Incident #BBA443 · 06 OCT 2026notable
ROMEO rewrites EU privacy policy with detailed data lists, recipients and transfer safeguards
ROMEO's EU privacy policy now lists the data processed for each purpose, names recipient categories with countries and purposes, and explains international transfer safeguards (SCCs). It cites GDPR articles and states that data is deleted within 1 day of account deletion, with a 28-day backup as before. Sensitive data is now processed because users made it public, and the explicit-consent option and the in-app ad-consent wording are gone.
Taken from you
- Sensitive data (e.g. sexual orientation) is now processed on the basis that you made it public, no longer 'explicit consent' wording
- Policy now mentions possible sharing of user profiles for internal business operations.
- Data protection officer email replaced by a generic legal@ address
Won back
- Clear per-purpose lists of data collected
- Named recipient categories with countries and purposes
- Explained international transfer safeguards and SCC rights, including claiming damages
- Statement that personal data is deleted within 1 day of account deletion.
- Legal bases (GDPR articles) cited; reCAPTCHA data not stored by ROMEO
Evidence · 4 of 4 quotes matched in source
Where you choose to make such information public through your ROMEO profile or other public features of the ROMEO services, ROMEO processes this information on the basis that you have manifestly made it public (Article 9(2)(e) GDPR).+ inserted · ✓ matched in source
Internal business operations and potential sharing of user profiles (with a legal basis).+ inserted · ✓ matched in source
After your account has been deleted, your personal data is deleted within 1 day, but they will remain in a back-up for another 28 days.+ inserted · ✓ matched in source
Archived version ↗ · 2,112 words changed