Privacy Policy

Version in effect as of October 29, 2026. It applies to the souperclub.app website, the app.souperclub.app application and the emails sent by Souper Club. Version française.

1. Who is responsible for your information

Souper Club is operated by Gildas Attachi, operator of Souper Club, South Shore of Montréal (Québec) J0L 1N0.

Person in charge of the protection of personal information: Gildas Attachi, founder. Email: gildas@souperclub.app. Mailing address: as above. Send any question, request for access, correction or deletion, or complaint to this person.

2. What we collect

What you give us

• Email address: to sign in (a code is sent to you, no password) and to send you messages about your dinners. It is never shown to other couples.
• Your couple’s first names and city.
• Couple introduction: a few words you write (2,000 characters maximum).
• What you’re looking for (optional): a private choice, made by each person for themselves. We treat it as sensitive information. It is never displayed to other couples; it is only revealed if it is mutual: to your partner if you made the same choice, and as a discreet ✦ sign when both partners of two couples have made that same choice. You can change it at any time in the Couple tab.
• Couple photo (optional): the app resizes it and converts it to a JPEG of about 500 KB at most, without the original’s hidden data (location, device). It is kept in private storage.
• Age declaration: you confirm that you are 18 or older; we record the date of this declaration. It is a declaration, not an identity check.
• Your partner’s email, if you invite them: it is used only to send them the invitation and to check that it is really that person who joins your couple. It is erased as soon as your partner joins you, and the invitation expires after 14 days.
• Your tables and dinners: restaurant, address, city, date and time, budget per person, welcome note, table visibility, requests, each person’s approvals, attendance confirmations, confirmation that the dinner took place.
• Messages: the conversation between the four participants of a confirmed table.
• “Would you do it again?” answer (yes, maybe, no) after a dinner. It stays private: the other participants don’t see it.
• “See each other again?” answer after a dinner: a secret choice, revealed only if all four participants made it.
• Verification selfie (Souper Club+, optional): a photo of the two of you holding a handwritten code. Only the person doing the check sees it; it is deleted as soon as the decision is made. We only keep the fact that your couple is verified.
• Reports and blocks: the text of your report, the table concerned, and the list of couples you have blocked.

What is recorded automatically

• Technical data needed for the service to work: creation and modification dates, anti-abuse counters (for example the number of invitations sent in a day), the list of couples who opened the link of a “link only” table.
• Notification token: if you allow notifications on your phone, a technical device identifier used to send them to you. It is deleted with your account.
• Preferred language (French or English): to write to you in your language.
• Copy of emails sent: recipient address, subject, text and sending date, kept for the period set out in section 7.
• Technical logs from our hosts: IP address, device and browser type, date and time of requests. They are used for security and troubleshooting.
• Sign-in session: on the web, it is kept in your browser only for the life of the tab (session storage); on a phone, in the device’s secure storage. We use no advertising or audience-measurement cookies.

What we don’t collect

No geolocation, no phone contacts, no home address, no ID document, no payment data (the service is free and you pay for your meal directly at the restaurant).

3. Why we use it

• To create your account and your couple, with each partner’s personal consent.
• To publish your tables, pass on requests and approvals, and open the four-way conversation.
• To send you emails related to the service (section 9).
• To keep the service safe: prevent abuse, handle reports, enforce blocks and, if necessary, suspend an account.
• To learn whether Souper Club makes people want to do it again, from answers counted overall, without identifying anyone.

We do not use your information for advertising, we do not sell it and we do not share it with anyone other than the other participants (section 4) and our providers (section 6). If we ever wanted to use it for another purpose, we would ask for your consent first.

Sensitive information. Your photo and the fact that you are a couple can say a lot about your private life. That is why your profile and photo are only visible after the express consent of each of the two partners, and you can withdraw that consent at any time.

4. Who sees what

• Until both partners have given their consent, your profile is visible to no one but the two of you.
• After that, your first names, your city and your introduction are visible to: registered and approved couples who can see one of your open tables; the hosts of a table you have asked to join, once you have both given your consent; the couple you share a confirmed table with.
• The photo follows the same rules, and only if each of you has approved that specific photo. A new photo requires new approvals.
• A table “for all registered couples” appears in the feed of registered and approved couples. A “link only” table only appears to couples who have opened its link.
• A table’s share link: anyone who has the link, even without an account, sees the hosts’ first names, the restaurant name, the city, the date, the budget, the beginning of the welcome note and the table’s status. Never the exact address, the photo or the conversation. Only share this link with people you trust.
• The restaurant address and the conversation are only accessible to the four participants of a confirmed table. The conversation closes if the table is cancelled, and is erased if the guest couple withdraws.
• Couples you block no longer see your tables and can no longer interact with you.
• The people in charge of moderation (section 10) can view reports and, if a report justifies it, the tables and messages concerned.

5. Your consent

When you sign up, we ask you to accept these rules by ticking a separate box. Each partner then gives their own consent to make the profile visible, then the photo, then each dinner request or acceptance. You can withdraw a consent at any time: remove the photo, withdraw from a table, block a couple or delete your account. Withdrawing some consents may prevent you from using part of the service (for example, without an approved profile, you cannot post a table).

6. Our providers and hosting outside Québec

We use providers that process your information on our behalf, only to provide the service, under written agreements that require them to protect it and not to use it for other purposes:

• Supabase: database, sign-in and photo storage. The data is hosted with Amazon Web Services, Canada (Central) region, in Montréal (Québec).
• Resend: sending emails, from the address connexion@souperclub.app. Your email address and the message text pass through its servers in the United States.
• Vercel: hosting of the website and the web app; receives technical browsing data (IP address, browser).
• Expo: sending notifications to your phone (title and beginning of the message), through its servers in the United States, then through Apple or Google.
• Google Fonts: the website’s fonts; your browser sends your IP address to Google when loading them.

Google restaurant search is not currently used. If it is ever turned on, this policy will be updated beforehand.

Communication outside Québec. Your information is stored in Québec. Some of it is, however, communicated outside Québec, notably to the United States, for sending emails (Resend) and hosting the website (Vercel). Before entrusting it there, the law requires us to assess whether it will be adequately protected. This assessment is in progress. Until then, we limit what each provider receives to what is strictly necessary, exchanges are encrypted and access to the data is restricted. We will update this section when the assessment is complete. The authorities of those countries may, in certain circumstances provided for by their laws, access this information.

7. How long we keep it

• Account and couple profile: as long as your account exists. After 12 months without signing in, we write to you once to remind you that your account exists and how to delete it.
• Partner invitation (and the partner’s email): until they join you, 14 days at most.
• Tables, requests and confirmations: 12 months after the dinner date, then deleted.
• A table’s conversation: erased if the guest couple withdraws; otherwise 12 months after the dinner date.
• “Would you do it again?” answer: deleted with the table; only anonymous totals may be kept.
• Copy of emails sent: 30 days after sending (automatic purge every night).
• Reports: 12 months at most after they are filed.
• Technical logs: for the period set by each host, according to the standard periods in their own policies.
• Backups: the host’s automatic backups are overwritten after the host’s standard periods.

Deleting your account (Couple tab, “Delete my account”): your account, your first name, your messages, the shared photo, the tables posted by your couple, your answers and your blocks are deleted. Your participation in other couples’ tables is cancelled. Your partner’s account is kept, and their profile will need to be approved again. What may remain briefly: copies of emails and backups, until the end of the periods above.

8. Your rights

• Access: to know what information we hold about you and receive a copy.
• Correction: to have inaccurate, incomplete or ambiguous information corrected. You can change your city, introduction and photo yourselves in the app; for your first name or email, write to us.
• Portability: to receive the information you gave us in a common, structured electronic format.
• Withdrawal of consent and deletion: see sections 5 and 7.
• Ceasing dissemination: to ask us to stop disseminating information about you (for example on a share-link page) when the conditions set by law are met.
• To be informed of the categories of people who have access to your information within our organization and how long it is kept.

Write to gildas@souperclub.app from your account’s address (or by mail). We may ask you to confirm your identity. We reply in writing no later than 30 days after receipt. Access is free. If you wish, we will help you clarify your request.

If you are not satisfied with our answer, or if we do not reply within 30 days, you may contact the Commission d’accès à l’information du Québec within 30 days of the refusal or the end of the deadline. If you live outside Québec, you may also contact the Office of the Privacy Commissioner of Canada.

9. The emails we send you

We only send emails related to the use of your account: sign-in code, partner invitation (at your partner’s request), request received, table confirmed, a couple withdrew, table cancelled, reminders the day before and the day of the dinner. We send no newsletters or advertising. If we ever wanted to, we would ask for your consent first, and every message would include an unsubscribe link.

10. Security and incidents

• All communications are encrypted (HTTPS). The data is not directly accessible: each request goes through functions that check your identity and your rights.
• Photos are kept in private storage and are never accessible through a public link.
• Conversations are not end-to-end encrypted: the founder, the only administrator, can technically access them, and only does so to handle a report or a request from you. A participant can always take a screenshot.
• In the event of a confidentiality incident (unauthorized access, loss or disclosure), we take steps to reduce the risk. If there is a risk of serious injury, we promptly notify the Commission d’accès à l’information and the people concerned. Every incident is recorded in a register kept for at least 5 years.

11. Automated decisions and profiling

No decision about you is made solely by automated processing: it is the couples who give or refuse their approvals. We do no profiling, no location tracking and no automatic recommendation of couples.

12. Age

Souper Club is for people 18 and older. We do not knowingly collect information about minors; if we learn that an account belongs to a minor, it is deleted. Photos must only show the two members of the couple, never a child.

13. How we govern your information

• Roles: the person in charge of the protection of personal information (section 1) approves this policy and the practices that go with it. Only people who need it for the service or moderation have access to the data, with a protected personal account.
• Complaints: write to the person in charge (section 1). We acknowledge receipt within 5 business days, review the complaint and reply in writing with the measures taken, no later than 30 days after receipt.
• Retention and destruction: according to the periods in section 7; destruction is by permanent deletion from the database and storage.
• New projects: before any new feature or provider that affects your information, we assess its effects on your privacy.

14. Changes

If we change this policy, we publish the new version here with its date. In the event of a significant change (new use, new provider, new country), we inform you in the app or by email before it takes effect, and we ask for your consent again where the law requires it.