Privacy Policy

meHappy is operated by Sport Star Management LLC (OOO «Sport Star Management», OGRN 1097746525898), a company registered in the Russian Federation, with its registered office at 34 Verkhnyaya Krasnoselskaya Street, Moscow, 107140, Russia (“we”, “us”). We are the operator of personal data within the meaning of Federal Law No. 152-FZ “On Personal Data”; where the UK or EU General Data Protection Regulation applies to you, we are the data controller.

Questions, requests and complaints: privacy@highglossy.com.

• Sign-up is your phone number. It is the account; we send a code to confirm it and do not ask for a password.
• Your address book finds your friends. With your permission, the phone numbers in your contacts are matched against meHappy users. We keep only the matches; numbers of people who are not users are not stored.
• Wishes are visible only to mutual contacts. A wish is shown to a person only when you are in each other's phone book.
• Who booked a gift stays secret from the person receiving it until it is handed over.
• We do see: your wishes, bookings, chat messages, push tokens, purchase records and crash reports. No ads, no selling of personal data.

Every category we hold, why we hold it, the lawful basis and how long we keep it:

• Account: phone number, the name and photo you choose — To create your account, confirm it by SMS code and show you to your friends. Basis: Performance of the agreement with you (Art. 6 of Federal Law No. 152-FZ). Kept: until you delete the account.
• Contact matches: which of the phone numbers in your address book belong to meHappy users — To show you your friends' wishes and show yours to them. Numbers that match no user are discarded immediately. Basis: Your consent (Art. 6 and 9 of Federal Law No. 152-FZ). Kept: until you revoke the contacts permission or delete the account.
• Wishes: the gifts you add, their price and links — To show them to your friends. Basis: Performance of the agreement with you (Art. 6 of Federal Law No. 152-FZ). Kept: until you delete the wish or the account.
• Bookings and chip-ins: who booked which gift and the chat about a shared gift — To run the gifting and keep the surprise. Basis: Performance of the agreement with you (Art. 6 of Federal Law No. 152-FZ). Kept: until the gift is handed over or the wish is deleted, then 90 days.
• Push tokens (only if you allow notifications) — To tell you about new wishes and to nudge you about a gift you booked. Basis: Your consent (Art. 6 and 9 of Federal Law No. 152-FZ). Kept: until the token is revoked or goes stale.
• Purchase records: product, store transaction identifier, status — To extend your profile as you paid for and restore it on a new device. Basis: Performance of the agreement with you (Art. 6 of Federal Law No. 152-FZ). Kept: life of the account, then 7 years where tax law requires.
• Crash and error reports: stack traces, device model, OS version, app version — To find and fix defects. Basis: Our legitimate interests in security and reliability (Art. 6 of Federal Law No. 152-FZ). Kept: 90 days.

We do not sell personal data and we do not use it for advertising or profiling.

We use a small number of processors. Each is bound by a data processing agreement and may use the data only to provide the service to us.

• SMS gateway — sends the confirmation code to your phone number.
• Apple — payment processing for in-app purchases. Apple takes the payment; we never see your card number or billing address. Your relationship for the payment itself is with the App Store, under Apple's own privacy policy.
• Google Firebase Cloud Messaging / Apple Push Notification service — delivery of push notifications. Receive the notification token and the notification text.
• Crash reporting (Sentry, hosted in the European Union) — receives stack traces, device model, OS and app version. Crash reports carry no IP address and no user identifier.
• Our hosting provider in the Russian Federation — runs the servers holding accounts and records.

We also disclose data where we are legally compelled to: to comply with a legal obligation, to protect our rights or property, to investigate possible wrongdoing in connection with the app, or to protect the safety of users or the public.

Your friends on meHappy see your name, photo and wishes, and the people in a chip-in chat see each other's messages. The person a gift is for never sees who booked it until it is handed over.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

The section above gives the retention period for each category. When you delete your account or ask us to, we delete the records that identify you; backups are purged on a rolling 30-day cycle. We keep purchase records where tax or accounting law obliges us to, and aggregated statistics that no longer identify anyone.

Personal data of citizens of the Russian Federation is recorded, stored and processed on servers located in the Russian Federation, as Federal Law No. 152-FZ requires. Some processors listed above operate outside Russia; they receive only the data named there. If you are located outside the Russian Federation and use the app, you consent to your data being transferred to and processed in the Russian Federation. Where the UK or EU GDPR applies, cross-border transfers rely on the Standard Contractual Clauses or an adequacy decision.

Wherever you live, you can ask us to:

• Give you a copy of the personal data we hold about you, in a portable format.
• Correct anything inaccurate.
• Delete your data. You can do this yourself in the app; we will also do it on request.
• Restrict or object to processing we carry out on the basis of legitimate interests.
• Withdraw consent, for example for notifications by turning them off in your device settings, without affecting what we did before you withdrew it.

Write to privacy@highglossy.com. We respond within 30 days (within 10 business days where Federal Law No. 152-FZ requires it).

In the Russian Federation you may also complain to Roskomnadzor, the authority for the protection of the rights of personal data subjects. If you are in the UK or the EEA, you may complain to your data protection authority.

Under the CCPA as amended by the CPRA, in the last 12 months we collected the categories described above for the business purposes stated there, from you and from your device. We have not sold personal information and we have not shared it for cross-context behavioural advertising. We have no actual knowledge of selling the personal information of consumers under 16.

You have the right to know, delete, correct, and to be free from discrimination for exercising those rights. Exercise them at privacy@highglossy.com.

meHappy is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with data, write to privacy@highglossy.com and we will delete it.

Data in transit is protected with TLS. Access to our systems is limited to the people who need it to run the service and is logged. No system is perfectly secure, and we will not claim otherwise; if a breach affects your personal data, we will notify you and the competent authority as the law requires.

We will update this policy when what we do changes. The date at the top always reflects the current version. If a change materially reduces your rights or widens what we collect, we will tell you in the app before it takes effect.

Sport Star Management LLC, 34 Verkhnyaya Krasnoselskaya Street, Moscow, 107140, Russia

Support: support@highglossy.com · Privacy: privacy@highglossy.com