Privacy Policy of Garagò

Your privacy matters to us. This policy explains clearly what data we collect when you use Garagò, why we use it, with whom we share it and what rights you have. For any questions you can always write to us at info@garago.app.

1. Introduction

Garagò is a social service for discovering and sharing events and making friends, reserved for adults (18+). It is not a dating app.

This policy describes what personal data we process, for which purposes and on which legal bases, with whom it may be shared and for how long it is retained, as well as the rights you can exercise. It is addressed both to users of the app and to the organizers and venues that publish events through the website.

2. Data we process — app users

This section concerns the people who use the Garagò app.

Data we process

• Registration and account data: email address; alternatively, login via Apple or Google; display name.
• Declaration of legal age (18+).
• Profile photo (optional).
• Bio: optional descriptive text that the user can enter in their profile.
• The user's own gender and age:for those who use the "Find Company" feature, these are necessary for the feature to work, as they are used to apply the mutual compatibility filters; they are not visible to other users (used only internally for the filters). Those who do not use "Find Company" are not required to declare them.
• Optional preference regarding the age and gender of the people with whom to share the event.
• Participations and requests relating to the "Find Company" feature.
• Messages exchanged in chats (managed through Stream Chat).
• Push notification tokens.
• City declared by the user in their profile.
• Device location:processed locally on the device to center the map and calculate the distance from events; it is not transmitted to or stored on Garagò's servers. The map display uses Google Maps (Android) or Apple Maps (iOS), which processes the displayed area to render the maps. Active only upon prior consent (device permission).

Name, profile photo and any bio are visible to other users exclusively in the context of a "Find Company" contact (sending or receiving a one-to-one invitation, or participating in the same group). Garagò does not offer any open profile search or browsing function: outside of a contact, this data is not visible to other users. The user's own gender and age are in no case visible to other users.

Purposes and legal bases

• Provision of the service, including the "Find Company" feature: performance of the contract (Art. 6(1)(b) GDPR).
• Chat between users who have been put in contact: performance of the contract (Art. 6(1)(b) GDPR).
• The user's own gender and age, necessary to apply the "Find Company" feature filters: performance of the contract (Art. 6(1)(b) GDPR).
• Gender and age preference for the company (optional data): the user's specific consent (Art. 6(1)(a) GDPR).
• Push notifications: consent (operating system permission).
• Geolocation for proximity filters: consent (operating system permission).
• Analytics and technical diagnostics: consent (subject to the consent expressed in the app).
• Recording of acceptances of the Terms and Privacy Policy: compliance with a legal obligation and accountability (Art. 6(1)(c) GDPR).

3. The "Find Company" feature and the gender preference

The "Find Company" feature allows you to share an event with other people, in two modes:

• Group (3-8 people): by indicating optional preferences (age range and/or gender of the group, with a symmetry constraint — you may request only groups of your own gender or mixed groups), the user is automatically placed in a compatible group that is forming or that has available spots.
• One-to-one: the user sees a list of people available for the same event, filtered by mutual compatibility of age and gender; the contact is activated only with double consent, that is, mutual compatibility of the filters and explicit acceptance of the request.

The system that proposes groups and people is based on fixed and deterministic rules (it does not use artificial intelligence or machine learning). Placement in a group or the proposal of a contact does not produce legal effects, nor does it similarly significantly affect the person, and does not constitute automated decision-making within the meaning of Art. 22 GDPR.

Gender preference.The age and gender filters of the "Find Company" feature are optional: they serve the user, if they wish, to choose with whom to share the event, consistently with the nature of the service — one of sociality and friendship, not of romantic encounters or dating.

The gender preference is therefore an optional filter that the user may set to choose with whom to share the event. Being optional, it is processed only if the user chooses to provide it (consent) and is used exclusively for the "Find Company" feature. The user's own gender is not exposed to other users, but is processed as functional data internal to the filters.

Given the social and non-romantic nature of the service, the choice of the company's gender is not capable of revealing sexual orientation within the meaning of Art. 9 GDPR. In any event, should such preference be qualified differently, the related processing is supported by the user's explicit consent (Art. 9(2)(a) GDPR).

4. Business users — organizers and venues

This section concerns the organizers, venues and performers who use the Garagò website to publish events. The "Find Company" feature, the chat and the processing of the gender preference described above do not apply to these users.

Data we process

• Business account data (contact details of the reference person, access credentials).
• Data relating to published events (description, place, date, images provided).
• Website usage analytics.

Purposes and legal bases

• Account management and event publication: performance of the contract (Art. 6(1)(b) GDPR).
• Website analytics: consent.

5. Methods and place of processing — security

Data is processed using IT and electronic tools, with technical and organizational security measures adequate to prevent unauthorized access, loss, destruction or unauthorized disclosure of the data. Data may be processed, on behalf of the Controller, by authorized persons and by technical service providers appointed as data processors pursuant to Art. 28 GDPR.

The most sensitive data — profile, photos, chat messages, analytics and diagnostics — is processed within the European Union. Certain transfers to providers located in the United States concern peripheral technical functions and are supported by appropriate safeguards (see the "Extra-EU transfers and safeguards" section).

6. Data processors and sub-processors

Below is the list of the data processors and sub-processors that Garagò relies on, with their function, the place of processing and the legal basis of any transfers.

The Google services used for users in the European Economic Area are provided by Google Ireland Limited; only the Google Maps mapping component also entails processing in the United States.

7. Extra-EU transfers and safeguards

For providers located in the United States, transfers of personal data are based on Standard Contractual Clauses (SCC) approved by the European Commission and/or on the provider's adherence to the EU-US Data Privacy Framework (DPF). The most sensitive data (profile, photos, chat messages, analytics and diagnostics) remains processed within the European Union. The up-to-date list of providers and their respective transfer bases is set out in the "Data processors and sub-processors" section.

8. Retention periods

• Account and profile: for the duration of the account and up to 30 days after deletion.
• Chat messages: 12 months from the last message, after which anonymization.
• Requests and participations in the "Find Company" feature: 12 months.
• Analytics (PostHog): 24 months (pseudonymized data), unless consent is withdrawn.
• Error diagnostics logs (Sentry): 90 days.
• Recording of acceptances of the Terms and Privacy Policy: 10 years (accountability).
• Push notification tokens: until revoked.
• Email logs: 30 days.
• Device location:no retention (processed on the device, not transmitted to Garagò's servers).

9. Your rights (Arts. 15-22 GDPR)

As a data subject, you have the right to:

• Access (Art. 15): obtain confirmation of the processing and a copy of your data.
• Rectification (Art. 16): correct inaccurate data or complete incomplete data.
• Erasure (Art. 17): obtain the erasure of data in the cases provided for by law.
• Restriction (Art. 18): request the restriction of the processing in the cases provided for.
• Portability (Art. 20): receive your data in a structured format and transmit it to another controller.
• Objection (Art. 21): object to the processing in the cases provided for.
• Withdrawal of consent: withdraw at any time the consents given, without affecting the lawfulness of the processing carried out before the withdrawal.

10. How to exercise your rights and complaint to the Italian Data Protection Authority

How to exercise them. You can exercise your rights by writing to info@garago.app, or through the self-service functions available in the app (editing the profile is equivalent to rectification; deleting the account entails the cascading deletion of the data). The Controller provides a response within one month of the request, a period that may be extended by two months for particularly complex or numerous requests, informing the data subject accordingly.

Complaint to the authority. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (the Italian supervisory authority) and to bring proceedings before the judicial authority.

11. Profiling and marketing

Garagò does not carry out advertising profiling and does not transfer data to third parties for marketing purposes. Analytics is processed in pseudonymized form and solely for the improvement of the service.

12. Changes to this policy

The Controller may amend this policy. Changes are published on this page, with an update of the last-modified date indicated at the top. Where the changes concern processing based on consent, consent will be collected again where necessary.

13. Data Controller and contacts

The Data Controller is Andrea Di Lieto (sole proprietorship), Italian VAT no. 06230520659. For any matter relating to the processing of personal data and for the exercise of your rights you can write to: info@garago.app.

Related documents: Terms and Conditions; Community Guidelines.

Version 1.0 — Last updated: 10 June 2026