Privacy Notice
This notice explains how we process personal data generated through your use of the Melyvo mobile application, the melyvo.hu website, and related customer support.
1. Data controller
Name: [controller name]
Registered address: [controller address]
Email: support@melyvo.hu
Registration number: [registration number]
Tax number: [tax number]
We have not appointed a data protection officer unless required by applicable law. You may use the email address above for privacy questions.
2. Data, purposes, legal bases, and retention
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address, securely hashed password, and email verification status | Registration, sign-in, account management, and communication | Performance of a contract, Article 6(1)(b) GDPR | Until account deletion; short-lived verification and reset tokens until they expire |
| Virtual friend settings, conversations, and memories created or approved by the user | Providing the service, conversation history, and personalization | Performance of a contract, Article 6(1)(b) GDPR | Until deleted by the user or the account is deleted |
| Necessary message excerpts and relevant memories | Generating AI responses and safety moderation | Performance of a contract and legitimate interests in protecting the service and others, Article 6(1)(b) and (f) GDPR | In Melyvo until the conversation is deleted; providers may apply different technical retention periods defined by contract |
| User identifier, product identifier, subscription status, and expiry | Subscription verification, entitlement delivery, and restoration | Performance of a contract and legal obligation, Article 6(1)(b) and (c) GDPR | Until account deletion or the end of applicable accounting or legal limitation periods |
| One-way security identifier derived from the IP address, request counts, and failed sign-in events | Preventing abuse, automated registration, and unauthorized access | Legitimate interests, Article 6(1)(f) GDPR | Rate-limit data for up to 2 days; security incidents for the period needed to investigate and establish or defend legal claims |
| Message and token counts, estimated cost, and technical logs | Enforcing limits, maintaining stability, troubleshooting, and cost protection | Performance of a contract and legitimate interests, Article 6(1)(b) and (f) GDPR | Until account deletion or a shorter operationally necessary period |
| Submitted content report and optional description | Investigating unsafe or inappropriate AI responses and improving moderation | Legitimate interests, Article 6(1)(f) GDPR | For the period needed for investigation and safety improvement; the user link is removed upon account deletion |
| Customer support correspondence | Responding to requests and fulfilling data subject rights | Performance of a contract, legal obligation, or legitimate interests | Up to 3 years after closing the matter, or until the conclusion of a dispute |
3. AI processing and special-category data
Melyvo uses a large language model. Your message, necessary conversation history, and relevant memories associated with the active virtual friend may be sent to an external AI provider. AI generates responses automatically, but these responses do not make legal or similarly significant decisions about you.
Do not submit information about racial or ethnic origin, political opinions, religion, health, sex life or sexual orientation, genetic or biometric data, criminal history, or another person’s confidential information. The service is not designed to process such data.
4. Processors and recipients
| Provider | Purpose and data transferred | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting the API and technical logs | [data center country/region] |
| Neon, Inc. (AWS infrastructure) | Hosting the production database | [data center country/region] |
| Mailgun / Sinch | Account verification and password-reset emails; email address and delivery data | European infrastructure through the EU endpoint; some supporting providers may be located in third countries |
| RevenueCat, Inc. | Store purchase and entitlement status; randomized in-app user identifier | United States and other locations listed by its subprocessors |
| Apple / Google | Application distribution, payment, and subscription management under their own privacy terms | Depends on the user’s store region and provider infrastructure |
| Scaleway SAS | Generating AI responses with the Qwen 3.6 model; message and necessary conversation context | Paris, France |
| OpenAI | Automated safety moderation when enabled in production | United States or the contractually selected region |
| Cloudflare | Turnstile security checks for suspicious registrations | International infrastructure |
5. International transfers
Content submitted for AI responses is processed on Scaleway infrastructure in Paris. Some other processors may process data outside the European Economic Area. Where this occurs, we rely on an adequacy decision, European Commission standard contractual clauses, or another safeguard permitted by Chapter V of the GDPR.
6. Data security
We use HTTPS, short-lived access tokens, revocable refresh tokens, secure password hashing, email verification, request limits, and restricted administrative access. No internet service can guarantee complete freedom from risk.
7. Your rights
You may request access, rectification, erasure, restriction of processing, and, where applicable, data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting processing performed before withdrawal. Send requests to support@melyvo.hu; we may verify your identity. We generally respond within one month.
You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11., naih.hu), your local supervisory authority, or seek a judicial remedy.
8. Deletion and backups
You can delete your account in the application or on the web deletion page. Your account and associated data are deleted immediately from Melyvo’s primary database; detached backups are cleared when their backup cycle expires. The exact production backup retention period will be added to this notice before launch. Deleting your account does not automatically cancel an Apple or Google subscription.
9. Cookies and the website
The current static website does not use marketing or analytics cookies. The account deletion form connects to the Melyvo API only at the user’s request. If we later introduce non-essential cookies or analytics, we will provide prior choices and updated information.
10. Changes
We will notify users of material changes in the application or by email. The current effective date and version always appear at the top of this document.