This policy explains what personal data we collect when you use The Groupchat (the "Community"), why we collect it, who we share it with and what rights you have. We keep it as short and clear as we can. If anything is unclear, email us at [PRIVACY EMAIL].
1. Who we are
The Community is run by Captivate Agency, owned by Isa Vrolijk, registered with the Dutch Chamber of Commerce (KvK) under number [KVK NUMBER], located at [BUSINESS ADDRESS], the Netherlands. We are the data controller for the personal data described in this policy.
Contact: [PRIVACY EMAIL]
2. What data we collect
Data you give us
- Account data: your name, email address and the login method you use (email code or Google).
- Membership and payment data: your membership type (regular or VIP), subscription status and invoices. Card and bank details are handled by our payment provider; we never see or store your full card number.
- Profile data: display name, profile picture, background picture, headline, location (city), interests, skills you offer and look for, goals, expertise, status, personal message, "now playing", Instagram handle and website. You decide what to fill in.
- Optional birth data: birth date, birth time and birth place, used only to calculate your horoscope and Human Design summary. Your raw birth details are visible only to you. Only the calculated summary is shown on your profile, and only if you choose to show it.
- Content you post: group chat messages, threads, notes, posts, photos, videos, files, comments, likes and live or huddle announcements. Content in shared spaces is visible to other members.
- Private messages: 1:1 chats are end-to-end encrypted in your browser. We store the encrypted messages and who sent them to whom and when, but we cannot read their content.
- Friends and connections: friend requests you send, accept or decline.
Data we create or collect automatically
- Points and achievements: points earned from likes, comments, posts, chat messages and call attendance, bonuses and leaderboard position.
- Call attendance: whether you attended a group call and for how long, taken from the video-call provider's attendance report and matched to your account email.
- Course progress: which lessons you completed.
- Technical data: login sessions, IP address, device and browser type, and error logs needed to keep the platform secure and working.
Data from third parties (only if you connect them)
- Instagram: if you connect your Instagram account, we receive your username, profile picture and recent public posts so we can show your feed on your profile. You can disconnect at any time.
- Google: if you log in with Google, we receive your name, email address and profile picture.
3. Why we use it (and our legal basis)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account and membership | Account, membership, payment data | Performance of our contract with you (art. 6(1)(b)) |
| Showing your profile and letting members connect, chat and post | Profile data, content, friends | Performance of contract (art. 6(1)(b)) |
| Calculating and showing your horoscope and Human Design summary | Optional birth data | Your consent (art. 6(1)(a)), which you can withdraw by removing the data |
| Suggesting member matches with AI | Profile data (no birth details, no private messages) | Your consent (art. 6(1)(a)), given when you click "Find my matches" |
| Points, leaderboard and surprise bonuses | Activity, attendance, points | Performance of contract (art. 6(1)(b)) |
| Showing your Instagram feed | Instagram data | Your consent (art. 6(1)(a)) |
| Sending invitations, login codes and service emails | Email address | Performance of contract (art. 6(1)(b)) |
| Bookkeeping and tax obligations | Invoices and payment records | Legal obligation (art. 6(1)(c)) |
| Security, preventing abuse and moderating the Community | Technical data, content | Our legitimate interest in a safe community (art. 6(1)(f)) |
We do not sell your data and do not use it for advertising.
4. AI features
When you use "Find my matches" or the birth place lookup, the relevant information (for matching: profile fields such as skills, interests, goals and city of you and other members; for the lookup: the place name) is sent to our AI provider, Anthropic, to generate suggestions. The AI does not make decisions with legal or similarly significant effects on you; matches are suggestions only. Under our agreement with Anthropic, this data is not used to train their models.
6. Data outside the EU
Some providers (such as Vercel, Stripe, Resend, Zoom, Anthropic, Meta and Google) may process data in the United States. Where that happens, we rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses to protect your data.
7. How long we keep it
- Account and profile data: as long as you are a member. When you leave or delete your account, we delete it within 30 days.
- Posts and group chat messages: deleted with your account, unless you choose to leave them up anonymously.
- Private messages: deleted with your account.
- Invoices and payment records: 7 years, as Dutch tax law requires.
- Technical logs: up to 90 days.
- Backups: overwritten within 30 days.
8. Security
We use encrypted connections (HTTPS), access rules so members can only change their own data, end-to-end encryption for private chats and login codes instead of passwords. Only Isa and people she appoints as admins can manage the Community. If a data breach happens that risks your rights, we will report it to the Dutch Data Protection Authority within 72 hours and inform you when required.
9. Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data (most of it you can edit yourself in your profile);
- have your data deleted;
- restrict or object to certain processing, including processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time, for example by removing your birth data or disconnecting Instagram. This does not affect processing that happened before.
Email [PRIVACY EMAIL] to use any of these rights. We reply within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
11. Minimum age
The Community is for people aged 16 and older. We do not knowingly collect data from children under 16. If you believe a child has joined, contact us and we will delete the account.
12. Changes and contact
We may update this policy when the Community changes. We will announce important changes in the Community and by email. The date at the top shows the latest version.
Questions? Email [PRIVACY EMAIL] or write to Captivate Agency, [BUSINESS ADDRESS], the Netherlands.