Your data at NOXYVIA.

Who operates NOXYVIA

NOXYVIA is a Dutch sole proprietorship, registered under KVK number 09594734. Contact: noxyvia@gmail.com.

Accounts and profiles

We process your email and authentication details to provide account access, and the profile information, photo, birth date and preferences you supply to provide the service. Required information is identified during registration and onboarding; without it you cannot complete the corresponding step. You can choose whether to participate in calls and whether to provide optional profile details.

Your full birth date is stored privately. If you enable age display, other users see a calculated age. Country and online visibility depend on your settings. Profile photos use publicly accessible image links: hiding a profile does not immediately make an existing photo link unavailable.

Conversations and connections

We process participants, connection requests, connections, messages and session information to arrange conversations and keep you in contact. Private messages and private calls require an accepted connection. Your conversation partner receives the messages, audio or video you choose to share. The NOXYVIA application does not record calls; another participant may still make their own recording.

Safety and service operation

We process blocks, reports, moderation decisions and relevant operational information to prevent abuse and investigate problems. Reports may contain information supplied by other users about you. Authorized moderators can review safety information needed for their work. Our infrastructure providers also process technical information, such as IP addresses and request logs, to deliver and protect the service.

Why we process data

We use information necessary for account access, requested profiles, matching, messaging and calls to perform our agreement with you. We rely on our legitimate interests in protecting users and operating a reliable service for proportionate security and abuse prevention, subject to your rights. Where a specific legal obligation applies, we process the information necessary to meet it. Permission to use your camera or microphone is controlled by your browser and does not authorize unrelated uses of your data.

Who receives data

Other users receive information associated with your chosen interactions. Our service uses Supabase for accounts, database and file storage; LiveKit for audio/video; Vercel for hosting; Cloudflare for DNS and Turnstile abuse protection; and Resend for account email delivery. These providers process information needed for their roles. The provider details below reflect the settings and published policies checked on 24 October 2026. Our review of contracts, international-transfer safeguards and remaining retention categories is not yet complete. We do not claim that all processing stays within the EEA.

For calls, LiveKit receives your account identifier and a display name, together with audio/video and technical connection information needed to provide the call. Our application does not start call recordings or transcriptions. Agent session capture is disabled in our LiveKit project. The configured data region for stored project analytics is Frankfurt in the European Union; this does not mean that all media routing or other provider processing stays within the EEA. Technical session information, such as participants, duration and connection quality, may be processed separately from call recordings.

Local storage and measurement

Our authentication client keeps session information on your device so you can stay signed in. Signing out ends the local signed-in session. On signup, login and password-recovery pages, we use Cloudflare Turnstile to help block automated abuse. Cloudflare processes technical signals such as your IP address, browser and connection characteristics, and the site you are visiting. Cloudflare processes these signals on our behalf to protect NOXYVIA and, as a separate controller, to improve its bot detection. See the Cloudflare Turnstile Privacy Addendum for more information about these uses and privacy contacts. We also keep daily totals of successful account, onboarding, match and Connect actions. Those totals do not contain user identifiers, message content or call recordings; the underlying account and interaction records remain personal data.

Deletion and retention

Account and interaction data support your account and conversations until removal or account deletion, subject to necessary safety handling. Request deletion in Settings or email us. The request immediately hides your profile and ends active matching/call sessions. An administrator then reviews it. Once processed, permanent deletion removes your account, uploaded avatar files and entire shared conversations for both participants.

Requests connected to safety records, billing records or staff accounts require separate review. A technical block is not itself a legal justification to retain data indefinitely. Review dates do not automatically erase data. Provider backups, logs and cached copies have separate lifecycles. The category-specific periods below are not a guarantee that every copy of your data is erased within those periods. Deletion cannot remove copies another participant has independently saved.

Provider retention and processing locations

Vercel hosting: Our current Hobby plan has a documented runtime-log retention window of 1 hour. Observability Plus is not enabled and no log drains are configured for this project. This window applies to runtime logs, not all build, security, billing or account records. See Vercel runtime-log documentation.

Resend account email: Resend stores customer data, including message content and delivery logs, in the United States; choosing a European sending region does not move that storage to Europe. Its published policy specifies 30 days for email and log data on Free, Pro and Scale plans, with configurable Enterprise retention, and 7 days for backups. Resend states that its standard data-processing agreement includes EU Standard Contractual Clauses for international transfers. See Resend data protection and retention information. These are provider-published terms; we have not independently measured deletion or confirmed an account-specific exception.

LiveKit call infrastructure: LiveKit distinguishes observability data from service telemetry. Its published default limits are up to 30 days for observability data, with encrypted backups for up to 30 additional days, and up to 60 days for telemetry. Telephony, billing, usage, security, fraud and abuse records can have longer retention where needed for those purposes or required by law or carrier rules. These are technical-data categories, not a statement that NOXYVIA records your calls. See LiveKit data-processing terms.

We have not yet established a complete, category-specific retention schedule for Supabase provider logs and backups or Cloudflare security signals. We do not promise immediate deletion from provider systems when a NOXYVIA account is erased. You can contact us about the safeguards or retention relevant to your data.

Your rights and contact

Depending on the legal conditions, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where consent is used, you can withdraw it without affecting earlier lawful processing. Email noxyvia@gmail.com. Do not send an identity document unless necessary verification has been discussed.

Rights requests normally require a response within one month. If a permitted extension is needed, you must be informed within that first month. You can complain directly to the Autoriteit Persoonsgegevens or another competent supervisory authority.

Changes

The date above identifies this version. Material changes to how personal data is used must be explained before the changed processing begins.