What m3lytsz processes, why, and what control you retain.

Beta status

The m3lytsz ecosystem is currently in beta.

m3lytsz and related ecosystem services are in active beta for a limited period that is not yet fixed. Features, transports, availability, qualification status and interfaces may change, pause or be withdrawn as security, reliability, legal and operational requirements evolve. Beta status does not reduce m3lytsz’s obligations relating to privacy, data protection, security, consumer rights, safety or lawful handling of communications.

Controller

Snooptsz Group Ltd.

m3lytsz is a trading name of Snooptsz Group Ltd, company number 17468359, incorporated in England and Wales. Snooptsz Group Ltd is the data controller for the processing described in this notice. ICO registration reference: ZC265345. Registered office: 66 Paul Street, London EC2A 4NA, United Kingdom. Data protection contact: snooptsz@m3ly.me.

Data categories

Minimal, functional and security-bound.

m3lytsz may process pseudonymous account identifiers; public WebAuthn/passkey verification material; device and session identifiers; user-selected profile/settings data; encrypted message envelopes and limited delivery metadata; contact-link and guest-session state; support and abuse reports; payment/number-order records where a paid feature is used; and security/network metadata such as IP address, timestamps and coarse country signals.

m3lytsz is designed not to require a real-world name, personal email address or telephone number as the native account identity. Private passkey keys remain with the authenticator. Plaintext private-message content is not intentionally collected as routine server data.

Purposes and legal bases

Each purpose has a defined reason.

Contract / requested service: create and authenticate identities, preserve sessions, pair devices, route encrypted communications, deliver user-requested links/calls and administer paid features. Legitimate interests: service security, fraud/scam/spam prevention, abuse handling, reliability and defence of legal claims, balanced against user rights. Legal obligation: accounting, regulatory, court or lawful-authority obligations where applicable. Consent: used where an optional permission, storage/access technology or other processing legally requires a freely given choice.

Recipients and processors

No sale of personal data.

m3lytsz does not sell personal data. Access is restricted to service providers and personnel who need it for defined operational purposes. Current production architecture may use Cloudflare for edge/security delivery, Supabase for limited identity/basic service data, R2 for encrypted primary storage and Backblaze B2 for encrypted disaster recovery where activated and reviewed. Payment, telecom-number or app-store providers process their own necessary transaction data under their respective terms. Provider activation must follow security, processor and transfer review.

International transfers

Safeguards follow the data.

Where personal data is transferred outside the UK, m3lytsz uses an applicable UK adequacy regulation, the UK International Data Transfer Agreement/Addendum, or another lawful transfer mechanism as required. Transfer risk is reviewed against the data type, destination, provider and technical protections.

Retention

Keep less, for less time.

Retention is purpose-limited. Short-lived authentication and pairing proofs expire quickly; ordinary sessions are bounded and revocable; temporary identities and guest sessions expire automatically; operational/security records are retained only for a defined support, security, fraud, legal or accounting need. Account deletion removes account-linked data that no longer has a lawful retention purpose.

Your rights

Access, correction, deletion and objection.

Where applicable you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. m3lytsz may request proportionate proof of control of a pseudonymous identity before disclosing account data. Requests: snooptsz@m3ly.me.

You may also complain to the UK Information Commissioner's Office if you believe your data-protection rights have been infringed.

Automated decisions and profiling

No hidden behavioural identity scoring.

m3lytsz does not use behavioural advertising profiles. Automated security controls may rate-limit, block suspicious requests or require additional verification. Where a decision would produce a legal or similarly significant effect solely by automated means, m3lytsz will provide the information and safeguards required by applicable law before relying on that process.

Source data and transparency timing

Notice when data is collected or obtained.

Most account information is obtained directly from the user or generated by the service as it operates. Security/network data can be generated by infrastructure. Where m3lytsz obtains personal data from another source, it will provide the required transparency information within the applicable period unless a lawful exemption applies.

Storage and device access

Cookies are only part of the picture.

The separate Cookies, local storage & device access notice describes browser cookies, local storage and protected app/device storage. Non-essential storage or access remains off unless and until a valid choice is obtained where required.