Privacy notice

Controller and purposes

Jonathan Romero, trading as IAP Vision Group, is the controller of VirtualMatch data. The business address is in the legal notice. Privacy contact: info@iapvision.com. We process data needed to create your account, authenticate you, save information you request, handle enquiries and protect the service.

Data and legal bases

• Account: email, user identifier, sign-in method and verification state. Firebase manages credentials. Google sign-in supplies the identity data authorised for sign-in, not access to your Gmail messages. Basis: performing the requested service (GDPR Art. 6(1)(b)).
• Profile and content: characters, notes and drafts you save when access is available. They are not published in a public gallery. They are not currently sent to AI generation providers.
• Acceptance record: terms version, adult declaration, language and date. Security and requests: necessary technical information and communications, based on legitimate interests in preventing abuse and handling incidents; legal obligations are handled under Art. 6(1)(c).
• Do not enter health, sex-life or sexual-orientation data, or private information about others. Future processing of special-category data requires an Article 9 basis and specific safeguards; accepting these terms is not explicit consent for that processing.

Providers and location

We use Google Firebase for authentication and the database, and Cloudflare for website and image hosting. Firestore is configured in nam5 (United States), not the European Union. These services can involve international transfers. Applicable processing agreements and transfer mechanisms must be maintained with each provider; we do not claim EU-only data residency. We do not use advertising or optional analytics.

Retention and your rights

Account data and content are retained while you maintain your account, subject to deletion requests and specific legal retention needs. Automatic inactivity deletion is not configured. You may request access, correction, deletion, portability, restriction or objection by contacting us. An active subscription is not required to exercise your rights. We will ask for additional identity information only when necessary. Requests are handled within the legal period, normally one month, with justified extensions where the GDPR permits. You may complain to your data protection authority; in Spain, the AEPD.