The fine print.

Privacy Policy

Controller and scope

Hotmate Ltd is the controller of personal data processed through Yumeku. Hotmate Ltd, Kinyra, 1, Kinyras Tower, 3rd floor, Flat/Office 301, Agios Andreas, 1102, Nicosia, Cyprus. Email: [email protected]. This Privacy Policy explains what personal data we collect, why we use it, who receives it, how long we retain it and the rights available to you.

Personal data we process

• account data, such as email address, account identifier and authentication information;
• age-eligibility confirmations and content-preference settings;
• membership and entitlement data, including plan, renewal status, Coin balances, animation unlocks and promotional credits;
• transaction metadata, such as payment status, amount, currency, provider transaction identifier and limited payment-method details supplied by the processor;
• usage data, such as comics viewed, reading progress, library and favourite selections, interactions with features and timestamps;
• device and technical data, such as IP address, browser, device type, operating system, language, approximate location, logs and security events;
• consent and preference records, including cookie choices and marketing preferences;
• communications sent to support, privacy or abuse teams;
• marketing and attribution data where the user has consented or another lawful basis applies.

Payment data

Payments are handled by third-party payment providers, including Centrobill where shown at checkout. We do not intentionally receive or store full payment card numbers. We may receive transaction status, amount, currency, identifiers and limited payment-method metadata needed to provide access, support the user, prevent fraud and maintain financial records.

Purposes and legal bases

We process personal data for the following purposes and legal bases:

• to create and operate accounts, supply purchased access, maintain reading progress, manage Coins and provide support: performance of our contract with you;
• to process payments, maintain accounting records and comply with tax, consumer-protection and other legal duties: performance of contract and compliance with legal obligations;
• to protect accounts, prevent fraud, diagnose failures and secure the Service: our legitimate interests in operating a safe and reliable service;
• to understand product performance and improve the Service using proportionate first-party or consented analytics: our legitimate interests or consent, depending on the technology and applicable law;
• to send promotional communications: consent where required, with an unsubscribe option;
• to use non-essential advertising, attribution or cross-site tracking technologies: consent where required;
• to establish, exercise or defend legal claims: our legitimate interests and applicable legal obligations.

Recipients

We disclose personal data only where needed to operate the Service or comply with law. Recipients may include:

• payment processors and fraud-prevention providers;
• hosting, content-delivery, database, security and technical service providers;
• customer-support and email-delivery providers;
• analytics and attribution providers;
• professional advisers, auditors and authorities where legally required;
• a purchaser or successor in connection with a corporate transaction, subject to appropriate safeguards.

Depending on the user's consent and the technologies enabled on the site, analytics or attribution providers may include Google, Meta and Trackdesk. The current providers and technologies are listed in the Cookie Policy and consent interface.

Sale or sharing

We do not sell personal data for money. Some privacy laws define sale or sharing more broadly and may include certain advertising or attribution technologies. Where those definitions apply, we provide the legally required notice and choice, including an opt-out where required.

International transfers

Some service providers may process personal data outside Cyprus or the European Economic Area. Where required, we rely on an adequacy decision, approved contractual safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. You may contact [email protected] to request information about safeguards relevant to your data.

Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy:

• account, entitlement and reading-progress data are generally retained while the account remains active and for a reasonable period afterwards;
• transaction and accounting records are retained for the period required by applicable tax, accounting and anti-fraud laws;
• support and dispute records are retained until the matter is resolved and for an appropriate limitation period;
• security logs are retained for a limited period appropriate to fraud prevention and incident investigation;
• cookie and analytics data are retained for the periods shown in the Cookie Policy;
• consent records are retained for as long as needed to demonstrate the user's choice.

When data is no longer required, we delete or anonymize it unless continued retention is required by law.

User rights

Subject to applicable law, you may have the right to:

• access your personal data;
• correct inaccurate data;
• request deletion;
• restrict or object to processing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting earlier lawful processing;
• object to direct marketing;
• lodge a complaint with a supervisory authority.

To exercise a right, contact [email protected]. We may need to verify your identity before completing the request.

Supervisory authority

You may lodge a complaint with: Office of the Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia, Cyprus. Email: [email protected]. Website: https://www.dataprotection.gov.cy/.

Cookies

We use cookies and similar technologies for authentication, security, preferences, analytics and, where enabled, advertising or attribution. Strictly necessary technologies operate because they are needed to provide the Service. Non-essential analytics, advertising and attribution technologies are used only after consent where applicable law requires it. See our Cookie Policy for details.

Security

We use reasonable organizational and technical measures designed to protect personal data. No internet service can guarantee absolute security. If you believe your account or data has been compromised, contact [email protected].

Adults only

Yumeku is intended only for adults. We do not knowingly collect personal data from anyone under 18. If you believe that a minor has provided personal data to us, contact [email protected] so that we can investigate and take appropriate action.

Updates and contact

We may update this Privacy Policy to reflect changes in law, technology or our processing. We will publish the revised version with a new effective date and provide additional notice where required. Privacy enquiries may be sent to [email protected] or by post to: Hotmate Ltd, Kinyra, 1, Kinyras Tower, 3rd floor, Flat/Office 301, Agios Andreas, 1102, Nicosia, Cyprus.