Privacy Notice

1. Identity of the controller

Masri operates the Moorvit platform from Switzerland. The full controller identity (legal-entity name, Swiss UID, registered office and commercial-register entry) will be published here once the Swiss commercial-register entry is finalised. Until then, all data-protection enquiries are handled through the contact channels below; please use these to identify the controller, exercise your rights, or raise a concern.

Trading name

Moorvit, operated by Masri

Country of operation

Switzerland

Email

privacy@moorvit.com

General contact

privacy@moorvit.com

2. Data Protection Officer

The Moorvit Data Protection Officer is reachable via the contact channel below. The named DPO and postal address will be published here together with the controller-registration details (see section 1) once finalised.

Email

dpo@moorvit.com

The Data Protection Officer is your primary contact for any question about how Masri handles your personal data, to exercise your rights, or to raise a concern.

3. Personal data we process

We process the following categories of personal data, by purpose:

3.1 Identification and account management

• Username, email address, phone number, password (hashed with BCrypt cost 14)
• Display name, date of birth (if provided), locale, timezone
• IP address, user agent (at sign-up and during sessions)
• WebAuthn credential public keys (server-stored; biometric data never leaves your device)

3.2 Sign-up and sign-in checks

• Whether a connection looked like a VPN or proxy, from an offline IP database
• Joining and inviting never ask for a passport, national ID card or other identity document

3.3 Marketplace activity

• Listings, bookings, dates, locations
• Messages exchanged with hosts and guests (see 3.5)
• Payment metadata (card data is processed solely by Stripe, not by Masri)
• Trust and fraud-detection scores

3.4 Social and content

• Posts, comments, media, follows / blocks
• Notifications you receive
• Family-relationship requests

3.5 Communications

• Direct and group chat messages — these are end-to-end encrypted; we cannot read them.
• Inquiry chat messages with hosts — these are stored in plaintext on our servers and may be read by Masri staff or automated systems for fraud detection. You will see an in-app disclosure when you start an inquiry chat.

3.6 Behaviour analytics

• Login times, IP addresses, geographic-country signals, anomalous-behaviour scores
• Used to detect account takeover and abuse; not shared with advertisers

3.7 Consent and audit

• Records of consent granted and withdrawn (append-only)
• Audit log of significant security events

3.8 Reading without an account

Anyone can open a limited number of public posts, videos and stories each day without signing in. To count them we use:

• A cookie named mv_preview: a random identifier with a signature, sent only to our public preview addresses. It contains no personal data, is not used for analytics, advertising or tracking across sites, and expires at midnight UTC the same day.
• Which items you opened that day, stored against that identifier and against a keyed hash of your IP address (never the address itself), so that clearing cookies does not reset the limit. Both are deleted automatically at midnight UTC.

This cookie is strictly necessary for the limit to work, so it is set without asking and is not affected by your cookie preferences. Members who are signed in are never counted.

Back to contents

4. Purposes of processing

We process your personal data for the following purposes:

Back to contents

5. Categories of recipients

5.1 Service providers acting as our processors

5.2 Other Moorvit users

• Information you publish (listings, posts, profile) is visible to other users and the public.
• Information you exchange with hosts via inquiry chat is visible to the host (and to Masri for moderation).
• Information you share via end-to-end-encrypted chat is visible only to the recipients.

5.3 Authorities, when legally required

Swiss law enforcement, courts, and supervisory authorities (FDPIC, FINMA where applicable) on receipt of a legally valid order.

Back to contents

6. Cross-border transfers (Art. 16 nFADP)

For a complete list and detail of safeguards, see our Cross-border Transfer Register (available on request to dpo@moorvit.com).

Back to contents

7. Retention periods

After the retention period, we either delete the data or pseudonymise it irreversibly.

Back to contents

8. Your rights (Art. 25, 32 nFADP and related)

You have the right to:

• Access (Art. 25 nFADP): request a copy of your personal data. We provide this as a downloadable archive within 30 days.
• Rectification (Art. 32 §1): correct inaccurate or incomplete data.
• Erasure (Art. 32 §2): delete your account and associated personal data. Some data may be retained where we have a legal obligation or legitimate interest in defending claims (e.g. accounting records, audit logs).
• Restriction: limit our processing pending an objection.
• Objection (Art. 21 §1): object to processing based on legitimate interest, including profiling.
• Withdrawal of consent: where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Object to automated decisions (Art. 21 nFADP): we use automated systems to flag potential fraud and to compute juror cohorts. You can request a human review of any decision that materially affects you.
• Data portability: receive your personal data in a structured, machine-readable format. Our access export covers this.
• Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC):
  • Web: https://www.edoeb.admin.ch
  • Address: Feldeggweg 1, 3003 Bern, Switzerland

To exercise any of these rights, contact dpo@moorvit.com or use the in-app account-management menu (Account → Privacy).

Back to contents

9. Automated individual decisions and profiling

We use automated systems for:

• Fraud and abuse detection (booking, payments, content): a low-confidence flag triggers human review; a high-confidence flag may automatically suspend an action and trigger expedited human review within 48 h.
• VPN and proxy detection at sign-up: a connection flagged as a VPN or proxy cannot create an account; signing up again without it works.
• Juror cohort assignment for content claims: assignment is based on prior accuracy and other neutral signals.
• Host suspension on excessive cancellations: a count threshold triggers automated suspension with a human-reviewable appeal.

You can request a human review of any of these decisions at dpo@moorvit.com.

Back to contents

10. Security

We protect your personal data with measures including:

• Strong passwords (BCrypt cost 14)
• Symmetric encryption of sensitive fields with AES-256-GCM
• End-to-end encryption of direct and group chat (X25519 + Kyber-768 hybrid post-quantum)
• TLS for all connections (currently being upgraded to TLS 1.2/1.3 only)
• Multi-factor authentication options (TOTP, WebAuthn / passkeys)
• Server-side authentication tokens with revocation
• Strict access controls and audit logging
• Regular security reviews and penetration testing

If a security breach occurs that is likely to result in a high risk to you, we will notify you without undue delay and will inform the FDPIC as required by Art. 24 nFADP.

11. Children

Moorvit is not intended for users under 13 years of age. We will delete any account we identify as belonging to a user under 13. If you believe a child is using Moorvit, contact dpo@moorvit.com.

12. Changes to this notice

We may update this notice from time to time. Material changes will be communicated via in-app banner and email at least 30 days before they take effect. Minor changes (clarifications, typo fixes) will be reflected with an updated "Last reviewed" date.

13. Imprint

This notice was last reviewed on November 6, 2026.

Issued by Masri, the Moorvit platform operator in Switzerland.

For questions: dpo@moorvit.com.