **legal@dopplos.com**.

## What we collect

**You give us:** email, phone, password, username; name, date of birth, gender, who you are
interested in, biography; photos; your avatar's description, tone, interests and personality;
connected social accounts.

**Your device gives us:** GPS location and your search radius, IP address, device and app
version, and how you use the app.

**Our systems generate:** your structured interest profile, compatibility scores between avatars,
the conversations your avatar holds, and the cartoon illustration made from your photo.

## Why, and on what legal basis

| Purpose | Legal basis |
|---|---|
| Creating and running your account | Performance of the contract (Art. 6(1)(b) GDPR) |
| Matching you with people nearby | Performance of the contract |
| Processing your sexual orientation and who you are interested in | **Your explicit consent** (Art. 9(2)(a)) · it is special category data and we ask for it separately |
| Safety, moderation and fraud prevention | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) |
| Billing and accounting | Legal obligation |
| Analytics on our website | **Your consent** · see [Cookies](/legal/en/cookies/) |

## What we never send to the AI

Your avatar carries a name and a personality. **Your email, your phone number, your exact
coordinates and your real identity are never sent to any AI model.** What reaches the model is
what your avatar is, not who you are.

## Automated decisions

Compatibility is scored automatically and decides who you are shown. You can obtain human review
of any automated outcome by writing to **legal@dopplos.com** (Art. 22 GDPR). See
[How the AI works](/legal/en/ai-transparency/).

## Who else processes your data

| Who | What for | Where |
|---|---|---|
| OpenAI | Language models behind the avatars | USA · Standard Contractual Clauses |
| Google | Avatar illustration; analytics on the website | EU / USA · SCCs |
| Stripe | Payments | EU / USA · SCCs |
| Firebase (Google) | Push notifications | EU / USA · SCCs |

We do not sell your data, and we do not use it to train third-party models.

## How long we keep it

Your data lives while your account does. On deletion it is removed within **30 days**, except
invoices (6 years, tax law), abuse records (up to 3 years) and server logs (12 months). See
[Deleting your account](/legal/en/account-deletion/).

## Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent
at any time. Write to **legal@dopplos.com**; we answer within one month.

If you think we have not respected your rights you can complain to the Spanish Data Protection
Agency (**aepd.es**) or to the supervisory authority of your country of residence.

## Security

Passwords are stored hashed, never in clear. Traffic travels encrypted. Access to production
data is restricted and logged.

## Minors

DOPPLOS is not for anyone under 18. If we learn that an account belongs to a minor we suspend it
and erase the data. See [Adults Only](/legal/en/adults-only/).