Last updated: 18 June 2026 · Effective: 18 June 2026
T&T Leisureland ("we", "us", or "our") operates the Rollout Plus mobile application. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights under the General Data Protection Regulation (GDPR) and applicable Cypriot law.
By creating an account or using Rollout Plus you confirm that you have read this policy and agree to its terms. If you do not agree, please do not use the app.
1. Who We Are
Data Controller: T&T Leisureland (trading name)
App: Rollout Plus
Contact: support@rollout-plus.com
For any privacy-related questions or requests, please email us at the address above.
2. Age Requirement
Rollout Plus is intended for users aged 17 and over. We do not knowingly collect personal data from anyone under 17. If we become aware that a user is under 17, we will delete their account and all associated data without notice.
3. Data We Collect
3.1 Account & Profile Data
- Email address — used for account creation, login, and password reset
- Full name — displayed on your profile and to other members
- Password — stored as a secure hash; we never see your plain-text password
- Profile photo — uploaded voluntarily; stored in our secure media storage
- Profile visibility setting — whether your profile is public, friends-only, or private
3.2 Location Data
- At Venue check-in — when you use the "At Venue" feature, we collect your precise GPS coordinates. This location is shared with other Rollout Plus users who are within approximately 300 metres of you. Your check-in is automatically hidden from other users after 3 hours and is never stored permanently.
- Post location — when you create a "What's Happening" or nearby post, your approximate location is tagged to that post.
- Location access is opt-in. You can deny or revoke location permission at any time in your device settings. Revoking permission disables location-based features but does not affect other functions of the app.
3.3 User-Generated Content
- Posts — text, venue tags, and photos you share in What's Happening, Open Chat, and Spur of the Moment. Posts that include photos are automatically deleted after 24 hours.
- Venue reviews — your written reviews and star ratings of venues
- Messages — direct messages between you and other members
- Night Out plans — plans you create and members you invite
- Club/Group activity — groups you create or join
3.4 Usage & Technical Data
- App interactions (screens visited, features used) — used to improve the service
- Device type and operating system — for compatibility and debugging
- Error logs — to identify and fix technical issues
4. Why We Collect It — Legal Basis
| Data type | Purpose | Legal basis (GDPR) |
|---|
| Account data | Create and manage your account, authenticate you | Contract performance (Art. 6(1)(b)) |
| Profile data | Display your profile to other members | Contract performance (Art. 6(1)(b)) |
| Location data | Show your position on the At Venue map; tag nearby posts | Consent (Art. 6(1)(a)) |
| User content | Deliver the social features of the app | Contract performance (Art. 6(1)(b)) |
| Usage & error data | Maintain, improve, and secure the service | Legitimate interests (Art. 6(1)(f)) |
5. How Long We Keep Your Data
- Check-in location — hidden from other users after 3 hours; overwritten on your next check-in
- Posts with photos — automatically deleted after 24 hours
- Messages — retained while both accounts exist; deleted when either account is deleted
- Account data — retained until you delete your account
- Deleted account data — purged within 30 days of account deletion, except where we are required to retain records by law
6. Who We Share Your Data With
We do not sell your personal data. We do not share it with advertisers or marketing companies. We share data only with the following service providers, solely to operate the app:
- Supabase Inc. — database, authentication, and media storage provider. Data is stored on servers in the EU (Ireland region). Supabase is our data processor under a Data Processing Agreement. See Supabase Privacy Policy.
- Expo / Expo Application Services (EAS) — app build and deployment infrastructure. Expo Privacy Policy.
We may disclose data to law enforcement or regulatory authorities if required by law or to protect the rights and safety of our users.
7. International Transfers
Your data is processed primarily within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g. by our service providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
8. Your Rights Under GDPR
As a user in the EU/EEA you have the following rights:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure ("right to be forgotten") — request deletion of your account and data
- Portability — receive your data in a structured, machine-readable format
- Restriction — ask us to pause processing of your data in certain circumstances
- Objection — object to processing based on legitimate interests
- Withdraw consent — you may revoke location permission at any time via device settings
To exercise any of these rights, email us at support@rollout-plus.com. We will respond within 30 days. You also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy).
9. Security
We implement industry-standard measures to protect your data, including:
- TLS encryption for all data in transit
- Passwords stored as secure hashes (bcrypt via Supabase Auth)
- Row-Level Security (RLS) policies ensuring users can only access data they are permitted to see
- JWT-based authentication with short-lived tokens
No system is completely secure. If you suspect unauthorised access to your account, please contact us immediately.
10. Cookies & Tracking
Rollout Plus is a native mobile application and does not use browser cookies. We do not use tracking pixels, advertising SDKs, or analytics tools that track you across other apps or websites.
11. Third-Party Links
The app may display links to third-party websites or services (e.g. venue websites). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notice or email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the app after the effective date constitutes acceptance of the revised policy.
13. Contact Us
For any questions, data requests, or concerns about this Privacy Policy:
T&T Leisureland
Email: support@rollout-plus.com