Privacy Policy

Nocturne Finder Operated by Experts SEA (experts-sea.com)

Effective date: 26 May 2026 Last updated: 16 September 2026

1. Who we are

This Privacy Policy describes how Experts SEA ("we", "us", "our") collects, uses, and shares your personal data when you use Nocturne Finder, our nightlife and place discovery platform (the "Service"). We act as the data controller for the personal data described in this policy, within the meaning of Regulation (EU) 2016/679 ("GDPR").

Operator: Experts SEA
Website: https://experts-sea.com
Service: Nocturne Finder
Privacy contact: info@nocturnefinder.com

If you have questions about this policy or wish to exercise your rights, contact us at info@nocturnefinder.com.

2. Scope

This policy applies to personal data we process when you:

Visit our marketing website or landing page;
Create or use a Nocturne Finder consumer account (web or mobile app);
Create or use a Nocturne Finder business account or use the business dashboard;
Interact with our Service as a guest (without an account);
Communicate with us by email or other means.

It does not cover third-party websites or services linked from the Service. Their own privacy policies apply.

3. Personal data we collect

We collect personal data in the following ways:

3.1 Data you provide when creating an account

When you register or update your profile, we collect:

Identifiers and contact details: email address, username, first name, last name;
Authentication credentials: password (stored in hashed form using bcrypt; never stored in plain text). If you sign in with a third-party provider (Google, Apple, or Facebook), we receive an identifier issued by that provider and limited profile information (name, email, and where provided a profile picture);
Profile details: gender, freetext address, geocoded city and country, avatar/profile photo;
Business profile (business accounts only): business name, business type, and authorised representative details.

3.2 Data generated when you use the Service

Search activity: the search queries you perform, the categories you choose, location parameters (such as the centre point and radius), the number of results, and timestamps. This is stored in our search_events log;
Place interactions: places you claim (for business accounts), closure reports you submit, and events you create;
Advertising and billing data (business accounts): Ad Wallet balance, top-up transactions, ad impressions, clicks, search-served counts, campaign performance, and the corresponding ledger of debits and credits;
Technical and device data: IP address (which we store in hashed form in our search-event logs, not in plaintext), browser/device user-agent, language, timestamps, and information about your interaction with our API endpoints;
Cookies and similar identifiers: see Section 7.

3.3 Data from third parties

Google (OAuth): if you sign in with Google, Google shares your basic profile information with us according to the scopes you approve;
Apple (Sign in with Apple): if you sign in with Apple, Apple shares an Apple user identifier and, depending on your choice, your name and either your email address or an Apple private relay address;
Facebook / Meta (Facebook Login): if you choose Continue with Facebook, we request the email permission only. Meta then shares your Facebook user ID, name, and email address with us, together with a short-lived access token. We use the access token once, to verify that the sign-in was issued for our app and to read those three fields, and then discard it — we do not store your Facebook access token or your Facebook user ID. We keep your email address and a username derived from your name, so that we can create and recognise your account. We do not post to Facebook, read your friends, or request any other permission;
Stripe (payments): when you make a payment, Stripe shares limited transaction metadata with us (transaction ID, amount, status, last four digits of card, country). We do not receive or store your full payment card details. Card data is collected and processed directly by Stripe under their own terms and privacy policy;
Google Maps / Places API: place data displayed in the Service (names, addresses, opening hours, ratings, photos) is sourced from Google. When the Service queries this API, technical metadata about the request is logged.

3.4 Guests (no account)

If you use the Service without an account, we generate an ad session identifier stored in your browser to apply frequency caps and prevent abuse. We also process the IP address you connect from to apply rate limits. Place search requires an account, so its daily quota is counted against your account rather than against a browser identifier.

3.5 Device permissions, and data that stays on your device

The mobile app asks for a small number of operating-system permissions. Each one is requested only at the moment you tap the feature that needs it, and each can be withdrawn at any time in your device settings. Granting a permission is not the same as giving us the data behind it:

Contacts (address book). If you tap Find friends, the app asks your device for access to your address book so it can show your contacts as invitable cards. Your contacts are read on your device and never leave it. We do not upload, transmit, store, hash, or index your address book; we do not match it against our users; and we do not build a social graph from it. There is nothing to match it against - a Nocturne Finder account carries an email address and no phone number. Choosing to invite someone opens your own SMS or email app with a message already written; your device sends it directly to that person, and the phone number or address never reaches our servers. The only records kept are two lists held locally on your phone - which contacts you have already invited, and which you have dismissed - so that the same cards are not offered to you again. Revoking the permission, or uninstalling the app, ends this entirely.
Location. Used to show places and events near you, at the moment you ask for them. See Sections 3.2 and 5.
Camera and photo library. Used to scan QR tickets and to attach an image to a post or event. Photos are uploaded only when you choose one and publish it.
Microphone and speech recognition. Used only while you are dictating a search.

We process your personal data on the following legal bases:

Purpose	Legal basis
Creating and maintaining your account; providing the core Service; processing payments and Ad Wallet transactions	Performance of a contract with you (Art. 6(1)(b))
Sending transactional emails (verification codes, password resets, billing receipts, service notices)	Performance of a contract (Art. 6(1)(b))
Preventing fraud, abuse, scraping, and unauthorised access; enforcing rate limits and security; debugging and improving the Service; analytics in aggregated form	Legitimate interests (Art. 6(1)(f)) — namely, securing the Service and improving its quality
Sending optional marketing communications	Consent (Art. 6(1)(a)) — you can withdraw consent at any time
Cookies and similar technologies that are not strictly necessary	Consent (Art. 6(1)(a))
Complying with legal obligations (tax, accounting, lawful requests from authorities)	Legal obligation (Art. 6(1)(c))
Defending or asserting legal claims	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure your rights and freedoms are not overridden. You may object to such processing as described in Section 9.

5. How we use your data

We use your personal data to:

Provide the Service — create your account, authenticate you, display search results, fulfil ad campaigns, process payments, and operate the business dashboard;
Communicate with you — send transactional emails such as verification codes, password resets, account alerts, billing receipts, and important service notices;
Personalise and improve — analyse usage patterns in aggregate, debug issues, develop new features, and tune our ad-ranking auction;
Secure the Service — detect, prevent, and respond to fraud, abuse, scraping, account takeover, and other security threats. This includes applying rate limits keyed on hashed IP and, for signed-in requests, your account identifier;
Comply with law — meet tax, accounting, and other legal obligations, and respond to lawful requests from competent authorities.

We do not carry out automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 GDPR.

We share personal data only as described below. We do not sell your personal data.

6.1 Service providers (processors)

We rely on the following categories of processors, who act on our behalf under written contracts that include the safeguards required by Article 28 GDPR:

Processor	Purpose	Data categories
Stripe	Payment processing for Ad Wallet top-ups and premium subscriptions	Name, email, payment card data (collected directly by Stripe), transaction metadata
Google (OAuth, Maps / Places API)	Sign-in with Google; place data; geocoding	Google account identifier, profile basics, search queries containing location text
Resend and our SMTP relay provider	Sending transactional emails (verification, notifications, receipts)	Email address, message content
Cloud hosting and infrastructure	Hosting the Service, databases, and backups	All categories described in Section 3
Redis cache provider	Rate-limit counters, session/cache storage	Hashed IP, account identifiers, session identifiers

6.2 Other recipients

Competent authorities when required by law, court order, or to protect our rights or the rights of others. We review every such request for legal validity, disclose only the minimum data necessary, challenge requests we consider unlawful or overbroad, and keep a record of each request and our response;
Professional advisers (lawyers, accountants, auditors) bound by confidentiality obligations;
Successors in the event of a merger, acquisition, reorganisation, or sale of assets, subject to appropriate confidentiality and continued protection of your data.

6.3 Public information

Information you choose to make public — for example, a business profile or a claimed-place listing — is visible to other users of the Service.

7. Cookies and similar technologies

We use a small number of cookies and similar identifiers:

Cookie / identifier	Purpose	Type
Session / authentication cookies and access tokens	Keeping you signed in	Strictly necessary
Ad session ID (browser session storage)	Frequency capping for advertising	Strictly necessary
Rate-limit counters (server-side, keyed on hashed IP and, for signed-in requests, your account identifier)	Preventing abuse and scraping	Strictly necessary
Optional analytics or marketing cookies (if enabled)	Measuring usage and (where applicable) marketing	Only set with your consent

Strictly necessary cookies do not require consent under the EU ePrivacy Directive because they are essential for the Service to function. Any non-essential cookies are set only after you give consent through our cookie banner, and you can withdraw consent at any time via the cookie settings link in the Service footer.

8. International transfers

The Service is operated for users in the European Union and beyond. Some of our processors and data sources (notably Google, Meta, and Stripe) may process personal data outside the European Economic Area, including in the United States. Where this is the case, we rely on appropriate safeguards under Articles 45–46 GDPR, in particular:

EU Commission adequacy decisions (where applicable, e.g. the EU–US Data Privacy Framework for participating US processors);
Standard Contractual Clauses approved by the European Commission;
Supplementary measures where reasonably necessary in light of the Schrems II judgement.

You may obtain a copy of the safeguards in place for a specific transfer by contacting info@nocturnefinder.com.

If your personal data is processed by us, you have the following rights:

Right of access (Art. 15) — obtain confirmation of whether we process your data and a copy of it;
Right to rectification (Art. 16) — correct inaccurate or incomplete data;
Right to erasure / "right to be forgotten" (Art. 17) — request deletion of your data, subject to lawful exceptions;
Right to restriction of processing (Art. 18);
Right to data portability (Art. 20) — receive data you provided in a structured, commonly used, machine-readable format;
Right to object (Art. 21) — object to processing based on legitimate interests, including profiling, and to direct marketing at any time;
Right to withdraw consent (Art. 7(3)) — for any processing based on consent, without affecting the lawfulness of processing carried out before withdrawal;
Right not to be subject to a decision based solely on automated processing (Art. 22), where such processing produces legal or similarly significant effects.

To exercise any of these rights, email info@nocturnefinder.com. We will respond within one (1) month, extendable by a further two months for complex requests, in accordance with Article 12 GDPR. We may need to verify your identity before acting on your request.

9.1 Deleting your account and your data

You can delete your account yourself, at any time, without contacting us:

Sign in on the web app or the mobile app;
Open Settings → Manage account (on the web, the Danger zone section of Settings);
Choose Delete account and type your username to confirm.

This permanently deletes your account and the personal data attached to it — profile details, avatar, search and place-interaction history, events, saved places, messages, and any social connections. Communities you own are handed over to their longest-serving remaining admin (or member) so that other members do not lose their content; a community with no other active members is deleted with your account.

This is also how you delete data we received from Facebook Login: deleting your account removes the email address and username that originated from your Facebook profile. We hold no Facebook access token and no Facebook user ID to delete. You can additionally remove our app's access from Facebook → Settings & privacy → Settings → Apps and websites.

Two exceptions survive account deletion, because the law requires it: payment and ticketing records needed for tax and accounting purposes, and security logs containing hashed (non-reversible) IP addresses. Retention periods for both are in Section 10. Backups are overwritten on their normal rotation.

If you cannot sign in, email info@nocturnefinder.com from the address on the account and we will delete it for you within one (1) month.

You also have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or where you believe an infringement has occurred. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

10. Data retention

We retain personal data only for as long as necessary for the purposes set out in this policy or as required by law:

Data category	Retention period
Account data (profile, credentials)	Until your account is deleted, plus a short technical buffer for backups
Search events and place-interaction logs	Up to 24 months from creation, or earlier upon valid request
Hashed IP addresses in security/rate-limit logs	Up to 24 months
Payment and Ad Wallet transaction records	As required by applicable tax/accounting law (typically up to 10 years in the EU)
Email correspondence	Up to 36 months from last interaction
Cookies	Per the lifetime declared in the cookie banner

After the retention period, we delete or anonymise the data. Aggregated, non-identifying analytics may be kept indefinitely.

11. Security

We implement appropriate technical and organisational measures designed to protect your personal data, including:

Passwords hashed with bcrypt;
IP addresses hashed before being written to search-event logs;
Encrypted connections (HTTPS/TLS) between your device and our servers;
Server-side rate limiting and abuse-prevention controls;
Access controls and least-privilege principles for our staff;
Regular security testing, including the internal security test suite shipped with the Service.

No system is perfectly secure. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, notify affected users without undue delay, in accordance with Articles 33–34 GDPR.

12. Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, please contact info@nocturnefinder.com so we can delete the data and close the account.

13. Third-party services

The Service displays content and integrates services from third parties (such as Google Maps and Stripe). When you interact with those features, the third party may collect personal data directly. Their own privacy policies govern that processing. We encourage you to review them:

Google Privacy Policy: https://policies.google.com/privacy
Stripe Privacy Policy: https://stripe.com/privacy

14. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will indicate the most recent revision. For material changes, we will provide notice in the Service or by email before the change takes effect. Please review this Policy periodically.

15. Contact and Data Protection Officer

You can reach our privacy team at any time:

Email: info@nocturnefinder.com
Operator: Experts SEA
Website: https://experts-sea.com

If we appoint a Data Protection Officer ("DPO") in accordance with Article 37 GDPR, we will update this section with the DPO's contact details. Until then, all privacy queries should be sent to info@nocturnefinder.com.