Privacy Policy
What we collect, why, how long we keep it, who sees it, and what you can do about it. Written to be read.
Version 2026-11-12
1. Who is responsible
Nordiso, 21660 Parainen, Finland, business ID 3588847-6, is the controller of your personal data. For questions or requests about your data, write to info@nordiso.com.
2. What we collect
| Who | What | Where it comes from |
|---|---|---|
| DJs and venues | Name, email, a password stored only as a one-way hash, DJ or venue name, city, country, prices, earnings and payout records, the date you accepted our terms. | You |
| Guests sending requests | The song, dedication or tip you send, the name or table you type, the amount paid, and a random device ID kept on your phone to limit abuse. | You |
| Guests in table sharing | Your account and profile (below), a note about your table, your table or seat request, a keyed fingerprint of your phone number (not the number itself), whether you were inside the venue (from your phone’s location if you allow it), and safety reports you make or that are made about you. | You, and your phone |
| Members and profiles | Email, first name, a face photo taken with your camera, up to three more photos, a yes or no from your browser on whether it found one face in that photo (nothing else about your face leaves your phone), the messages in your conversations while they exist, and your subscription status. | You |
| Everyone | Payment details handled by Stripe (we receive status and a reference, never your full card number), a hashed network address next to your consent record, and technical logs needed to keep the service secure. | You and Stripe |
We do not ask for or store your sexual orientation, health, religion, political views or any other special category of data. We do not run face recognition, we do not compare faces and we do not create face templates. Each photo you add is sent once, without your name or email, to an automatic content check (OpenAI’s moderation service) that looks for explicit or graphic content. It is not used to identify you. Photos are re-saved on our servers, which removes any hidden location or camera details.
3. Why we use it, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Run requests, table sharing and memberships; take and refund payments; pay DJs and venues | Contract (Art. 6(1)(b)) |
| Show your face, first name and photos to other guests who may share a table with you | Your consent (Art. 6(1)(a)), given each time you join a venue. You can withdraw it by leaving, or by deleting your photos or your account |
| Automatically check profile photos for explicit or graphic content, and have a person review the ones it flags | Our legitimate interest in keeping the service safe and lawful (Art. 6(1)(f)). A person makes the final decision on any flagged photo; nothing is decided by the automatic check alone except refusing a clearly explicit upload, which you can contest by writing to us |
| Check that you are in the venue, verify phone numbers, filter messages, review reports, ban people who harm others, keep the service secure | Our legitimate interest in running a safe service (Art. 6(1)(f)), balanced against your rights, and your safety |
| Keep proof that you accepted our terms and are 18 or older | Legitimate interest in being able to show consent; legal obligation where it applies |
| Accounting, tax, and responding to authorities | Legal obligation (Art. 6(1)(c)) |
We do not use your data for advertising and we do not sell it. Our filters flag messages for a person to review. They do not make decisions that have legal or similarly significant effects on you.
4. How long we keep it
| Data | Kept for |
|---|---|
| Messages in tonight’s chat between two guests who agreed to meet | Until either of you ends it, or the venue closes the night. Messages you report are kept for 90 days |
| Tonight’s table session: your table, seat requests, notes, phone fingerprint, and the copy of your name and face used tonight | Until the venue closes the night, or 10 hours after you join, whichever comes first, or until you press “Leave and delete my data”. If you and another guest chose to keep in touch, 24 hours so you can finish setting up |
| Your account and profile: email, first name, face photo, extra photos | Until you delete your account in the app, which removes them at once. |
| Messages in a keep-in-touch conversation | Until either person ends it, a subscription ends, or the paid month runs out. Then deleted for both people |
| A report and the messages attached as evidence | 90 days from the report, then deleted |
| Fingerprint of a banned phone number | Until the ban is lifted. It cannot be turned back into a number |
| Song requests and dedications | As needed to run the night and handle disputes, normally deleted or anonymised within 12 months |
| Proof of consent (version accepted, date, hashed network address) | For guests, 24 months. For accounts, for as long as the account exists plus the period in which claims can be made |
| Audit log of safety and deletion actions (no message content) | 12 months |
| Accounting and payout records | As long as accounting law requires, typically 6 to 10 years. They do not include messages or profiles |
| DJ, venue and member accounts | Until you ask us to delete the account, apart from records we must keep by law |
5. Who sees your data
- Other guests and venue staff see what is needed for table sharing: your face and first name (and your other photos if they open your profile), your note, which table you are at, and an alert if you press “I feel unsafe”. Guests who choose to appear on the board are shown to everyone checked in at that venue, and can hide themselves at any time. Photos are never in a public page and are only served to guests checked in at that venue, to its staff, to you and to our admins.
- The DJ sees the request, dedication or tip you send and the name you typed. They do not see your payment details.
- The other person in a conversation sees your first name, photo and messages. Staff do not.
- Our service providers, who process data for us under contract: OpenAI (automatic check of profile photos for explicit content), Stripe (payments and payouts), our hosting and database provider, a text-message provider for verification codes (for example Twilio), and an email provider for sign-in codes (for example Resend).
- Authorities and others where the law requires, or to protect someone’s safety or our rights. We will tell you unless the law forbids it.
6. Transfers outside the EEA
Some providers, such as Stripe, may process data outside the European Economic Area. Where they do, we rely on adequacy decisions or the European Commission’s standard contractual clauses and the provider’s additional safeguards.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time (which does not affect what we did before). To use these rights, write to info@nordiso.com. We reply within one month.
You can also complain to the data protection authority in your country. For Finland this is the Office of the Data Protection Ombudsman. Configured authority: Office of the Data Protection Ombudsman (Finland).
8. Children
Roomcue is for people aged 18 or older. We do not knowingly collect data about anyone younger. If you think a child has used the service, tell us at info@nordiso.com and we will delete it.
9. How we protect it
Passwords are hashed. Phone numbers are stored only as keyed hashes. Connections are encrypted. Staff access to personal data is limited to what the work needs and is logged. Venue staff cannot read conversations. No system is perfectly secure; if there is a breach that puts your rights at risk, we will tell you and the authority as the law requires.
10. Cookies
We use only the cookies and browser storage needed to make Roomcue work. No advertising or tracking. See the Cookies page.
11. Changes
When this policy changes in a way that matters, we update the version at the top and ask you to read it again before you carry on.