Privacy Policy

outercircl Privacy Policy Version 2.2 (Updated 16 October 2026)

This Privacy Policy for outercircl Limited ('outercircl', 'we', 'us', or 'our') explains what personal data we collect, why, who sees it, how long we keep it, and what your rights are when you use our services (the 'Services'), including when you:

• visit our website at https://outercircl.com or any website of ours that links to this Privacy Policy;
• use outercircl in your browser or as an app installed from your browser to your phone's home screen;
• use outercircl itself - a platform for finding and joining small-group, in-person activities hosted by members and by communities we call Circls, and for collecting stamps and rewards at participating venues (Circl Places). All activities and Circls are created by members, not by us, unless clearly labelled as hosted by outercircl;
• contact us, or receive emails or notifications from us.

This Privacy Policy is issued in accordance with Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ('GDPR'), the Irish Data Protection Act 2018, and the Irish ePrivacy Regulations 2011 (S.I. No. 336 of 2011). outercircl Limited is based in Ireland and the Data Protection Commission ('DPC') is our lead supervisory authority.

Who is responsible: outercircl Limited is the data controller for the personal data described in this Policy, except where Section 8 says otherwise. We have not appointed a formal Data Protection Officer, as we do not meet the thresholds in Article 37 GDPR; questions about your data go to [email protected], and we aim to reply within 5 business days. Added 8 October 2026. The same address, [email protected], is our single point of contact under the EU Digital Services Act (Regulation (EU) 2022/2065) for users and for authorities, in English or Irish.

If you do not agree with this Policy, please do not use the Services.

SUMMARY OF KEY POINTS What we collect: your name, email, password (held by Supabase, never seen by us) or Google sign-in; the profile you build (photo, interests, optional 'About you', optional age range and gender, a rough location); the activities and Circls you join, host, or follow; your friends and messages; your tickets, memberships, stamps and rewards (card details stay with Stripe); your notification settings; and basic technical data about your device.

Why: to run the Services for you (the contract between us), including putting you in a small group for each activity; to keep the Services safe and deal with reports; to send you the notifications you have chosen; to meet our legal duties; and, only with your consent, to measure how the Services are used (analytics cookies) and to send you optional emails.

Who sees it: other members see only what the Services say they see (Section 4); Hosts and Circl organisers see who is in their activity, and any note you leave when you ask to join or cancel; venues see a first name and stamp progress; and the companies that host and run the Services for us (Supabase, Amazon Web Services, Stripe, Google, PostHog, Postmark) process it on our instructions. We do not sell your data and we do not run advertising.

Where: in the EU (Ireland and Germany). Push notifications, email delivery, Google sign-in and maps involve US companies, under the safeguards in Section 9.

Your rights: download your data and delete your account from Settings at any time; access, correct, restrict, object, or complain to the DPC (Section 13).

TABLE OF CONTENTS 1. What Information Do We Collect? 2. How Do We Use Your Information, And On What Legal Basis? 3. Automated Grouping (Small-Group Matching) 4. Who Can See Your Information? 5. What Is Our Stance On Third-Party Websites? 6. Do We Use Cookies And Other Tracking Technologies? 7. How Do We Handle Google Sign-In? 8. Who Is Responsible For Your Data? (Controllers And Processors) 9. Do We Transfer Your Data Internationally? 10. How Long Do We Keep Your Information? 11. How Do We Keep Your Information Safe? 12. Do We Collect Information From Minors? 13. What Are Your Privacy Rights? 14. Controls For Do-Not-Track Features 15. Do We Make Updates To This Policy? 16. How Can You Contact Us About This Policy? 17. How Can You Review, Update, Or Delete Your Data?

1. WHAT INFORMATION DO WE COLLECT? In Short: Only what the Services need. Updated 5 October 2026.

Account. Your name, email address and a password (stored by Supabase in hashed form - we never see it), or, if you sign in with Google, the name, email and profile picture Google gives us (Section 7). When you sign up you confirm that you are 18 or over and accept our Terms; we record that confirmation and the time you gave it. You can also tick two optional boxes - email reminders and product updates - which we record separately so you can change them later.

Profile. Your profile photo (shown to other members), your interests (chosen from a list), an optional 'About you' text of up to 160 characters, an optional age range, and an optional gender (including 'Prefer not to say'). We do not collect your date of birth, phone number or postal address. You can edit or clear every optional field at any time in Settings.

Gender. Added 2 October 2026. Optional. We only use it so you can join activities designed for a specific group, like women-only ones, and in matching where a host has set such a tag (Section 3). It is never shown to anyone.

Location. Added 5 October 2026. We keep your location only as a rough area, rounded to about 1 km, whether you let your device share it or type an area in yourself. We never store your exact position, and we don't track where you are during an activity. The rough area is used to show you activities nearby and is not shown to other members. You can change or remove it in your profile, and you can refuse the location permission in your browser or device settings. Stamps at a Place (added 19 October 2026): if your device already lets outercircl use your location, scanning a Place's printed QR code checks once that you're at the Place, so stamps can't be collected from a photo of the code. That position is used only for the check and is never stored.

Activities and Circls. Which activities you join, host, are on the waitlist for, or cancel; which Circls you follow or are a member of; activities, Circls and Circl ideas you create (their titles, descriptions, photos, logos, banners, meeting points, times and prices); the 'vibe' you pick when you attend; and your answer, where a Circl Pro host has asked one optional question (for example, your pace).

Attendance. Added 29 September 2026. If you tap "I'm here" in an activity chat, or an organiser records who came, we keep that attendance with the activity so the host and Circl organisers can see who came. Other members can't see it, and we don't use your location for this.

Meet again. Added 5 October 2026. After an activity you can privately answer "Up for meeting this group again?" (thumbs up / thumbs down). Nobody ever sees your answer, and nobody is told who said what; it is used only on our servers to shape future groupings (Section 3; since 19 October 2026 only 'not really' answers are used, to keep people apart), is ignored after six months and deleted after a year.

Circl chat. Added 29 September 2026. Messages you post in a Circl's chat (text and up to one photo per message) are stored with that Circl and shown to its followers and members; you or the organisers can delete them, and they're deleted when the Circl is. Updated 7 October 2026. Members-only chats and content are shown only to the Circl's paying members and its organisers. If a Circl owner's Circl Pro ends, members-only content is hidden and then deleted 90 days after Circl Pro ended unless the owner upgrades again first.

Activity group chats and reports. Added 5 October 2026. Messages and photos you post in an activity's group chat are stored with that activity and shown to the people in your group and the host; you can delete your own messages. Chats are not end-to-end encrypted. We don't read chats or messages as a matter of course. If someone reports a message in any chat, outercircl staff see that message, its author's first name and the reason, so they can deal with the report; the person who reported it is never shown. A copy of the reported message is also emailed to our own inbox so a report about a host or organiser cannot be missed. Reports are kept while needed to handle the report and any follow-up, and are not part of the reported person's data download.

Profile, friends and direct messages. Added 5 October 2026. People you've been to an activity with see only your name and photo, and can send you a friend request. Your interests, "About you" (optional, and you can clear it at any time) and messaging are only for friends - people whose request you accepted, or who accepted yours. We keep a record of friend requests you send and receive and whether they were accepted; declining a request is never shown to the sender. You can unfriend anyone at any time. None of this works if either of you has blocked the other, and we keep a record of who you have blocked so that it stays in force. Messages are kept until the sender deletes them or either person deletes their account. A new message can show a preview in a notification on your phone. If someone reports a message, outercircl staff read that message (and only that message) to deal with the report. "Download your data" includes the messages you've sent.

Photos. Photos you upload (profile, activity, Circl, chat) are stored in our file storage (Amazon Web Services in Ireland, or Supabase Storage) and resized for display. Please only upload photos you have the right to use and that show only people who agree to appear in them.

Payments. We never see or store your card number. When you pay for a ticket, a Circl membership, Circl Pro, or Circl Places stamps, Stripe collects your payment details directly. We keep a record of what you bought, when, for how much, the status of the payment and any refund, and Stripe's reference for it, so that your ticket works and we can meet our tax and accounting duties. A host who takes payments connects their own Stripe account; the identity and bank details they provide go to Stripe, not to us. If you cancel Circl Pro we may ask why (optional) and keep your answer with your billing records to improve the service; it is included in your data download and deleted with your account.

Stamps and rewards (Circl Places). When you scan a venue's outercircl QR code we record the stamp (which venue, when, and whether it was linked to an activity) and any reward you earn or use, so your stamp card works.

Notifications. Your notification preferences (push, in-app, email), the in-app notifications we send you, and, if you turn on push notifications, a device-specific push token (Section 8.4).

Support and reports. What you send us when you email us or report something, and our replies.

Moderation records. Added 8 October 2026. Reports you make, reports about your content, and any action we take under our Terms (Section 5.8), with the reason. We keep these for 12 months after the matter is closed, then delete them, unless they are needed for a legal claim.

Technical data. When you use the Services our servers automatically record your IP address, browser and device type, operating system, language, the pages or screens you open, the time, and error logs. We use this to keep the Services secure and working, to prevent abuse, and to fix bugs. When something goes wrong on our servers, a technical error report (what failed and where, never your messages, contact details or payment details) is sent to PostHog in the EU so we can fix it; it is not linked to your account (Added 8 October 2026). If you accept analytics cookies, PostHog also records which pages you open and which buttons you tap (Section 6), never what you type.

Information we do not collect. We do not buy data about you from data brokers, marketing partners or public databases. We do not collect contacts, calendar, SMS or social-media data from your device. The only information we receive about you from anyone else is what Google sends when you sign in with Google (Section 7), what Stripe tells us about the status of a payment, and what another member tells us in a report or a message.

Sensitive data. We do not ask for, and do not want, information about your health, ethnicity, religion, sexuality, or politics. If you choose to put such information in your 'About you' text, a chat, or a Circl description, you do so voluntarily and it will be visible to whoever that content is shared with; please think before you share. The optional gender field is the only field we treat with special care, as described above.

2. HOW DO WE USE YOUR INFORMATION, AND ON WHAT LEGAL BASIS? In Short: The GDPR requires us to have a legal basis for everything we do with your data. Here is each purpose and its basis. Updated 5 October 2026.

To run your account and the Services you ask for - creating and securing your account, showing you activities near you, letting you join, host, follow, pay, chat, message friends, collect stamps, download your data and delete your account. Basis: performance of our contract with you (Article 6(1)(b)).

To put you in a small group for each activity, as explained in Section 3. Basis: performance of our contract (Article 6(1)(b)) - grouping is how the Services work. The optional signals (age range, gender, 'About you') are yours to leave blank.

To send you service notifications - that your place is confirmed, your group is revealed, an activity has changed or been cancelled, you have a new message or friend request, a payment or refund went through, or a safety matter concerns you. Basis: performance of our contract (Article 6(1)(b)) for the content; your consent (Article 6(1)(a)) for the push channel, which you can turn off at any time.

To send you optional emails - activity reminders and product updates - only if you ticked those boxes. Basis: consent (Article 6(1)(a)); every email has an unsubscribe link and you can change the setting in Settings.

To keep the Services safe - handling reports, blocking, detecting fraud, spam and abuse, enforcing our Terms, and protecting members. Basis: our legitimate interests (Article 6(1)(f)) in a safe platform and the legitimate interests of our members, and, for notice-and-action on illegal content, our legal obligations under the EU Digital Services Act (Article 6(1)(c)).

To process payments and keep records - facilitating payments through Stripe, issuing receipts and invoices, handling refunds, and keeping the records tax and accounting law requires. Basis: performance of our contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).

Platform tax reporting (DAC7). Added 5 October 2026. If you sell tickets or memberships through outercircl, we may have to report your name, address, date of birth or company registration number, tax identification number (PPSN/TIN), VAT number if any, payout account identifier and the amounts you were paid to the Revenue Commissioners each January under the EU DAC7 rules (Directive 2021/514; s.891I Taxes Consolidation Act 1997), who may share it with other EU tax authorities. Basis: legal obligation (Article 6(1)(c)). Kept for as long as tax law requires. Stripe is a separate controller for the identity checks it runs on your Stripe account.

To understand and improve the Services - counting how features are used, fixing bugs, and planning improvements. Basis: our legitimate interests (Article 6(1)(f)), using server logs and aggregated statistics; analytics cookies only with your consent (Article 6(1)(a)), see Section 6.

To respond when you contact us. Basis: our legitimate interests (Article 6(1)(f)) in answering you, or performance of our contract where your query is about the Services.

To comply with the law and legal process - responding to lawful requests from authorities, courts or the DPC, and defending legal claims. Basis: legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)).

To protect someone's life or safety in an emergency. Basis: vital interests (Article 6(1)(d)).

What we do not do. We do not sell your personal data. We do not run advertising, and we do not use your data for targeted advertising or share it with ad networks. We do not make inferences about your health, ethnicity, religion, sexuality or politics. If we ever introduce sponsored content, we will update this Policy and ask for any consent the law requires first (Section 6).

Where we rely on legitimate interests, we have checked that your interests and rights do not override ours, and you can object at any time (Section 13).

3. AUTOMATED GROUPING (SMALL-GROUP MATCHING) Added 5 October 2026. In Short: Software on our servers sorts the people attending an activity into groups of roughly three to five, so nobody arrives alone. Here is how it works.

What it uses. The 'vibe' you pick on the attend screen; your interests; whether it is your first time at that kind of activity; the age range you chose, if any; your gender, only where the host has set a gender tag for that activity; your answer to the host's one optional question where the host is on Circl Pro (for example, your pace); and your private 'meet again' answers from the last six months. Updated 19 October 2026: if either of you answered 'not really' about a past group the other was in, we try to keep you apart; 'yes' answers are saved but not used for grouping. We also look at who you have been grouped with on other activities in the last 90 days, so that at most about half of your group are people you have been grouped with before; friends you bring along on the same activity don't count. These are preferences, not rules - where there is no other way to keep groups the right size, they can give way.

How it works. The software scores how well each pair of attendees fits on these signals and forms groups with the best overall fit, within the size the host set. For bigger activities, groups are formed and revealed about 24 hours before the start; for smaller ones they may be formed as people join. Nobody - not the host, not other members - is shown the signals or told why people were grouped together. A host can see who is in each group and can move people between groups by hand.

What it is not. Grouping is a convenience, not an assessment of you. It does not decide whether you can attend, what you pay, or anything else with a legal or similarly significant effect on you, so it is not a decision covered by Article 22 GDPR. It is, however, automated processing of your data, so we tell you about it here. If you have a question about a grouping, or want to be moved, email [email protected] or ask the host, and a person will look at it.

4. WHO CAN SEE YOUR INFORMATION? In Short: Other members see only what the Services say they see; our service providers process data on our instructions; Hosts and venues see what they need to run their activity or honour a stamp. Updated 5 October 2026.

Other members. Everyone can see the public listing of an activity or Circl (its title, description, photo, general area, time, price, the host's name and photo, and how many people are going). People in the same activity or Circl as you can see your name and photo, what you post in that chat, and whether you tapped 'I'm here'. Your friends can see that you are going to an activity, your interests and your 'About you'. Nobody can see your email, your rough location, your age range, your gender, your vibe, your matching answers, who you have blocked, or whose friend request you declined.

Hosts and Circl organisers. To run their activity or Circl they see the full list of people who joined or are on the waitlist, who came, and the group chat. The seller of a paid ticket or membership also receives your name, email and limited payment details (card brand and last four digits) from Stripe. Our Terms (Section 11.4) only allow them to use this to run the activity or Circl; for anything they do with it outside the Services they are the data controller and are responsible under the GDPR (Section 8.5). Updated 7 October 2026. Organisers see members' and followers' first names and photos in their Circl; outercircl does not give them a downloadable list of members or their contact details. Updated 16 October 2026. For an activity in a Circl, the Circl's owner and managers, as well as the host, see who is going, the message you send with a request to join, and any note you leave when you cancel.

Venues (Circl Places). When you scan a caf\u00E9's or venue's outercircl QR to collect a stamp, the venue can see only your first name, your stamp progress at that venue and any reward you use there (on its live QR screen, if it uses one). The venue owner sees totals only (for example, stamps this month and how many Circls they came from), never your contact details. We keep your stamps and rewards so your card works; they are included in your data download and deleted with your account. If your device already lets outercircl use your location, scanning a venue's printed QR code checks once that you're there; that position is never stored or shown to the venue (see Location in Section 1).

Our service providers (processors). These companies process personal data on our behalf, only on our instructions and under data processing agreements:

• Supabase, Inc. - sign-in and accounts, our database, and file storage, in its EU (Ireland) region (Sections 8.1 and 9)
• Amazon Web Services EMEA SARL - hosting of our servers and storage of uploaded photos, in the EU (Ireland, eu-west-1) region
• Stripe Technology Europe Limited and Stripe Payments Europe Limited - payments, payouts to hosts, subscriptions and invoices (Section 8.3)
• Google (Google Ireland Limited / Google LLC) - Google sign-in if you choose it (Section 7), Firebase Cloud Messaging for push notifications (Section 8.4), and Google Maps / Places for address suggestions and maps of a meeting point
• PostHog, Inc. - product analytics on PostHog EU Cloud (Frankfurt, Germany), only if you accept analytics cookies (Section 6), and technical error reports from our servers that are not linked to your account (Added 8 October 2026)
• Postmark (ActiveCampaign, LLC) - sends our emails (confirmations, receipts, safety notices and any optional emails you asked for), which means it processes your email address, name and the content of those emails (Section 9)

We may add or change providers; we will update this Policy when we do, and we always require equivalent protection.

Authorities and legal process. We disclose data where the law requires - for example, to the Garda S\u00EDoch\u00E1na, a court, the DPC, Coimisi\u00FAn na Me\u00E1n, or the Revenue Commissioners - and where necessary to protect someone's safety or to establish or defend a legal claim.

Revenue Commissioners (DAC7 platform tax reporting). Added 5 October 2026. If you sell tickets or memberships through outercircl, we may have to report your name, address, date of birth or company registration number, tax identification number (PPSN/TIN), VAT number if any, payout account identifier and the amounts you were paid to the Revenue Commissioners each January under the EU DAC7 rules (Directive 2021/514; s.891I Taxes Consolidation Act 1997), who may share it with other EU tax authorities. Legal basis: legal obligation (Article 6(1)(c) GDPR). Kept for as long as tax law requires. Stripe is a separate controller for the identity checks it runs on your Stripe account (Section 8.3).

Business transfers. If outercircl is sold, merges, or transfers its assets, your data may pass to the new owner, who must honour this Policy. We would tell you first.

We do not share your data with advertisers, data brokers, or social networks.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES? In Short: We are not responsible for websites or services we link to or that hosts link to.

The Services may contain links to third-party websites or services, including links a host puts in an activity or Circl description, and Stripe's checkout pages. We do not control those sites, and this Policy does not cover them. Please read their privacy notices. We are not responsible for the content, privacy, or security practices of any third party.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES? In Short: Only strictly necessary cookies, plus analytics cookies if you say yes. No advertising cookies.

Under the Irish ePrivacy Regulations we must obtain your prior, informed consent before placing non-essential cookies or similar technologies on your device. Strictly necessary cookies - those that keep you signed in (Supabase Auth), keep your session secure, and remember your cookie choice - do not need consent.

Currently Active Non-Essential Cookies - Product Analytics. At present, the only non-essential cookies we use are for product analytics through PostHog EU Cloud (hosted in Frankfurt, Germany), to understand how the Services are used so we can improve them. This is not advertising and does not involve cross-site tracking. The following privacy measures are in place:

• IP addresses are anonymised before storage and are never retained in identifiable form
• Analytics data is pseudonymised - linked to internal user identifiers, not directly to your name or email
• We don't record sessions, and analytics never collects what you type or the words on the screen (such as other members' names) - only which pages are opened and which buttons are tapped
• All analytics data is stored on EU servers subject to EU data protection law
• PostHog processes data under a Data Processing Agreement with outercircl

You can manage your analytics preferences at any time from Settings or the Cookie Policy page (no account needed), or through the cookie consent banner shown on your first visit.

Reserved for Future Use - Sponsorship and Advertising Cookies. We do not currently run advertising or sponsorship placements on the Services, and no advertising or retargeting cookie is active today. If we introduce sponsored content in the future, we will update our cookie consent banner and this Policy to name the specific provider(s) involved and obtain your prior, informed, affirmative consent first, exactly as we do today for analytics. Consent will never be assumed, bundled with acceptance of the Terms, or made a condition of using the Services, and you will be able to withdraw it as easily as you gave it.

Cookie Consent Requirements. In line with DPC guidance and the Irish ePrivacy Regulations:

• Pre-ticked boxes or assumed consent are not valid - consent must be a clear, affirmative action
• You must be able to withdraw consent as easily as you gave it
• Consent for cookies must not be bundled with acceptance of terms and conditions
• Non-essential cookies will not be placed on your device until you have given valid consent

Specific, current information about every cookie we use, why, and how to refuse it is set out in our Cookie Policy, available at outercircl.com/cookies.

7. HOW DO WE HANDLE GOOGLE SIGN-IN? In Short: Google is the only social sign-in we offer, and we receive only your name, email and picture.

If you choose to register or sign in with your Google account, we receive your name and email address from Google, and your Google profile picture if you have one. That picture is only shown to you; other members only ever see a photo you add yourself. Google is the only social login we offer. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements (developers.google.com/terms/api-services-user-data-policy).

We use what we receive only as described in this Policy. We do not control, and are not responsible for, how Google uses your data; please read Google's privacy policy. If you later want to stop using Google sign-in, contact us and we will help you switch to an email and password.

8. WHO IS RESPONSIBLE FOR YOUR DATA? (CONTROLLERS AND PROCESSORS) In Short: outercircl is the controller for the Services. Supabase, AWS, Google, PostHog and Postmark are our processors. Stripe, Hosts and venues are separate controllers for what they do with the data they receive. Updated 5 October 2026.

8.1 Authentication and User Account Data Sign-in is by email address and password, or with your Google account, using Supabase (and Google, if you choose it). Your password is stored by Supabase in encrypted (hashed) form; outercircl never sees it. Supabase also holds our database and, where we use it, our file storage, in its EU (Ireland) region.

Role: outercircl is the data controller. Supabase acts as our data processor. Google acts as an independent controller for your Google account itself, and as our processor for the sign-in handshake.

Our obligations here include disclosing the processors involved (this Policy), carrying out vendor due diligence so they maintain adequate technical and organisational security measures, and keeping valid Data Processing Agreements in place with them.

8.2 Profile, Activity, Social and Content Data Everything you add to the Services - your profile, interests, location area, activities, Circls, chats, messages, friends, stamps, reports and the matching signals in Section 3 - is governed by this Policy and our Terms.

Role: outercircl is the sole data controller and is fully responsible for the lawful collection, storage, use, retention and deletion of this data. If you have any query about it, outercircl is your point of contact.

8.3 Payment Information All payment information is processed by Stripe, a regulated payment service provider. This includes both (a) payment card and billing data you provide when paying for a subscription, a paid ticket, a Circl membership or Circl Places stamps, and (b) identity, business, and bank account information a Host or venue provides directly to Stripe when connecting their own Stripe account to receive payments. When you buy a ticket or Circl membership, your payment is made to the seller's own Stripe account (the Circl owner for a Circl event or membership, otherwise the Host), and the seller receives your name, email and limited payment details (such as card brand and last four digits) through Stripe.

Role: Stripe acts as an independent controller for the payment data it collects under its own privacy policy (stripe.com/ie/privacy) and regulatory duties, and as our processor for the limited payment status information it returns to us. The seller is an independent controller for the buyer details it receives. outercircl is the controller only for the order records described in Section 1 ('Payments').

outercircl does not store, process, or transmit cardholder data, banking information, Stripe Connect identity-verification documents, or any payment card details. All such data is collected, processed, and stored directly by Stripe in accordance with Stripe's privacy policy, PCI DSS, and applicable financial services regulation. Queries about Stripe's processing of your payment data should be directed to Stripe.

8.4 Push Notification Delivery Added 23 September 2026. If you opt in to push notifications (Settings > Push notifications) and grant your browser or device permission, we collect a device-specific push notification token so that notifications you have asked for - such as activity reminders, a new message, or updates on activities you are part of - can be delivered to that device, including when outercircl is not open in front of you.

Role: outercircl acts as the data controller for the fact that you opted in and for which notification types you have enabled. Google, via its Firebase Cloud Messaging service, acts as our data processor for the mechanics of delivery.

The push notification token itself, together with the title and body text of the notification being delivered (which can include a short preview of a message or the name of an activity), passes through Firebase Cloud Messaging in order to reach your device. outercircl does not use this token for any purpose other than delivering the notifications you have opted into, and does not use Firebase Cloud Messaging to send marketing or advertising messages.

You can withdraw this consent at any time, with immediate effect, by turning off "Push notifications" in Settings, or by revoking notification permission for outercircl in your browser or device settings directly. Either way stops future delivery and removes the stored push token for that device. This is separate from, and does not affect, in-app or email notifications, which are controlled independently in the same Settings screen.

8.5 Hosts, Circl Organisers and Venues Added 5 October 2026. Hosts, Circl organisers and venues are members or businesses using the Services, not part of outercircl. Within the Services they see only what Section 4 describes, and our Terms (Section 11.4) permit them to use it only to run their activity or Circl or to honour stamps and rewards. If a host or venue takes your information outside the Services - for example, adds you to their own mailing list, keeps their own attendance sheet, or collects a waiver - they are the data controller for that processing and are responsible to you under the GDPR. We will act on reports of misuse under our Terms, but we are not responsible for a host's or venue's own processing. Hosts and venues who are unsure of their duties can find guidance at dataprotection.ie.

8.6 Email Delivery Added 5 October 2026. Our emails - account confirmations, password resets, receipts, activity updates, safety notices, and any optional emails you asked for - are sent through Postmark, which processes your email address, name and the content of each email on our behalf as our processor. We do not use Postmark or any other provider to track you across the web.

9. DO WE TRANSFER YOUR DATA INTERNATIONALLY? In Short: Your data lives in the EU. A few of our providers are US companies, and we use the safeguards the GDPR requires. Updated 5 October 2026.

Our servers, database and file storage are in the European Union: Amazon Web Services and Supabase in Ireland, PostHog in Frankfurt, Germany. Stripe serves us from its Irish entities.

Some providers are headquartered in, or have support or infrastructure in, the United States, so some personal data may be transferred there: Google (Google sign-in, Firebase Cloud Messaging push tokens and notification text, and Google Maps requests made by your browser), Postmark / ActiveCampaign (email delivery), and the US parent companies of Supabase, Amazon Web Services and PostHog for limited support and operational access. Where such transfers occur, we rely on the safeguards in Chapter V of the GDPR:

• Adequacy decisions: where the European Commission has decided a country or framework provides adequate protection, including the EU-US Data Privacy Framework for US companies certified under it
• Standard Contractual Clauses (SCCs): the European Commission's clauses (Decision (EU) 2021/914), included in our data processing agreements with these providers, together with transfer impact assessments where required
• Processor-specific safeguards: each provider's own GDPR transfer mechanisms, which we verify as part of our vendor due diligence

You may request a copy of the transfer safeguards we rely on by contacting us at [email protected].

10. HOW LONG DO WE KEEP YOUR INFORMATION? In Short: For as long as you have an account, then we delete it, except for what the law makes us keep. Updated 5 October 2026.

While you have an account:

• Account, profile, interests, location area, friends, blocks and matching signals: kept until you change or clear them, or delete your account
• Activities, Circls, tickets, stamps and rewards: kept while the activity or Circl exists and as part of your history
• Chat messages and direct messages: kept until the sender deletes them, the Circl or activity is deleted, or either person deletes their account
• Hidden members-only content after a Circl owner's Circl Pro ends: deleted 90 days after Circl Pro ended, unless the owner upgrades again, deletes it sooner or makes it visible to followers
• Circl Pro cancellation feedback (why you left, if you told us): kept until you delete your account
• 'Meet again' answers: used for 6 months, deleted after 12 months
• In-app notifications: automatically deleted 30 days after they are sent
• Push tokens: deleted when you turn push off, or when a device stops accepting them
• Reports: kept while needed to handle the report and any follow-up, then closed
• Moderation records (reports you make, reports about your content, and any action taken, with the reason): kept for 12 months after the matter is closed, then deleted, unless needed for a legal claim (Added 8 October 2026)
• Seller agreements (if you sold tickets or memberships: when you agreed to the organiser terms, with your name, email, Stripe account and the device details recorded at the time): kept for 7 years after you delete your account, to defend legal claims and meet tax law, then deleted. Basis: our legitimate interests in establishing and defending legal claims (Article 6(1)(f); Article 17(3)(e)). Host agreements are deleted with your account (Added 8 October 2026)
• Insurance confirmations (if you confirmed you hold public liability insurance before selling or hosting a higher-risk activity: when you confirmed it, with your name, email and the device details recorded at the time): kept for 7 years after you delete your account if you hosted any activity, to defend legal claims about those activities, then deleted; deleted with your account if you never hosted one. Basis: our legitimate interests in establishing and defending legal claims (Article 6(1)(f); Article 17(3)(e)). (Added 9 October 2026)
• Server logs and authentication logs: kept for a limited period for security and fraud prevention, then deleted or anonymised
• Analytics data (with your consent): pseudonymised, kept by PostHog for up to 24 months
• Support emails and reports you send us: kept while the matter is open and for a reasonable period afterwards in case it comes back, then deleted

Account deletion. Added 5 October 2026. When you delete your account in Settings, we delete your profile, photos, interests, location, matching signals, friends and friend requests, blocks, the messages you sent, your Circl ideas, stamps and rewards, push tokens, notifications, consents any Circl Pro cancellation feedback you gave and your host agreements straight away, and remove your sign-in. Activities and Circls you host that haven't happened yet are cancelled and the people in them are told; subscriptions you pay or receive are cancelled through Stripe. A clean-up job runs daily to finish any part of a deletion that could not complete immediately. Copies in our providers' rolling backups are overwritten in the normal course and are not used for anything else. What we keep after deletion, and why: payment and invoice records, held in Stripe (for Circl Pro and Circl Places, in our Stripe account; for tickets and memberships, also in the organiser's own Stripe account, as they are the seller), for the period Irish tax and accounting law requires (typically 6 to 7 years) - the copy of a ticket's payment status inside outercircl goes with the activity; seller agreements, if you sold tickets or memberships (when you agreed to the organiser terms, with your name, email, Stripe account and the device details recorded at the time), for 7 years, to defend legal claims and meet tax law (Article 6(1)(f); Article 17(3)(e)), then deleted; insurance confirmations, if you hosted an activity, for 7 years on the same basis, then deleted; records needed to handle an open report, dispute or legal claim, until it is closed; and anonymised statistics that no longer identify you. Notices sent to other people during the deletion itself (for example, that a plan is off) stay with them, without your name. Our analytics provider is asked to delete your pseudonymous analytics data at the same time.

When we have no ongoing need to process your personal data, we delete or anonymise it. Where that is not immediately possible (for example, because it is in a backup), we isolate it from any further processing until deletion is possible.

11. HOW DO WE KEEP YOUR INFORMATION SAFE? In Short: We use appropriate technical and organisational measures, and we tell you and the DPC if something goes wrong.

Our measures include:

• Passwords are never stored by outercircl: sign-in is handled by Supabase, which keeps only an encrypted (hashed) form, or by Google if you sign in with Google
• Encrypted data transmission (TLS/HTTPS) across all platform communications, and the encryption at rest our hosting providers apply to our database and file storage
• Access controls limiting data access to authorised personnel only, and staff access to reported content only when handling a report
• Rough location only (about 1 km), exact meeting points shown only to confirmed attendees, and matching signals never exposed to other members
• Regular security assessments and vendor due diligence
• Data Processing Agreements with all third-party processors

However, no electronic transmission or storage can be guaranteed to be 100% secure. Please use a strong, unique password, keep your device secure, and do not share passwords, bank details or other sensitive information in any chat.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of it and notify affected users without undue delay, in accordance with Articles 33 and 34 GDPR. If you believe your account has been compromised, contact us immediately at [email protected].

12. DO WE COLLECT INFORMATION FROM MINORS? In Short: You must be 18 or over to use outercircl. We do not knowingly collect data from or market to anyone under 18.

You must be at least 18 years of age to use outercircl, and you confirm this when you sign up (the box is not pre-ticked and the Google sign-in button does not work until you tick it). Our Services are not directed at anyone under 18, and our Terms do not allow hosts to add minors to activities or chats. We do not knowingly collect, solicit data from, or market to anyone under 18.

If we learn that someone under 18 has an account, we will close it and delete their data. If you become aware of any data we may have collected from anyone under 18, please contact us at [email protected]. For completeness: the digital age of consent in Ireland under the Data Protection Act 2018 is 16, but outercircl applies a higher minimum of 18 for everyone, and we never process a known child's data for direct marketing or profiling.

13. WHAT ARE YOUR PRIVACY RIGHTS? In Short: You can access, download, correct, delete, restrict and object, withdraw consent, and complain to the DPC - all free of charge. Updated 5 October 2026.

Under the GDPR you have the right:

• Right of Access (Article 15): to know whether we hold personal data about you and to get a copy of it - the quickest way is 'Download your data' in Settings
• Right to Rectification (Article 16): to correct inaccurate or incomplete data - most fields can be edited in Settings
• Right to Erasure (Article 17): to have your data deleted - 'Delete account' in Settings does this immediately (Section 10)
• Right to Restriction of Processing (Article 18): to ask us to pause processing in certain circumstances
• Right to Data Portability (Article 20): to receive the data you gave us in a structured, machine-readable format - the download in Settings is in JSON
• Right to Object (Article 21): to object to processing based on our legitimate interests, and at any time to direct marketing
• Rights relating to automated decision-making (Article 22): we do not make solely automated decisions with legal or similarly significant effects about you (Section 3 explains the grouping we do and how to ask a person about it)

Withdrawing your consent. Where we rely on consent (optional emails, push notifications, analytics cookies), you can withdraw it at any time in Settings, in your device settings, on the Cookie Policy page, or by emailing us; this does not affect processing that happened before you withdrew.

Opting out of marketing emails. Turn off 'Product updates' (or 'Email', to stop update emails) under Notifications in Settings, or use the unsubscribe link in any such email. We will still send you the service emails your account needs (for example, a ticket confirmation, a safety notice, or word that a plan you're going to has been cancelled or its time or place has changed) - these are always emailed. (Updated 16 October 2026)

Obligation to provide data. Your name, email and acceptance of the Terms are needed to open an account. Everything else is optional, and we say so where you enter it.

How to exercise your rights. Use Settings, or email [email protected]. We may need to confirm it is really you. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extra time. Exercising your rights is free unless a request is manifestly unfounded or excessive.

Complaints. If you think we have handled your data unlawfully, you can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; phone +353 (0)1 765 0100; www.dataprotection.ie. If you live in another EU/EEA country you may complain to your own data protection authority instead; in the UK, the ICO (ico.org.uk); in Switzerland, the FDPIC (edoeb.admin.ch). We would appreciate the chance to resolve your concern first, so please consider contacting us before you do.

14. CONTROLS FOR DO-NOT-TRACK FEATURES Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') or Global Privacy Control signal. No uniform standard for honouring these signals has been finalised, so we do not currently respond to them. Because we only set analytics cookies with your explicit consent and run no advertising, refusing analytics in our cookie banner achieves the same result. If a standard we must follow is adopted, we will update this Policy.

15. DO WE MAKE UPDATES TO THIS POLICY? In Short: Yes, when the Services or the law change.

We may update this Privacy Policy from time to time. The updated version is indicated by the 'Last updated' date at the top of this page and by dated 'Added' or 'Updated' markers within the text, so you can see what changed. If we make material changes - for example, a new category of data, a new purpose, or a new recipient - we will tell you in the app or by email before they take effect, and ask for consent where the law requires it. The current version is always at outercircl.com/privacy-policy.

16. HOW CAN YOU CONTACT US ABOUT THIS POLICY? If you have questions or comments about this Policy, or want to exercise your rights, email [email protected] or write to:

outercircl Limited 136 Capel Street County Dublin, D01 T2C9 Ireland

We aim to respond to all privacy-related queries within 5 business days, and to rights requests within one month.

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA? You can review and change your profile, interests, location area, gender, age range, notification settings and consents at any time in Settings. 'Download your data' in Settings gives you a copy of your data. 'Delete account' in Settings deletes your account and data as described in Section 10. For anything you cannot do in Settings, email [email protected] and we will act on your request in accordance with Section 13.

\u00A9 2026 outercircl Limited.