Privacy Policy

Nocturne Finder Operated by Experts SEA (experts-sea.com)

Effective date: 26 May 2026 Last updated: 26 May 2026

1. Who we are

This Privacy Policy describes how Experts SEA ("we", "us", "our") collects, uses, and shares your personal data when you use Nocturne Finder, our nightlife and place discovery platform (the "Service"). We act as the data controller for the personal data described in this policy, within the meaning of Regulation (EU) 2016/679 ("GDPR").

Operator: Experts SEA
Website: https://experts-sea.com
Service: Nocturne Finder
Privacy contact: info@nocturnefinder.com

If you have questions about this policy or wish to exercise your rights, contact us at info@nocturnefinder.com.

2. Scope

This policy applies to personal data we process when you:

Visit our marketing website or landing page;
Create or use a Nocturne Finder consumer account (web or mobile app);
Create or use a Nocturne Finder business account or use the business dashboard;
Interact with our Service as a guest (without an account);
Communicate with us by email or other means.

It does not cover third-party websites or services linked from the Service. Their own privacy policies apply.

3. Personal data we collect

We collect personal data in the following ways:

3.1 Data you provide when creating an account

When you register or update your profile, we collect:

Identifiers and contact details: email address, username, first name, last name;
Authentication credentials: password (stored in hashed form using bcrypt; never stored in plain text). If you sign in via Google, we receive a Google OAuth identifier and limited profile information (name, email, profile picture);
Profile details: gender, freetext address, geocoded city and country, avatar/profile photo;
Business profile (business accounts only): business name, business type, and authorised representative details.

3.2 Data generated when you use the Service

Search activity: the search queries you perform, the categories you choose, location parameters (such as the centre point and radius), the number of results, and timestamps. This is stored in our search_events log;
Place interactions: places you claim (for business accounts), closure reports you submit, and events you create;
Advertising and billing data (business accounts): Ad Wallet balance, top-up transactions, ad impressions, clicks, search-served counts, campaign performance, and the corresponding ledger of debits and credits;
Technical and device data: IP address (which we store in hashed form in our search-event logs, not in plaintext), browser/device user-agent, language, timestamps, and information about your interaction with our API endpoints;
Cookies and similar identifiers: see Section 7.

3.3 Data from third parties

Google (OAuth): if you sign in with Google, Google shares your basic profile information with us according to the scopes you approve;
Stripe (payments): when you make a payment, Stripe shares limited transaction metadata with us (transaction ID, amount, status, last four digits of card, country). We do not receive or store your full payment card details. Card data is collected and processed directly by Stripe under their own terms and privacy policy;
Google Maps / Places API: place data displayed in the Service (names, addresses, opening hours, ratings, photos) is sourced from Google. When the Service queries this API, technical metadata about the request is logged.

3.4 Guests (no account)

If you use the Service without an account, we generate an ad session identifier stored in your browser to apply frequency caps and prevent abuse, and we may use a guest_id cookie to enforce anti-abuse limits (such as the daily search limit). We also process the IP address you connect from to apply rate limits.

We process your personal data on the following legal bases:

Purpose	Legal basis
Creating and maintaining your account; providing the core Service; processing payments and Ad Wallet transactions	Performance of a contract with you (Art. 6(1)(b))
Sending transactional emails (verification codes, password resets, billing receipts, service notices)	Performance of a contract (Art. 6(1)(b))
Preventing fraud, abuse, scraping, and unauthorised access; enforcing rate limits and security; debugging and improving the Service; analytics in aggregated form	Legitimate interests (Art. 6(1)(f)) — namely, securing the Service and improving its quality
Sending optional marketing communications	Consent (Art. 6(1)(a)) — you can withdraw consent at any time
Cookies and similar technologies that are not strictly necessary	Consent (Art. 6(1)(a))
Complying with legal obligations (tax, accounting, lawful requests from authorities)	Legal obligation (Art. 6(1)(c))
Defending or asserting legal claims	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure your rights and freedoms are not overridden. You may object to such processing as described in Section 9.

5. How we use your data

We use your personal data to:

Provide the Service — create your account, authenticate you, display search results, fulfil ad campaigns, process payments, and operate the business dashboard;
Communicate with you — send transactional emails such as verification codes, password resets, account alerts, billing receipts, and important service notices;
Personalise and improve — analyse usage patterns in aggregate, debug issues, develop new features, and tune our ad-ranking auction;
Secure the Service — detect, prevent, and respond to fraud, abuse, scraping, account takeover, and other security threats. This includes applying rate limits keyed on hashed IP and guest_id cookies;
Comply with law — meet tax, accounting, and other legal obligations, and respond to lawful requests from competent authorities.

We do not carry out automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 GDPR.

We share personal data only as described below. We do not sell your personal data.

6.1 Service providers (processors)

We rely on the following categories of processors, who act on our behalf under written contracts that include the safeguards required by Article 28 GDPR:

Processor	Purpose	Data categories
Stripe	Payment processing for Ad Wallet top-ups and premium subscriptions	Name, email, payment card data (collected directly by Stripe), transaction metadata
Google (OAuth, Maps / Places API)	Sign-in with Google; place data; geocoding	Google account identifier, profile basics, search queries containing location text
Email service provider (Nodemailer / SMTP relay)	Sending transactional emails	Email address, message content
Cloud hosting and infrastructure	Hosting the Service, databases, and backups	All categories described in Section 3
Redis cache provider	Rate-limit counters, session/cache storage	Hashed IP, `guest_id`, session identifiers

6.2 Other recipients

Competent authorities when required by law, court order, or to protect our rights or the rights of others;
Professional advisers (lawyers, accountants, auditors) bound by confidentiality obligations;
Successors in the event of a merger, acquisition, reorganisation, or sale of assets, subject to appropriate confidentiality and continued protection of your data.

6.3 Public information

Information you choose to make public — for example, a business profile or a claimed-place listing — is visible to other users of the Service.

7. Cookies and similar technologies

We use a small number of cookies and similar identifiers:

Cookie / identifier	Purpose	Type
`guest_id`	Anti-abuse and daily search-quota enforcement for users without an account	Strictly necessary
Session / authentication cookies and access tokens	Keeping you signed in	Strictly necessary
Ad session ID (browser session storage)	Frequency capping for advertising	Strictly necessary
Rate-limit counters (server-side, keyed on hashed IP and `guest_id`)	Preventing abuse and scraping	Strictly necessary
Optional analytics or marketing cookies (if enabled)	Measuring usage and (where applicable) marketing	Only set with your consent

Strictly necessary cookies do not require consent under the EU ePrivacy Directive because they are essential for the Service to function. Any non-essential cookies are set only after you give consent through our cookie banner, and you can withdraw consent at any time via the cookie settings link in the Service footer.

8. International transfers

The Service is operated for users in the European Union and beyond. Some of our processors (notably Google and Stripe) may process personal data outside the European Economic Area, including in the United States. Where this is the case, we rely on appropriate safeguards under Articles 45–46 GDPR, in particular:

EU Commission adequacy decisions (where applicable, e.g. the EU–US Data Privacy Framework for participating US processors);
Standard Contractual Clauses approved by the European Commission;
Supplementary measures where reasonably necessary in light of the Schrems II judgement.

You may obtain a copy of the safeguards in place for a specific transfer by contacting info@nocturnefinder.com.

If your personal data is processed by us, you have the following rights:

Right of access (Art. 15) — obtain confirmation of whether we process your data and a copy of it;
Right to rectification (Art. 16) — correct inaccurate or incomplete data;
Right to erasure / "right to be forgotten" (Art. 17) — request deletion of your data, subject to lawful exceptions;
Right to restriction of processing (Art. 18);
Right to data portability (Art. 20) — receive data you provided in a structured, commonly used, machine-readable format;
Right to object (Art. 21) — object to processing based on legitimate interests, including profiling, and to direct marketing at any time;
Right to withdraw consent (Art. 7(3)) — for any processing based on consent, without affecting the lawfulness of processing carried out before withdrawal;
Right not to be subject to a decision based solely on automated processing (Art. 22), where such processing produces legal or similarly significant effects.

To exercise any of these rights, email info@nocturnefinder.com. We will respond within one (1) month, extendable by a further two months for complex requests, in accordance with Article 12 GDPR. We may need to verify your identity before acting on your request.

You also have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or where you believe an infringement has occurred. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

10. Data retention

We retain personal data only for as long as necessary for the purposes set out in this policy or as required by law:

Data category	Retention period
Account data (profile, credentials)	Until your account is deleted, plus a short technical buffer for backups
Search events and place-interaction logs	Up to 24 months from creation, or earlier upon valid request
Hashed IP addresses in security/rate-limit logs	Up to 24 months
Payment and Ad Wallet transaction records	As required by applicable tax/accounting law (typically up to 10 years in the EU)
Email correspondence	Up to 36 months from last interaction
Cookies	Per the lifetime declared in the cookie banner; `guest_id` cookies expire 30 days from last update

After the retention period, we delete or anonymise the data. Aggregated, non-identifying analytics may be kept indefinitely.

11. Security

We implement appropriate technical and organisational measures designed to protect your personal data, including:

Passwords hashed with bcrypt;
IP addresses hashed before being written to search-event logs;
Encrypted connections (HTTPS/TLS) between your device and our servers;
Server-side rate limiting and abuse-prevention controls;
Access controls and least-privilege principles for our staff;
Regular security testing, including the internal security test suite shipped with the Service.

No system is perfectly secure. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, notify affected users without undue delay, in accordance with Articles 33–34 GDPR.

12. Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, please contact info@nocturnefinder.com so we can delete the data and close the account.

13. Third-party services

The Service displays content and integrates services from third parties (such as Google Maps and Stripe). When you interact with those features, the third party may collect personal data directly. Their own privacy policies govern that processing. We encourage you to review them:

Google Privacy Policy: https://policies.google.com/privacy
Stripe Privacy Policy: https://stripe.com/privacy

14. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will indicate the most recent revision. For material changes, we will provide notice in the Service or by email before the change takes effect. Please review this Policy periodically.

15. Contact and Data Protection Officer

You can reach our privacy team at any time:

Email: info@nocturnefinder.com
Operator: Experts SEA
Website: https://experts-sea.com

If we appoint a Data Protection Officer ("DPO") in accordance with Article 37 GDPR, we will update this section with the DPO's contact details. Until then, all privacy queries should be sent to info@nocturnefinder.com.