Privacy Policy

Who is responsible for your data

[LEGAL ENTITY NAME], [REGISTERED ADDRESS] is responsible for your personal data on Dyaspo (the controller). Contact: [CONTACT EMAIL].

What we collect

We collect only what we need to run Dyaspo.

• Account: your name, email address and profile photo, received from LinkedIn or Google when you sign in, and the technical sign-in tokens that the provider returns.
• Profile: the headline, short bio, country and city, languages, skills, weekly availability, LinkedIn address and preferred contact method that you enter.
• Projects and applications: projects you post and their roles, your applications and the notes you write, teams you join and the short line saying what you are working on.
• Safety: reports you send and people you block.
• Technical data: your IP address and browser details when you use the site, used to keep the service secure, apply rate limits and fix errors. We also keep error logs.
• Messages we send you: sign-in codes and notification emails, for example when someone applies or accepts you.

Where your data comes from

Most of it comes from you. Your name, email address and photo come from LinkedIn or Google when you choose to sign in with them. We do not read anything else from your LinkedIn or Google account.

Why we use your data

We use your data on these legal bases under the GDPR:

• To provide Dyaspo (performance of our contract with you): create your account, show your profile and projects, handle applications, release contact details after an acceptance and send the messages you need.
• To keep Dyaspo safe (our legitimate interest): check that accounts belong to real people, prevent spam and fraud, enforce our rules, handle reports and secure our systems.
• To maintain and improve the service (our legitimate interest): find and fix errors and understand how the service performs.
• To follow the law (legal obligation): for example to answer valid requests from authorities.
• With your consent where the law requires it. You can withdraw it at any time.

Who can see what

• Everyone, including search engines: a project's title, pitch, stage, website, where the team is based, the titles and places of its open roles, the creator's name and city, and how many people are on the team.
• People with an account: the full project description, role details and skills, the team and what each member is working on, member profiles, and project creators' LinkedIn addresses.
• A project owner, before they decide: your profile and the note you write when you apply.
• A project owner, after they accept you: the contact method you chose, either your email address or your LinkedIn address.
• Nobody else sees your email address.

Who we share it with

We use these service providers, who process data on our behalf:

• Railway: hosting and our database.
• Resend: sending notification emails. It receives your email address and the message.
• LinkedIn and Google: signing you in, under their own privacy policies.
• Photon (by Komoot, using OpenStreetMap data): place suggestions. Our server sends the text you type in a place field, not your account details.

What we do not do

We do not sell your data, we do not show advertising, and we do not use your data to make automated decisions that have legal effects on you. We may share data when the law requires it or to protect people from harm.

Your LinkedIn PDF

If you use the LinkedIn import, we read the file you upload on our server to fill in your profile form. We do not store the file or its contents. Only what you review and save in the form is kept.

How long we keep data

We keep your account and profile while your account is open. If you ask us to delete your account, we delete or anonymise your personal data within [30] days, except what we must keep for legal reasons or to handle a report. Server logs are kept for [14] days. Backups are removed on their normal schedule.

Contact details that another member has already received after an acceptance are outside our control once shared.

Where your data is stored

Our servers run in the European Union. Some of our providers are based outside the European Economic Area or may process data there. When that happens we rely on safeguards such as the European Commission's standard contractual clauses.

How we protect your data

We use encrypted connections, restrict access to our systems, limit sign-in and code attempts, and release contact details only through one controlled step. No system is perfectly secure, so please keep your account safe too.

Your rights

If the GDPR applies to you, you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent. You can change most of your information yourself in your profile. For anything else, write to [CONTACT EMAIL]. We answer within one month.

You can also complain to your data protection authority. In France this is the CNIL (cnil.fr).

Children

Dyaspo is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think a child has an account, tell us and we will delete it.

Changes to this policy

When we change this policy in an important way, we will tell you before it applies. The date at the top shows the latest version.

Contact

Questions or requests about your data: [CONTACT EMAIL].