Privacy Policy

Last updated: May 23, 2026
Effective date: May 23, 2026

1. Data Controller

The data controller responsible for the processing of your personal data is:

Circl
Postal address: Paris, France
Email: privacy@app-circl.com

For all questions regarding your personal data and the exercise of your rights, you may contact our Data Protection point of contact at privacy@app-circl.com.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Information you provide directly

• Account information: email address, password (encrypted), username, date of birth, profile photo;
• Profile information: biography, interests, location (city/country), language preferences, profile pictures, video presentation;
• Content you create: posts, stories, photos, videos, comments, messages, exclusive content;
• Communications: private messages, support requests, feedback;
• Payment information: processed exclusively by Apple App Store and Google Play Store. Circl does not directly collect or store payment card data.

2.2 Information collected automatically

• Device data: device type, operating system, unique device identifiers, mobile operator, language settings;
• Usage data: features used, pages viewed, time spent, clicks, interactions with content and other users, search queries;
• Technical data: IP address, browser type, app version, crash reports, performance data;
• Approximate location: derived from your IP address to provide localized content (we do not collect precise GPS location unless you explicitly enable it);
• Cookies and similar technologies: see Section 11 below.

2.3 Information from third parties

• If you sign in using a third-party account (Apple, Google), we receive limited profile information from that provider, in accordance with the permissions you grant.

3. Sensitive Data

Circl is built for and by the global Afro community. By voluntarily creating a profile and sharing content on Circl, you may reveal information that could be considered "sensitive data" or "special category data" under applicable privacy frameworks, such as your racial or ethnic origin, religious beliefs, political opinions or sexual orientation.

Circl processes such data only on the basis of your explicit consent, given through your free decision to share this information publicly or with selected users on the Platform. You may withdraw this consent at any time by editing or deleting the relevant content, or by deleting your account.

We apply enhanced security measures to sensitive data and never share or sell such data to third parties.

4. Why We Process Your Data and on What Legal Basis

We process your personal data for the following purposes, each justified by a specific legal basis under the NDPA and GDPR:

5. Automated Decisions & Profiling

Circl uses recommendation and discovery algorithms to suggest content, profiles and communities you may find relevant. This involves limited profiling based on your activity, declared interests and interactions with other users.

These algorithmic suggestions do not produce legal effects on you or significantly affect you in a similar way. You retain full control over which content you consume and which connections you accept. You may also adjust your discovery preferences in the app settings.

If you wish to object to profiling-based recommendations, you may do so by contacting privacy@app-circl.com.

6. Who We Share Your Data With

We do not sell your personal data. We share data only in the limited circumstances described below.

6.1 Other users of the platform

Information visible to other users on Circl includes your username, profile photo, biography, posts, public stories and other content you choose to share publicly or with selected users. Your privacy settings control this visibility.

6.2 Service providers (data processors)

We use trusted third-party service providers ("data processors") to operate the Service. These providers process your data on our instructions, under contractual obligations consistent with global data protection standards:

We may update this list as our infrastructure evolves. The current list is maintained on this page.

6.3 Legal authorities and law enforcement

We may disclose personal data when required by law, court order or other legal process, including in response to lawful requests from public authorities for national security or law enforcement purposes. In matters involving child safety, we proactively report to the National Center for Missing & Exploited Children (NCMEC) as required by US federal law (18 U.S.C. § 2258A) and to relevant national authorities.

6.4 Business transfers

In the event of a merger, acquisition, reorganization, sale of assets or bankruptcy, your personal data may be transferred to a successor entity, subject to equivalent protections.

7. International Data Transfers

Circl is based in France (European Union) and operates a global Service. As a result, your personal data may be transferred to, stored or processed in countries outside Nigeria or the European Economic Area (EEA), including the United States, where our cloud providers (AWS, Google Cloud) operate data centers.

When we transfer data internationally, we ensure an adequate level of protection through standard contractual safeguards, institutional adequacy mechanisms, and robust technical measures (encryption, access controls).

You may request a copy of the safeguards in place for international transfers by contacting privacy@app-circl.com.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy and to comply with our legal obligations. Specific retention periods include:

9. Your Rights Under Data Protection Laws

Depending on your location, including under the NDPA and GDPR, you have the following data privacy rights:

• Right of access: obtain confirmation that we process your data, and receive a copy;
• Right to rectification: correct inaccurate or incomplete data;
• Right to erasure / "right to be forgotten": request deletion of your data;
• Right to restriction of processing: limit how we use your data in certain circumstances;
• Right to data portability: receive your data in a structured, commonly used and machine-readable format;
• Right to object: object to processing based on legitimate interests, including profiling;
• Right to withdraw consent: withdraw consent at any time for processing based on consent (e.g. marketing, sensitive data);
• Right to lodge a complaint with a supervisory authority: in Nigeria, the Nigeria Data Protection Commission (NDPC); in France, the CNIL; or your local data protection authority.

To exercise these rights, contact us at privacy@app-circl.com. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.

10. Your Rights Under CCPA / CPRA (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: what personal information we collect, use, disclose and (if applicable) sell or share;
• Right to delete personal information we have collected from you;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information;
• Right to limit use of sensitive personal information to specific purposes;
• Right to non-discrimination for exercising your CCPA rights.

"Do Not Sell or Share My Personal Information"

Circl does not sell personal information in the conventional sense and does not engage in "sharing" for cross-context behavioral advertising. You may exercise your privacy rights at any time by contacting privacy@app-circl.com.

11. Cookies & Similar Technologies

Circl uses cookies and similar technologies on the website to provide and improve the Service. The categories of cookies we use are:

Non-essential cookies (analytics, functional, marketing) are loaded only after you give explicit consent through our cookie banner.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure or destruction, including:

• Encryption in transit (TLS) and at rest;
• Access controls and authentication (limited personnel access on a need-to-know basis);
• Regular security audits and vulnerability assessments;
• Monitoring and incident response procedures;
• Secure development practices.

In the event of a data breach affecting your personal data, we will notify the relevant supervisory authority and affected users without undue delay where required by applicable laws.

13. Minors

Circl is strictly limited to users aged 18 years and older. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor, we will promptly delete it.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at childsafety@app-circl.com. See also our Child Safety Standards Policy.

14. Profile Visibility and Public Content

Information you share on your profile, including posts, stories, photos, comments and bio, may be visible to other users depending on your privacy settings, the audience you select, and your interactions with communities.

Once you make content public, other users may share, screenshot or save it outside Circl. We cannot control such uses, and we encourage you to share thoughtfully.

15. Links to Third-Party Services

The Service may contain links to third-party websites, apps or services. We are not responsible for the privacy practices of those third parties. We recommend reviewing their privacy policies before sharing your data with them.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the Service or in applicable laws. When we make material changes, we will notify you through the application, by email, or by other reasonable means, at least 30 days before the changes take effect.

The "Last updated" date at the top of this Policy indicates when it was most recently revised. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

17. Related Policies

This Privacy Policy is part of our broader user agreement. Please also review:

• Terms of Use — general contractual agreement;
• Community Guidelines — detailed rules of conduct;
• DMCA Policy — copyright procedures;
• Child Safety Standards Policy — child protection commitments.

18. Contact Us

For any question regarding this Privacy Policy or the exercise of your rights:

If you are located in Nigeria and are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC): ndpc.gov.ng.

This Privacy Policy is intended to provide transparency about Circl's data practices and to ensure compliance with applicable data protection laws. It does not constitute legal advice. We recommend reviewing this Policy with a qualified data protection counsel prior to public release.