Privacy Policy

This privacy policy explains how Big White Spot (operated by Montages Media Labs, Flat 1, 24 Charles Road, St. Leonards-on-sea, TN38 0QH, UK) handles your personal data when you use our service.

Big White Spot is a privacy-first live event social wall and matchmaking platform. This policy sets out what data is collected, how it is processed, how safety moderation operates, and your statutory rights under UK and EU Data Protection legislation (UK GDPR / EU GDPR).

1. Guest Patrons (Venue Attendees)

If you join a room as a guest patron by scanning a venue QR code or entering a room slug:

Local Badge Profile: Your badge details (name, visual ID HELP, bio, photo/avatar) are saved on your device using cookies (`bws_user_profile`) for 1 year to provide instant profile recall when you visit future events.
Ephemeral Geofence Location: To verify you are physically inside the venue, your browser requests temporary GPS access. Distance calculations occur in real time and your GPS coordinates are never stored in persistent location tracking logs.
Ephemeral AI Safety Moderation: When submitting your profile or direct messages, data is checked in real time by our automated Modal VLM / OpenRouter AI safety filters. Images and text are evaluated ephemerally solely to prevent indecency, slurs, or commercial spam, and are never used to train public AI models.
DACH Direct Messaging (DM) Compliance: In Germany, Austria, and Switzerland (DACH region), 1-to-1 direct messaging is currently deactivated in compliance with youth protection legislation (JuSchG / JMStV) until integrated privacy-preserving 18+ age verification (EUDI Wallet) is launched.

2. Account Holders (Venue Hosts & Event Organisers)

If you register an organizer account to create and manage rooms, we process:

Account Credentials: Name, email address, and hashed passwords.
Venue & Room Data: Room titles, venue address, geofence radius, logos, header banners, and event calendar dates.
Payment Processing: Token purchases and plan upgrades are processed securely via Stripe. We never store credit card numbers on our servers.

3. Cookies and Local Storage

We use essential functional cookies to manage sessions, store language preferences, and retain your local patron badge. For full details, see our Cookie Policy.

4. Data Disclosures & Hosting

Our server infrastructure is hosted securely with Hetzner Online GmbH (Germany). We do not sell, rent, or trade personal data. Data is disclosed only to essential service providers (Stripe, Modal cloud for real-time AI moderation, Scaleway Object Storage (S3) for venue asset storage) bound by strict GDPR data processing agreements.

5. Your Rights

Under UK/EU GDPR, you have the right to access, rectify, restrict, or erase your personal data. Contact us at [email protected] to exercise these rights.

6. Contact & Controller