Privacy Policy

Last Updated: May 8, 2026 — Version 2026-05

1. Who We Are

CityPros is operated by CityPros, Inc., a corporation registered in Wyoming, USA. We provide a professional networking platform for cities including Barcelona, Spain and Charlotte, NC.

Data Controller: CityPros, Inc.
Privacy Contact: [email protected]

If you are located in the EU/EEA and wish to contact our EU representative, you may do so at the same address with subject line "EU Privacy Representative."

2. Information We Collect

Information you provide:

• Name, email address, and password
• Professional profile: role, career stage, company, job title, industry, tags, interests, and optional bio
• Optional: profile photo, LinkedIn, Instagram, WhatsApp number, website
• Content you create: connection requests, group participation, event RSVPs, messages, posts
• User reports regarding inappropriate behavior
• Payment information, processed by Stripe (we do not store card numbers)

Information collected automatically:

• App usage and behavioral data: features used, screens viewed, matches viewed and dismissed, search terms, social profile links clicked, events attended, connections made
• Device and technical data: device type, operating system, app version, push notification token
• Account activity: login times, last active timestamp
• Error and performance data sent to our error monitoring service (Sentry)

3. Lawful Basis for Processing (GDPR Article 6)

For users in the EU/EEA, we process personal data under the following lawful bases:

Data Category	Purpose	Lawful Basis
Profile information (name, email, professional details)	Providing the CityPros service	Contract — Art. 6(1)(b)
Push notification tokens	Delivering notifications you have requested	Consent — Art. 6(1)(a)
Payment data (via Stripe)	Processing subscriptions and purchases	Contract — Art. 6(1)(b)
Behavioral analytics (usage events, match interactions)	Improving matching quality and app performance	Legitimate interests — Art. 6(1)(f)
Error monitoring data (via Sentry)	Diagnosing and fixing technical issues	Legitimate interests — Art. 6(1)(f)
Security and abuse prevention data	Protecting users and preventing fraud	Legitimate interests — Art. 6(1)(f)
Data retained after account deletion	Legal obligations and safety records	Legal obligation — Art. 6(1)(c)

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your fundamental rights. You may request our Legitimate Interests Assessment by contacting us.

4. How We Use Your Information

• Create and manage your account and professional profile
• Generate weekly professional match suggestions using an automated algorithm based on role, goals, industry, and group membership
• Facilitate professional connections and group participation
• Send push notifications for connection requests, event reminders, and group activity (controllable in settings)
• Analyze app usage to improve matching quality and platform performance
• Detect and prevent fraud, spam, and abuse
• Process subscription payments
• Comply with legal obligations

Automated matching: Match suggestions are generated by an automated algorithm. This does not produce legal effects or significantly affect you — you may dismiss any suggestion. You have the right to obtain human review or object to automated processing by contacting us.

5. Third-Party Data Processors

We share data with the following processors under contractual data protection agreements. For US-based processors, international transfers are covered by Standard Contractual Clauses (SCCs).

Processor	Role	Data Shared	Location
Supabase	Database, authentication, file storage	All profile and usage data	EU (Germany) for EU users
Expo / EAS	App infrastructure, push notification delivery	Push notification tokens, notification content	USA (SCCs apply)
Sentry	Error monitoring and performance	Anonymous user ID, device info, error context (no name or email)	USA (SCCs apply)
Stripe	Payment processing	Billing information, subscription status	USA (SCCs apply)
RevenueCat	In-app purchase management	User ID, subscription and entitlement status	USA (SCCs apply)
Vercel	Web hosting (citypros.app)	Web request logs	USA/EU (SCCs apply)
Anthropic / OpenAI	AI-assisted features (when enabled)	Profile context for match suggestions and message drafts	USA (SCCs apply)

CityPros does not sell your personal information to any third party.

6. Data Retention

Data Type	Retention Period
Profile and account data	Duration of account; deleted within 30 days of account deletion request
Behavioral analytics events	12 months from creation, then deleted
Push notification logs	90 days
Rate limiting logs	30 days
Payment records	7 years (legal and tax obligation)
Security and abuse records	Up to 3 years where necessary to protect users
Anonymized aggregate data	Indefinite (cannot identify individuals)

7. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate data (most fields are editable directly in the app)
• Erasure: Delete your account and personal data via Profile → Delete Account, or by contacting us
• Portability: Request your data in machine-readable format via Profile → Export My Data, or by contacting us
• Restriction: Request that we limit processing of your data in certain circumstances
• Object: Object to processing based on legitimate interests, including behavioral analytics and automated matching
• Withdraw consent: Withdraw consent for push notifications at any time in app settings or device settings

To exercise any of these rights, contact [email protected]. We respond within 30 days (extendable by 60 days for complex requests, with prior notice).

Right to lodge a complaint: If you are located in Spain, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es. Users in other EU/EEA countries may contact their local supervisory authority.

8. Data Security

• All data in transit is encrypted via HTTPS/TLS
• Database access is controlled by Row Level Security (RLS) — users can only access data they are authorized to see
• Sessions are stored in encrypted device storage (iOS Keychain / Android Keystore)
• Production database access is restricted to authorized personnel
• Error monitoring data is sanitized before transmission — names, emails, and tokens are never sent to Sentry

9. Children

CityPros is intended for adults. Users must be at least 14 years old (or 18 in jurisdictions where a higher age applies). We do not knowingly collect data from users under 14. If you believe a minor has created an account, contact us at [email protected].

10. Changes to This Policy

We will notify you of material changes via in-app notification or email at least 15 days before they take effect. The version date at the top of this page reflects the most recent update. If changes affect the lawful basis for processing your data, we will seek fresh consent where required.