Privacy notice

Last updated: 18 September 2026

Controller and scope

X20 Digital Trust Services S.r.l., Via Luigi Varanini 24, 20127 Milano, Italy, VAT number 12300800963, is the sole controller. Email: info@x20digitaltrust.com. Certified email (PEC): x20digitaltrust@pec.x20digitaltrust.com.

This notice covers amemus.app, its waitlist and newsletter form, and related correspondence only. It does not cover the app. We apply Regulation (EU) 2016/679 (GDPR), the Italian Privacy Code and, where applicable, the UK GDPR and Data Protection Act 2018.

Information collected

We collect your email, selected subscriptions, confirmation that you are 18 or older, submission and confirmation timestamps, consent wording/version, and necessary delivery records.

Technical information includes IP address, browser information, access times and security events. We also process information you voluntarily send when contacting us. Please do not send identity documents or sensitive personal details.

The website does not collect dating profiles, photographs, partner preferences, conversations, or declarations about relationships, sex life or sexual orientation. No matching or messaging takes place on this website.

Purposes and legal bases

Waitlist: managing your request and emailing you about Amemus's availability, based on consent, Article 6(1)(a) GDPR.

Newsletter: emailing Amemus news and promotional communications, based on separate consent, Article 6(1)(a) GDPR and Article 130 of the Italian Privacy Code; applicable UK electronic-marketing rules also apply.

You may choose either, both or neither. Newsletter consent is never required for the waitlist. Neither is required to browse.

Website operation, security, abuse prevention, age-eligibility administration and responding to general enquiries rely on our legitimate interests, Article 6(1)(f), balanced against your rights. Handling statutory rights requests and demonstrating GDPR compliance rely on Article 6(1)(c). Necessary legal-claims processing relies on Article 6(1)(f).

Interest in a dating app and explicit consent

Subscribing indicates interest in a dating app, not a declaration about your relationships or sexual orientation. As this association may indirectly reveal information about sex life or sexual orientation, we seek explicit consent under Article 9(2)(a), separately for each selected subscription. We use this association only to administer that subscription and send its requested communications. We do not infer intimate characteristics, enrich the information, create profiles, train AI or make significant automated decisions. The limited legal-record exceptions below are not permission for further marketing or analysis.

Confirmation and withdrawal

The confirmation email identifies your selections. Its link expires seven days after sending. Confirmation activates only the selected subscriptions. Until then, we use the submitted data only to verify your request and record your choices; no availability or newsletter messages are sent.

Unconfirmed requests are deleted from active systems on day eight. Joining requires your email, the relevant consent and the 18+ declaration.

Each subscription can be stopped independently, including its associated explicit consent, through the link in its emails or by contacting us. Withdrawal does not affect earlier lawful processing.

Recipients and international transfers

Authorised staff and instructed providers access only necessary data. Supabase provides the CRM and receives the form, with its database in Ireland; Google Workspace (Google Ireland Limited) to send confirmation emails and subsequent communications relating to the subscriptions you select; Lovable hosts the website pages only and receives no form data. The form sends your data directly to Supabase; Google Workspace processes the email address and message content needed for the subscriptions you select. Providers acting on our instructions are processors under Article 28 GDPR. Necessary information may also reach professional advisers and competent authorities. We do not sell or publicly disclose subscription data.

Irish infrastructure does not mean exclusively European processing. Google may also process data in the United States (Google LLC participates in the EU-US Data Privacy Framework); Supabase's contracting entity is in Singapore. Form submissions may also be processed outside the EEA. Hosting, support and subprocessors can involve additional international access.

Transfers rely on applicable adequacy decisions or contractual safeguards, including EU standard contractual clauses, with necessary supplementary measures. Contact us for the recipient list, destinations and copies of safeguards. For transfers subject to the UK GDPR, the UK Extension to the EU-US Data Privacy Framework or the contractual safeguards required under UK law apply, as appropriate.

Retention

Waitlist records are kept until the availability notification, withdrawal, project cancellation or 24 months after confirmation, whichever occurs first. Newsletter records are kept for up to 24 months after confirmation, unless withdrawn or discontinued earlier. Continued newsletters thereafter require renewed consent.

Technical and delivery logs are kept for 30 days; identifiable records of unconfirmed requests are deleted on day eight. Deletion covers the copies of the confirmation messages sent and any other request data held in active systems managed by X20. General correspondence is kept for 12 months after resolution.

Minimal consent, withdrawal and suppression records are retained separately for up to five years where necessary. Special-category content is deleted when consent ends unless strictly necessary for establishing, exercising or defending legal claims under Article 9(2)(f). Records needed for an actual dispute may remain until its final resolution. None are reused for communications or profiling.

Deleted data in isolated backups expire within 90 days and are not restored to mailing lists. For Google, deletion of residual copies from the provider's systems may take up to 180 days following the definitive deletion instruction, under its DPA.

Your rights and complaints

You may request access, rectification, erasure, restriction and, where applicable, portability. You may object to legitimate-interest processing for reasons relating to your situation, and to direct marketing at any time.

Contact us using the details above. We normally respond within one month; a lawful extension of up to two further months will be explained within the first month.

You may complain to the Italian Garante, or the competent authority in your EU country of habitual residence, work or alleged infringement. Where UK law applies, you may also complain to the Information Commissioner's Office. Your right to seek judicial remedies remains unaffected.

Under-18s and changes

Subscriptions are restricted to people aged 18 or over. The form asks for an age declaration, not identity documents. If we discover an underage subscription, we stop communications and erase its data, subject only to necessary lawful records.

Changes are published here with their date. A new purpose requiring consent will not begin without fresh consent.