Privacy notice — waitlist
Last updated: 27 October 2026 (invitations in waves, a permanent link to your page, where you signed up)
This notice covers the Cyproom waitlist only. Cyproom has not launched yet: today we only keep a list of people who want to be invited. Before you create an account, you will see the separate member privacy notice and be asked for separate consents before we collect anything else.
On this page
1. Who we are
The controller of your data is Cyproom. Contact for anything about your data: info@cyproom.com.
2. What we keep
- Your e-mail address — stored encrypted (AES-256).
- What you chose in the form: I am (woman / man / non-binary), age band, district, the languages you could date in, and the language of the site: the one you used in the form or, if you changed it later on your page, the last one you chose (we write to you in it).
- Your personal invitation code, and the code of the friend who invited you, if any. That friend sees only how many people joined through their link — never your e-mail or any other detail.
- Where you signed up: the campaign name, if your link had one (for example “instagram”), otherwise the Cyproom page where you filled in the form (for example a guide or the “Dating in Limassol” page).
- Your answer to the optional question about the ID check, if you give one.
- When you signed up and confirmed, and which version of this notice you accepted.
- When we sent you the invitation and, if needed, the reminder.
We do not ask for your name, phone number, photos, orientation or any other sensitive information on the waitlist.
When you send the form, your IP address is used only as a scrambled (hashed) value in anti-abuse counters, which are deleted within about a day. Our hosting server also keeps standard web logs (IP address, browser, page) for a limited time for security and troubleshooting.
3. Why, and on what legal basis
- To keep your place, send you the confirmation e-mail and the link to your page when you ask for it, and invite you when your turn comes — based on your consent (GDPR Art. 6(1)(a)).
- To decide when to open and whom to invite in each wave: we only look at totals by district, age band, language and gender, and at the invitation order in the terms (friends you brought, date you confirmed). From the totals per campaign and page we also see which pages help people find us — same basis.
- To protect the form against bots and abuse — our legitimate interest in a secure service (Art. 6(1)(f)).
4. What we never do
- No advertising or tracking cookies, no analytics tools, no social-media pixels on this site.
- We do not sell or rent your data, and we do not share it with other dating services or advertisers.
- No automated decisions about you.
5. Who else processes it
- OVH (France, EU) — the server the site and database run on.
- Cloudflare — network security and delivery of the site. Cloudflare may process connection data outside the EU, under the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
- Brevo (Sendinblue SAS, France, EU) — sends our e-mails (the confirmation, the link to your page when you ask for it under “Sign in”, the invitation when your turn comes, and one reminder), so it processes your e-mail address and the message. Brevo records whether each e-mail was delivered and, for its statistics, counts opens and clicks anonymously (not linked to you): the links in our e-mails first pass through Brevo’s servers. If Brevo is unavailable, our own server sends the e-mail instead.
6. How long we keep it
- If you do not confirm your e-mail, everything is deleted automatically after 7 days.
- If you confirm, we keep your entry until you leave the list, or until we have invited you and you have had 12 months to create an account — and in any case no longer than 24 months after you signed up if we have not launched by then. If you create an account, your waitlist entry becomes part of the account and the member privacy notice applies.
- If you leave, your entry is deleted from the list immediately. Technical traces, such as our mail server’s delivery log containing your address, are deleted automatically within about 5 weeks, and any working export of the list is deleted within 30 days.
7. Your rights
You can ask to see, correct, export or delete your data, restrict or object to its use, and withdraw your consent at any time — this does not affect what we did before. Every e-mail we send has a link to delete you from the list. For anything else, write to info@cyproom.com; we answer within one month.
You can also complain to the Commissioner for Personal Data Protection in Cyprus: www.dataprotection.gov.cy.
8. Security
The site uses HTTPS only. E-mail addresses are encrypted in the database; lookups use a keyed hash, so the list cannot be read without the keys. Only the operator can access the waitlist. The link to your page is permanent and signed; it gives no access to an account. If needed, we cancel it and send you a new one.
9. Age
Cyproom is only for adults. If you are under 18, please do not sign up; if we learn that someone under 18 joined, we delete the entry.
10. Cookies
The public site sets no cookies. The operator’s private admin area uses strictly necessary login cookies, for the operator only.
11. Changes
If this notice changes, we update the date above. Important changes are announced by e-mail before they apply.
12. Data sources for areas
The driving times on our city pages are based on public data, not on data about people. Area locations: © OpenStreetMap contributors (ODbL). Populations: Statistical Service of Cyprus, Census 2021. Driving times: computed with OSRM on OpenStreetMap data.