MomGals — Privacy Policy

Effective Date: October 10, 2026 | Last Updated: October 6, 2026

This Privacy Policy explains how Carolina Rodriguez Hoyos, a sole trader (empresária em nome individual) operating under Portuguese tax number (NIF) 306770253 and trading as “MomGals” (“we,” “us,” “our”), collects, uses, shares, and protects personal data when you use the MomGals website and app (the “Service”). We built MomGals around a simple rule: your information is private by default, and we only share what's needed to make a good match — never your exact address, and never your children's names or photos.

1. Who Is Responsible for Your Data

Carolina Rodriguez Hoyos, trading as MomGals, NIF (Portuguese tax number) 306770253, Rua Eduardo Coelho 35, 1, 1200-165 Lisbon, Portugal, is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). As MomGals is operated by a sole trader rather than a separate company, Carolina is personally and directly accountable for how your data is handled. You can reach us about any privacy question at wecare@momgalsapp.com. We have not appointed a Data Protection Officer, as one is not currently required for an operation of our size; all privacy requests go to the address above and are handled personally by Carolina.

2. Personal Data We Collect

We collect the following categories of data, all provided directly by you unless noted:

Required vs. optional: your name, email, city and location, live selfie, pregnancy status, and children's approximate ages are needed to verify you and match you, so we cannot provide the Service without them. Your work status, business description, hobbies, and bio are optional.

3. How We Collect Your Data

We collect data you provide directly when you register, complete your profile, verify your identity, send messages, create listings or events, or contact support. We also collect data automatically through your use of the Service (such as device information), and location data through your browser or device's geolocation permission, which you can decline, though this will limit matching.

4. A Note on Sensitive Data

Under GDPR, information about pregnancy and health-related status is treated as a “special category” of data requiring extra care. When you tell us you are pregnant, or share your children's approximate ages, you are giving us your explicit, informed consent to process that specific information for the purpose of matching you with similar members. You can withdraw this consent at any time by editing your profile or deleting your account, though doing so may limit or end your ability to use core matching features.

5. Our Legal Basis for Processing

• Contract performance: processing needed to create your account, form your tribe, run messaging, and deliver the subscription you've signed up for.
• Consent: for pregnancy and children's-age data (Section 4), for precise location access, and for any marketing communications you opt into.
• Legitimate interests: for safety and moderation activities (verification review, fraud prevention, handling reports), for improving the Service, and for limited analytics — balanced against your privacy interests.
• Legal obligation: where we must retain or disclose data to comply with tax, accounting, or other legal requirements.

Emails: we send service emails that are part of running your account — welcome, approval or rejection of your account, payment problems, warnings, and referral rewards. These are not marketing. We only send marketing emails (news, offers, city launches) if you tick a separate, unticked consent box, and you can unsubscribe at any time from any email or your settings.

6. Who We Share Your Data With

Other members

When you're matched into a tribe, your matched members can see: your first name and profile photo, your neighborhood-level area label (never your exact address or GPS pin), the languages you speak, your hobbies/interests, and the approximate ages of your children if you have any. Anything you post in chat, community discussions, events, or the marketplace is visible to the relevant audience for that feature (your tribe, an event's attendees, or the whole community, depending on where you post it).

Service providers

We share limited data with the vendors who help us run MomGals, under contracts that require them to protect your data and use it only to provide their service to us:

• Supabase — hosts our database, authentication, file storage, and real-time messaging infrastructure (servers in Ireland, EU).
• Vercel — hosts and serves the MomGals app and website.
• Resend — sends our emails, such as account confirmation and password reset.
• Natively and OneSignal — run the MomGals iPhone and Android app and deliver push notifications to your phone (they receive your member ID, a device identifier and the notification text, never your messages or profile).
• Stripe — processes payments and stores your payment method and subscription details, only if you choose a paid membership.
• OpenStreetMap Nominatim — powers the city and address search and converts coordinates into a neighborhood-level area label.

Our team

A small admin team manually reviews verification selfies and safety reports. Verification photos are stored in a restricted, admin-only storage area and are not visible to other members.

What we don't do

We do not sell your personal data, and we do not share your exact address or GPS coordinates with other members or with any third party for advertising purposes.

7. Safety, Moderation, and Fraud Prevention

We use certain personal data specifically to help keep MomGals safe:

• Verification data — your live selfie is used to confirm your account is controlled by a real person whose photo matches her profile picture, and are reviewed only by a small, restricted admin team.
• Report, warning, and ban records — who reported whom, why, and what action we took, so we can identify repeat problem accounts and enforce our Terms of Use consistently.
• Marketplace and event review records — used to approve or reject listings and events before they go live.

We process this data on the basis of our legitimate interest in maintaining a safe community and, where relevant, to comply with legal obligations. Please note that these measures — described in full in Section 3 of our Terms of Use — confirm identity and help us enforce our rules, but they are not criminal background checks and cannot guarantee the safety of any interaction. We do not run criminal record or sex-offender registry checks on members.

Verification selfies are compared with your profile photo by a member of our team looking at both images. We do not use facial-recognition software or create biometric templates. Our team may also read messages and posts when they are reported to us, but only to the extent needed to review that report.

8. How Long We Keep Your Data

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymize your profile, location, and family data within 15 days, except where we must keep certain records longer to comply with legal, tax, or fraud-prevention obligations (for example, payment records may be kept as required by accounting law). Messages you've sent may remain visible to the other participants in that conversation after you delete your account, in the same way a text message doesn't disappear from the recipient's phone.

9. International Data Transfers

Some of our service providers (including Vercel, Resend, Natively, OneSignal, and Stripe) may process data outside the European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards recognized under GDPR, such as the European Commission's Standard Contractual Clauses or the provider's own adequacy certifications. Our database, authentication, and file storage are hosted in the European Union (Ireland, on Amazon Web Services), so your core account data stays within the EU.

10. Your Rights Under GDPR

If you are located in the EU/EEA (and, in many cases, regardless of location), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (“right to be forgotten”), including by deleting your account in-app.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, for any processing based on consent (this won't affect processing carried out before you withdrew it).
• Not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Our tribe-matching algorithm automatically suggests groupings based on location, language, and children's ages, but does not deny you access to the Service or make any legal or similarly significant decision about you without the possibility of human review — you can contact us to ask a human to review or explain a match.
• Lodge a complaint with your local data protection supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), or the supervisory authority in your own EU/EEA country of residence.

To exercise any of these rights, contact us at wecare@momgalsapp.com. We will respond within the timeframes required by law.

11. Children's Data

MomGals is intended for adults 18 and over and is not directed at children. We do not knowingly collect personal data directly from children. The only information we hold that relates to your children is what you, as their parent, choose to share for matching purposes — specifically, a count and approximate age per child (e.g., “Little one #1: 2 years”). We do not collect your children's names, photos, or any other identifying information through the app, and we ask that you avoid sharing such details in chats, posts, or listings.

12. How We Protect Your Data

We apply technical and organizational measures designed to protect your data, including:

• Database-level access rules (row-level security) so that each member can only read or write her own data — there is no general cross-member access to raw account data.
• Verification selfies stored in a private, admin-only storage area with no public link, never visible to other members.
• Encrypted connections (HTTPS/TLS) between your device and our servers.
• Payment card data handled directly by Stripe, a PCI-compliant payment processor; we never receive or store your full card number.
• Access to admin tools (including the verification review and moderation queues) restricted to a small, authorized team.

These measures reduce risk but cannot eliminate it. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or stored by us. If a personal data breach is likely to put your rights at risk, we will notify the Portuguese data protection authority (CNPD) within 72 hours and, where required, notify you without undue delay.

13. Cookies and Similar Technologies

MomGals uses only cookies and similar local-storage technologies that are strictly necessary to keep you logged in and the Service working. We do not use analytics, advertising, or tracking cookies. If we ever add them, we will update this Policy and ask for your consent first.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in-app or by email before they take effect.

15. Contact Us

Questions or requests about this Privacy Policy can be sent to wecare@momgalsapp.com, or by post to Carolina Rodriguez Hoyos (NIF 306770253), Rua Eduardo Coelho 35, 1, 1200-165 Lisbon, Portugal.