1. Data controller
Controller: Pollocrudo Company
Platform: Soclya (soclya.com)
Privacy email: privacy@pollocrudocompany.com
This policy complements the Terms of Service and the Cookie Policy.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identification | Name, username, email, account ID | Registration |
| Profile | Bio, avatar, location, website | User |
| Content | Posts, images, videos, messages, polls | User |
| Interactions | Likes, reposts, follows, blocks, reports | App usage |
| Technical | IP, browser, device, session cookies | Automatic |
| AI | Messages to Soclya V1, moderation logs | AI services |
| Preferences | Theme, language, notifications, privacy | Settings |
We do not sell your personal data to third parties.
2b. Private messages (strict rule)
Meta-style: we do not read your chats
We may see private message content only if:
- You (or another chat participant) file a report, and
- You explicitly select the messages to attach (up to 30), and
- Those messages are copied as report evidence. The rest of the thread is not opened.
Exception: valid legal order from a competent authority. See EU Compliance.
3. Purposes of processing
- Service provision — Create account, post, message, feed.
- Authentication and security — Sessions, CSRF, fraud detection.
- Moderation — Automatic content analysis with AI.
- Personalization — «For you» feed, user suggestions.
- Communications — Verification emails (OTP), security notices.
- Product improvement — Aggregated and anonymized usage metrics.
- Legal compliance — Responding to authorities and legal obligations.
4. Legal basis (GDPR)
| Processing | Legal basis |
|---|---|
| Account and core service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Security and moderation | Legitimate interest (Art. 6(1)(f)) |
| Non-essential cookies | Consent (Art. 6(1)(a)) |
| Legal obligations | Legal compliance (Art. 6(1)(c)) |
| Marketing emails (future) | Consent (Art. 6(1)(a)) |
5. Recipients and processors
We share data only with providers necessary to operate Soclya:
- Cloudflare — Hosting, D1, KV, R2, CDN, and security.
- Proton Mail — Sending OTP verification emails.
- Pollocrudo Company — Moderation, recommendations, and Soclya V1 assistant.
All processors are subject to data processing agreements (DPAs).
6. International transfers
Some providers are located in the United States. Transfers are carried out under Standard Contractual Clauses (SCCs) approved by the European Commission or applicable adequacy decisions, ensuring a level of protection equivalent to that in Europe.
7. Retention periods
- Active account — For as long as you keep your account.
- After deletion — 30-day grace period, then deletion or anonymization.
- Security logs — Up to 12 months.
- Moderation — Logs up to 24 months for appeals.
- Legal obligations — For the time required by law.
8. Your rights
You may exercise at any time:
- Access — Know what data we hold about you.
- Rectification — Correct inaccurate data.
- Erasure — The «right to be forgotten».
- Restriction — Restrict processing.
- Portability — Receive your data in a structured format.
- Objection — Object to processing based on legitimate interest.
- Withdraw consent — Without affecting prior processing.
9. Security measures
We apply encryption in transit (HTTPS/TLS), salted password hashing, CSRF tokens, rate limiting, secure storage on Cloudflare, and periodic access reviews.
10. Minors
Soclya is not directed at persons under 16. If we detect a minor's account, we will delete it. Contact privacy@pollocrudocompany.com if you believe we have collected data from a minor.
11. Changes to this policy
We will update this policy when necessary. Material changes will be communicated by email or notice on the platform. The last updated date appears in the header.
12. Contact
Pollocrudo Company · Soclya
privacy@pollocrudocompany.com