populus.social Privacy Policy

Last updated: 29 September 2026

This policy explains what personal data populus.social processes, why, and what you can do about it. It applies to every populus.social service. Some services add their own details on top of it, such as Feed’s privacy policy.

In short

These are the data promises from our terms of service:

  • You control what you disclose. Nothing about you reaches a service unless you choose to disclose it, and you can disclose it less precisely.
  • We never sell or share your data. No advertising, no data brokerage, no marketing to groups of members, and no sharing with third parties unless you separately and explicitly agree.
  • We know who you are, and keep it to ourselves. We reveal who is behind a pseudonym only when the law requires us to.

Who we are

The controller of your data is Initiative Economics B.V. (KVK 42072679, Rotterdam, Netherlands). For anything about your data, use our contact form or write to dataprotection@populus.social.

What we process and why

  • Invitation requests. When you request an invitation, we keep your email address and the status of your request, to send you the confirmation link and to invite you when a place opens. We need this to take the steps you ask us to take before you become a member (Article 6(1)(b) GDPR).
  • Your account. Your principal account, your personas and your pseudonyms, with the profile details you give them (such as display name, date of birth, postal address and profile pictures), the email addresses you register, and your account’s status. We need this to provide the service you signed up for (Article 6(1)(b) GDPR).
  • Verifying who you are. To verify your identity, you submit your legal name, date of birth, address and identity documents, such as a photo of your ID and a selfie. Our staff review them and record the decision. We need this to provide the service (Article 6(1)(b) GDPR).
  • Your requests to us. When you contact us about your data, we keep your request and our correspondence to answer it, as the law requires (Article 6(1)(c) GDPR).
  • Contact enquiries. When you use our contact form, we keep your name, email address, topic and message to answer you, as a ticket in our own support system. This is our legitimate interest in answering enquiries sent to us (Article 6(1)(f) GDPR). Requests about your data stay under “Your requests to us”.
  • Records of account events. We keep a tamper-evident record of what happened to an account and when, for example who issued a ticket, or who made a verification decision and why. This protects the security and integrity of the service (Article 6(1)(f) GDPR).
  • Technical logs. We keep the minimal logs needed to run the services securely.

We do not use consent as a basis for processing, we do not profile you, and we make no automated decisions about you.

What services see

Services receive only what you disclose to them, per pseudonym, at the precision you choose. Your verified identity stays with your principal account. No service, and no other member, receives it from us.

Where your data lives

All populus.social services run on dedicated servers in EU data centres, rented from EU-based providers. Your data does not leave the EU. We deliberately avoid providers that are subject to laws from outside the EU which could compel them to hand over data, such as the US CLOUD Act.

How long we keep it

  • An invitation request is kept while it is open. If you never confirm it, it expires, or we decline it, or you have joined, we delete it 90 days later. You can also ask us to delete it at any time through our contact form.
  • A contact enquiry is kept for 5 years after our last activity on it (10 years for billing), or until you ask us to delete it, which you can do at any time through our contact form. Requests about your data are kept as the record that we handled them.
  • While your subscription is active, we keep your account data.
  • When your subscription ends, your account is suspended. For 30 days you can return by redeeming a new ticket, and nothing is lost.
  • After those 30 days, we delete your personal data: your profile details, email addresses, verification documents and the details you submitted for verification, together with your presence on our services. What remains is your pseudonyms’ callsigns, which stay reserved so nobody else can take them, and the records of account events described above, which never contain your documents. From then on, neither is associated with your personal information anymore.
  • Our backups contain copies of this data until they are overwritten as the backups roll over. We keep no other copies.

Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to receive a copy of it in a portable format. Send your request through our contact form or to dataprotection@populus.social. We respond within one month.

If you believe we have not handled your data correctly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes to this policy

We will tell you before any material change to this policy takes effect.