Privacy Policy
1. Data controller. Alta Media Ε.Ε, Πλαστήρα 3, Μαρούσι, [email protected]. This policy explains what data we collect, why, how long we keep it and what rights you have, under the GDPR (Regulation 2016/679) and Greek Law 4624/2019.
2. What we collect and why
| Who | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visitor | Technical connection data for security (IP in encrypted form, only for rate limits) | Security, preventing abuse | Legitimate interest | Up to 24 hours |
| Visitor | Visit counting without cookies: a fingerprint of the IP and browser with a key that changes every day (not the IP) | Traffic statistics (visitors, visits, pages) | Legitimate interest | The fingerprint: up to 30 minutes (and only as an irreversible count for the day); we keep only the daily totals |
| Visitor | Acceptance of the 18+ gate (method, random identifier, no IP) | Legal obligation to protect minors | Legal obligation | 180 days (cookie) |
| Visitor who reports | Text of the report, encrypted fingerprint of the IP, email if you give one | Examining reports | Legitimate interest, legal obligation | 5 years |
| Visitor before the opening | "Notify me": email; "Ask for an invitation": email and an optional note; an invitation from us: the recipient's email (all encrypted) | Telling you we have opened; sending an invitation | Consent (withdrawn by email to [email protected]); for the invitation, steps prior to a contract | "Notify me": until the opening email, then deleted; requests: 30 days after a refusal, 90 days after the invitation |
| Registered user | Email, one-time codes (only as a fingerprint) | Sign-in, notifications | Performance of contract | As long as the account exists |
| Registered user | Gender (encrypted) | Display on the profile, matching | Explicit consent (Article 9(2)(a)) | As long as the account exists; revocable |
| Registered user | Nickname, private account photo, language, last sign-in | Running the account | Performance of contract | As long as the account exists |
| Registered user | Chat messages and photos (encrypted), blocks, reactions | Communication between users | Performance of contract | Up to 90 days after the last activity in the conversation; what the user deletes earlier, 30 days after deletion; exception: a pending report or a lawful order |
| Profile holder | Text, attributes, stated age (if not verified), location, photos, videos, image fingerprint for detecting duplicates | Publishing the profile | Performance of contract | Until deletion + 30 days |
| Profile holder | Phone, Telegram, Viber/WhatsApp options (never on a public page) | Display to signed-in members via "Show phone" (or only to verified members, at the holder's choice); detecting duplicate accounts | Performance of contract and the holder's choice; legitimate interest for duplicates | As long as the Ad exists + 30 days after its deletion; encrypted fingerprint 12 months |
| Member and Ad holder | "Show phone" log: which Ad, which member, when (no IP or device data) | Preventing and investigating abuse (bulk collection of numbers, harassment); seen only by staff investigating abuse | Legitimate interest in protecting members | 90 days, deleted automatically |
| Any member or advertiser who chooses to verify | Verification result: document type and country, year/month of birth, fingerprint of the document number | Age and identity verification, preventing duplicates and exploitation | Consent; legitimate interest (preventing duplicates and exploitation) | 5 years after the account ends |
| Profile holder | The verification provider's full response (encrypted) | Resolving disputes | Legitimate interest | 30 days |
| Everyone | Log of moderation and security actions (identifiers and codes only) | Proof of compliance, security | Legal obligation, legitimate interest | 5 years |
We do not receive or store images of identity documents or verification selfies, card details, or IP addresses in readable form. Photo metadata (location, device) is removed on upload.
3. Gender and sex life. The gender you state and the content of profiles reveal special-category data. We process them with your explicit consent, which you give at sign-up and can withdraw by deleting your account. Gender is stored encrypted and is not recorded in audit logs.
4. Who sees what. Your Ad is public to adult visitors and [being implemented] may appear in search engines. A Dating card is visible only to signed-in users and never in search engines. The Ad's phone number and Telegram username are never inside the page; only signed-in members who tap "Show phone" see them (or only verified members, if you choose so), not visitors or members you have blocked or who have blocked you. Dating cards never show contact details. Your email and private account photo are not shown to anyone. In conversations you appear under a nickname.
5. Recipients and transfers
| Recipient | What they receive | Why | Location |
|---|---|---|---|
| Signed-in members | The Ad holder's phone, Telegram and Viber/WhatsApp options, only when they tap "Show phone" | Contacting the advertiser, with their consent | — |
| Viber, WhatsApp, Telegram | Nothing from sexaki.com. The button is a plain link that opens the app on your device, only if you tap it | Communication outside sexaki; each app's privacy policy applies | Depends on the app |
| Sumsub (Sum and Substance Ltd) | Only from members who choose to verify: identity document and selfie directly from you | Age and identity verification | EU |
| Postmark (ActiveCampaign) | Email, sign-in code; invitation email | Sending sign-in emails and invitations | USA — EU–US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) |
| Cloudflare | Technical data of every request (IP, cookies), photos and videos (R2 storage), bot check at sign-in, on "Show phone" and on the invitation page's forms (Turnstile) | Delivery network, security, storage | Storage in the EU; global network — EU–US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) |
| DataCamp Limited | All the data in the database | Hosting | Bulgaria |
| Authorities | Whatever a lawful order requires | Legal obligation | Greece / EU |
We do not use visitor analytics, advertising networks or third-party tracking tools. We do not sell or hand over data for advertising.
6. Security. Connections only over TLS. Messages, gender and verification responses encrypted in the database. Sign-in codes, IPs, phone numbers and document numbers only as irreversible fingerprints where that is enough. Audit logs are append-only, with no way to change them. Staff access to conversations only to examine a report, and it is recorded. For support or checks, the Operator may log in to a member's account and see what the member sees, conversations included; every such login and every conversation opened is recorded. In the event of a data breach we inform the Hellenic Data Protection Authority and, where required, you.
7. Your rights. Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You see and change your Ad's contact details yourself in the edit form, and delete the Ad from the same page. The other rights, such as deleting your account or receiving a copy of your data, as well as requests about the "Show phone" log, are exercised by email to [email protected] from your account's address; we reply within 30 days. Erasure does not cover what we must keep by law or to protect others (verification results, reports, audit logs, fingerprints to prevent banned accounts from signing up again). You have the right to complain to the Hellenic Data Protection Authority (dpa.gr).
8. Changes. Changes are announced on the Service before they take effect. Version 1.0, 9 October 2026.
Last updated: 13 October 2026