Version: 1.2
Last updated: 31 August 2026
This Privacy Policy explains how Olympos Labs OÜ (“we”, “us”, or “our”) collects, uses, discloses and protects your information when you use the Heyspace mobile application and any related websites, services, or tools (collectively, the “Service”).
By using the Service, you acknowledge that you have read this Privacy Policy.
1. Who We Are
Controller / Operator
Olympos Labs OÜ
Trade Registry Number: 16626115
VAT Number: EE102581980
Registered address:
Harju maakond, Kesklinna linnaosa,
Viru väljak 2, 3. korrus
10111 Tallinn, Estonia
Contact email: [email protected]
For users in the European Economic Area (EEA), the United Kingdom, and similar jurisdictions, Olympos Labs OÜ is the “data controller” for the processing of personal data described in this Privacy Policy.
If you have questions about this Privacy Policy or our data practices, you can contact us at [email protected].
2. Scope of This Policy
This Privacy Policy applies to:
- The Heyspace mobile applications
- Any websites, web apps, or other online services that link to this Privacy Policy
- Customer support and communication channels related to Heyspace
It does not apply to third-party services that are not owned or controlled by us (for example, app stores, external websites, social networks, or payment processors’ own pages). Those services are governed by their own privacy policies.
3. Eligibility & Children’s Privacy
Heyspace is intended only for users aged 18 and over.
We do not knowingly collect personal data from anyone under 18. If we learn that personal data has been collected from a minor, we will take reasonable steps to delete it and may suspend or close the account.
If you believe we may have collected data from a minor, please contact us at [email protected].
4. Information We Collect
We collect information in three main ways:
- Information you provide directly
- Information collected automatically when you use the Service
- Information from third parties
4.1 Information You Provide
When you use Heyspace, you may provide us with:
Account & Profile Information
- Name, username or handle
- Email address and/or phone number
- Date of birth, age, gender, pronouns
- City, country, and general location
- Profile photos and other media you upload
- About/bio text, interests, hobbies, music/movies/games/activities you like
- Professional/educational details you choose to include (e.g. job, industry, university)
This information is used to create your profile, help you discover others, and help others discover you.
Social / Community Content
- Posts and content you share on walls, clubs, or community spaces
- Comments, likes, reactions, and other engagement with content
- Club memberships, event participation, invitations, and RSVPs
- Any other content you choose to upload, including text, images, audio, video, and links
Please remember that content you share in public areas may be visible to other users.
Communication Data
- Messages, chats, and other communications you exchange with other users within Heyspace
- Messages you send to us (support requests, feedback, bug reports, etc.)
Private messages and chats between users are not subject to automated scanning or moderation. We access and review a private message only after a user reports that message, and only to investigate the report, enforce our Terms, protect users, or comply with applicable law.
Verification & Safety Data (if applicable)
- Information and media you provide if we introduce identity or age verification (e.g. selfie, ID document)
- Reports you file about other users and reports other users file about you
- Information relating to safety investigations, moderation actions, and enforcement of our rules
Permanent Ban Enforcement Data
If an account is permanently banned for serious or repeated violations, Heyspace may retain a restricted safety record containing the account’s internal user ID, current and historical usernames, email address, phone number, authentication provider, provider account identifier, Firebase UID, moderation history, report history, enforcement dates, and subsequent attempts to register or authenticate using the same identifiers. We use this information to enforce permanent bans, prevent repeat abuse and ban evasion, protect users, investigate safety incidents, establish or defend legal claims, and respond to lawful requests. These records may remain after the user deletes the associated account.
Payment & Purchase Information
If you purchase subscriptions or paid features:
- For purchases made in the iOS app, payments are processed exclusively through Apple In-App Purchase.
- For purchases made in the Android app, payments are processed through Google Play Billing.
- We do not store your full payment card details.
- We may receive limited information about the transaction, such as:
- Transaction ID and status
- Purchase history (type of subscription or feature bought)
- Billing country or general billing info from the payment provider
4.2 Information Collected Automatically
When you use Heyspace, we may automatically collect:
Device and Usage Information
- App installation identifier, push notification token, App Check integrity information, IP address, device model, operating system, and app version
- Preferred language, time zone, and app settings
- Logs of actions in the app (e.g. screens viewed, taps, clicks, matches created, session duration)
- Diagnostic information such as crash logs and performance data
We use this to operate, secure, and improve Heyspace.
Location Data
- Approximate location, such as city and country, inferred from your IP address
- Precise location (e.g. via GPS, Wi-Fi, or cell towers) if you grant us permission on your device
We may use location data to:
- Suggest nearby users, clubs, or events
- Show relevant local content or language
- Improve recommendations and safety features
You can control precise location access in your device settings at any time.
Cookies and Similar Technologies
On our websites or web-based features, we may use:
- Cookies
- SDKs
- Local storage or similar technologies
These help us:
- Remember your preferences and login
- Analyze traffic and usage
- Customize and improve the Service
If applicable, more details may be provided in a separate Cookie Policy.
4.3 Information from Third Parties
We may receive information from:
Social Login Providers
If you sign up or log in via third-party providers (e.g. Google or Apple):
- We may receive basic profile information, such as your name, email, and profile photo, and any other information you authorize the provider to share with us.
Analytics, Security, and Marketing Partners
- Analytics and measurement tools (e.g. anonymized usage statistics)
- Security and fraud prevention providers
- Advertising and attribution partners (if we use ads or attribution tools)
The information we obtain from these third parties is governed by their privacy policies and your settings with them.
5. How We Use Your Information
We use your information for the following purposes (and, where applicable, on the legal bases of contract, legitimate interest, consent, and legal obligation):
5.1 Provide and Operate the Service
- Create and manage your account
- Display your profile, interests, and preferences
- Enable friend discovery, matching, and recommendation features
- Enable you to join clubs, respond to invites, and participate in events
- Provide messaging, notifications, and social features
5.2 Personalize Your Experience
- Suggest people you may want to connect with
- Suggest clubs, groups, and events that might fit your interests
- Tailor content, feeds, and in-app experiences based on your profile and activity
5.3 Maintain Safety, Security, and Integrity
- Detect, prevent, and address fraud, spam, abuse, harassment, and other harmful or unauthorized activity
- Enforce our Terms of Use and community guidelines
- Investigate and respond to safety reports and complaints
- Use automated moderation for profile photos through Sightengine and server-side rules for publicly visible bio content, together with human review where necessary and lawful. Private messages are not automatically scanned or moderated and are reviewed only when reported by a user.
We compare verified registration and authentication identifiers against identifiers associated with permanently banned accounts. An exact match may automatically prevent registration or access to the Service. We do not use private-message content for this comparison. If you believe a restriction was applied incorrectly, you may contact us to request human review.
5.4 Communicate with You
- Send you essential service-related messages (e.g. account verification, security alerts, legal updates)
- Respond to your support requests and inquiries
- Provide optional product updates, offers, and marketing communications (where permitted by law and subject to your consent where required). You can unsubscribe at any time.
5.5 Improve and Develop the Service
- Analyze usage and performance
- Fix bugs and improve reliability
- Develop new features, social tools, and recommendation systems
- Conduct A/B testing and user research (often in anonymized or aggregated form)
5.6 Comply with Legal Obligations
- Respond to lawful requests from authorities
- Fulfill accounting, tax, and regulatory obligations
- Enforce or defend legal claims
6. Legal Bases for Processing (EEA/UK Users)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under one or more of the following legal bases:
- Contract: To provide the Service and perform our contract with you (e.g. managing your account, enabling social features).
- Legitimate Interests: To maintain and improve Heyspace, keep it secure, prevent abuse, and personalize content in ways that do not override your rights and freedoms.
- Consent: For certain processing, such as:
- Sending marketing communications by email or push notifications (where required by law)
- Using precise location data
- Using certain types of cookies or tracking technologies
You can withdraw consent at any time, but this will not affect processing already carried out.
- Legal Obligation: To comply with laws and regulations, such as tax and accounting rules and lawful requests from public authorities.
7. How We Share Your Information
We do not sell your personal data.
We may share information as follows:
7.1 With Other Users
Depending on your settings and how you use Heyspace:
- Your profile information (such as name, username, age, city, profile photos, interests, and clubs) may be visible to other users.
- Public posts, comments, and content you share in clubs, events, or public areas may be visible to other users or participants.
- When you send messages or invites, the recipient will see the information you include and your profile preview.
You should assume that information you share in public or semi-public areas may be seen, used, or shared by others.
7.2 Service Providers and Partners
We use third-party service providers who act on our behalf to:
- Host and operate infrastructure and databases
- Provide analytics and measurement tools
- Deliver push notifications, emails, and in-app messages
- Provide customer support tools
- Process payments and subscriptions
- Provide security and fraud-detection tools
Profile photos may be sent to Sightengine, our image-moderation provider, solely to detect prohibited visual content. Private and group message text is not sent to Sightengine. Public biographies are checked using Heyspace’s own server-side rules.
These providers only process your data under our instructions and are bound by confidentiality and data protection obligations.
7.3 Business Transfers
If Olympos Labs OÜ is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, your data may be transferred as part of that transaction. Where required by law, we will inform you of any material change in ownership or use of your personal data.
7.4 Legal Requirements and Protection
We may disclose information if we reasonably believe it is necessary to:
- Comply with applicable laws, regulations, legal processes, or government requests
- Enforce our Terms of Use and other agreements
- Protect the rights, property, or safety of Olympos Labs OÜ, our users, or the public
- Detect, prevent, or address fraud, security, or technical issues
8. International Data Transfers
We are based in Estonia and may process your information in Estonia and other countries. These countries may have data protection laws that differ from those in your country.
Where required by law (for example, for transfers from the EEA or UK), we implement appropriate safeguards, such as:
- Standard Contractual Clauses approved by the European Commission or relevant authorities; or
- Other mechanisms and safeguards recognized by data protection law.
You can contact us at [email protected] for more information about these safeguards.
9. Data Retention
We keep personal data only for as long as it is reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, protecting users, preventing fraud and abuse, complying with legal obligations, and establishing or defending legal claims.
Report-related message evidence is normally deleted or anonymized 180 days after the report is closed, unless an open investigation, legal hold, legal obligation, or serious repeat-abuse risk requires longer retention.
Safety records that are not associated with a permanent ban are normally retained for 730 days after the latest relevant safety activity, unless an open case or legal hold requires longer retention.
Identifiers associated with a permanently banned account may be retained for as long as the permanent ban remains in force and the information remains reasonably necessary to prevent repeat abuse or ban evasion. These identifiers may therefore remain after account deletion. They are removed or anonymized when the ban is revoked or the information is no longer necessary, unless continued retention is required for legal claims, legal obligations, or a documented legal hold.
Account deletion requests are subject to a 30-day reactivation period. During this period, the account is marked for deletion and may be restored if the user signs in again. After the period expires, ordinary account data is deleted or anonymized according to this Policy, subject to the safety, legal, transaction, report-evidence, and backup exceptions described above.
Content previously shared with other users may remain visible to those users where technically necessary for conversation or community continuity. When we no longer need personal data, we delete or anonymize it. If immediate deletion is not feasible, including because of secure backup systems or a documented legal hold, we isolate the data from ordinary use until deletion or anonymization is possible.
10. Your Rights & Choices
Depending on your location and applicable law, you may have some or all of the following rights:
- Right of Access: Request confirmation whether we process your data and obtain a copy of your personal data.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of your personal data, subject to legal exceptions.
- Right to Restriction: Request that we restrict certain processing of your data.
- Right to Data Portability: Request a copy of your personal data in a structured, commonly used, machine-readable format and/or request that we transmit it to another controller where technically feasible.
- Right to Object: Object to processing based on our legitimate interests, and to direct marketing at any time.
- Right to Withdraw Consent: Where we rely on consent, you can withdraw it at any time.
- Right to Lodge a Complaint: You may have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, place of work, or where an alleged infringement occurred.
A request to delete an account does not necessarily result in immediate deletion of information that we must or are permitted to retain for permanent-ban enforcement, user safety, fraud and abuse prevention, legal obligations, legal claims, or documented investigations. Where applicable, you may object to this processing or request that a decision be reviewed by a person.
To exercise your rights, please contact us at [email protected]
We may need to verify your identity before acting on your request.
For EU/EEA users, our lead supervisory authority may be the Estonian Data Protection Inspectorate, or you may contact your local data protection authority.
11. Your Controls in the App
Within Heyspace, you can typically:
- Edit your profile: Change or remove profile information, photos, and interests.
- Manage visibility (if options are provided): Adjust visibility settings for certain profile fields or features.
- Manage notifications: Control push notifications and email preferences.
- Control location: Enable or disable precise location via your device’s settings.
- Manage marketing communications: Unsubscribe from marketing emails by using the “unsubscribe” link or by contacting us.
- Delete your account: Request account deletion from within the app (if available) or by contacting us at [email protected].
12. Security
We use reasonable technical and organizational measures designed to protect your personal data from unauthorized access, loss, misuse, or alteration.
Permanent-ban identifiers and report evidence are accessible only to authorized personnel with an operational, safety, or legal need. Sensitive identity access requires a documented reason and is recorded in security audit logs. Ordinary moderator views mask identity details until an authorized administrator deliberately reveals them.
However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.
You are responsible for:
- Keeping your login credentials confidential
- Not sharing your password or verification codes with others
- Not reusing your Heyspace password on other services
If you believe your account or data has been compromised, please contact us immediately at [email protected].
13. Third-Party Links & Services
The Service may contain links to third-party websites, apps, or services (for example, external event pages, social media, or content platforms).
We are not responsible for the privacy practices or content of third parties. When you follow a link to a third-party service, its privacy policy will apply. We encourage you to review the privacy policies of those services.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this document. Where required by law, we will notify you of any material changes (for example, within the app, by email, or by other appropriate means).
We encourage you to review this Privacy Policy periodically. Changes become effective when posted or otherwise communicated, unless a later effective date is stated.
15. Contact Us
If you have any questions, concerns, or requests about this Privacy Policy or our data practices, you can contact us at:
Olympos Labs OÜ
Email: [email protected]
Address:
Harju maakond, Kesklinna linnaosa,
Viru väljak 2, 3. korrus
10111 Tallinn, Estonia