Privacy Policy

Processing of personal data, GDPR, the Bangladesh Personal Data Protection Act, and cookies

Who is responsible for your personal data

MiNigh is operated by Aridrishti SL (“Aridrishti SL”, “we”, “us”), a company registered in Spain (NIF-B42834606, registered office at Calle Leon Felipe 6, 8C, Loranca, Fuenlabrada, Madrid-28942), through the web application https://www.minigh.com/.

For users and transactions connected to Bangladesh (for example, payments made through a Bangladeshi payment gateway, or tax/invoicing records generated for a Bangladesh-attributed transaction), some of your personal data is also processed by Aridrishti BD, an independent Bangladeshi company. Aridrishti BD is Aridrishti SL’s Bangladesh development and operations partner under a separate commercial contract — it is not a subsidiary of Aridrishti SL, and the two companies are not otherwise affiliated or under common ownership. Where Aridrishti BD processes your data (principally Bangladesh-side payment processing and the invoicing/tax records Bangladeshi law requires it to keep in its own right), it does so either as Aridrishti SL’s data processor or, where it must independently determine how and why that specific data is processed to meet its own legal obligations under Bangladeshi law (for example NBR/VAT recordkeeping), as an independent controller for that data. Aridrishti SL remains the controller for MiNigh as a whole and for all data not specifically tied to a Bangladesh-attributed transaction.

Your data is processed following the current regulations on the protection of personal data applicable to MiNigh, principally: Regulation (EU) 2016/679 of 27 April 2016 (GDPR); Spain’s Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD), which has superseded the earlier Ley Orgánica 15/1999; and, for Bangladesh-connected processing, the Personal Data Protection Act, 2026 of Bangladesh (“PDPA”).

This policy does not apply to the use of other websites or applications operated by Aridrishti SL, such as FlyScan, DocValy, EasyKomida, E-Trust, etc, or to active research projects such as TrafficEye, FlySave, Kotha, etc. Please refer to each website’s or application’s own privacy policy.

How we obtain your data

We obtain your data when you use MiNigh (onboarding, posting a Wish/Request, hosting or joining an Event, chatting, making a payment, withdrawing from your wallet, submitting tax information, or verifying as a host), when you contact us through MiNigh or ARIDRISHTI, or automatically from your device/browser while you use the app.

Personal data we process

We process the data necessary to sign you in, suggest suitable activities and members, run events, process payments, and meet our own tax/legal obligations:

• Device/browser identifiers: your device’s IP address, browser characteristics used to recognise your device (used to protect the account-verification flow from automated abuse), and a first-party device cookie
• Location: both an approximate location derived from your IP address and, if you allow it, your device’s GPS location. Your GPS-derived location is randomised within a small radius before it is shown to other users, so no other user ever sees your exact coordinates — only MiNigh’s own servers process your real, unrandomised location
• Login email address
• If you sign in with Google or Apple: the name, email address, and account identifier that provider shares with us to verify you
• Gender, age, and your activity-companion preferences (gender and age range)
• Height, weight, religion, citizenship/nationality, residency, ethnicity, education, and other profile preferences you choose to provide
• Zodiac sign, personality type (from MiNigh’s own Personality Test, or self-reported by you), and emotional and social results (from MiNigh’s own tests)
• A face scan captured when you set your profile picture or complete host identity verification, used only to confirm your photo shows a real, live person and, for later photos, that they show the same person — see “Biometric data” below
• Political, cultural, social, economic standing and state, where you choose to share this as part of your profile or a Wish
• Date, time and location of a meeting, and Event details if you host or join an Event
• Chat messages between you and a member you have a confirmed meetup with, and any photo/voice attachments you send, up to the message/attachment limits shown in the chat window
• Feedback you give about a meetup or Event
• If you host an Event, apply for Host Verification, or submit tax information: your legal name, address, national ID/passport/tax-residency document details, and (for a qualifying host) VAT/Autónomo or VIES registration details, used to issue correct invoices and apply the correct tax withholding
• Payment and wallet records: the transaction IDs, invoice records, gateway used, amount, currency, and VAT/withholding applied to each payment or withdrawal — not your card number, CVV, or full bank account details, which are collected directly by our payment providers, not by us (see “Personal data and third parties” below)
• A record that you ticked the checkout pledge box (“I pledge: NO WAR and agree to the terms and conditions”) before paying, together with the time and IP address of that confirmation — kept as evidence that a payment was made knowingly, in case a payment is later disputed with a bank or payment provider (see “Chargebacks and payment disputes” below)
• Push-notification subscription details, if you allow notifications
• Consent to our Terms and Conditions and this Privacy Policy, and the version of each you accepted

Biometric data

To help keep MiNigh’s users real people, MiNigh asks you to take a short, live photo capture (including brief head-turn poses) when you set your profile picture or complete host identity verification. From this capture we generate a numeric facial “embedding” (a mathematical representation of your face, not a photo a person could recognise on its own) used only to (i) confirm the capture shows a real, live person rather than a photo or video played back to the camera, and (ii) confirm a later profile picture you upload shows the same person. This embedding is a special category of personal data under Article 9 GDPR. We process it on the basis of your explicit consent, given by completing the capture — you may decline, in which case the specific features that require it (setting a profile picture, or Host Verification) will not be available to you. You may withdraw this consent at any time by deleting your account; the embedding in your profile is deleted along with your account data on the same schedule as your other personal data (see “Personal data retention period” below), except for the encrypted copy described in “Face verification and fraud prevention”. We do not use this data for any purpose other than the liveness/match check described here and the fraud prevention check described below, and we do not share it with any third party.

Face verification and fraud prevention

When you verify your face, we create a face template: a list of numbers that describes your face. It is not a photo, and a photo cannot be rebuilt from it. We use it for two things: to confirm that you are a real person, and to make sure each person receives the welcome credit only once.

• Legal basis: our legitimate interest in preventing fraud (Article 6(1)(f) GDPR). Because a face template is biometric data, we process it on the basis of your explicit consent, which you give when you start the face check (Article 9(2)(a) GDPR).
• Storage: the template is encrypted. Only the automated duplicate check can read it, and staff cannot see it.
• Retention: if you close your account, your profile photo and the template in your profile are deleted. One encrypted copy is kept for 24 months after you close your account, only to stop the same person from claiming the welcome credit again. After that, it is deleted automatically.
• Your rights: you can ask us at any time what we hold about you, and you can object to this processing. If we agree to delete the copy, you will no longer be able to receive the welcome credit again.

Your photos and the face check

We compare the photos you add to your profile with your face template, to check that they show you. If a photo you had before the face check does not show you, we remove it from your profile and delete the file. The face check does not post anything on social media, and we do not look for you there. The face images and templates go only to our own face service.

You decide whether your profile photo appears to other members. If you hide it, other members see “Verified, photo not shown” instead. A hidden photo is not deleted: we keep it securely on our servers, our authorised staff can access it where this is needed (for example for safety or moderation), and you can show it again at any time. You can delete it by removing the photo or closing your account.

Face check for account security

To protect your account and other members from fraud, we may ask you to repeat the face check before a sensitive action, for example when something unusual happens on your account. We then compare a new live face check with the face template we already hold, and we use the result only to allow or stop that action. The new check is not stored: we keep no photos or video frames from it, and we keep a short security log that records that a check was asked for and whether it passed.

• Legal basis: our legitimate interest in preventing fraud (Article 6(1)(f) GDPR) and your explicit consent to the face check, given on the screen before the camera opens (Article 9(2)(a) GDPR).
• If you do not want to use it: you can decline the face check. Contact our support team instead and a member of staff will review the action by hand. This may take longer, and until it is reviewed the action may stay on hold.
• Repeated failed checks: if the check does not match several times in a short time, your account may be reviewed by our team and limited to Pay Now payments until the review is done.

We do not collect:

• Your card number, CVV, expiry date, or full bank account number — these are collected directly by our third-party payment providers, not by MiNigh
• Your preferred language by any means other than your browser’s own settings (you can always change it yourself in Settings)
• Any other data beyond what is listed above

Legitimation of the processing of your data

Most of MiNigh’s processing of your data is based on your consent, given when you accept this Privacy Policy and our Terms and Conditions and, for biometric data, given separately as described above. Some processing (issuing invoices, applying tax withholding, retaining financial records, responding to a legal request, or defending a legal claim) is instead based on our legal obligations under Spanish and/or Bangladeshi tax, commercial and consumer-protection law, and does not depend on your consent — this is why some records survive account deletion, as explained below.

Purpose of personal data processing

We process your data to: suggest activities and members that fit your preferences through MiNigh’s Fit score; run Events you host or join; process payments, wallet top-ups, and withdrawals, and issue the invoices/tax documents required by Spanish and/or Bangladeshi law; verify you are a real, live person and, where relevant, verify your identity as a host; keep a watchful eye on anti-social behaviour using the feedback you and other users give us; investigate a payment dispute or chargeback; and provide AI-assisted customer support (see “AI support chatbot” below).

Where requests and event joins come from

When you send a Request for a Wish or join an Event, we store the city you were in and your public map position (the one already shifted by your privacy offset, rounded to about 100 metres), with its distance to the Wish or Event. Your exact GPS position is never used for this. We use it to show hosts how many people a listing reached, as counts only and never below three people, and to suggest where a Wish or Event could find more interest.

When a search on the full-screen map finds nothing, we store the place searched, the distance and the date, without your account, to learn where activities and events are missing.

Problems you report and card disputes

When you report a problem with a booking we keep what you wrote, the booking and the payment, and how we answered. If a payment is disputed with a bank, we send the bank a record of the booking that may include: what you confirmed at checkout, changes made to the booking and what you chose, problems you reported, and how active you were in the booking's chat as numbers only (messages, calls, places or live location shared). The content of your messages and your positions are never included. An account with a disputed card payment is marked so that it can only use Pay Now.

AI support chatbot

If you use MiNigh’s in-app support chat, your question is processed to search MiNigh’s own help content and, where needed, generate an answer using an AI language model. A human MiNigh team member can take over a support conversation at any time; your message history in that conversation is retained to allow that handover and for quality/support purposes, and is treated with the same confidentiality as any other message you send us.

Personal data and third parties

• We do not sell your personal data, and we do not run advertising on MiNigh, so no data is shared with any advertising entity
• We use map and place-search providers and the GeoNames place database to identify your approximate location from your IP address or GPS coordinates and to search addresses, sharing only what is needed for that lookup
• We use payment providers appropriate to your country and currency — among others, Stripe, PayPal, Wise, SSLCommerz, bKash, AamarPay and EkPay — to process your payments and withdrawals. These providers collect the payment details needed to process your transaction (for example your card details) directly from you; MiNigh does not receive or store them
• Where required by Spanish tax law, invoice data for a Spain-attributed payment is submitted to Verifacti, Spain’s certified electronic-invoicing platform, which forwards the required record to the Agencia Tributaria (AEAT) as part of Spain’s real-time invoicing (“Veri*Factu”) system. Invoice data for a Bangladesh-attributed payment is instead kept in Aridrishti BD’s own local invoicing records, as required by Bangladeshi law
• If a payment you made is disputed as a chargeback with your bank or with Stripe/PayPal, we may submit relevant records described in this policy (including your checkout confirmation record, invoice, and evidence that the service was delivered) directly to that payment provider through their own dispute-resolution process, as permitted or required by their rules
• We use hosting, email-delivery, push-notification and similar technology-infrastructure providers to operate MiNigh; these providers process data on our behalf, under contract, and may not use it for their own purposes
• We do not share your email, mobile number, phone number, physical/social-media address, or any other identity element with any other MiNigh user or any third party, except as described in this policy or where you choose to share it yourself with another member

If Aridrishti SL makes other transfers of personal data in the future, you will be duly informed.

International transfers of personal data

Aridrishti SL has contracted services from technology providers located mainly in the European Economic Area (“EEA”). Some countries outside the EEA are recognised by the European Commission as guarantors of an adequate level of data protection under EEA rules; the complete list of these countries can be consulted on the website of the Spanish Data Protection Agency. For transfers from the EEA to countries not considered adequate by the European Commission — including transfers to Aridrishti BD in Bangladesh for the Bangladesh-connected processing described above, and transfers to our Bangladesh-side payment providers — Aridrishti SL puts in place the contracts, guarantees and safeguards (such as the European Commission’s Standard Contractual Clauses) necessary to preserve your privacy.

For more information about these guarantees, you can contact Aridrishti SL at info@aridrishti.com or through Aridrishti SL’s postal address.

Personal data retention period, including after account deletion

While your account is active, your data is kept for as long as necessary to provide MiNigh’s services to you.

When you delete your account (Settings > Delete Account), your account and profile are immediately made invisible everywhere on MiNigh — you can no longer log in, and no other user can find or see you. However, in line with Article 17(3)(b) and (e) GDPR (which allow personal data to be retained where necessary to comply with a legal obligation, or to establish, exercise or defend legal claims), we are not able to erase every record immediately: personal data connected to a financial transaction — payments, invoices, tax-withholding and host-verification records, and the checkout confirmation records described above — must be retained for the period required by applicable Spanish and/or Bangladeshi tax, commercial and consumer-protection law (currently up to ten years from the relevant transaction, reflecting MiNigh’s invoicing and tax record-keeping obligations). This retained data is kept solely for that legal purpose, is no longer used to run any part of the live app, is inaccessible to other users, and is deleted once the applicable retention period expires.

Where you were banned from MiNigh for anti-social behaviour (see Terms and Conditions, Account Banning Policy), we retain the minimum data needed (a device identifier and the specific account-identifying data listed there) to prevent you re-registering to evade the ban, for as long as the ban remains in force.

Deactivating your account instead of deleting it

If you want a temporary break rather than permanent deletion, Settings > Deactivate Account hides your profile from other users and from discovery while keeping your account and data intact, exactly as they were, so you can reactivate at any time by logging back in. Deactivation does not trigger any of the retention rules above, since nothing is deleted.

Contact information to exercise your rights

As a MiNigh user, you have the right to:

• Withdraw the consent you gave us, including by deleting or deactivating your account (except where you were banned for anti-social behaviour, as described above)
• Obtain confirmation of whether we are processing personal data that concerns you
• Access your data
• Rectify inaccurate or incomplete data
• Request deletion of your data, subject to the retention explained above
• Request that we limit our processing of your data, where the conditions in applicable data-protection law are met
• Request portability of your data
• Object to our processing of your data
• File a claim with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) and, for Bangladesh-connected processing, with Bangladesh’s data protection authority under the PDPA, if you believe your rights have been violated

You may exercise these rights, and reach Aridrishti SL’s Data Protection Delegate, by sending a request together with a copy of a document proving your identity, either by post to Calle Leon Felipe 6, 8C, Loranca, Fuenlabrada, Madrid-28942, Spain, or by email to info@aridrishti.com. For a request specifically about Bangladesh-connected processing, please say so in your request so it can be routed to Aridrishti BD as needed; you may also use MiNigh’s Contact Us form and select “legal” as the issue type.

Data on persons under 18 years of age

You must be at least 18 years of age to open a MiNigh account. We do not knowingly collect data from anyone under 18; if we become aware that we have, we will delete that account and its data.

Financial data

Aridrishti SL and Aridrishti BD do not retain your card number, expiry date, CVV, or full bank account number. Payments and withdrawals are processed by third-party payment providers (see “Personal data and third parties” above), each certified under the rules of the country/currency they operate in. We keep only the minimal payment metadata described above (transaction IDs, amounts, invoice records) needed to track your payment, apply the correct tax treatment, and process a cashback, referral, or withdrawal.

Chargebacks and payment disputes

If a payment you made through MiNigh is reversed as a chargeback with your bank or card issuer despite the corresponding Wish, Request, or Event having genuinely been fulfilled, we treat this the same way any merchant is entitled to under the rules of Stripe, PayPal and the relevant card networks: we may submit evidence of the transaction to the payment provider’s dispute-resolution process, drawn from the records described in this policy (your checkout confirmation, invoice, and, where relevant, records showing the service was used — such as an Event check-in or that the meetup chat was opened). This is a legitimate use of your data for fraud prevention and to defend our legitimate business interests, and does not affect your right to raise a genuine dispute about a service that was not provided.

Website and use of cookies

MiNigh uses a small number of first-party cookies, set directly by minigh.com (never by a third-party advertiser), needed to operate the site:

• A session cookie, so you stay logged in as you move between pages
• A long-lived device-recognition cookie, used to recognise your device on a later visit and to protect the account-verification flow from automated abuse
• A device identifier used to correlate evidence in the rare event of a payment dispute, as described above

None of these cookies are used for advertising or third-party tracking. Some third-party services embedded in MiNigh (such as Google Maps) may set their own cookies under their own privacy policy, which we encourage you to read. Your browser also keeps its own cache/local storage independently of MiNigh; please consult your browser’s own cookie and cache policy for that.

Social login (Google / Apple)

If you choose to sign in with Google or Apple instead of email verification, we receive and process only the name, email address, and account identifier that provider shares with us to confirm your identity, under the basis described in “Legitimation of the processing of your data” above. We do not receive your Google/Apple password, and we do not post to your Google/Apple account on your behalf.

Social networks and messengers

MiNigh does not currently integrate with, or exchange data with, any third-party social media or messaging platform. If this changes in the future, you will be duly informed and this policy will be updated accordingly.

Identification of the data controller

Domain name: www.aridrishti.com
Commercial name: ARIDRISHTI SL
Company name: Artificial Intelligence, Robotics, IoT and Drishti (computer vision) (ARIDRISHTI)
NIF-B42834606
Registered office: Calle Leon Felipe 6, 8C, Loranca, Fuenlabrada, Madrid-28942, Spain
Telephone: 911134092
E-mail: info@aridrishti.com
Registered in the Mercantile Registry: Asiento:10/153/1 146 Folio: 170 FP: 28/06/21 Prof:2021/2981/N/22/06/2021

For Bangladesh-connected processing: Aridrishti BD, registered office at 777 Manikdee Bazar, Dhaka Cantonment, Dhaka-1206, Bangladesh, acting as Aridrishti SL’s Bangladesh development and operations partner under a separate commercial contract, as described above.

Intellectual and industrial property rights

The website, including but not limited to its programming, editing, compilation and other elements necessary for its operation, and its designs, logos, text and/or graphics, are the property of Aridrishti SL or, where applicable, are used under an express licence or authorisation from their authors. All content is protected by intellectual and industrial property regulations, and reproduction, use, exploitation, distribution or marketing of it requires prior written authorisation from Aridrishti SL. Unauthorised use is considered a serious breach of these rights.

Designs, logos, text and/or graphics belonging to third parties that may appear on the website belong to their respective owners; their mere appearance on the website does not imply any endorsement, sponsorship, or transfer of rights. To report a possible breach of intellectual or industrial property rights, or any other content concern, please email secretaria@sectcv.es.

Disclaimer

Aridrishti SL is exempt from responsibility for information published on the website whenever that information has been manipulated or introduced by a third party unrelated to it.

Link policy

From the website, you may be redirected to third-party content, for example if you independently take the official MBTI® assessment referenced in our Terms and Conditions. Aridrishti SL cannot always control content introduced by third parties on their own websites and does not assume responsibility for it. If any content contravenes applicable law, morality, or public order, we will act to remove the link and, where relevant, bring the content to the attention of the competent authorities.

Aridrishti SL is not responsible for content that users publish independently on MiNigh (for example chat messages), but, in compliance with Spanish Law 34/2002 (LSSICE) articles 11 and 16, actively collaborates with authorities and security forces to remove or block content that may contravene national or international legislation, third-party rights, or morality and public order. If you believe any content on MiNigh falls into this category, please notify us immediately through the Contact Us form.

Google user data

If you host a free online activity or event, you can choose to connect your Google Calendar to MiNigh. This is optional and you can use MiNigh without it: you can paste your own meeting link instead.

What we access. With your permission (the Google Calendar scope calendar.events), MiNigh creates an event in your own primary Google Calendar with a Google Meet link for your activity or event, updates that event when you change its title or time, and deletes it when you cancel the activity or event or replace the link. We do not read, list or store your other calendar events, your contacts or your other Google data.

What we store. We store the access and refresh tokens Google gives us (encrypted), and the Google Calendar event id and Meet link of the events we created. We show the Meet link to members who join your activity or event, from 15 minutes before it starts. We do not show your Google account details to anyone.

How we use it. Only to create, update and delete those Meet events for you. We do not use Google user data for advertising, we do not sell it, we do not share it with third parties except the service providers that host MiNigh and only to run this feature, and we do not use it to develop, improve or train generalized artificial intelligence or machine-learning models. Our staff do not read your calendar data.

Limited Use. MiNigh’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion. We keep the tokens until you disconnect Google Calendar in MiNigh, delete your account, or revoke access in your Google Account (myaccount.google.com/permissions). When you disconnect or delete your account, we revoke the token with Google and delete it from our systems. The Meet event stays in your own calendar until you cancel the activity or event in MiNigh; you can also delete it yourself in Google Calendar. To ask us to delete anything else, write to contact@minigh.com.

Calendar sync

You can choose to add your MiNigh plans to your own calendar. This is optional and you can use MiNigh without it. Only confirmed meetups, the activities and events you joined, and the activities and events you host are added (a hosted post shows as tentative until its minimum is met).

What goes into your calendar. For each item: its title, the first name of the other member where there is one, the start and end time, the exact meeting place (address and map point) or “Online”, and a link back to MiNigh. Online room links, share links and your own home location are never added.

Google Calendar. With your permission (the Google Calendar scope calendar.app.created), MiNigh creates one separate calendar named “MiNigh” in your Google Account and adds, updates and deletes events only in that calendar. We cannot see, read or change your other calendars or events, your contacts or your other Google data. We store the access and refresh tokens Google gives us (encrypted) and the ids of the events we created, and we use them only to keep that calendar up to date. We do not use Google user data for advertising, we do not sell it, we do not share it with third parties except the service providers that host MiNigh and only to run this feature, and we do not use it to develop, improve or train generalized artificial intelligence or machine-learning models. MiNigh’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Apple Calendar and other calendars. If you connect Apple Calendar, or copy your calendar link into Outlook or another calendar app, we create a private link that only you hold. Your calendar app reads your MiNigh items from that link; we do not get any access to your calendar. Anyone who has the link can see those items, so keep it private. You can reset the link at any time, which stops the old one working.

Disconnecting and deletion. You can disconnect at any time in Settings → Calendar. When you disconnect Google Calendar or delete your account, we delete the “MiNigh” calendar from your Google Account, revoke the token with Google and delete the tokens and event ids from our systems; you can also revoke access in your Google Account (myaccount.google.com/permissions). When you disconnect the calendar link, it stops working at once. To ask us to delete anything else, write to contact@minigh.com.