Privacy policy
Last updated: 27 September 2026
This policy explains what personal data m3i.app collects, why, for how long, and how you control it. Karako Systems (see the Legal notice) is the controller of this data. Although the service is governed by Haitian law, we apply the standards of the European General Data Protection Regulation (GDPR) to everyone.
Contact for any question or request: [email protected]
1. What we collect
When you create an account
- your email address, and a password stored only as a secure hash, if you sign up with an email;
- if you sign in with Google or Apple: the identifier of that account, your name, your email address and, for Google, the address of your profile picture. We do not keep the access tokens of these providers;
- your public username, and what you choose to add to your profile: first and last name, photo, bio (160 characters), phone number;
- your preferences: language, time zone, notification switches, newsletter consent;
- the date you accepted these terms.
When you use your account
- the date and IP address of your last sign-in;
- your active sessions: IP address, browser and system, date of creation and of last activity, so you can review and end them from My account > Security;
- a history of changes made to your account, kept for security and to answer disputes.
When you post on an event
- the first name you give, and the messages, answers, photos, videos and voice notes you post.
For security
- failed sign-in attempts (address typed, IP address, browser), to block password guessing;
- short-lived counters per IP address, account or browser session, to limit abuse.
We do not use advertising, tracking or audience measurement tools.
2. Why we use it
| Purpose | Legal basis |
|---|---|
| Create your account, sign you in, run the events and guest books | Performance of the contract (the Terms of service) |
| Protect accounts and the service (sign-in limits, session review, change history, error reports) | Our legitimate interest in keeping the service secure |
| Send the emails the service needs (confirmation codes, security alerts) | Performance of the contract |
| Send the newsletter | Your consent, which you may withdraw at any time |
| Keep records the law requires | Legal obligation |
3. Who receives it
Your data is never sold. Only these recipients process it, each only for the service it provides:
- Hostinger (Cyprus): hosting of the site and its database;
- [STORAGE PROVIDER]: storage of uploaded photos, videos and voice notes, private and served through temporary links;
- [EMAIL PROVIDER]: delivery of emails;
- Google and Apple: only if you choose to sign in with them;
- Cloudflare (Turnstile): checks that sign-in, sign-up and reset forms are filled in by a person;
- Cloudflare (Web Analytics): counts page views and measures load times, without cookies and without identifying you;
- Sentry: error reports, from which names, usernames, email addresses, passwords, codes, messages, captions and other personal fields are removed before sending;
- DiceBear: when you have no profile photo, your browser loads an image of your initials from DiceBear, which receives only those two letters.
Other people see what you choose to make public: your username, name, photo and bio on your public profile, and your messages and photos to the organiser and guests of the event you posted to.
Anyone holding an event's link sees its preview image when the link is shared: it shows the event's title, date and place, and the hosts' photo when the organiser added one. It is replaced when these change and deleted with the event. The event's app icon, shown when a guest installs it, is drawn from the same information and follows the same rules.
Some of these providers are located outside Haiti, including in the United States and the European Union. We only use providers that commit to protecting the data they process for us.
4. How long we keep it
| Data | Duration |
|---|---|
| Account and profile | Until you delete your account, then 30 days before erasure |
| Account change history | As long as the account exists, erased with it |
| Sessions | Two weeks after their last change, or until you sign out or end them |
| Session list (IP address, browser) | Expired entries are cleared every day, and all of them with your account |
| Failed sign-in attempts | Until the next successful sign-in, and at most one hour for a lockout |
| Successful sign-in log | 30 days |
| Messages posted on an event | As long as the event exists, or until the organiser or the author deletes them |
| Preview image of an event (title, date, place, hosts' photo) | Until these change or the event is deleted |
| Photos, videos, voice notes and albums of an event | As long as the event page is open (three years on every plan at launch, longer with an extension, and until 90 days after a time capsule opens), the organiser being warned two weeks before they are deleted, or until the organiser or the author deletes them |
| Error reports | [SENTRY RETENTION TO CONFIRM] |
When your account is erased, we also erase your profile photo, your sessions, your change history and your sign-in records.
5. Your rights
You may access, correct, export or delete your data, object to a processing based on our legitimate interest, withdraw a consent, and ask us to restrict a processing.
- Correct: from My account.
- Export: My account > My data downloads your data as a JSON file.
- Delete: My account > My data deletes your account after 30 days.
- Anything else: write to [email protected]. We answer within one month.
If you believe your rights are not respected, you may also complain to the data protection authority where you live.
6. Security
Connections are encrypted (HTTPS), passwords are hashed, photos are stored privately, sign-ins are limited against guessing, and staff accounts never sign in through the public site.
7. Cookies
The few cookies the site uses are described on the Cookies page.
8. Changes
We may update this policy. The date at the top of the page changes with each version, and we tell account holders by email before a substantial change applies.