Privacy Policy

Who runs Mingleround

Mingleround is operated by Merkenberg, the sole proprietorship (eenmanszaak) of C.J. Bodbijl, based in the Netherlands. For anything about this policy or your data, contact info@mingleround.app.

• Merkenberg, the sole proprietorship (eenmanszaak) of C.J. Bodbijl, the Netherlands
• Address: Reestraat 5-1, 1016 DM Amsterdam
• E-mail: info@mingleround.app
• Chamber of Commerce (KVK): 82826218
• VAT number: NL003735674B80

Who is responsible for what

Two different parties decide what happens with your data, depending on the feature.

• The organizer of an event is responsible for the data of the people they register or invite for that event: name, contact details, meeting preferences, profile details, pairings and your private answers. Mingleround processes that data for the organizer under a data processing agreement (see our Terms). For questions about what an organizer does with it, ask the organizer.
• Mingleround (Merkenberg) is responsible for what it decides itself: organizer accounts and billing, participant accounts, chat between matched participants, keepsake recordings, notes in conversation games, the reminder and notification emails we schedule and send, feedback, the waitlist, visit statistics and the technical records that protect the service from abuse. The organizer cannot see your chat messages, recordings or game notes.

What we collect

If you organize events through Mingleround, we collect:

• Your email address and password (handled by our authentication provider, Supabase).
• Your organization's name and the events, rounds, and participants you set up.
• Billing details for paid plans: the reference to your Stripe customer and subscription, your plan and the payment records.

If you register as a participant in someone else's event (no account needed, just a link), we collect:

• Your name, email address, and optionally a phone number.
• Your meeting preferences, who you are and who you're open to meeting, which the event's organizer uses to generate matches.
• Optionally, profile details: age, a bio and interests; in a dating event also pronouns and a sexual orientation; in a business event a LinkedIn address and a work email.
• Which rounds you were placed in, who you were paired or grouped with, whether you checked in, and your private answers about whether you'd want to meet someone again.
• Optionally, a profile photo. It's stored privately and shown only to the event's organizer, except during a live one-to-one round, when your current round partner sees it too, the same way they already see your name.
• If the organizer switches on conversation games: which questions you drew, the short notes you choose to write down with the person or table you played with, and your own tick that says whether such a note may be reused. Notes are visible to the people you played with and never to the organizer, who only sees counts. After the organizer releases results, a note can appear as a conversation starter in your chat with someone you mutually matched with, but only if both of you ticked that you are OK with it. You can untick at any time from your registration page, and the starter disappears.
• At an online event, your video calls take place in rooms we create per pairing with Whereby (see below). We store the room link, not the call. A call is recorded only if both people in it say yes before it starts; if either says no, nothing is recorded and the other person is not told if you decline. A recording is a keepsake for the two people in the call: each can watch and delete their copy from their registration page, the organizer never has access to it, and it is deleted automatically after 30 days. The call ends when the round ends.
• If you have a participant account: your login, name, optional phone and profile, and the list of events you registered for with any organizer. After a mutual match, a chat with that person.
• Feedback you send us: if you use the Feedback page, we keep what you wrote, the kind of feedback, the date, and our reply, and the founder is notified by email. The founder reads it together with your name and email. The text of your message, without your name or email address, is also copied to the product team's task list so it can be followed up. Your message is deleted from our feedback inbox when you delete your account, or the registration you sent it from, and its copy in the task list is removed at our next update of that list.

If you join our waitlist we keep the email address you typed and the kind of event you are interested in.

Who sees what

• The organizer sees your registration: name, contact details, preferences, profile details (including a sexual orientation, if you gave one, also in the participant lists they download) and who you are paired with. Your individual yes or no answers stay private until the organizer releases the results of the event; after that the organizer can see them. The organizer never sees chat messages, recordings or game notes.
• Your round partner sees your name, and your photo during a live one-to-one round.
• A person you matched with, once results are released and you both said yes: the fact that you matched, your name, a chat between the two of you and, at a business event, the LinkedIn address and work email you added. Nobody ever sees a one-sided answer.
• Other participants see nothing about you, except that at an event with a mingling round your name appears in the list from which people pick whom they met.

Sensitive data

Some data about you is a special category of personal data under GDPR Article 9. We handle it in two ways, and only dating events can involve it. Business events do not ask for a sexual orientation or pronouns.

• Your meeting preferences at a dating event (who you are and who you are open to meeting) can reveal your sexual orientation. The registration form asks for your explicit consent to this in the tick box that lets us and the organizer run the event, and says so in plain words. You can withdraw it at any time by deleting your registration from your registration link.
• The optional sexual orientation field has its own tick box, which appears only when you choose a value, is never ticked for you and is never required to register. If you tick it we store your orientation and the organizer can see it, also in the participant lists they download. It is not used for matching and not shown to other participants. You can withdraw this consent at any time on your registration page; withdrawing removes the value.

We keep a record of what you agreed to: when, and the version of the text you saw. If an organizer adds you or imports you, the organizer confirms that you agreed, and you can withdraw on your registration page just the same. We never copy a sexual orientation from one organizer to another or into your participant account.

Why we process this data, and on what basis

• Organizer accounts and billing: to provide the service you signed up for (contract), and to keep payment records the tax law requires (legal obligation).
• Registering and taking part in an event: your consent, given with the tick box on the registration form (GDPR Article 6(1)(a)), and, where the data reveals a sexual orientation, your explicit consent (Article 9(2)(a)). You can withdraw it at any time, which does not affect what happened before. The organizer, as the party responsible for running the event, also relies on its own basis for the registration.
• Participant accounts, chat and games: to provide what you asked for (contract). Keepsake recordings: the consent of both people in the call.
• Reminders and notifications: our legitimate interest in making the event work for you and the organizer (Article 6(1)(f)); you can stop them with the link in each email. Emails you need, like your registration link, are part of the service (contract).
• Feedback: our legitimate interest in improving the service. Waitlist:your consent.
• Visit statistics and abuse prevention: our legitimate interest in knowing how the site is used and keeping it secure. This includes a counter per scrambled internet address to limit automated sign-ups; it holds no name or email address.

How matching works

Mingleround pairs people with fixed rules, not with a score or a profile of you. It puts two people together only when each fits what the other said they are open to (using the categories the organizer set up for that event), and it avoids repeating earlier pairs where it can. The organizer can change any pairing by hand. No decision that has legal or similarly significant effect on you is taken automatically.

Emails we send you

We send two kinds of email.

• Emails you need: your registration link (and a new one if you ask for it), account emails such as sign-up and password reset, and notices that an account, organization or membership was deleted or removed. These come with the service, so there is no unsubscribe link in them.
• Reminders and notifications: once you have registered for an event, a reminder before it starts, a reminder to vote afterwards, a notice when results are released, and, at business events that use meeting confirmations, a request to confirm that a meeting took place.

Every reminder and notification has a "Stop these emails" link at the bottom, and a one-click Unsubscribe button in mail programs that show one. Using it stops these reminders and notifications from that organizer's events straight away, without signing in. Your registration links and emails about your own account still reach you, and the organizer still sees your registration. Unsubscribing applies to one organizer at a time: if you registered with several, use the link in an email from each, or write to info@mingleround.app and we will do it for you.

To keep your choice when you later delete your registration, we keep a scrambled code made from your email address and that organizer (a keyed hash, not the address itself and not readable back into it), and only use it to skip your address when reminders are sent. It is removed when the organizer is deleted.

Cookies

We use only cookies the service needs, so there is no cookie banner. When you sign in, our authentication provider sets session cookies that keep you signed in. If you pick a language we remember it in a cookie for a year. Opening a registration link sets no cookie. Vercel Web Analytics counts visits without cookies. On the home page the product video only loads, from YouTube's privacy-enhanced domain, after you press play. A video call at an online event runs in a window from Whereby, which may set functional cookies for the duration of the call.

Who we share it with, and where it goes

Beyond what the organizer sees, we share data only with the providers that run Mingleround, each bound by a data processing agreement. We never sell your data, and we never use it for advertising.

• Supabase: Database, file storage and sign-in. Where: Paris, France (AWS eu-west-3). How a transfer outside the EU is covered: Data is stored in the EU. Supabase's DPA incorporates the EU standard contractual clauses for any transfer outside the EU.
• Vercel: Hosting of the application; cookieless visit statistics (Vercel Web Analytics). Where: Functions run in Paris, France (cdg1). Vercel's primary processing facilities are in the United States.. How a transfer outside the EU is covered: EU standard contractual clauses (Commission Decision 2021/914, module two) in Vercel's DPA.
• Resend: Sending e-mail. Where: United States. How a transfer outside the EU is covered: EU-U.S. Data Privacy Framework (Resend is certified under it, per its DPA).
• Stripe: Payments from organizers (plans and add-ons). Where: Stripe, LLC in the United States, as named in Stripe's DPA. How a transfer outside the EU is covered: Stripe's data transfer addendum (EU-U.S. Data Privacy Framework and EU standard contractual clauses).
• Whereby: Video rooms for online events and optional keepsake recordings. Where: Whereby is a Norwegian company; data is stored in Ireland or another EU/EEA location (its sub-processor is Amazon Web Services EMEA SARL). How a transfer outside the EU is covered: Storage in the EU/EEA; where a transfer is not covered otherwise, Whereby's DPA uses standard contractual clauses.

Stripe processes payment data for us and may also use some of it for its own purposes, such as fraud prevention and legal compliance. Card details are entered on Stripe's own pages and are never stored by us. Participants do not pay through Stripe. Vercel Web Analytics counts visits to our pages without cookies and without following you across other websites.

How long we keep it

• Participant data for an event (registration, preferences, pairings, answers, chat, game notes, photo, profile): for as long as the organizer's organization exists, or until you or the organizer delete it, whichever is sooner. This also applies to events that were cancelled. We have no automatic deletion date.
• Keepsake video recordings: deleted automatically after 30 days, or sooner when either person deletes theirs or their registration.
• Payment records: 7 years, as tax law requires. Stripe also keeps the customer record and invoices under its own rules.
• Organizer account: until you delete it. Participant account: until you delete it.
• Feedback: until you delete your account or the registration you sent it from. Waitlist: until you ask us to remove you.
• Technical abuse-prevention counters (a scrambled internet address and a count, no name or email): kept for now without a fixed end date.
• Emails we sent are kept by our email provider, Resend, under its own rules.

Your rights

Wherever you are, you have the same rights:

• Delete your own event registration: open your registration link (sent to you when you signed up) and use the "Delete my registration" option. This removes your preferences, pairings, match answers, anything you recorded in a game for that event, feedback you sent from it, and your keepsake recordings (we delete them at our video provider and keep retrying if that fails). If it is your last registration with that organizer, your contact record with them goes too: your name, email, phone, profile and photo, whether or not you have an Mingleround account. If the organizer has you registered for other events, that record stays for those events and is deleted together with your last registration. Your own Mingleround account, if you have one, is separate and stays until you delete it.
• Withdraw consent for your sexual orientation: on your registration page, which removes the value and records the withdrawal.
• Delete your account: sign in and use "Delete my account" on your profile page. This permanently deletes your account and, across every organizer you registered with, your profile, photo, preferences, matches, answers, messages and keepsake recordings. Organizers who use Mingleround can delete their own account from their organization's Settings page. Deleting an organization deletes all of its events and participant data. Payment records (invoices and payment events) are kept for the legally required tax retention period of 7 years, and Stripe keeps the customer record. Copies in our providers' backups expire under the providers' own schedules.
• Download a copy of your data: on your registration page, or on your profile page if you have an account, use "Download my data". You get a JSON file (a common format other services can read) with your profile, your registrations, who you met, your own answers, the messages you sent, and your game and feedback entries, and the record of what you agreed to. It does not contain other people's answers, messages or contact details, or the recording files themselves, which you can watch or delete from your registration page.
• Correct or fully erase your data, or get anything the download does not cover (including your underlying contact record, which may span multiple events with the same organizer): email info@mingleround.app or the event's organizer directly. We answer within one month.
• Object to or restrict how we use your data.
• Complain to a supervisory authority: in the Netherlands, the Autoriteit Persoonsgegevens; in the UK, the ICO; or your own country's equivalent.

Age

Mingleround is for adults. Registering for an event requires confirming you are 18 or older. We don't verify this beyond that confirmation.

If something goes wrong

If we become aware of a data breach affecting your personal data, we'll notify the Dutch Autoriteit Persoonsgegevens within 72 hours where required, tell the organizer concerned without undue delay, and tell you directly if the breach is likely to put you at high risk.

Changes to this policy

We'll update the date at the top of this page if anything material changes, and for any change that affects how we handle data you've already given us, we'll make a reasonable effort to let you know directly.