Privacy Policy

Geniva is a social platform for University of Liverpool students, operated by Joshua Hinder trading as Geniva ("we", "us", "our"). We are the data controller for personal data collected through this service.

Registered address: 124 City Road, London, EC1V 2NX

ICO registration number: 00014031434

Privacy contact: [email protected]

We are registered with the UK Information Commissioner's Office (ICO) as a data controller.

Independence notice: Geniva is an independent platform with no affiliation with, endorsement from, or involvement by the University of Liverpool. The University of Liverpool is not a data controller or data processor for this service, and has no access to or responsibility for any data collected through Geniva.

When you use Geniva we collect and process the following categories of personal data:

• Account data — your University of Liverpool email address, display name, and username, collected when you register. Your @liverpool.ac.uk address is used solely to verify student eligibility; we do not store copies of student identification documents.
• Profile data (optional) — bio, pronouns, course, year of study, profile picture, and Instagram URL. You provide these voluntarily and can update or remove them at any time.
• Society activity — which societies you join, your membership status, and any committee role you hold.
• Content you create — posts, comments, reactions, event RSVPs, pub crawl check-ins, and messages in society and event chats.
• Notification data — in-app notification history. If you opt in to push notifications, we store your browser push subscription (endpoint URL and cryptographic keys) to deliver alerts to your device.
• Usage data — login timestamps and standard server logs (IP address, request metadata). These are held by our infrastructure providers and are not used for profiling or advertising.

We do not use tracking cookies, advertising cookies, or any third-party analytics services.

We use your data solely to operate and improve Geniva:

• To provide and maintain the service — create your account, display your profile, deliver messages, and show you society and event content.
• To verify you are a University of Liverpool student via your @liverpool.ac.uk email address.
• To send transactional emails (account confirmation, password reset). We do not send marketing emails.
• To send push notifications about activity relevant to you — such as pub crawl updates or society announcements — if you have opted in.
• To enforce our Terms of Service, moderate content, and keep the platform safe.
• To maintain an audit log of moderation actions for accountability and legal compliance.

We process your personal data under the following legal bases:

• Article 6(1)(b) — Performance of a contract: processing your account data, society memberships, content, messages, and event activity is necessary to provide the service you signed up for.
• Article 6(1)(f) — Legitimate interests: maintaining security logs, moderation records, ban history, and anonymised content for the integrity and safety of the platform.
• Article 6(1)(a) — Consent: optional profile fields (bio, pronouns, course, Instagram URL) and push notification subscriptions. You can withdraw this consent at any time — remove optional profile data in your settings, or turn off push notifications in your browser settings.

We keep your data for as long as your account is active. When you request account deactivation:

• 30-day cooling-off period: your account is deactivated but recoverable. Log back in at any time within this window to reactivate.
• Purge within 90 days: after the cooling-off period, all personal data associated with your account — profile, messages, RSVPs, check-ins, and push subscriptions — is permanently deleted within 90 days.
• Posts and comments: are anonymised (your name and identity are removed) rather than deleted, so community content is preserved. The content itself remains but cannot be linked back to you.
• Moderation and ban records: where an account has been suspended or banned, we retain a minimal record (account identifier, reason, date) for up to 2 years to prevent re-registration and protect other users. This is processed under legitimate interests.
• Push notification subscriptions: deleted immediately when you withdraw consent or when your account is deactivated.
• Server logs: retained by our infrastructure providers per their standard policies (typically 30–90 days).

We share your data only with the following sub-processors, each of whom processes data solely on our instructions and under a Data Processing Agreement:

We do not sell your data to any third party, and we do not share your data with advertisers.

Your data is primarily stored in Frankfurt, Germany (EEA) via Supabase — no transfer restrictions apply. Vercel and Resend are US-based companies; transfers to them are protected by Standard Contractual Clauses (SCCs) approved by the UK ICO under the International Data Transfer Agreement (IDTA) framework.

If you choose to enable push notifications, we will store your browser push subscription and use it to send you alerts such as pub crawl updates and society announcements. This is subject to your consent under the Privacy and Electronic Communications Regulations (PECR) 2003.

You can withdraw consent at any time by disabling notifications in your browser or device settings. Doing so will not affect your ability to use Geniva.

Geniva uses only strictly necessary cookies — specifically, a single session cookie set by Supabase to keep you logged in. This cookie is essential for the service to function and does not track you across other websites.

We do not use advertising cookies, analytics cookies, or any other non-essential cookies. No cookie consent banner is required or shown because no non-essential cookies are set.

Geniva is open only to individuals who are 18 years of age or older and who hold a valid University of Liverpool @liverpool.ac.uk email address. Eligibility is verified by confirming your university email during sign-up. By creating an account you confirm you meet these requirements.

If we become aware that a user is under 18, we will promptly delete their account and associated data.

You have the following rights regarding your personal data. To exercise any of them, email [email protected]. We will respond within one calendar month.

• Right of access (Article 15) — request a copy of the data we hold about you.
• Right to rectification (Article 16) — correct inaccurate data. You can update most profile information yourself in settings.
• Right to erasure (Article 17) — request deletion of your account and data. Use "Deactivate account" in settings, or contact us directly.
• Right to data portability (Article 20) — request your data in a machine-readable format.
• Right to restriction (Article 18) — ask us to restrict processing of your data in certain circumstances.
• Right to object (Article 21) — object to processing based on legitimate interests.
• Right to withdraw consent — for consent-based processing (push notifications, optional profile fields), you may withdraw consent at any time without affecting the lawfulness of prior processing.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. Our ICO registration number is 00014031434.

We may update this policy from time to time. If we make material changes we will notify you via the platform. The "last updated" date at the top of this page indicates when the policy was last revised. Your continued use of Geniva after any changes constitutes your acceptance of the updated policy.

For any privacy-related questions or to exercise your data subject rights:

Email: [email protected]
Post: Joshua Hinder, 124 City Road, London, EC1V 2NX