Privacy Policy

STUDIO SPOTLIGHT.NET LTD („СТУДИО СПОТЛАЙТ.НЕТ" ЕООД)

Company ID (ЕИК): 201153652 | Address: Dunavtsi 6145, 7 Krairechna St., Bulgaria

Email: hello.relatedapp@gmail.com

Last updated: 29 September 2026

1. What personal data do we collect?

• First and last name
• Email address (the password is stored hashed by Firebase Auth)
• Phone number, if you provide one
• Event details (date, type, number of guests, location, budget)
• Professional details for specialists (category, description, prices, portfolio photos and videos, company ID for registered companies, social media links)
• Chat messages, enquiries and offers
• Reviews you leave, and the specialists' replies to them
• Bank details for specialists (IBAN, bank, account holder) - solely for payment purposes
• Technical data: device type, operating system version, IP address, and the approximate city and country derived from that IP address
• Sign-in records (date, time, platform - website or app)
• Website visit data: which pages you opened and which site you came from. From the referring address we keep only the domain (e.g. "facebook.com"), never the full URL - it may carry personal data in its parameters.

Visits are also counted for people without an account. In that case we do not know who you are - see section 12.

2. Why do we process this data?

• Providing the service that connects organisers with specialists
• Handling enquiries, offers and contracts
• Sending important notices and notifications
• Verifying the email address at registration
• Improving and developing the application
• Processing payments through Stripe
• Showing "online" status and a specialist's approximate city
• Visit statistics - which pages are viewed and where visitors come from
• Detecting abuse - fake profiles, fake deals and untrue reviews (see section 11)
• Complying with legal obligations

3. Legal basis (GDPR)

• Consent - at registration and for marketing messages
• Performance of a contract - to provide the service
• Legitimate interest - platform security, detection of abuse, and service improvement
• Legal obligation - when required by the competent authorities

4. Third parties and processors

• Google Firebase - storage and authentication. Servers in the EU (europe-west1). Policy
• Stripe - payment processing. We do not store card data. Policy
• Apple / Google - distribution and in-app purchases
• Vercel - hosting of the website and the admin panel. Policy
• Cloudinary - storage and processing of portfolio photos and videos. Policy
• Resend - delivery of the emails we send you. Policy
• Expo - delivery of push notifications to the mobile app. Policy
• ipapi.co - determines the approximate city and country from an IP address. Your IP address reaches ipapi.co as part of that request. Policy

We do not sell or disclose personal data to advertisers or other third parties.

5. Transfers outside the EU

The core data is stored in the EU - Firebase Firestore runs in the europe-west1 region.

Some of the services listed above (Stripe, Resend, Expo, Cloudinary, Vercel, ipapi.co) are established outside the EU or operate servers outside the EU. Transfers to them are made under appropriate safeguards pursuant to the GDPR - standard contractual clauses and/or the EU-U.S. Data Privacy Framework.

6. Retention periods

• Active accounts - for as long as the account is active
• On account deletion - data is erased within 30 days
• Financial data - up to 5 years, as required by accounting legislation
• Backups - up to 90 days after deletion
• Technical data (IP addresses, city and country by IP, sign-in records) - up to 12 months, after which it is erased
• Visit records for people without an account - up to 30 minutes in the "live" list, after which only aggregate statistics remain, with no link to an individual

7. Children's data

RELATED is intended exclusively for persons over 18. We do not knowingly collect data from persons under 18. If such an account is identified, it will be terminated immediately.

8. Your rights under the GDPR

• Access - to obtain a copy of your data
• Rectification - to correct inaccurate data
• Erasure - the "right to be forgotten"
• Restriction - to restrict processing
• Portability - to receive your data in a machine-readable format
• Objection - to processing based on legitimate interest
• Withdrawal of consent - at any time

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP).

9. Payments and financial data

Payments are processed by Stripe. We do not store full card details. Specialists' IBAN details are stored solely to calculate payments within the platform.

10. Data security

We apply technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS) and access control. In the event of a security breach we will notify the affected individuals and the CPDP within the statutory period.

11. Detecting abuse

The badges "Worked through RELATED" and "Proven specialist" are awarded after a real deal with a client review. For them to mean anything, we check whether the deal is genuine.

To that end we keep a list of the IP addresses used to sign in to each account and compare them - for example when a review comes from an account created minutes before the deal, from the same address as the specialist's. The check is performed by an administrator, not automatically, and a matching IP address on its own does not decide anything: everyone in a single home, office or mobile network shares one address.

The legal basis is legitimate interest - the platform and its clients have an interest in reviews being genuine. You have the right to object to this processing (section 8).

12. Cookies and tracking

We do not use cookies - neither our own, nor advertising, nor third-party ones. We have no Google Analytics, Meta Pixel or similar.

For visit statistics the website stores one random session number in the browser's memory (sessionStorage). It is not a cookie, contains nothing about you, and disappears as soon as you close the tab. Its only purpose is to avoid counting the same visit several times. Alongside it we record the page, the domain you came from, and a coarse device type (phone / tablet / computer). We do not profile people and we do not track anyone across websites.

Firebase may collect anonymous technical data about the stability of the application.

13. Changes to this policy

We will notify users through the application of any material changes. We recommend reviewing the current version regularly.