Privacy Policy

Version 2026-08-27-attribution-security-canada · Effective August 27, 2026

PRIVACY POLICY

Kream & Sugar Dating LLC

Last Updated: August 15, 2026

Effective Date: April 20, 2026

PLEASE READ THIS PRIVACY POLICY CAREFULLY. THIS PRIVACY POLICY DESCRIBES HOW KREAM & SUGAR DATING LLC COLLECTS, USES, DISCLOSES, RETAINS, AND PROTECTS YOUR INFORMATION WHEN YOU VISIT OUR WEBSITE, USE THE KREAM & SUGAR DATING APPLICATION, INTERACT WITH OUR MARKETING PLATFORMS, SUBSCRIBE TO UPDATES, OR OTHERWISE ENGAGE WITH OUR SERVICES. BY ACCESSING OR USING ANY PORTION OF THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THE PRACTICES DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, YOU MUST IMMEDIATELY CEASE ALL USE OF THE SERVICE.

1. INTRODUCTION AND SCOPE

1.1 Identity of the Data Controller

This Privacy Policy (hereinafter referred to as this "Policy," "Privacy Policy," or "Privacy Notice") is issued by Kream & Sugar Dating LLC, a limited liability company duly organized and existing under the laws of the State of North Carolina, with its principal place of business in the State of North Carolina (hereinafter referred to as the "Company," "we," "us," or "our"). The Company operates the Kream & Sugar dating application (including all mobile, web, and desktop versions thereof), the website located at https://kreamandsugardating.com and any subdomains thereof, all associated marketing pages, landing pages, and promotional microsites, and all related services, features, content, functionality, tools, games, virtual cafes, interactive experiences, application programming interfaces, and any other products or offerings provided by the Company in connection therewith (collectively, the "Service" or "Services").

1.2 Scope of This Policy

This Privacy Policy applies to all personal information, personally identifiable information, and non-personal information (collectively, "Information" or "Data") that the Company collects from or about you (hereinafter referred to as "User," "you," "your," or "yourself") through:

(a) Your use of the Kream & Sugar dating application and all features thereof, including account registration, profile creation, messaging, voice chat, event participation, game and virtual cafe sessions, subscription management, and payment processing;
(b) Your visits to the Company's marketing website, including all landing pages, promotional pages, and informational pages;
(c) Your interactions with forms hosted on the website, including email subscription forms, contact forms, and popup forms;
(d) Your interactions with the Company's analytics and advertising integrations on the marketing website, including TikTok Pixel and Conversions API, Google Analytics (including Google Tag Manager and server-side API), and Meta Pixel (Facebook/Instagram) and Conversions API. These pixel integrations operate only on the marketing website; the Company's mobile applications embed the Meta software development kit in a measurement-only configuration and transmit conversion events server-side, in each case as described in and subject to the permissions in Section 3.1.4;
(e) Any and all other interactions with the Service, regardless of the device, platform, or method by which you access the Service.

This Policy governs the collection, use, disclosure, storage, retention, transfer, and protection of such Information in all of the foregoing contexts.

1.3 Relationship to Terms and Conditions

This Privacy Policy is incorporated by reference into the Company's Terms and Conditions of Use (the "Terms"). Capitalized terms used herein but not otherwise defined in this Policy shall have the meanings ascribed to them in the Terms. In the event of any conflict between this Privacy Policy and the Terms with respect to data collection, use, or disclosure practices, the provisions of this Privacy Policy shall control.

1.4 Changes to This Policy

The Company reserves the right, at its sole and absolute discretion, to modify, amend, update, or revise this Privacy Policy at any time and for any reason, with or without prior notice to you. Any such modifications shall become effective immediately upon posting the revised Privacy Policy on the Service. The "Last Updated" date at the top of this Policy will reflect the date of the most recent revision. Your continued use of the Service following the posting of any revised Privacy Policy shall constitute your acceptance of and agreement to such revised Privacy Policy. It is your sole responsibility to review this Privacy Policy periodically for changes. If we make material changes to this Privacy Policy that substantively affect how we collect, use, or disclose your personal information, we will make reasonable efforts to notify you via in-app notification, email, or other appropriate means, provided that such notification is a courtesy and shall not be a condition to the effectiveness of such changes.

1.5 Applicability to Minors

The Service is intended exclusively for individuals who are at least eighteen (18) years of age. The Company does not knowingly collect, solicit, or maintain personal information from anyone under the age of eighteen (18). If we become aware that we have collected personal information from an individual under the age of eighteen (18), we will take prompt steps to delete such information from our records. If you are a parent or legal guardian and believe that your minor child has provided personal information to the Company, please contact us at the email address provided in Section 16 of this Policy, and we will take reasonable steps to delete such information.

2. CATEGORIES OF INFORMATION WE COLLECT

The Company collects, receives, and generates various categories of Information in connection with your use of the Service. The following sections describe, in detail, the types of Information collected, the sources from which such Information is obtained, and the circumstances under which such collection occurs. For the avoidance of doubt, not all categories of Information described below will be collected from every User; the specific categories collected depend on how you interact with the Service (e.g., whether you use only the marketing website, or whether you also create an account and use the dating application).

2.1 Information You Provide Directly

The following categories of Information are collected directly from you when you voluntarily provide them through your interactions with the Service:

2.1.1 Website Forms and Subscriptions

When you interact with forms hosted on the Company's marketing website, you may provide:

(a) Your email address, submitted through the email subscription form for the purpose of receiving updates and marketing communications;
(b) Your name, email address, phone number (optional), and message content, submitted through the website contact form or Elementor popup forms;
(c) Your email address, submitted through website form submissions, which is hashed on our server prior to transmission to third-party analytics APIs (including TikTok's Conversions API) for privacy-preserving advertising attribution.

2.1.2 Account Registration Information

When you create an account on the dating application, you are required to provide certain Information necessary for account creation and authentication, including but not limited to:

(a) Your email address, which serves as your primary account identifier and is used for authentication via one-time password ("OTP") verification;
(b) Your phone number, which may be used for SMS-based OTP verification, account recovery, and as an additional authentication vector;
(c) Your first name and last name;
(d) Your date of birth, which is used to verify that you meet the minimum age requirement of eighteen (18) years of age;
(e) Your timezone designation.

If you choose to register or authenticate through a third-party social login provider (including but not limited to Google, Apple, or Facebook), the Company may receive certain Information from such provider as described in Section 2.4 of this Policy.

2.1.3 Profile Information

Upon registration for the dating application, you may provide additional Information to create and customize your user profile, including but not limited to:

(a) Your gender identity (which may include, without limitation, Male, Female, Non-Binary, or Prefer Not to Say);
(b) A biographical description or personal statement (limited to one thousand (1,000) characters), which is sanitized for security purposes prior to storage;
(c) Profile photographs (you may upload up to nine (9) photographs, of which one (1) must be designated as your primary photograph and must depict you);
(d) Your dating context preference (In-Person, Virtual, or both);
(e) Your gender preference for potential matches (Men, Women, or Everyone);
(f) Your preferred age range for potential matches (minimum and maximum);
(g) Your preferred matchmaking radius (in miles);
(h) Your preference regarding global matching outside your designated geographic region.

2.1.4 Communication Content

When you communicate through the dating application, we collect the content and metadata of such communications, including but not limited to:

(a) Text messages transmitted through the in-app messaging system;
(b) Voice notes and audio recordings you create and send through the messaging system;
(c) GIF images you select and send via the integrated Giphy service;
(d) Voice chat session participation data;
(e) Timestamps, delivery status, and read receipts associated with all messages;
(f) Conversation metadata, including participant information, conversation creation and closure dates, and conversation status;
(g) Virtual café voice. While you are in a café voice chat, a short rolling buffer of café audio is briefly retained on your device. This on-device buffer is uploaded to the Company and analyzed (transcribed to text and screened for prohibited content) only when you or another participant files a report; absent a report, the buffer is continuously overwritten on your device and is never transmitted to or retained by the Company. When a report is made, the relevant audio segment(s) and the corresponding speech-to-text transcript are retained as moderation evidence in accordance with Section 6.5. The Company does not continuously record or transmit café voice. Separately from the report flow above, if the participant you are paired with has enabled live captions, or automatic captions are triggered because you are speaking a language that participant does not read, your café speech is transmitted to Company-controlled infrastructure and converted to text in real time, and, where that participant has selected a caption language other than the language you are speaking, machine-translated on Company-controlled infrastructure, solely so that it can be displayed to that participant as you speak. The audio and the resulting text are processed transiently, are not retained after display, are not shown to anyone other than the participant you are speaking with, and are not used for any other purpose. In particular, they are not used for model training, which occurs only under the separate opt-in consent described in Section 6.8.
(h) Typed café messages (accessibility). If you use the type-instead-of-speaking feature, the text you type is relayed through Company servers to the participant you are paired with, is displayed to that participant, and may be read aloud by that participant's device. Typed café messages are relayed and not stored by the Company, except that a short rolling buffer of recent typed messages is retained on the participating devices and is uploaded and reviewed as moderation evidence only when a participant files a report, in the same manner as café voice above.

2.1.5 Payment and Subscription Information

When you subscribe to a paid tier of the Service or purchase standalone products, we collect transaction-related Information, including but not limited to:

(a) Your CCBill subscription/customer identifier;
(b) Payment method tokens (note: full credit card numbers, debit card numbers, and bank account numbers are collected and processed directly by our third-party payment processor, CCBill, LLC, and are not stored on our servers);
(c) Subscription tier selections and subscription period dates;
(d) Transaction amounts, currency, billing period dates, invoice identifiers, and transaction identifiers;
(e) Promotion codes redeemed, including redemption timestamps and associated discount amounts;
(f) Standalone product purchase records.

2.1.6 User Reports and Feedback

When you submit reports about other Users or provide feedback, we collect:

(a) The content of your report or feedback, including any free-text descriptions you provide;
(b) The category of your report (which may include, without limitation, Harassment, Inappropriate Content, Spam, Fake Profile, or Other);
(c) Any supplementary information you voluntarily provide in connection with such report;
(d) The identity of the reported User and the timestamp of the report submission.

2.1.7 Blocking and Interaction Preferences

When you choose to block or unblock another User, we collect:

(a) The identity of the blocked User;
(b) The timestamp of the blocking or unblocking action;
(c) Any optional reason you provide for the block.

2.1.8 Notification Preferences

You may configure your notification preferences within the dating application, and we collect:

(a) Your preferred delivery methods for each notification type (which may include Email, SMS, Push Notification, and In-App Notification);
(b) Your enabled or disabled status for each notification type, including but not limited to: Upcoming Events, New Messages, Match Requests Received, Match Requests Accepted, Subscription Expiration, Promotions, Account Security, and Inactivity Re-engagement notifications;
(c) Timestamps of any changes to your notification preferences.

2.1.9 Event Participation Information

When you register for, attend, or participate in in-person or virtual events organized or facilitated through the Service, we collect:

(a) Your event registration and attendance records;
(b) Your event participation status (including check-in and no-show records);
(c) Any feedback or ratings you provide concerning events or other attendees.

2.2 Information Collected Automatically

The following categories of Information are collected automatically when you access or use the Service, without requiring any affirmative action on your part beyond the use of the Service itself:

2.2.1 Website Analytics and Pixel Data

When you visit the Company's marketing website, we automatically collect Information through cookies, pixels, and server-side analytics integrations, including but not limited to:

(a) Page views, scroll depth, time spent on page, button clicks, and other user interaction events;
(b) Your IP address (which may be anonymized for certain analytics purposes);
(c) Your device type, browser type, browser version, operating system, and screen resolution;
(d) Traffic source and referral information, including UTM parameters (source, medium, campaign, term, content);
(e) Event data transmitted to TikTok via the TikTok Pixel (client-side) and TikTok Conversions API (server-side), which may include hashed identifiers (such as hashed email addresses), event timestamps, event types (page views, form submissions, registrations), and associated metadata;
(f) Event data transmitted to Google via Google Analytics, Google Tag Manager, and Google's server-side API, which may include traffic sources, UTM parameters, page interactions, device and browser information, and anonymized IP addresses;
(g) Event data transmitted to Meta (Facebook/Instagram) via the Meta Pixel (client-side) and Meta Conversions API (server-side), which may include hashed identifiers (such as hashed email addresses), event timestamps, event types (form submissions, registrations, page views), UTM parameters, and associated metadata.

The use of both client-side pixel tracking and server-side Conversions API tracking enables the Company to maintain analytics and advertising attribution even when browser cookies are deleted, expire, or are blocked, in accordance with industry best practices for privacy-preserving measurement.

2.2.2 Device and Browser Information (Dating Application)

When you access the dating application, we automatically collect technical information about your device and browser, including but not limited to:

(a) A device fingerprint, which is a unique identifier generated from the characteristics of your device and browser configuration;
(b) Your user agent string, which contains information about your browser type, browser version, operating system, and device type;
(c) VOIP (Voice over Internet Protocol) detection data, which indicates whether your phone number is associated with a VOIP service rather than a traditional cellular carrier.

2.2.3 IP Address and IP-Based Location Data

Upon your access to and use of the Service, including at the time of account registration, we automatically collect:

(a) Your Internet Protocol ("IP") address;
(b) Geolocation data derived from your IP address through our third-party IP geolocation service provider, which may include your approximate city, state or region, country, country code, and approximate latitude and longitude coordinates;
(c) A confidence score associated with the accuracy of the IP-based geolocation determination;
(d) Your Internet Service Provider ("ISP") and organization information as reported by the IP geolocation service.

2.2.4 GPS-Based Location Data

If you grant the dating application permission to access your device's Global Positioning System ("GPS") capabilities, we collect:

(a) Your precise GPS latitude and longitude coordinates (to a precision of up to eight (8) decimal places, which corresponds to approximately 1.1 millimeters of accuracy);
(b) The accuracy radius of the GPS reading (in meters);
(c) Timestamps indicating when GPS location data was last updated.

YOU ACKNOWLEDGE THAT GPS-BASED LOCATION DATA IS SUBSTANTIALLY MORE PRECISE THAN IP-BASED GEOLOCATION DATA AND THAT THE COLLECTION OF SUCH DATA IS NECESSARY FOR CORE SERVICE FUNCTIONALITY, INCLUDING WITHOUT LIMITATION PROXIMITY-BASED MATCHMAKING, LOCATION-RESTRICTED FEATURE ACCESS, AND EVENT-RELATED SERVICES. DISABLING GPS ACCESS WILL CAUSE DEGRADATION OF SERVICE FUNCTIONALITY.

2.2.5 Activity and Usage Data

We automatically log and track your interactions with and usage of the dating application, including but not limited to:

(a) The types of activities you engage in on the Service (including without limitation voice chat sessions, questions answered, points scored, virtual cafe sessions joined, profile changes, and authentication events);
(b) Timestamps and metadata associated with each activity;
(c) Your geographic location at the time of each activity;
(d) The features you access and the frequency of such access;
(e) Features for which you were denied access and the reasons for such denial;
(f) Your online status (which may include Online, Offline, Away, Busy, or Active);
(g) Login and logout timestamps;
(h) The date and time of your last activity and your last online status;
(i) Profile views you initiate and profile views of your profile by other Users, including associated timestamps;
(j) Match requests sent and received, and the outcomes thereof (accepted, rejected, expired).

2.2.6 Security Event Data

For the purposes of maintaining the security and integrity of the Service, we automatically log security-related events, including but not limited to:

(a) Login attempts (both successful and unsuccessful);
(b) One-time passcode requests and completions;
(c) Email verification events;
(d) Phone verification events;
(e) OAuth login and authentication events;
(f) Logout events;
(g) Account lock and unlock events;
(h) The IP address associated with each security event;
(i) The user agent string associated with each security event;
(j) The success or failure status and severity level of each security event;
(k) Additional contextual metadata associated with each security event.

2.2.7 Payment Event Data

In connection with payment processing, we automatically collect and log:

(a) Webhook events received from our payment processor, including event identifiers, event types, and processing timestamps;
(b) Payment processing status updates (including Pending, Completed, Failed, and other status indicators);
(c) Error messages and processing metadata associated with payment transactions.

2.3 Information Derived or Generated by the Company

The Company may derive, generate, compute, or infer additional Information from the Information described in Sections 2.1 and 2.2, including but not limited to:

(a) Compatibility assessments and match scores based on your profile attributes, preferences, and behavior patterns;
(b) Location assignments mapping your detected geographic position to a predefined location within the Service's location system;
(c) Feature usage analytics and engagement metrics;
(d) Risk assessments for fraud detection and account security purposes;
(e) Behavioral patterns for the purposes of automated promotion eligibility determination (including, without limitation, registration-based, inactivity-based, feature-usage-based, and location-based promotional triggers);
(f) Device trust scores based on VOIP detection, device fingerprinting, and phone number history analysis;
(g) Advertising attribution models derived from the correlation of website analytics data (including pixel and Conversions API event data) with account registration and subscription conversion events.

2.4 Information Received from Third Parties

The Company may receive Information about you from the following third-party sources:

If you choose to register or authenticate via a third-party OAuth provider (Google, Apple, or Facebook), we receive from such provider:

(a) Your unique provider-specific user identifier;
(b) An access token and, where applicable, a refresh token, along with associated expiration timestamps;
(c) Such profile information as the provider makes available pursuant to its own terms and your privacy settings with that provider (which may include your name, email address, and profile photograph).

2.4.2 Payment Processor

Our third-party payment processor, CCBill, LLC, may provide us with:

(a) Transaction confirmation data, including transaction identifiers and payment status;
(b) Webhook notifications concerning subscription status changes, payment failures, chargebacks, and other payment-related events;
(c) Subscription and customer identifiers necessary for subscription management.

2.4.3 IP Geolocation Provider

Our third-party IP geolocation provider provides us with:

(a) Geographic location data derived from your IP address, including city, state, country, approximate coordinates, and ISP information, as described in Section 2.2.3.

2.4.4 Carrier and VOIP Detection

Through our telecommunications service providers, we may receive:

(a) Carrier line type intelligence data indicating whether a phone number is associated with a mobile carrier, landline, or VOIP service;
(b) Phone number validation and verification status.

2.4.5 Analytics and Advertising Platforms

Through our analytics and advertising integrations, we may receive:

(a) Aggregated analytics data and reports from Google Analytics, Meta (Facebook/Instagram), and TikTok concerning website traffic patterns, user demographics, and campaign performance;
(b) Advertising attribution data correlating ad impressions, clicks, and conversions;
(c) Audience segmentation data derived from marketing-website pixel and Conversions API events.

2.5 Calendar Integration Information (Optional Feature)

If you elect to connect a third-party calendar service (currently Google Calendar or Microsoft Outlook / Microsoft 365 Calendar) to the Service, the Company collects, stores, and generates the following Information solely to operate that optional feature:

(a) An OAuth authorization credential (a "refresh token") issued to the Company by the calendar provider at the time you grant consent. This credential authorizes the Company to add and manage calendar events on your behalf. It is stored in encrypted form (see Section 6.6) and is used for no purpose other than adding to, updating, and removing from your connected calendar the specific events described in subsection (c);
(b) The scope of access you granted and the identifier of the calendar to which events are added (by default, your primary calendar);
(c) A record, for each event the Company adds to your calendar on your behalf, of the provider-assigned identifier of that calendar entry, retained so that the Company can update the entry if the underlying event's details change, or remove it if you cancel your registration or RSVP.

Connecting a calendar is entirely optional, is disabled by default, and is initiated only by your affirmative action. The Service requests only the permission necessary to add and manage the specific events you elect to add through the Service. The Service does not request permission to read your existing calendar, and the Company does not read, retrieve, import, or store the contents of your calendar or any calendar entries not created by the Service. You may disconnect a connected calendar at any time through the Service's in-app settings, which revokes the stored authorization credential, and you may additionally revoke the Company's access directly through your Google or Microsoft account security settings. The manner in which the calendar provider itself processes your Information is governed by that provider's own privacy policy, as further described in Section 5.2.18.

3. COOKIES, TRACKING TECHNOLOGIES, AND SIMILAR TECHNOLOGIES

3.1 Types of Cookies and Tracking Technologies

The Service employs cookies, pixels, local storage, session tokens, and similar tracking technologies. The specific technologies used vary depending on whether you are interacting with the marketing website or the dating application:

3.1.1 Essential Cookies and Tokens

(a) Session Tokens and JWT Tokens (Dating Application): Used for authentication and session management within the dating application. These tokens are issued upon login and expire after a designated period or upon logout (at which point they are blacklisted to prevent reuse);
(b) Refresh Tokens (Dating Application): Used to obtain new access tokens without requiring re-authentication, subject to expiration;
(c) Essential Website Cookies: First-party cookies necessary to maintain website session state, preferences, and core functionality.

3.1.2 Analytics and Advertising Cookies

(a) Google Analytics Cookies: Cookies set by Google Analytics and Google Tag Manager for the purpose of understanding site usage, traffic sources, and user engagement on the marketing website. These cookies may track page views, session duration, bounce rates, and conversion events;
(b) TikTok Pixel Cookies: Cookies set by the TikTok Pixel for client-side tracking of page views, clicks, form submissions, and other user interaction events on the marketing website;
(c) Meta Pixel Cookies: Cookies set by the Meta (Facebook/Instagram) Pixel for client-side tracking of on-site events, including page views, form submissions, registrations, and other conversion events on the marketing website.

3.1.3 Server-Side Tracking (Cookieless)

In addition to client-side cookies and pixels, the Company employs server-side Conversions APIs for TikTok, Google, and Meta (Facebook/Instagram) in connection with the marketing website. Server-side tracking transmits event data directly from our servers to the respective analytics platforms, enabling privacy-preserving measurement and advertising attribution that is not dependent on browser cookies. Server-side events may include hashed identifiers (such as hashed email addresses), event timestamps, event types, and associated metadata. This approach enables the Company to maintain analytics and advertising attribution capabilities even when browser cookies are deleted, expire, or are blocked by the User's browser settings or privacy tools.

3.1.4 Mobile Application Advertising Measurement and App Tracking Transparency

The Company's iOS and Android applications do not display advertising and contain no advertising-display software. The applications embed the Meta software development kit in a measurement-only configuration, which logs application installation and activation events and, subject to the permissions described below, the device advertising identifier, for the purpose of measuring and optimizing the Company's own advertising campaigns. In addition, the Company transmits certain conversion events from its own servers to advertising platforms (currently Meta and TikTok) for the sole purpose of measuring the effectiveness of the Company's own advertising campaigns. These server-side events may include a hashed email address; a hashed phone number; a hashed internal account identifier; for users who signed in with Facebook, the Facebook account identifier; the device advertising identifier where permitted (Apple Identifier for Advertisers or Google Advertising ID); campaign click identifiers previously recorded against the account; the event type (such as registration, verification completion, trial start, or subscription purchase); purchase value and currency; and device context such as operating system version.

On iOS, the Company requests permission through Apple's App Tracking Transparency prompt. Conversion events relating to an iOS user are transmitted only where that user has granted permission, and the Apple advertising identifier is accessed only with such permission. Users who decline are measured solely through Apple's SKAdNetwork framework, which provides anonymous, aggregate campaign statistics and does not identify any individual. Permission may be withdrawn at any time in iOS Settings (Privacy & Security, then Tracking); upon withdrawal, transmission relating to that user ceases and the stored advertising identifier is deleted.

On Android, conversion events are transmitted on an opt-out basis. Users may reset or delete their Google Advertising ID in Android system settings, and may opt out of server-side conversion transmission entirely by contacting the Company using the contact information provided in this Privacy Policy.

Where a User arrives at the Service through a campaign link, the associated campaign parameters and click identifiers are recorded against that User's account to enable the Company to measure the performance of its own campaigns, and are shared with the originating advertising platform only as part of the conversion events described in this Section. The Company does not sell Information, and shares Information with advertising platforms only as described here and in Sections 3.1.2 and 3.1.3.

3.1.5 Local Storage

The Service may use browser local storage to store preferences, cached data, and other information necessary for the efficient operation of the Service on your device.

A complete cookie-by-cookie inventory, including each cookie's name, the provider that sets it, its purpose, and its retention duration, is published at https://kreamandsugardating.com/cookie-policy. The Company manages cookie consent through its own first-party consent-management solution and maintains that inventory directly, updating it whenever a cookie is added, removed, or changed. The inventory is organized into the same consent categories presented in the consent banner (Strictly Necessary, Statistics, and Marketing) and reflects the actual cookies in use.

You may control, restrict, or delete cookies through your web browser settings. Please note that disabling or deleting cookies may impair certain features of the Service, including website functionality and personalization. The following resources provide information on managing cookies and opting out of specific analytics and advertising platforms:

(a) Consent Management: You may withdraw, modify, or re-confirm your cookie consent at any time by clicking the "Your Privacy Choices" link in the footer of any page on the marketing website, which opens the consent preferences panel, or by visiting https://kreamandsugardating.com/cookie-policy. Consent is collected and managed by the Company's own first-party consent-management solution; no third-party consent tool is used. Your consent preferences are stored in a first-party ks_consent cookie. The marketing website also honors your browser's Global Privacy Control (GPC) signal, treating it as an opt-out of Marketing (advertising) cookies and of the corresponding "sale" or "sharing" of personal information, unless you subsequently opt in through the consent preferences panel;
(b) Google Analytics Opt-Out: You may opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-On, available at: https://tools.google.com/dlpage/gaoptout
(c) Meta (Facebook/Instagram) Advertising Preferences: You may manage your Meta advertising preferences at: https://www.facebook.com/settings/?tab=ads
(d) TikTok Privacy Settings: You may review TikTok's privacy settings and policies at: https://www.tiktok.com/legal/privacy-policy
(e) Browser Cookie Settings: You may adjust your browser's cookie settings to block or delete first-party and third-party cookies. Refer to your browser's help documentation for instructions.

3.3 Do Not Track Signals

Certain web browsers may transmit "Do Not Track" ("DNT") signals to websites and online services. At this time, there is no universally accepted standard for how companies should respond to DNT signals. The Service does not currently alter its data collection or use practices in response to DNT signals. If a uniform standard for responding to DNT signals is adopted, the Company will reassess its practices and update this Privacy Policy accordingly. DNT is distinct from the Global Privacy Control (GPC) signal, which the marketing website does honor as described in Section 3.2(a).

3.4 Marketing Attribution

When you arrive at Kream & Sugar from a link in a creator's post, an advertisement, or a referral, we record which campaign, creator, or channel referred you — for example marketing campaign tags (UTM parameters), a creator or referral identifier, and advertising click identifiers provided by the platform you came from (such as Meta's fbclid, Google's gclid, TikTok's ttclid, and Reddit's rdt_cid). We use this first-party information to measure which marketing efforts bring real members, to compensate creators fairly, and to prevent fraudulent or fake sign-ups. We retain it for as long as your account is active and for a reasonable period afterward for accounting and anti-fraud purposes. We do not sell this information; any sharing with an advertising platform is done only with your marketing consent.

4. HOW WE USE YOUR INFORMATION

The Company uses the Information it collects for the following purposes. Each purpose is described with specificity to enable you to understand the nature and extent of our data processing activities.

4.1 Provision and Operation of the Service

We use your Information to provide, operate, maintain, and improve the Service, including but not limited to:

(a) Creating, authenticating, and managing your account through passwordless one-time password verification via email or SMS, or through third-party OAuth social login;
(b) Displaying your profile to other Users in accordance with your preferences and our matching algorithms;
(c) Facilitating matches between Users based on geographic proximity, age preferences, gender preferences, dating context preferences, and compatibility assessments;
(d) Enabling and facilitating real-time messaging (including text, voice notes, and GIF images), voice chat sessions, virtual cafe interactions (including live captioning and translation of café voice and accessibility features such as type-to-speak), and game participation;
(e) Processing and managing subscriptions, payments, refunds, and standalone product purchases;
(f) Organizing, facilitating, and managing in-person and virtual events;
(g) Enforcing blocking preferences by preventing blocked Users from viewing your profile information, communicating with you, interacting with you in virtual cafes, or being paired with you in games (whether in-person or virtual).

4.2 Marketing Website and Communications

We use your Information to:

(a) Send you updates and marketing emails if you have opted in to receive such communications through the email subscription form;
(b) Respond to your inquiries, messages, and requests submitted through the website contact form, Elementor popup forms, or other communication channels;
(c) Send transactional communications that are necessary for the operation of your account and the Service, including but not limited to authentication codes, email verification messages, phone verification messages, payment confirmations, subscription status updates, and account security alerts (note: transactional communications cannot be opted out of, as they are essential to the operation and security of your account);
(d) Send non-transactional communications in accordance with your notification preferences, including but not limited to new message alerts, match request notifications, event reminders, promotional offers, and re-engagement notifications.

4.3 Location-Based Services

We use your location data (both IP-based and GPS-based) for the following purposes:

(a) Determining your geographic location for proximity-based matchmaking within your specified radius;
(b) Assigning you to a geographic region within the Service's location system for the purposes of location-restricted features, events, and promotions;
(c) Verifying your eligibility for location-specific promotions and events;
(d) Providing location-relevant content and recommendations;
(e) Detecting and preventing fraud, including the identification of suspicious geographic anomalies.

4.4 Analytics, Advertising Attribution, and Service Improvement

We use Information collected through website analytics, pixels, and server-side APIs to:

(a) Track and optimize website performance and user experience;
(b) Analyze user behavior on the marketing website to improve content, design, and functionality;
(c) Measure the effectiveness of advertising campaigns across TikTok, Google, and Meta (Facebook/Instagram) platforms;
(d) Provide cookieless tracking through server-side Conversions APIs for key events (form submissions, registrations) that persist beyond browser cookie limitations;
(e) Generate advertising attribution models to understand which marketing channels and campaigns drive user acquisition and conversions;
(f) Analyze aggregated, de-identified, or anonymized usage patterns, trends, and user engagement to improve the Service;
(g) Evaluate the effectiveness of features, events, promotions, and content;
(h) Conduct research and development to enhance user experience;
(i) Generate internal reports and business intelligence.

4.5 Safety, Security, and Fraud Prevention

We use your Information to protect the safety and security of our Users and the integrity of the Service, including but not limited to:

(a) Detecting, investigating, and preventing fraud, unauthorized access, and other illegal or harmful activities;
(b) Monitoring and enforcing compliance with our Terms and Conditions of Use and all applicable policies;
(c) Conducting content moderation and reviewing User reports of violations;
(d) Implementing device bans to prevent circumvention of account suspensions and bans;
(e) Performing VOIP detection to identify potentially fraudulent phone numbers;
(f) Maintaining security event logs for audit, investigation, and incident response purposes;
(g) Implementing rate limiting to prevent brute-force attacks, denial-of-service attacks, and other forms of automated abuse;
(h) Employing device fingerprinting to detect and prevent the creation of multiple accounts by a single individual in violation of the Terms;
(i) Evaluating and responding to refund requests, chargebacks, and payment disputes, including, where a purchase was made through a third-party app store, by sharing relevant account, engagement, and purchase and refund history information with that app store provider as described in Section 5.2.19, in order to assess the legitimacy of the request and to detect and prevent refund abuse.

4.6 Legal Compliance and Law Enforcement

We use your Information as necessary to comply with our legal obligations, including but not limited to:

(a) Responding to lawful requests from law enforcement agencies, regulatory authorities, courts, and other governmental bodies, including subpoenas, court orders, search warrants, and national security letters;
(b) Preserving evidence in connection with legal proceedings, law enforcement requests, or regulatory investigations, including the imposition of evidence holds on relevant communications and account data;
(c) Establishing, exercising, or defending legal claims;
(d) Complying with applicable laws, regulations, and legal processes;
(e) Disclosing Information in emergency situations involving imminent danger of death or serious physical injury to any person, in accordance with applicable law.

4.7 Automated Promotional Targeting

We use certain behavioral and transactional data to determine your eligibility for automated promotions, including but not limited to promotions triggered by:

(a) Account registration date and location;
(b) First subscription event;
(c) Duration of account inactivity;
(d) Feature usage patterns and engagement metrics;
(e) Geographic location.

Such automated promotional targeting does not involve the sale of your personal information to third parties and is conducted solely within the Service for the purpose of offering you relevant promotional pricing.

4.8 Calendar Integration (Optional)

Where you have connected a third-party calendar as described in Section 2.5, we use the OAuth authorization credential you granted solely to add to your connected calendar the in-person or virtual events for which you register or RSVP through the Service, and to update or remove those calendar entries if the corresponding event changes or you cancel your registration or RSVP. We do not use this access for any other purpose, we do not read the contents of your calendar, and we do not use calendar data for advertising, marketing, profiling, or the training of machine-learning models.

The Company does not sell or rent your personal information to third parties. However, we may share, disclose, or otherwise make your Information available to the following categories of recipients, under the following circumstances and for the following purposes:

5.1 Other Users of the Service

Certain Information is inherently shared with other Users as part of the core functionality of the dating application, including but not limited to:

(a) Your profile information (including your name, age, gender, bio, photographs, dating context preference, and general geographic location) is visible to other Users in accordance with the Service's matching and discovery features, subject to your blocking preferences;
(b) The content of your messages, voice notes, and GIFs is visible to the recipients thereof;
(c) Your online status and last active timestamps may be visible to other Users with whom you are matched;
(d) Your participation in events, virtual cafes, and games may be visible to other participants thereof;
(e) A blocked indicator is visible on the profile of any User you have blocked, but only to you; blocked Users receive no notification of being blocked and cannot see any of your Information.

5.2 Third-Party Service Providers (Dating Application)

We engage third-party service providers to perform certain functions on our behalf in connection with the dating application, and we share Information with such providers only to the extent necessary for them to perform such functions. Such providers are contractually obligated to use your Information only for the purposes for which it was shared and in accordance with this Privacy Policy. The following describes the principal categories of such providers and the Information shared with each:

5.2.1 Payment Processing: CCBill, LLC

Information shared: Customer and subscription identifiers, transaction amounts, currency, billing period information, and the limited set of personal data CCBill requires to bill the cardholder (typically name, billing address, email, and IP address).
Purpose: Processing payments, managing recurring subscriptions, issuing refunds, handling chargebacks, and receiving payment-related webhook events.
Note: CCBill directly collects your full payment instrument details (e.g., credit card numbers) through its own secure payment interfaces and is the merchant of record for the transaction. Such details are not transmitted through or stored on our servers.
CCBill Privacy Policy: For information on how CCBill handles your payment data, please refer to the CCBill Privacy Policy.

5.2.2 Transactional Email Delivery

Information shared: Email addresses, email content (including verification codes, sign-in links, notification content, and transactional communications), sender addresses, and unsubscribe headers.
Purpose: Delivering transactional and notification emails on our behalf.

5.2.3 SMS and Telecommunications Providers

Information shared: Phone numbers, SMS message content (including verification codes, notification text, and the Company's application name), and carrier line type intelligence queries (carrier name, line type, mobile country / network code).
Purpose: Delivering SMS messages for account verification, phone number verification, and notification delivery; performing VOIP detection and carrier line type analysis for fraud prevention.
Retention of cached Lookup results: To reduce redundant external API calls and limit data transmitted to the sub-processor, the Company caches the carrier-line-type-intelligence response (carrier name, VOIP / mobile classification, and country code) for up to thirty (30) days, keyed to a one-way, non-reversible hash of the phone number rather than the phone number itself. The cache does not include your call history, SMS history, or message content.
Suppression list: When you delete your account or opt out, your phone number is stored on a Company-maintained suppression list solely as a one-way, non-reversible hash to prevent re-registration or re-marketing of a deleted number. The plaintext phone number is not retained on the suppression list.
Mobile information, SMS consent, and third-party marketing: The Company does not sell or rent your telephone number. The Company does not share your telephone number with any third party for that third party's own marketing or promotional purposes, and does not share it with any party for the purpose of enabling that party to send you messages. Your telephone number is disclosed in plaintext only to the telecommunications providers engaged by the Company to transmit the Company's own messages to you, solely in that capacity. Separately, and as described in Section 3.1.4, a one-way, non-reversible cryptographic hash of your telephone number may be transmitted to advertising platforms (currently Meta Platforms, Inc. and TikTok) for the sole purpose of measuring the effectiveness of the Company's own advertising campaigns, subject to the permissions described in that Section; those platforms receive the hash rather than your telephone number itself, and are not authorized to use it to contact you. Your SMS opt-in and opt-out records are used exclusively to determine which of the Company's own messages you have consented to receive and are not disclosed to any third party.

5.2.4 IP Geolocation Provider

Information shared: Your IP address.
Purpose: Determining your approximate geographic location (city, state, country, approximate coordinates) for location-based service functionality, including matchmaking, promotion eligibility, and fraud detection.

5.2.5 GPS-Based Reverse Geocoding Provider

Information shared: Your GPS latitude and longitude coordinates.
Purpose: Converting your GPS coordinates into human-readable geographic location names (reverse geocoding) for the purpose of location assignment within the Service.

5.2.6 GIF Integration: Giphy (Shutterstock, Inc.)

Information shared: Search queries you enter when searching for GIFs within the messaging interface. Because GIF images are loaded directly from Giphy's servers, Giphy also receives your IP address and device user agent when GIFs are displayed.
Purpose: Providing searchable GIF content within the messaging feature of the Service. Giphy may collect additional information in accordance with its own privacy policy.

Information shared: OAuth authentication tokens and, as necessary, your account identifier on the respective platform.
Purpose: Enabling account registration and authentication through third-party social login. Each provider may have access to Information in accordance with its own privacy policy and your privacy settings on that platform.

5.2.8 Cloud Object Storage; Amazon Web Services, Inc. (Security Token Service)

Information shared: User-uploaded photographs and files are stored in dedicated Company-controlled cloud object storage with access controls; the storage provider processes the stored files solely to provide the storage service. Amazon Web Services, Inc. issues temporary security credentials via its Security Token Service (STS) used to operate the optional age-verification liveness capture described in Section 14.3.
Purpose: Securely storing and serving user-uploaded content, and issuing short-lived credentials for the age-verification liveness feature.

5.2.9 Biometric Verification and Photo Moderation: Amazon Rekognition (Amazon Web Services, Inc.)

Information shared: (a) For Users who voluntarily opt in to age verification: a self-captured photograph of the User's face ("verification selfie"); a face vector (a non-reversible mathematical representation of the User's facial geometry) that is added to a private Face Collection scoped solely to the Service for the purpose of detecting duplicate accounts; (b) For all profile photo uploads: the photograph submitted to your profile gallery, transmitted as raw image bytes for content-moderation classification and, for the photograph designated as your primary photograph, automated detection that the photograph depicts a person and, where your account is the subject of a report alleging that you may be underage, estimation of the apparent age of the person depicted, for child-safety purposes. No face template or identifier is created or stored from the checks described in this clause (b).
Purpose: (i) Estimating an apparent age range from the verification selfie (used solely to confirm that the User appears to be at least eighteen (18) years of age); (ii) comparing the verification selfie against your existing profile photographs to confirm that those photographs depict the same person; (iii) searching the private Face Collection to detect attempts to create duplicate accounts; (iv) adding the resulting face vector to the private Face Collection so that future duplicate-account searches can recognize you; (v) classifying profile photo uploads to enforce community standards regarding nudity, sexually explicit content, graphic violence, weapons, and hate symbols; (vi) detecting that a primary profile photograph depicts a person; and (vii) where an account is reported as possibly belonging to a minor, estimating the apparent age of the person in the primary photograph, solely to determine whether age verification should be requested or required as described in the Terms and Conditions (Section 11.12).
Retention: Verification selfies and ID document images uploaded for age verification are stored in dedicated Company-controlled cloud object storage subject to a thirty (30) day automatic expiration lifecycle policy. The face vector stored in the Face Collection persists for as long as your account remains active and is permanently deleted when you exercise your right to permanent account deletion under Section 7.5.2. Profile photos submitted for moderation are not retained by Amazon Rekognition; only the moderation classification result (e.g., the names of any matched policy-violation labels) is logged on our servers for audit purposes.
Important: Model Training. Verification selfies, ID documents, profile photos, and the resulting face vectors are not used by Amazon Web Services to train or improve any Amazon Rekognition machine-learning models. The Company has elected not to participate in AWS's optional ML-improvement program for these services.

5.2.10 Identity Document Optical Character Recognition: Amazon Textract (Amazon Web Services, Inc.)

Information shared: Photographs of government-issued identity documents (United States driver's licenses, United States state identification cards, and United States passports) voluntarily uploaded by Users in two narrow circumstances: (a) when a User opts in to age verification and is asked to confirm adult status by submitting an identity document; or (b) when a User submits an identity document as evidence in connection with an appeal of an age-verification soft-restriction.
Purpose: Extracting structured data fields from the submitted identity document through automated identity-document analysis, including (i) the date of birth, used solely to confirm that you are at least eighteen (18) years of age, and (ii) an automated confidence assessment used to determine whether the submission may be auto-approved or must be routed to manual administrative review by Company personnel.
Retention: Identity document images are stored in dedicated Company-controlled cloud object storage subject to a thirty (30) day automatic expiration lifecycle policy. Extracted fields (first name, last name, date of birth, document type, expiration date, and per-field confidence scores) are persisted to our application database for the lifetime of the associated verification attempt or appeal record, and are subject to deletion under Section 7.5.2.
Important: Model Training. Identity document images and extracted fields are not used by Amazon Web Services to train or improve any Amazon Textract machine-learning models.

5.2.11 Automated Content Moderation: Google LLC (primary) and OpenAI, L.L.C. (failover)

Information shared: Free-text content that you submit to the Service for the purpose of automated policy-violation screening, including (without limitation): profile biography text, profile display name and first/last name fields, direct-message text bodies, the speech-to-text transcripts of direct-message voice notes, and the speech-to-text transcripts of reported virtual-café voice described in Section 2.1.4(g). For all voice content, the speech-to-text transcription is performed on the Company's own infrastructure; only the resulting transcript text — never the underlying audio — is transmitted to the classification provider. Where you or another User files a report, recent content from the relevant conversation and from the reported profile (message text, voice-note transcripts, biography and display name, and the images described below) within a limited recent window is likewise submitted for classification in order to assess the report.
Images (report review only): In connection with the review of a report, profile photographs of the reported user and images submitted by the reporter as evidence may additionally be submitted to the classification provider for scoring against the same fixed policy categories. Outside of report review, images are screened only by the separate services described in Sections 5.2.9 and 5.2.13.
Purpose: Classifying the submitted content against a small fixed set of policy categories (such as harassment, hate, sexual content, and self-harm) so that violating content can be blocked, redacted, or routed to manual administrative review by Company personnel, and so that user reports can be assessed.
Failover provider: Where the primary classification provider is unavailable, the same content may be submitted to a secondary provider, OpenAI, L.L.C., under equivalent commitments: content submitted through its API is not used to train the provider's models and is retained by the provider only for a limited period for abuse monitoring before deletion.
Retention: The submitted content is transmitted to the classification API on a per-request basis and is not retained by the provider for model-training purposes pursuant to the Company's contractual arrangements. The Company retains only the classification result (the list of matched policy categories and the associated confidence scores) on its own servers for audit and appeals purposes, in accordance with the retention schedule in Section 6.5.
Google Privacy Policy & API Terms: For information on how Google handles data submitted to its developer APIs, please refer to the Google Privacy Policy and the Gemini API Additional Terms of Service, which govern Google's generative-AI and content-moderation APIs (including the contractual commitment that paid-tier API data is not used to train Google's models).

5.2.12 Push Notifications: Web Push Protocol (VAPID)

Information shared: Push subscription endpoint URLs, P256DH public encryption keys, and authentication secret keys associated with your browser or device.
Purpose: Delivering push notifications to your device or browser in accordance with your notification preferences.

5.2.13 Child Sexual Abuse Material Hash Matching

Information shared: A non-reversible perceptual hash derived from each image you upload to the Service. The hash is generated on our servers before transmission; the underlying image itself is never transmitted to the hash-matching service.
Purpose: Comparing the hash against an industry database of known child sexual abuse material (CSAM) hashes for the sole purpose of detecting and blocking such material from the Service, in furtherance of the Company's obligations under the federal REPORT Act of 2024 and applicable state laws.
Retention: Hashes generated for matching are not retained by the hash-matching service beyond the duration of the matching request. Where an image is identified as a positive match, the Company preserves the image and associated metadata on its own infrastructure for one (1) year as required by 18 U.S.C. § 2258A(h).

5.2.14 Voice Transcription: Performed on Company Infrastructure (No Third-Party Sub-Processor)

Current practice: Speech-to-text transcription of voice content — including direct-message voice notes and reported virtual-café voice described in Section 2.1.4(g) — is performed entirely on the Company's own self-hosted infrastructure using open-source speech-recognition models operated by the Company. No third-party transcription service receives your audio. Only the resulting transcript text is transmitted to the content-classification sub-processor described in Section 5.2.11, and only for the content-safety purposes described there.
Discontinued sub-processor: A prior version of this Policy disclosed AssemblyAI, Inc. as a voice-transcription sub-processor. That integration has been discontinued; no voice audio is transmitted to AssemblyAI or to any other third-party transcription provider.
Retention: Transcripts are retained on the Company's servers for audit and appeals purposes in accordance with the retention schedule in Sections 6.4(k) and 6.5.

5.2.15 Content Delivery and Edge Services: Cloudflare, Inc.

Information shared: HTTP request metadata (IP address, request URL, user-agent, response status, response size, timestamp) for traffic to the Service's websites and application, including image and media URLs requested by your client.
Purpose: Providing content delivery, DNS, and edge security services for the Service — serving images, voice notes, and other assets via a global content delivery network with access controls for private user-uploaded media, and reducing latency, bandwidth costs, and exposure to automated abuse.
Retention: Cloudflare retains edge HTTP logs for the period specified in its standard service terms; the Company does not configure additional log retention beyond Cloudflare's defaults.

5.2.16 Bot Detection and Abuse Prevention: Cloudflare Turnstile (Cloudflare, Inc.)

Information shared: When you initiate a security-sensitive action on the dating application — specifically, requesting a one-time password ("OTP") by email or SMS, or signing in through a third-party social login — the Cloudflare Turnstile widget collects and transmits certain client-side signals to Cloudflare, including your IP address, a TLS fingerprint, your browser's User-Agent header, and the Turnstile sitekey and originating domain. These signals also fall within the categories of automatically collected Information described in Sections 2.2.2 and 2.2.3.
Purpose: Distinguishing human Users from automated bots in order to protect the authentication flow against automated account creation, credential-stuffing, OTP-pumping, and other forms of automated abuse, and to improve Cloudflare's bot-detection algorithms. Cloudflare acts as the Company's data processor for this purpose. Cloudflare has represented that it cannot directly identify any individual from the signals Turnstile collects, and that such signals are used solely to detect and block bots and are not used for advertising or cross-site tracking.
Retention: Cloudflare processes the Turnstile signals for the period specified in its standard service terms and the Turnstile Privacy Addendum referenced below. The Company does not itself retain the raw Turnstile signals; it retains only the short-lived, single-use verification token returned by Turnstile, and only for the duration of the associated authentication request.
Cloudflare Turnstile Privacy Addendum: For details on how Cloudflare processes the client-side signals collected by Turnstile, please refer to the Cloudflare Turnstile Privacy Addendum.

5.2.17 Mandatory Reporting Recipient: National Center for Missing & Exploited Children ("NCMEC")

Information shared: Where the Company's automated child-sexual-abuse-material detection pipeline (described in Section 5.2.13) identifies a positive hash match, the Company is required by federal law (18 U.S.C. § 2258A) to file a CyberTipline report with NCMEC. The report includes (a) the matched image, (b) the uploading User's account identifier, registration metadata, IP address, and device fingerprint, (c) the Service's account-level moderation history and ban state at the time of the match, and (d) the matched hash and source identifier. The Company also retains the matched image for one (1) year under 18 U.S.C. § 2258A(h) to support NCMEC and law-enforcement investigation.
Purpose: Compliance with the Company's federal reporting obligations under 18 U.S.C. § 2258A and the REPORT Act of 2024. NCMEC is a mandatory regulatory recipient and is not engaged as a sub-processor of the Company.
No opt-out: Reporting to NCMEC is not subject to user opt-out, withdrawal of consent, or data-subject deletion requests under any applicable data-protection law. Retention of reportable material is similarly required by federal law and overrides any otherwise-applicable retention limit in this Policy.

5.2.18 Calendar Integration: Google LLC and Microsoft Corporation

Information shared: Where you voluntarily connect a third-party calendar to the Service (see Section 2.5), the Company transmits to the applicable calendar provider (Google LLC for Google Calendar, or Microsoft Corporation for Microsoft Outlook / Microsoft 365 calendars), together with the OAuth authorization credential you granted, the details of the specific event you have elected to add, namely the event title, description, date, start and end times, time zone, and location.
Purpose: Adding to your connected calendar the events for which you register or RSVP through the Service, and updating or removing those calendar entries if the underlying event changes or you cancel. The Company does not read, retrieve, or store the contents of your existing calendar, and requests only the access necessary to manage the events it adds on your behalf.
Google API Services User Data Policy (Limited Use): The Company's access to, and use of, information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information obtained through Google Calendar authorization is used solely to provide and improve the user-facing calendar feature described above; is not transferred to or sold to others except as necessary to provide that feature, to comply with applicable law, or as part of a merger, acquisition, or asset sale as described in Section 5.6; is not used or transferred for the purpose of serving advertising; and is not used for any purpose unrelated to adding and managing the events you elect to add. The Company does not permit humans to read this data except (i) with your affirmative agreement, (ii) as necessary for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where the data has been aggregated and de-identified and is used for internal operations, in each case consistent with the Limited Use requirements.
Provider privacy policies: For information on how these providers process your data, please refer to the Google Privacy Policy and the Microsoft Privacy Statement.
Optional and revocable: This integration is optional and disabled by default. You may revoke the Company's access at any time through the Service's in-app settings or directly through your Google or Microsoft account security settings, as described in Section 2.5.

5.2.19 App Store Providers: Apple Inc. and Google LLC (Refund and Dispute Evaluation)

Information shared: Where you purchased a subscription or other paid item through a third-party app store (the Apple App Store, operated by Apple Inc., or Google Play, operated by Google LLC) and you request a refund, or the app store provider otherwise asks the Company to assist in evaluating a refund or payment dispute for that purchase, the Company may transmit to that provider information relevant to the request. This information consists of coarse, categorized indicators rather than raw records, and may include the tenure and status of your account, your level of engagement with the Service during the relevant subscription period, and your aggregate purchase and refund history.
Purpose: Assisting the app store provider in determining whether the refund or dispute is legitimate, and detecting and preventing refund abuse and "friendly fraud" (for example, fully using a paid subscription and then seeking a refund of amounts fairly owed). The Company shares only the information reasonably necessary for this purpose and does not share the contents of your communications. The app store provider, not the Company, makes the final refund decision.
Provider privacy policies: The app store provider's own handling of this information is governed by its privacy policy; please refer to the Apple Privacy Policy and the Google Privacy Policy.

5.3 Third-Party Service Providers (Marketing Website)

We engage the following third-party service providers in connection with the operation of the marketing website:

5.3.1 Email Marketing Provider

Information shared: Email addresses of users who subscribe to marketing communications through the website subscription form.
Purpose: Managing email subscription lists and delivering marketing and update emails.

5.3.2 Website Form Processing

Information shared: Form submission data (including name, email address, phone number, and message content) submitted through website contact forms and popup forms.
Purpose: Processing and managing form submissions on the marketing website.

5.3.3 Website Hosting

Information shared: Standard web server log data, including IP addresses, user agent strings, request URLs, and timestamps.
Purpose: Hosting and serving the marketing website.

5.4 Analytics and Advertising Partners (Marketing Website)

We share Information with the following analytics and advertising partners through pixel tracking and server-side Conversions APIs on the marketing website:

5.4.1 TikTok (ByteDance Ltd.)

Information shared (client-side via TikTok Pixel): Page views, clicks, form submissions, and other user interaction events, along with cookie-based identifiers.
Information shared (server-side via TikTok Conversions API): Hashed identifiers (such as hashed email addresses), event timestamps, event types, and associated metadata.
Purpose: Tracking and optimizing TikTok advertising campaigns; measuring advertising attribution and conversion events.

5.4.2 Google (Alphabet Inc.)

Information shared (client-side via Google Analytics and Google Tag Manager): Page views, session data, traffic sources, UTM parameters, page interactions, device and browser information, and anonymized IP addresses.
Information shared (server-side via Google API): Event data including UTM parameters and anonymized IP addresses for campaign effectiveness measurement.
Purpose: Understanding website traffic patterns, user engagement, and marketing campaign effectiveness; optimizing Google advertising campaigns.

5.4.3 Meta: Facebook/Instagram (Meta Platforms, Inc.)

Information shared (client-side via Meta Pixel): Page views, form submissions, registrations, and other on-site events, along with cookie-based identifiers.
Information shared (server-side via Meta Conversions API): Hashed identifiers (such as hashed email addresses), event timestamps, event types, UTM parameters, and associated metadata.
Purpose: Tracking and optimizing Meta (Facebook/Instagram) advertising campaigns; measuring advertising attribution and conversion events.

5.5 Law Enforcement and Legal Obligations

We may disclose your Information to law enforcement agencies, regulatory authorities, courts, governmental bodies, and other authorized entities in the following circumstances:

(a) In response to a valid and enforceable subpoena, court order, search warrant, national security letter, or other lawful legal process;
(b) When we reasonably believe that disclosure is necessary to comply with applicable law, regulation, or legal obligation;
(c) When we reasonably believe that disclosure is necessary to protect the rights, property, or safety of the Company, our Users, or the public;
(d) In emergency situations involving imminent danger of death or serious physical injury to any person, where we may disclose Information to appropriate law enforcement or emergency services without a prior legal process, in accordance with applicable law (including, without limitation, 18 U.S.C. § 2702(b)(8) and § 2702(c)(4) of the Stored Communications Act);
(e) In connection with the investigation, prevention, or detection of fraud, security incidents, or violations of our Terms and Conditions of Use.

When we receive a lawful request for your Information, we may place an evidence hold on relevant account data and communications to preserve such data for the duration of the legal proceeding or investigation. Evidence holds may include the preservation of messages, account data, transaction records, and other relevant Information, and may include a specified duration and reason for the hold.

5.6 Business Transfers

In the event that the Company undergoes a merger, acquisition, reorganization, bankruptcy, dissolution, sale of all or substantially all of its assets, or similar corporate transaction or proceeding, your Information may be transferred to the acquiring entity or successor as part of such transaction. In such event, we will make reasonable efforts to ensure that the acquiring entity or successor assumes the obligations set forth in this Privacy Policy with respect to your Information, or provides you with notice and an opportunity to opt out of such transfer to the extent required by applicable law.

5.7 Aggregated and De-Identified Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you with third parties for analytical, research, business intelligence, or other purposes. Such data is not considered personal information under this Privacy Policy.

We may share your Information with third parties when you have provided your express consent to such sharing, including but not limited to situations where you voluntarily share content from the Service on external platforms or provide authorization for a specific data transfer.

6. DATA STORAGE, RETENTION, AND SECURITY

6.1 Data Storage Infrastructure

Your Information is stored on secure servers utilizing PostgreSQL relational database management systems. User-uploaded files, including photographs, are stored in dedicated Company-controlled cloud object storage. The Company's infrastructure may utilize additional cloud services and content delivery mechanisms as necessary to provide the Service reliably and efficiently.

6.2 Message Encryption

The content of text messages transmitted through the dating application is encrypted using server-side encryption prior to storage in the database. The Company retains the capability to decrypt such messages as necessary for content moderation, compliance with legal obligations (including law enforcement requests and court orders), enforcement of the Terms and Conditions of Use, and other purposes described in this Privacy Policy. Voice notes and audio recordings are stored as encrypted files in Company-controlled cloud object storage. THE COMPANY DOES NOT PROVIDE TRUE END-TO-END ENCRYPTION; THE COMPANY RETAINS DECRYPTION CAPABILITIES FOR THE PURPOSES DESCRIBED HEREIN.

6.3 Hashing of Sensitive Data

Certain categories of sensitive data are hashed using industry-standard cryptographic techniques prior to storage or transmission, including:

(a) Authentication tokens and verification codes;
(b) Email addresses transmitted to third-party analytics providers via server-side Conversions APIs (hashed prior to transmission for privacy-preserving advertising attribution);
(c) Other sensitive credentials and tokens as appropriate.

6.4 Data Retention Periods

The Company retains your Information for the following periods:

(a) Active Account Data: For as long as your account remains active and for a reasonable period thereafter to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
(b) Soft-Deleted Account Data: When you delete your account through the in-app account deletion feature, your account is "soft deleted," meaning your profile is hidden from other Users and your account is deactivated, but your data is retained in our systems. Soft-deleted data is retained for a reasonable period to enable account recovery, comply with legal obligations, resolve disputes, and enforce our agreements.
(c) Permanently Deleted Account Data: When you permanently delete your account within the dating application (Settings → Privacy & Data → Request permanent deletion), or submit a verified emailed deletion request as described in Section 7.5.2, we will undertake commercially reasonable efforts to permanently delete your personal information from our active systems within a reasonable timeframe, subject to the exceptions described in Section 6.5.
(d) Security Event Logs: Security event data (including login attempts, authentication events, IP addresses, and user agent strings associated with such events) is retained for a period necessary to maintain the security of the Service, detect and prevent fraud, and comply with applicable legal requirements.
(e) Payment and Transaction Records: Payment transaction data is retained for the period required by applicable tax, accounting, and financial regulations, and as necessary to resolve payment disputes.
(f) Content Moderation Records: Reports, moderation actions, warnings, and enforcement records are retained for the period necessary to enforce our policies, resolve disputes, and comply with legal obligations. Where content is removed or disabled in response to a notice of claimed copyright infringement received pursuant to Section 21.4 of the Terms and Conditions of Use, the Company retains an internal administrative audit-log entry for that removal action, recording the identity of the administrator effecting the removal, the date and time of removal, the reason recorded, and the identifier of the removed content, in accordance with the safe-harbor provisions of 17 U.S.C. § 512. The Company does not retain copies of the underlying photograph, voice note, or other media bytes after removal.
(g) Evidence Holds: Where an evidence hold has been placed on your data in connection with a legal proceeding, law enforcement request, or regulatory investigation, your data subject to such hold will be retained until the hold is lifted, regardless of any deletion requests or other retention periods.
(h) Website Analytics and Marketing Data: Data collected through website analytics, pixels, and server-side Conversions APIs is retained according to each analytics provider's data retention policies (Google Analytics, Meta, and TikTok each maintain their own data retention schedules). Server-side hashed event logs are retained in accordance with such provider retention policies.
(i) Email Subscription Data: Email addresses and subscription preferences provided through the marketing website are retained for as long as you remain subscribed and for a reasonable period thereafter, unless you request deletion.
(j) Biometric Verification Data: Verification selfies and identity document images uploaded in connection with the optional age verification feature are stored in dedicated Company-controlled cloud object storage subject to a thirty (30) day automatic expiration lifecycle policy. Face vectors stored in the private Amazon Rekognition Face Collection are retained for the lifetime of your account, subject to a maximum outer limit of three (3) years from your last interaction with the Service (in accordance with the Illinois Biometric Information Privacy Act, 740 ILCS 14/15(a)). Detailed retention rules for biometric Information are set forth in Section 14.3.3 of this Policy.
(k) Voice Moderation Audio and Transcripts: Virtual cafe voice audio reaches the Company's servers only when a participant files a report, as described in Section 2.1.4(g), or where you have separately given the opt-in consent to voice analysis described in Section 6.8 (retention for that program is governed by subsection (l) of this Section). Audio uploaded in connection with a report, together with its corresponding speech-to-text transcripts, is stored in dedicated Company-controlled cloud object storage subject to a thirty (30) day automatic expiration lifecycle policy, regardless of the outcome of the review. For voice content that is screened by automated moderation before delivery (such as direct-message voice notes), transcription is transient: where no violation is found, the transcript is not retained. Where a moderation review results in an enforcement record, the corresponding audio, transcript, and metadata are retained as part of the Content Moderation Records described in subsection (f) of this Section.
(l) Voice ML Training Corpus (opt-in only): For Users who have given the separate, express, opt-in consent described in Section 6.8, the communication-style features derived from voice-cafe audio are retained for so long as that consent remains in effect and are deleted when you withdraw consent or delete your account. The underlying raw voice-cafe audio captured for this purpose is retained only transiently — for no more than sixty (60) days — in dedicated Company-controlled cloud object storage subject to an automatic expiration lifecycle policy, solely to allow the derived features to be re-computed as the model is refined, after which it is permanently deleted. This corpus is used only to train the Company's own matchmaking model, is never sold or disclosed to any third party, and is further governed by the Biometric Information Privacy notice in Section 14.3.7.

6.5 Exceptions to Data Deletion

Notwithstanding any request for data deletion, the Company may retain certain Information where:

(a) Retention is required by applicable law, regulation, or legal obligation;
(b) An evidence hold has been placed on the data in connection with a legal proceeding or law enforcement request;
(c) Retention is necessary for the establishment, exercise, or defense of legal claims;
(d) Retention is necessary for fraud detection and prevention purposes;
(e) The data has been aggregated, de-identified, or anonymized such that it cannot reasonably be used to identify you;
(f) Retention is necessary to enforce the Company's Terms and Conditions of Use, including but not limited to maintaining records of bans and enforcement actions to prevent circumvention.

6.6 Security Measures

The Company implements and maintains commercially reasonable technical, administrative, and organizational security measures designed to protect your Information from unauthorized access, disclosure, alteration, destruction, and other forms of unlawful processing. These measures include, without limitation:

(a) Encryption: Encryption of Information in transit and at rest, applied on a layered basis and calibrated to the sensitivity of each category of Information, together with the hashing of passwords, one-time passcodes, and other credentials, and the hashing of identifiers transmitted to third-party analytics or advertising platforms for privacy-preserving measurement;
(b) Access Controls: Role-based access controls and authenticated-session controls that limit access to Information to authorized personnel and services;
(c) Network and Application Security: Transport-layer encryption for data in transit, together with standard network and application security controls and security headers;
(d) Abuse Prevention: Rate limiting and other automated-abuse defenses designed to protect against brute-force attacks, denial-of-service attacks, and similar activity;
(e) Fraud Detection: Measures to detect and prevent fraud and ban evasion, including the use of device and account signals and the enforcement of account and device restrictions;
(f) Input Sanitization: Sanitization of user-generated content to guard against injection and similar attacks.

The specific safeguards employed are reviewed and updated from time to time as the Company deems appropriate, and the Company does not publish the detailed technical configuration of its security controls, as doing so would itself present a security risk.

NOTWITHSTANDING THE FOREGOING, NO METHOD OF TRANSMISSION OVER THE INTERNET AND NO METHOD OF ELECTRONIC STORAGE IS COMPLETELY SECURE. THE COMPANY CANNOT AND DOES NOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR INFORMATION. YOU ACKNOWLEDGE AND AGREE THAT YOU TRANSMIT YOUR INFORMATION AT YOUR OWN RISK, AND THE COMPANY SHALL NOT BE LIABLE FOR ANY UNAUTHORIZED ACCESS TO, DISCLOSURE OF, OR LOSS OF YOUR INFORMATION RESULTING FROM CAUSES BEYOND THE COMPANY'S REASONABLE CONTROL.

6.7 Suppression List for Banned Accounts

Where we permanently ban an account due to a confirmed chargeback, payment dispute filed in bad faith, or other material violation of our Terms and Conditions of Use, we retain a one-way, non-reversible cryptographic hash of your email address, phone number, device fingerprint, and the IP address used at the time of the violation, in a separate "suppression list." These records:

(a) Are retained indefinitely;
(b) Cannot be reversed, decrypted, or otherwise transformed back into the original values from which they were derived;
(c) Are used exclusively to deny re-registration, prevent ban evasion, and protect the integrity, safety, and security of the Service;
(d) Are stored separately from your other Information and are not used for marketing, profiling, advertising, analytics, or any purpose unrelated to ban enforcement;
(e) Continue to apply even after you exercise a right of erasure, deletion, or "right to be forgotten" under applicable law.

This processing is necessary for our legitimate interests in operating a safe service, preventing fraud, and enforcing our agreements (GDPR Article 6(1)(f)), and is exempt from deletion under GDPR Article 17(3)(b) and 17(3)(e), CCPA / CPRA Section 1798.105(d)(2) (fraud-prevention exemption), and analogous provisions of other applicable privacy laws. When you exercise a right of erasure, all other personal data tied to your account is deleted in accordance with Section 6.4 and Section 7; suppression list entries are retained as described in this Section 6.7. The suppression list contains no plaintext personal information and cannot be used to recover, contact, identify, or profile any individual.

Where the Company has applied an age-verification restriction to an account (for example, a verification cooldown imposed following an unsuccessful or potentially abusive age-verification attempt), a small set of non-reversible cryptographic hashes derived from your face vector identifier, device fingerprint, account identifier, and (where present) the IP address associated with the restricted verification attempt is retained in a separate "verification-cooldown registry." These records share each of the characteristics described in subsections (a) through (e) above (indefinite retention, non-reversibility, exclusive use to enforce the restriction, separate storage, and survival of erasure), are processed on the same legitimate-interest basis (GDPR Article 6(1)(f), CCPA / CPRA Section 1798.105(d)(2)), and exist solely to prevent reset of an age-verification restriction through delete-and-re-signup. As with the suppression list described above, the verification-cooldown registry contains no plaintext personal information and cannot be used to recover, contact, identify, or profile any individual.

6.8 Machine Learning and Aggregated Model Parameters

The Company may use aggregated user data to train, evaluate, and improve internal machine-learning models that support the Service (for example, models that influence match suggestions, content ranking, or fraud detection). Behavioral and interaction signals that are not sensitive — such as in-app activity, match outcomes, and message metadata — are used for this purpose under the disclosures in this Policy. Separately, and only where you have given your express, opt-in consent (off by default, revocable at any time, and never a condition of using the Service), the Company also uses your voice-cafe audio and the communication-style and interaction features derived from it (such as conversational dynamics and prosody) to train and improve the Company's own internal matchmaking model, so that the Service can suggest more compatible matches. This first-party matchmaking use is the only purpose for which consented voice data is used to train a model; such data and any features derived from it are never sold, leased, traded, used to train any third party's model, or otherwise used to profit from your biometric information, and are handled in accordance with the retention and destruction schedule in Section 6.4 and the Biometric Information Privacy notice in Section 14.3. Where your Information has contributed to such models prior to your exercising a right of erasure or account deletion:

(a) The Company will delete the underlying records (the raw training samples, embeddings keyed to your account, and any feature stores indexed by your user identifier) in accordance with Sections 6.4 and 7.5;
(b) The Company will not include your Information in any future training run after the deletion request is processed;
(c) The aggregated model parameters (the trained weights themselves) will not be reversed, retrained from scratch, or otherwise modified solely to remove the residual statistical contribution of any single user's data. Once data has been incorporated into an aggregated model in this way, the resulting parameters do not contain identifiable information about you and cannot be used to recover, reconstruct, contact, or re-identify you. The European Data Protection Board has expressly recognised that aggregated model parameters meeting these conditions fall outside the scope of "personal data" (EDPB Opinion 28/2024, December 2024).

Where the Company periodically retrains models from scratch on a refreshed dataset, the residual contribution of deleted accounts is naturally removed from subsequent model versions through that retraining cycle. The Company does not currently engage in solely automated decision-making that produces legal effects concerning you within the meaning of GDPR Article 22; should this change, this Policy will be updated and (where required) explicit consent obtained.

7. YOUR RIGHTS AND CHOICES

7.1 Account Information and Profile

You may access, review, and update certain of your account and profile Information at any time through the dating application's in-app settings and profile editing features. You are responsible for maintaining the accuracy and completeness of your Information.

7.2 Notification Preferences

You may manage your notification preferences, including enabling or disabling specific notification types and delivery methods (Email, SMS, Push Notification, In-App Notification), through the in-app notification settings. For SMS notifications specifically, you may opt out at any time by replying STOP to any SMS message received from the Company; to re-enable SMS notifications, reply START. The following SMS keywords are recognized: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT to opt out; START, YES, and UNSTOP to opt back in. Replying STOP terminates every SMS message the Company sends to that mobile number, including one-time passcodes, account notifications, and marketing messages; no category of SMS message is exempt from a STOP request. If you opt out of SMS, you may continue to authenticate using one-time passcodes delivered to your email address, and essential transactional communications will be delivered to you by email and in-app notification instead. Separately, and with respect to communication channels other than SMS, you cannot opt out of transactional communications that are essential to the operation and security of your account (including, without limitation, authentication codes, verification messages, and critical account security alerts). Marketing and promotional communications may additionally be opted out of, without opting out of SMS entirely, through the in-app notification settings or by using the unsubscribe mechanism provided in such communications. THE COMPANY'S SUPPORT TEAM DOES NOT PROCESS OPT-OUT REQUESTS; ALL NOTIFICATION PREFERENCE CHANGES MUST BE MADE THROUGH THE IN-APP SETTINGS, UNSUBSCRIBE LINKS PROVIDED IN COMMUNICATIONS, OR BY REPLYING STOP TO ANY SMS MESSAGE.

7.3 Email Marketing (Website)

If you subscribed to marketing emails through the website subscription form, you may opt out of future marketing emails by clicking the "unsubscribe" link included in any such marketing email. Unsubscribing from website marketing emails does not affect transactional or notification emails sent through the dating application.

7.4 Location Data

You may disable GPS-based location services by revoking the dating application's access to your device's location capabilities through your device settings. However, as described in Section 2.2.4, disabling GPS access will cause degradation of Service functionality, including but not limited to impaired proximity-based matchmaking and the inability to access location-dependent features. IP-based geolocation data is collected automatically when you access the Service and cannot be disabled without ceasing use of the Service.

7.5 Account Deletion

7.5.1 In-App Account Deletion (Soft Delete)

You may initiate account deletion through the in-app account deletion feature. This action constitutes a "soft delete" whereby:

(a) Your profile is hidden from other Users;
(b) Your account is deactivated and you will be unable to access the Service;
(c) Your data is retained in our systems as described in Section 6.4(b);
(d) You may be able to recover your account within a reasonable period by contacting the Company.

7.5.2 Permanent Data Deletion (Hard Delete)

You may permanently delete your account and personal data directly within the dating application by navigating to Settings → Privacy & Data → Request permanent deletion. The action is irreversible. Upon confirmation, the Company will permanently delete your personal data from active systems, subject only to the exceptions described in Section 6.5 (including, without limitation, the limited suppression-list retention described in Section 6.7 and the aggregated-model-parameter exemption described in Section 6.8), and will send a confirmation email to the email address associated with your account. If you are unable to access the application (for example, because you have lost access to your phone number or your account has been suspended), you may instead submit a written deletion request via email to the address specified in Section 16, and the Company will respond within thirty (30) days. To exercise your rights of access or data portability, navigate to Settings → Privacy & Data → Download my data.

7.6 Push Notification Subscription

You may unsubscribe from push notifications by revoking push notification permissions through your browser or device settings, or by managing your push notification preferences within the dating application's in-app settings.

You may manage your cookie preferences and limit analytics data collection as described in Section 3.2 of this Policy, including through browser cookie settings, browser-based privacy tools, and platform-specific opt-out mechanisms provided by Google, Meta, and TikTok.

If you registered or authenticated via a third-party social login provider, you may manage the connection between the Service and that provider through the provider's own settings and permissions interfaces. Disconnecting a social login provider may affect your ability to authenticate to the Service using that method.

8. STATE-SPECIFIC PRIVACY RIGHTS

8.1 California Residents (California Consumer Privacy Act / California Privacy Rights Act)

If you are a resident of the State of California, you may have additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), including but not limited to:

(a) Right to Know: The right to request that the Company disclose the categories and specific pieces of personal information it has collected about you, the categories of sources from which such information was collected, the business or commercial purpose for collecting such information, and the categories of third parties with which such information was shared;
(b) Right to Delete: The right to request the deletion of personal information the Company has collected from you, subject to certain exceptions under the CCPA;
(c) Right to Correct: The right to request correction of inaccurate personal information the Company maintains about you;
(d) Right to Opt-Out of Sale or Sharing: The right to opt out of the "sale" or "sharing" of your personal information, as such terms are defined under the CCPA. The Company does not sell your personal information. To the extent that any data sharing described in this Privacy Policy constitutes "sharing" under the CCPA (including, without limitation, the transmission of hashed identifiers to analytics and advertising platforms via pixels and Conversions APIs), you may exercise your right to opt out by any of the following methods: (i) declining or disabling Marketing cookies through the "Your Privacy Choices" link in the footer of the marketing website, as described in Section 3.2(a); (ii) enabling the Global Privacy Control (GPC) signal in your browser, which the marketing website honors as a valid opt-out of sale and sharing; or (iii) contacting us at the email address specified in Section 16;
(e) Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising any of your CCPA rights.

To exercise any of these rights, please submit a verifiable consumer request to the Company using the contact information provided in Section 16. The Company will verify your identity before processing any request and will respond within the timeframes required by the CCPA.

Do Not Sell or Share My Personal Information: The Company does not sell your personal information. California residents who wish to request that the Company refrain from sharing their personal information for cross-context behavioral advertising purposes may do so through the "Your Privacy Choices" link in the footer of the marketing website, by enabling the Global Privacy Control (GPC) signal in their browser (which the marketing website honors as a valid opt-out), or by contacting us at the email address specified in Section 16.

California "Shine the Light" Law: Pursuant to California Civil Code Section 1798.83, California residents who have provided personal information to the Company may request certain information regarding the Company's disclosure of personal information to third parties for their direct marketing purposes. The Company does not disclose personal information to third parties for their direct marketing purposes.

Notice at Collection: Pursuant to CCPA Section 1798.100(b), the categories of personal information the Company collects and the purposes for which such information is used are described in Sections 2 and 4 of this Privacy Policy, respectively.

Sensitive Personal Information: Biometric Data. Pursuant to CCPA Section 1798.121, you have the right to limit the Company's use and disclosure of your sensitive personal information, including biometric Information used to identify a consumer (such as the face vector described in Section 14.3 of this Policy), to those uses that are necessary to perform the services reasonably expected by an average consumer who requests those services. The Company's use of biometric Information is already strictly limited to the enumerated purposes described in Section 14.3.2, all of which are necessary to perform the age verification service that you opted in to. The Company does not use biometric Information to infer characteristics about you, for cross-context behavioral advertising, or for any other purpose beyond those expressly enumerated. You may at any time withdraw your consent to biometric processing as described in Section 14.3.6.

8.2 Virginia Residents (Virginia Consumer Data Protection Act)

If you are a resident of the Commonwealth of Virginia, you may have additional rights under the Virginia Consumer Data Protection Act ("VCDPA"), including the right to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise any of these rights, please contact us using the information provided in Section 16.

8.3 Colorado Residents (Colorado Privacy Act)

If you are a resident of the State of Colorado, you may have additional rights under the Colorado Privacy Act ("CPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, as well as the right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, and profiling. To exercise any of these rights, please contact us using the information provided in Section 16.

8.4 Connecticut Residents (Connecticut Data Privacy Act)

If you are a resident of the State of Connecticut, you may have additional rights under the Connecticut Data Privacy Act ("CTDPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, as well as the right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, and profiling. To exercise any of these rights, please contact us using the information provided in Section 16.

8.5 Utah Residents (Utah Consumer Privacy Act)

If you are a resident of the State of Utah, you may have additional rights under the Utah Consumer Privacy Act ("UCPA"), including the right to access and delete your personal data, as well as the right to opt out of the processing of personal data for purposes of targeted advertising and the sale of personal data. To exercise any of these rights, please contact us using the information provided in Section 16.

8.6 Other State Privacy Laws

As additional state privacy laws come into effect, the Company will endeavor to comply with such laws as applicable. If you are a resident of a state that has enacted a comprehensive consumer privacy law not specifically addressed in this Section 8, you may contact us at the email address provided in Section 16 to inquire about and exercise any applicable rights.

8.7 Canadian Residents (PIPEDA, Quebec Law 25, BC/Alberta PIPA)

The Service is offered in Canada. If you are a resident of Canada, your personal information is handled in accordance with the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where applicable, the Act respecting the protection of personal information in the private sector of Quebec (as amended by Law 25), the British Columbia Personal Information Protection Act, and the Alberta Personal Information Protection Act. In addition to the rights described elsewhere in this Policy, you have the right to:

(a) Access and correction: request access to the personal information the Company holds about you and request correction of inaccurate or incomplete information;
(b) Withdraw consent: withdraw your consent to the Company's collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent for an optional processing activity (such as the matchmaking-ML uses described in Sections 6.8 and 14.3.7) does not require you to delete your account and does not affect the lawfulness of processing carried out before withdrawal;
(c) Consent for sensitive information (Quebec Law 25): the Company obtains your express, opt-in consent before collecting or using sensitive personal information — including the voice-derived features described in Section 14.3.7 — for the matchmaking-ML purpose. This consent is off by default, is sought separately from any other consent, and is never a condition of using the core Service;
(d) Refuse secondary use / profiling: you may refuse the use of your activity and interaction data to train the matchmaking model (an opt-out available in Settings → Privacy & Data, or by contacting us), separate from the voice opt-in;
(e) Data portability and erasure: request a copy of your personal information in a structured, commonly used format, and request its deletion, as described in Section 7.5;
(f) No identifying voiceprint / biometric database: the Company does not create a voiceprint or other biometric identifier to identify you (Section 14.3.7); the matchmaking model relies on relational, communication-style features rather than identity templates. The Company does not operate a biometric database that would require disclosure to Quebec's Commission d'accès à l'information; should that ever change, the Company will make the required filing before bringing any such system into service and will update this Policy;
(g) Automated processing: match suggestions are informational and do not replace your own choices. One account decision may be made by automated means within the meaning of Quebec Law 25 s. 12.1: where a report alleges that a user may be under eighteen (18) and the automated checks described in Section 5.2.9 cannot rule that report out, the account may be limited to read-only until age verification is completed. If this happens to you, you will be informed of the decision, completing verification lifts the restriction automatically, and you may have the decision reviewed by a member of the Company's personnel through the in-app appeal described in the Terms and Conditions (Section 11.12.4).

To exercise any of these rights, or to reach the Company's Privacy Officer, contact us using the information in Section 16.

8.8 Exercising Your Rights

To exercise any privacy right described in this Section 8:

(a) You may submit a request via email to the address specified in Section 16;
(b) The Company will verify your identity prior to processing any request by requiring you to confirm information associated with your account;
(c) The Company will respond to verified requests within the timeframes required by the applicable state law (typically forty-five (45) days, with extensions as permitted by law);
(d) You may designate an authorized agent to submit requests on your behalf, provided the agent presents written authorization and the Company can verify both the agent's authority and your identity;
(e) If the Company denies your request, you may appeal such denial by contacting us at the email address specified in Section 16, and the Company will respond to your appeal within the timeframe required by applicable law.

9. INTERNATIONAL DATA TRANSFERS

9.1 Territorial Availability of the Service

The Service is currently made available only to Users located within the United States of America and Canada. Eligibility checks at registration include verification of a +1 telephone number and a server-side IP geolocation gate; non-US/Canada IP addresses are denied registration. The Company does not knowingly accept registrations from, or direct the Service to, Users located in the European Economic Area, the United Kingdom, Switzerland, or any other jurisdiction outside the United States and Canada. If you are located outside the United States or Canada, the Service is not intended for you, and you should not register an account or submit any personal information.

9.2 Location of Processing

The Company is based in the United States, and the Service is operated from and directed to Users within the United States and Canada. Your Information is processed by the following infrastructure providers in the locations indicated:

(a) Cloudflare, Inc.: (i) Cloudflare R2 (object storage for user-uploaded media and database backups), Eastern North America jurisdiction (default), with data primarily resident in Virginia, United States; (ii) Cloudflare's content delivery network, edge-compute platform, and edge security services, which serve the Service's websites and application, including access-controlled delivery of user-uploaded media, from Cloudflare's global edge network; and (iii) Cloudflare Turnstile, which loads in your browser on the authentication screens and transmits client-side signals (IP address, TLS fingerprint, and User-Agent header) to Cloudflare's global edge network for bot detection, as described in Section 5.2.16.
(b) Amazon Web Services (Amazon Rekognition and Amazon Textract, used to operate the optional age-verification and photo-moderation features): us-east-1 region (Northern Virginia, United States).
(c) Application servers and PostgreSQL database: operated by the Company on dedicated infrastructure provided by a European-headquartered hosting provider. The underlying infrastructure provider maintains ISO/IEC 27001 and SOC 2 attestation, and data is encrypted at rest at the storage layer; this approach is recognized as an "appropriate technical and organisational measure" under GDPR Art. 32 and analogous Canadian provincial law (PIPEDA, Quebec Law 25).
(d) CCBill, LLC (payment processor and merchant of record), the Company's telecommunications and transactional-email providers, Google LLC (Analytics 4, Gmail SMTP, and a hosted text-classification API used for automated text-content moderation as described in Section 5.2), Meta (Conversions API), and TikTok (Events API) as further described in Sections 3 and 4 of this Policy. These third-party processors may store and process your Information in jurisdictions outside the United States and Canada in accordance with their respective privacy policies and the Company's data processing agreements with each provider.

9.3 Safeguards for International Transfers

The Company maintains a vendor data processing agreement (DPA) with each of the third-party processors enumerated in Section 9.2(d), and relies on the processor's standard contractual measures (such as standard contractual clauses, the EU-US Data Privacy Framework where applicable, and the corresponding UK/Swiss addenda) for any cross-border transfer initiated by that processor. Where your Information is transferred across international borders, the Company takes commercially reasonable steps to ensure that your Information receives an adequate level of protection, including through the use of contractual safeguards, certification mechanisms, or other transfer mechanisms recognized under applicable data protection laws.

10. THIRD-PARTY LINKS AND SERVICES

10.1 Third-Party Websites and Services

The Service, including the marketing website and the dating application, may contain links to or integrations with third-party websites, applications, or services that are not owned or controlled by the Company. This Privacy Policy does not apply to any third-party websites, applications, or services, and the Company is not responsible for the privacy practices, data collection methods, or content of any such third parties. We encourage you to review the privacy policies of any third-party websites, applications, or services that you visit or interact with.

10.2 Giphy Content

When you search for and send GIF images through the dating application's Giphy integration, your search queries are transmitted to Giphy (a Shutterstock, Inc. company). Because GIF images are loaded directly from Giphy's servers, Giphy also receives your IP address and device user agent. Giphy's collection, use, and disclosure of your data is governed by Giphy's own privacy policy, which is separate from and independent of this Privacy Policy.

When you use a third-party social login provider (Google, Apple, or Facebook) to register or authenticate, the exchange of information between the Service and that provider is governed in part by that provider's privacy policy and your privacy settings on that platform.

10.4 Analytics and Advertising Platforms

The data collection and processing practices of Google Analytics, Meta (Facebook/Instagram), and TikTok on the marketing website are governed in part by each platform's respective privacy policy. The Company encourages you to review the privacy policies of these platforms:

(a) Google Privacy Policy: https://policies.google.com/privacy
(b) Meta Privacy Policy: https://www.facebook.com/privacy/policy/
(c) TikTok Privacy Policy: https://www.tiktok.com/legal/privacy-policy

11. CHILDREN'S PRIVACY

The Service is not intended for use by individuals under the age of eighteen (18). The Company does not knowingly collect, solicit, store, or process personal information from individuals under the age of eighteen (18). If the Company becomes aware that it has collected personal information from an individual under the age of eighteen (18), the Company will take prompt steps to delete such information from its systems. If you believe that a minor has provided personal information to the Company, please contact us immediately at the email address provided in Section 16, and we will investigate and take appropriate action.

Although the Children's Online Privacy Protection Act of 1998 ("COPPA") and its implementing regulations at 16 C.F.R. Part 312 apply specifically to the online collection of personal information from children under thirteen (13), the Company applies a stricter eighteen (18) year age floor for use of the Service, consistent with our adult-dating positioning and with applicable state laws prohibiting the operation of dating services for minors. Accordingly, the Service implements technical and procedural measures designed to prevent the registration and use of the Service by any individual under the age of eighteen (18), including but not limited to age attestation at registration, date-of-birth collection, and identity verification incorporating age estimation through facial analysis. If the Company receives an inquiry, complaint, or request from a parent or legal guardian relating to a child under thirteen (13), the Company will respond in accordance with COPPA and 16 C.F.R. Part 312.

12. LAW ENFORCEMENT AND LEGAL DISCLOSURES

12.1 Lawful Requests

The Company will comply with lawful requests from law enforcement agencies, courts, regulatory authorities, and other governmental bodies for the disclosure of User Information, provided that such requests are served through proper legal channels, including but not limited to:

(a) Valid and enforceable subpoenas (civil or criminal);
(b) Court orders;
(c) Search warrants;
(d) National security letters;
(e) Other legal processes authorized under applicable law.

12.2 Evidence Preservation

Upon receipt of a lawful preservation request or litigation hold notice, the Company will take reasonable steps to preserve the relevant User Information, including placing evidence holds on specified account data, communications, and transaction records. Evidence holds may be maintained for the duration specified in the preservation request or for such longer period as may be required by applicable law.

12.3 Emergency Disclosures

In situations involving imminent danger of death or serious physical injury to any person, the Company may, in its sole discretion, disclose relevant User Information to appropriate law enforcement agencies or emergency services without requiring a prior legal process, in accordance with applicable federal and state law (including, without limitation, 18 U.S.C. § 2702(b)(8) and § 2702(c)(4) of the Stored Communications Act).

12.4 User Notification

Where legally permitted and not prohibited by the terms of the legal process, the Company will make reasonable efforts to notify the affected User of a law enforcement request for their Information. However, the Company is under no obligation to provide such notification where doing so would be prohibited by law, would interfere with a law enforcement investigation, or would pose a risk to the safety of any person.

13. DATA BREACH NOTIFICATION

13.1 Breach Response

In the event of a data breach involving unauthorized access to, acquisition of, or disclosure of your personal information, the Company will:

(a) Take prompt steps to investigate and contain the breach;
(b) Assess the scope and nature of the breach and the categories of Information affected;
(c) Notify affected Users and applicable regulatory authorities within the timeframes required by applicable state and federal data breach notification laws;
(d) Provide affected Users with information about the nature of the breach, the categories of Information involved, and the steps the Company is taking to mitigate the breach and prevent future occurrences;
(e) Offer identity theft prevention and mitigation services to affected Users where required by applicable law or where the Company deems such services appropriate given the nature and scope of the breach.

14. SENSITIVE INFORMATION

14.1 Categories of Sensitive Information

The Company recognizes that certain categories of Information it collects may be considered "sensitive" under applicable privacy laws, including but not limited to:

(a) Precise geolocation data (as described in Section 2.2.4);
(b) Information revealing racial or ethnic origin, religious beliefs, or sexual orientation (to the extent voluntarily disclosed in profile content);
(c) Biometric data, collected only with your prior, separate, informed, and explicit opt-in consent in connection with the optional age verification feature, consisting of (i) a self-captured verification selfie, (ii) a non-reversible mathematical face vector derived from that selfie and stored in a private Face Collection scoped solely to the Service, and (iii) where applicable, photographs of government-issued identity documents and the structured fields extracted therefrom. The collection, use, storage, and disclosure of this category of Information is described in detail in Sections 5.2.9 and 5.2.10 of this Policy. Use of the age verification feature is optional except where required by applicable state or provincial law, or where the Company has received a credible report that you may be under eighteen (18) and its automated checks could not rule that report out, in which case your account may be limited until verification is completed; outside those circumstances you are not required to use the feature, and you may decline at any time;
(d) Health-related information (note: the Company does not collect health information; however, Users may voluntarily disclose health-related information in profile content or messages).

14.2 Processing of Sensitive Information

To the extent that the Company processes sensitive Information, such processing is conducted solely for the purposes of providing the Service as described in this Privacy Policy and is not used for any purpose other than those disclosed herein. Where applicable law requires your consent or provides additional protections for the processing of sensitive Information, the Company will comply with such requirements.

14.3 Biometric Information Privacy: Specific Notice

This Section 14.3 provides additional disclosures applicable to the Company's collection and processing of biometric Information through the optional age verification feature, in furtherance of the Company's obligations under the Illinois Biometric Information Privacy Act (740 ILCS 14, "BIPA"), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001, "CUBI"), the Washington Biometric Privacy Act (Wash. Rev. Code § 19.375), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") Article 9, and any other applicable biometric or special-category data laws.

14.3.1 Categories of Biometric Information Collected

For Users who voluntarily opt in to age verification, the Company collects:

(a) Verification selfie: A self-captured photograph of the User's face, captured through the User's device camera and uploaded to dedicated Company-controlled cloud object storage;
(b) Face vector: A non-reversible numerical representation of the geometry of the User's face (sometimes referred to as a "biometric template" or "face print"), generated from the verification selfie and stored in a private Face Collection that is scoped solely to the Service. The face vector cannot be used to reconstruct the original photograph and is used exclusively to detect attempts by the same individual to create multiple accounts;
(c) Identity document images (only for Users who are asked to confirm their adult status with a government-issued document, or for Users submitting evidence in support of an age-verification appeal): photographs of a United States driver's license, United States state identification card, or United States passport, and the structured fields extracted therefrom through automated document analysis (date of birth, first name, last name, document type, and expiration date). Where the back of a United States driver's license or state identification card is captured, the Company may additionally read the machine-readable data printed on that document for the sole purpose of cross-checking it against the information printed on the front, as an anti-tampering measure;
(d) Liveness signals: an automated liveness check performed on the verification selfie described in subsection (a) to assess the likelihood that the captured image depicts a live human being physically present at the time of capture, rather than a printed photograph, screen replay, mask, or other spoofing artifact. This check is performed entirely on Company-controlled infrastructure, and the verification selfie is not transmitted to any third party for this purpose. Where the automated check is inconclusive, the User may be prompted to complete a brief self-captured "active" liveness step, which is analyzed on the same Company-controlled infrastructure. The resulting liveness outcome is persisted as part of the verification attempt record; any additional frames captured for the active step are processed transiently and are not retained beyond the request that produced them, except as part of the verification selfie or appeal-evidence images already governed by subsection (a) of this Section 14.3.1. The specific models, techniques, and thresholds used for liveness detection are intentionally not disclosed in this Policy as a safety and anti-circumvention measure.

14.3.2 Specific Purposes of Collection

The Company collects, captures, receives, and otherwise obtains the foregoing biometric Information solely for the following enumerated purposes:

(a) Estimating the User's apparent age range to confirm that the User is at least eighteen (18) years of age, as required by the Terms and Conditions of Use of the Service;
(b) Comparing the verification selfie against the User's existing profile photographs to confirm that those photographs depict the same individual (anti-impersonation);
(c) Searching the private Face Collection to detect duplicate accounts (anti-fraud);
(d) Adding the resulting face vector to the private Face Collection so that future duplicate-account searches can recognize the User;
(e) For identity documents only: extracting and verifying the date of birth printed on the document for the sole purpose of confirming that the User is at least eighteen (18) years of age, and verifying that the document's expiration date (where present in the extracted fields) has not lapsed;
(f) For identity documents only: cross-checking the information recognized on the front of the document against the machine-readable data on the back of the document, for the sole purpose of detecting tampering or alteration of the document;
(g) For verification selfies and any frames captured for the active head-turn fallback: detecting presentation attacks (printed photographs, screen replays, masks, and similar spoofing artifacts) so as to confirm that the verification selfie depicts a live human being physically present at the time of capture. This liveness analysis is performed exclusively on infrastructure operated by the Company and is not transmitted to any third party.

The Company does not use the age-verification biometric Information described in this Section 14.3 (the verification selfie, identity-document images, liveness frames, and the resulting face vector) for advertising, marketing, profiling, training of machine-learning models, or any other secondary purpose. In particular, neither the verification selfie nor the active-fallback head-turn frames are retained, used, or made available for the purpose of training, fine-tuning, or otherwise improving any machine-learning model, whether operated by the Company or by any third party. A separate and distinct category of biometric information — the communication-style features derived from voice-cafe audio — is collected only with your express, opt-in consent and is used solely to train the Company's own matchmaking model as described in Section 14.3.7 and Section 6.8; it is never sold, leased, traded, used by any third party, or used to profit from your biometric information.

14.3.3 Retention Schedule

The Company retains biometric Information only for the periods strictly necessary to fulfill the purposes set forth in Section 14.3.2, and in no event longer than the periods set forth below:

(a) Verification selfies and identity document images are stored in dedicated Company-controlled cloud object storage subject to a thirty (30) day automatic expiration lifecycle policy, after which the original image files are permanently deleted from storage;
(b) Face vectors stored in the private Amazon Rekognition Face Collection are retained for as long as your account remains active and you continue to use the Service. Face vectors are permanently deleted when (i) you exercise your right to permanent account deletion under Section 7.5.2 of this Policy, (ii) the initial purpose for which the biometric Information was collected has been satisfied, or (iii) within three (3) years of your last interaction with the Service, whichever occurs first. The three-year outer limit is adopted as the lesser of the maximum retention period permitted under BIPA Section 15(a) and the period during which the Company has a legitimate-interest basis to retain the face vector for anti-fraud detection, and is consistent with the data-minimisation principle under GDPR Article 5(1)(c), the "reasonable time" destruction requirement of the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001(b)), the Washington Biometric Privacy Act (Wash. Rev. Code § 19.375.020(3)), and Section 23 of Quebec's Act respecting the protection of personal information in the private sector (Law 25). For Users whose accounts are inactive for an extended period, the inactivity-triggered deletion process described in Section 6.4 will independently cause associated face vectors to be deleted before the three-year outer limit is reached;
(c) Extracted identity document fields (date of birth, first name, last name, document type, and expiration date), together with machine-readable document fields (where applicable) and liveness signals (the liveness outcome recorded for the attempt), are persisted in our application database for the lifetime of the associated verification attempt or appeal record, and are deleted upon permanent account deletion or upon expiration of the three-year outer limit referenced in subsection (b), whichever occurs first;
(d) Frames captured for the active liveness step are not persisted to durable storage. They are processed transiently on the Company's own infrastructure, the resulting pass/fail outcome is recorded as described in subsection (c), and the underlying frame bytes are discarded at the conclusion of the request that submitted them.

14.3.4 Disclosure of Biometric Information

The Company does not sell, lease, trade, or otherwise profit from biometric Information. The Company does not disclose, redisclose, or otherwise disseminate biometric Information to any third party other than:

(a) the Company's service providers, solely to perform the technical functions described in Section 14.3.2 (Amazon Web Services, Inc., for the automated analysis performed by Amazon Rekognition and Amazon Textract) and to provide the Company-controlled storage described in Section 14.3.3, in each case contractually prohibited from using such Information for any other purpose;
(b) Where required by, or in response to, a valid subpoena, court order, search warrant, or other lawful legal process compelling disclosure;
(c) With your written consent, if such consent is provided by you separately and specifically for the proposed disclosure.

For clarity: the liveness-detection processing described in subsection (g) of Section 14.3.2 is performed exclusively on infrastructure operated by the Company and is not disclosed, transmitted, or otherwise shared with any third party for that purpose. The models that perform that processing are open-source neural-network weights distributed under permissive open-source licenses and are executed locally; neither the verification selfie nor the active-fallback head-turn frames leave the Company's controlled environment in connection with liveness analysis.

14.3.5 Storage and Protection

Biometric Information is stored using a reasonable standard of care within the Company's industry, and in a manner that is the same as or more protective than the manner in which the Company stores, transmits, and protects other confidential and sensitive Information, including by application of encryption in transit for all transmissions, encryption at rest for stored images and artifacts, strict access controls limiting access to the Face Collection and stored verification artifacts to a small number of authorized backend services, and audit logging of all access to verification records.

You may withdraw your consent to the Company's continued processing of your biometric Information at any time. Withdrawal is exercised through the following pathways:

(a) In-app pathway. From within the dating application, navigate to Settings → Privacy & Data → Request permanent deletion. Confirming the account-deletion flow withdraws biometric consent and triggers the deletion described below. This pathway invokes the right to permanent account deletion described in Section 7.5.2.
(b) Written request. You may also withdraw consent by sending a written request to the contact address specified in Section 16. The Company will verify your identity and process the request within the timelines below.

Backend processing upon withdrawal. Upon a valid withdrawal request, the Company's backend systems will:

(i) Immediately delete the face vector associated with your account from the Company's private Face Collection. This occurs synchronously as part of the account-deletion transaction; in the ordinary course it completes within seconds of the request being processed by our servers;
(ii) Delete the stored face identifier from the Company's database;
(iii) Block the affected account from initiating new biometric verification attempts. If a valid verification-restriction (cooldown, soft ban, or hard ban) is active against the account at the time of withdrawal, the face vector may be retained for the duration of that restriction solely to enforce the prior anti-abuse decision; this retention is described in Sections 6.4 and 14.3.3(b) and is subject to the limits specified there.

In all other cases, the Company will complete deletion of biometric Information associated with your account within a commercially reasonable period not to exceed thirty (30) days, except to the extent that retention is required by an exception described in Section 6.5. If the synchronous deletion call fails for transient reasons (for example, a network or service-availability issue), the failure is logged so a Company operator can complete the deletion manually; the deletion will, in any event, be completed within the thirty (30) day outer bound.

14.3.7 Voice-Derived Biometric Features (Matchmaking; Opt-In Only)

This Section 14.3.7 applies only to Users who have given the separate, express, opt-in consent to the first-party matchmaking use of voice data described in Section 6.8 of this Policy and in Section 4.2.5 of the Terms and Conditions. That consent is off by default, is never a condition of using the Service, and may be withdrawn at any time.

(a) Category. With your opt-in consent, the Company derives communication-style and interaction features from your voice-cafe audio (such as conversational dynamics, turn-taking, and prosody). To the extent any such feature constitutes a "biometric identifier" or "biometric information" under the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, or the Washington Biometric Privacy Act, it is treated as biometric Information under this Section 14.3. The Company does not create a voiceprint for the purpose of identifying you.
(b) Purpose. These features, and the transient raw audio from which they are derived, are used for the sole purpose of training and improving the Company's own internal matchmaking model so that the Service can suggest more compatible matches. They are not used for advertising, marketing, or any other secondary purpose, and are not disclosed to or used by any third party.
(c) Retention and destruction schedule (BIPA Section 15(a)). Raw voice-cafe audio captured for this purpose is retained for no more than sixty (60) days and is then permanently deleted by an automatic expiration lifecycle policy. Derived features are retained only for so long as your opt-in consent remains in effect. All such audio and derived features associated with your account are permanently deleted when you withdraw your consent (see subsection (e)) or delete your account under Section 7.5.2, and in any event are not retained longer than three (3) years from your last interaction with the Service. This schedule constitutes the Company's publicly available written retention-and-destruction policy for this category of biometric Information for purposes of BIPA Section 15(a).
(d) No sale or profit (BIPA Section 15(c)). The Company does not sell, lease, trade, or otherwise profit from this voice-derived biometric Information, and does not disclose it except to the limited Company-controlled infrastructure that performs the feature derivation and model training.
(e) Withdrawal of consent. You may withdraw your consent at any time in Settings → Privacy & Data (or the equivalent in-app control), which stops all further capture and, on a forward-going basis, triggers deletion of your previously captured raw audio and derived features in accordance with subsection (c). Withdrawal does not require you to delete your account and does not affect the lawfulness of processing carried out before withdrawal.

15. OPT-OUT INSTRUCTIONS

For your convenience, the following is a consolidated summary of the available opt-out mechanisms described throughout this Privacy Policy:

15.1 Email Marketing (Website)

Click the "unsubscribe" link in any marketing email received from the Company to stop future marketing communications from the website email subscription list.

15.2 In-App Marketing and Promotional Notifications

Manage your notification preferences through the dating application's in-app notification settings. You may disable promotional and re-engagement notifications while retaining essential transactional notifications.

15.3 Analytics and Tracking (Website)

To limit analytics data collection on the marketing website, you may:

(a) Adjust your browser's cookie settings to block or delete analytics and advertising cookies;
(b) Use browser-based privacy tools and extensions;
(c) Install the Google Analytics Opt-Out Browser Add-On: https://tools.google.com/dlpage/gaoptout
(d) Manage Meta (Facebook/Instagram) advertising preferences: https://www.facebook.com/settings/?tab=ads
(e) Review TikTok privacy settings: https://www.tiktok.com/legal/privacy-policy

15.4 SMS Notifications

The Company operates two separate SMS programs, each with its own, independently recorded consent:

(a) Account messages. One-time passcodes, new-message alerts, match confirmations, and subscription and billing notices are sent to the mobile number you submit during registration, on the basis of the consent disclosure displayed at the point at which you submit that number.
(b) Marketing messages. Event announcements and reminders, promotional offers, feature updates, and virtual-café invitations are sent only if you separately check the optional marketing box presented at registration. That box is unchecked by default, is never a condition of creating an account or of using any part of the Service, and may be turned off at any time in the in-app notification settings.

Message frequency varies. Message and data rates may apply.

You may opt out of SMS at any time by:

(i) Replying STOP to any SMS message received from the Company (also recognized: STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT);
(ii) Disabling SMS as a delivery method in the dating application's in-app notification preferences.

Replying STOP stops all SMS messages from the Company to that mobile number, including the one-time passcodes used to sign in; no category of message is exempt. If you opt out, you may continue to sign in using one-time passcodes delivered to your email address. To resume SMS messages after opting out, reply START (also recognized: YES, UNSTOP) to any message, or re-enable SMS in your notification preferences. For assistance, reply HELP to any message or email [email protected].

15.5 Push Notifications

Revoke push notification permissions through your browser or device settings, or disable push notifications through the dating application's in-app notification settings.

The Company does not sell your personal information. California residents may opt out of any sharing of their personal information for cross-context behavioral advertising purposes through the "Your Privacy Choices" link in the footer of the marketing website, by enabling the Global Privacy Control (GPC) browser signal (which the marketing website honors as a valid opt-out), or by contacting us at the email address specified in Section 16.

16. CONTACT INFORMATION

16.1 Data Controller Contact

If you have any questions, concerns, or requests regarding this Privacy Policy, the Company's data practices, or your privacy rights, you may contact us at:

Kream & Sugar Dating LLC Email: [email protected] Mailing Address: 210 N Church St, Unit 1706, Charlotte, NC 28202

16.2 Privacy Requests

All requests to exercise privacy rights described in this Policy (including requests for access, deletion, correction, or portability of personal data) should be directed to the email address specified in Section 16.1. The Company will acknowledge receipt of your request and respond within the timeframe required by applicable law.

16.3 Complaints

If you believe that the Company has violated your privacy rights or has not adequately addressed your privacy concerns, you may file a complaint with:

(a) The Company, using the contact information provided above;
(b) The applicable state attorney general's office or consumer protection agency in your state of residence;
(c) Any other applicable regulatory authority.

17. MISCELLANEOUS PROVISIONS

17.1 Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of North Carolina, without regard to its conflict of laws principles, to the extent not preempted by applicable federal law.

17.2 Severability

If any provision of this Privacy Policy is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such invalidity, illegality, or unenforceability shall not affect any other provision of this Privacy Policy, and the remaining provisions shall continue in full force and effect. The invalid, illegal, or unenforceable provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving its original intent.

17.3 Entire Privacy Agreement

This Privacy Policy, together with the Terms and Conditions of Use (to the extent they address data practices), constitutes the entire agreement between you and the Company with respect to the collection, use, disclosure, and protection of your Information in connection with the Service.

17.4 Assignment

The Company may assign or transfer this Privacy Policy and its rights and obligations hereunder, in whole or in part, to any successor, affiliate, or assignee in connection with a merger, acquisition, reorganization, or sale of assets, without your prior consent, provided that the assignee agrees to be bound by the terms of this Privacy Policy.

17.5 No Waiver

The failure of the Company to enforce any provision of this Privacy Policy shall not constitute a waiver of such provision or the Company's right to enforce it at a later time.

18. ACKNOWLEDGMENT

BY ACCESSING OR USING THE SERVICE, INCLUDING BY VISITING THE MARKETING WEBSITE, SUBMITTING FORMS, SUBSCRIBING TO UPDATES, OR USING THE DATING APPLICATION, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY IN ITS ENTIRETY, THAT YOU UNDERSTAND ITS TERMS AND CONDITIONS, AND THAT YOU AGREE TO THE COLLECTION, USE, DISCLOSURE, STORAGE, RETENTION, AND PROTECTION OF YOUR INFORMATION AS DESCRIBED HEREIN. YOU FURTHER ACKNOWLEDGE THAT YOUR CONTINUED USE OF THE SERVICE FOLLOWING ANY MODIFICATIONS TO THIS PRIVACY POLICY SHALL CONSTITUTE YOUR ACCEPTANCE OF SUCH MODIFICATIONS.

This Privacy Policy is effective as of April 20, 2026.