Privacy notice

1. Operator and scope

Gigolo Select is publicly accessible. Applications remain private until approved publication. Before processing real personal data the controller must identify their name or company, address, country and privacy contact, and any required EU representative or DPO. No operating company has been designated. This draft does not identify a third-party company as our controller.

2. Data and purposes

Registration and new sign-ins use Gigolo Select email and password. Only a scrypt password hash with a random salt is stored. Existing profile identifiers are retained; setting their password requires an existing authenticated session or a personal link issued by the operator after checking ownership. Applications store public name, private first and last names, stated age, city, languages, audiences, description, activities, photos, optional video and audio, contacts, requested plan. This supports saving and managing the profile. The server records acknowledgment dates, document version and offer summary, never card numbers, CVV or IBAN. Profile reports store the reporter’s email, reason, details, affected profile, date and review status; only the operator can view them to investigate content and abuse.

3. Legal grounds and sensitive data

The final service must identify contractual/precontractual grounds for applications, assessed legitimate interests for security and separate freely given consent for marketing. Acknowledging this notice is not blanket consent. Audiences and content may reveal sex life or orientation: an appropriate Article 9 GDPR basis, minimisation and any required assessments must be established before processing real data. Do not upload intimate information, identity documents or other people’s data.

4. Required information and disclosure

Email and WhatsApp are required; Telegram and marketing are optional. Full name and email remain private. Published profiles show the public name, photos and authorised details, including enabled WhatsApp. Applications remain private until authorised publication. Authorised operators can export contact and consent records; this preview does not sell a contact list.

5. Providers and transfers

The site uses Cloudflare Workers hosting, a D1 database for account details and media and Gigolo Select email/password authentication. No payment provider is connected. Contracts, processors, subprocessors, processing locations and safeguards for transfers outside the EEA must be documented before launch. EU-only storage is not guaranteed. Applicable GDPR duties can apply to an operator outside the EU.

6. Retention and deletion

Applications remain until deleted from the professional area; withdrawal does not delete them. Deleting a profile removes its application, photos and professional conversations through the app. Provider backups and logs follow separate schedules to be documented. A SHA-256 digest of the account identifier and its activation date remain to prevent restarting the included month after deleting and recreating a profile; this record contains no photos, name or contact details. Withdrawn forum posts are hidden, not deleted from the database. Final retention periods for inactive applications, consent records, support, accounting and backups remain to be established.

7. Messages and external services

Participants can access their conversations through the app; there is no end-to-end encryption. History remains readable after expiry; active GOLD enables new chats. WhatsApp and Telegram are external services with their own notices. Forum content is visible to users who can access the site. Do not share private details or third-party data.

8. Browser storage and tracking

Saved profiles, filters and test reviews are stored in the browser session. Home Screen installation caches only a generic offline page, not personal profiles or data. Hosting and authentication may use necessary technical tools. Optional analytics are described in the Google Analytics 4 section.

9. Marketing and rights

Email marketing consent is optional, unchecked by default, separately recorded and revocable in your profile without losing access. No promotions are sent in this preview. Applicable rights include access, rectification, erasure, restriction, objection, portability, consent withdrawal and complaints to a supervisory authority. We make no solely automated decisions with legal effects. A controller contact must be established before launch; manage test data from your professional area.

Manual activation requests

You can request instructions to activate or renew your plan from your account. A request is not a purchase, does not authorise charges and does not activate the profile. We store the account, plan, duration, indicative amount, status and dates, visible to the requester and operator. The prepared workflow also records operator instructions, payment reports, receipt references and the confirming operator; reconciliation references remain private to the operator. Collection stays disabled until the operator, commercial terms, tax arrangements and eligible account are defined. Do not send money in this preview.

Google Analytics 4 · Cookie _ga / _ga_*

Google Analytics 4 is optional: when configured, its tag loads only after “Accept analytics”. It collects cookie identifiers, technical device data, approximate geographic area and visits to information pages only. We do not send names, contact details, messages, applications, profile identifiers, filters or URL parameters. Articles are grouped under Magazine; referral information is limited to the domains of selected search engines, without search queries. Ad personalisation, Google Signals and automatic enhanced measurement are disabled. The choice and Analytics cookies last up to 180 days; withdraw consent using “Cookie preferences” in the footer. Refusal does not limit the service. Google processes data under its own privacy policy and may process it outside the EEA: the operator must complete provider and transfer documentation before public launch. DNS verification in Search Console installs no analytics cookies. With the same consent, Gigolo Select records card impressions, profile opens and contact clicks in its own database. Counters store no visitor identity, IP, contact details or browsing history and are not sent to Google. Only the profile owner can see them; they do not represent unique people or meetings.

Google · Privacy notice ↗

Personal details, galleries and reviews

Height, weight, hair, eyes, build, smoking, habits and personal answers are optional and appear on the published profile when provided. Extra galleries accept non-explicit images only, under the same access rules as regular galleries. Reviews require sign-in and an adult declaration; we store the account identifier, reviewed profile, chosen alias, rating, text, dates and status. Only the alias, rating, text and date are public after moderation. Account names and emails remain private; meetings are not verified. You can withdraw your review on the profile: it is hidden but retained for moderation. Deleting the reviewed profile deletes its associated reviews. Do not include intimate details, contact details or third-party data. Reviews are saved in the database, not only in the browser.

Account security

The technical gs_session cookie is HttpOnly, SameSite=Lax, Secure over HTTPS, and lasts up to 30 days. Only the token digest is stored. The technical gs_email_access cookie lasts up to one year and keeps the new sign-in choice after sign-out. Signing out revokes the session; changing a password revokes previous sessions. Abuse counters store only keys derived from email or IP and short expiry times. Personal recovery links are single-use, expire after one hour and require an ownership check by the operator. Recovery is assisted; automatic emails are not promised. Technical cookies do not require analytics consent. Deleting a profile does not automatically delete account credentials; contact the operator for full deletion.