See your app rebuilt
Trust Center / Privacy and data transfers

Your members’ data stays yours.

You decide why and how your members’ data is used. We process it only on your written instructions, as your processor under the GDPR and your service provider under US state law. Dating data is sensitive, so we treat all of it that way.

Reviewed 18 October 2026

Our role

Your processor, on your instructions.

  • A standard data processing agreement (in German, the AVV under Article 28 GDPR), with our technical and organisational measures, the EU standard contractual clauses, the UK addendum, Swiss terms and a US state privacy addendum. Request it.
  • Never sold, never shared, never combined with other partners’ data for our own purposes, and never used to train AI models.
  • Government requests are passed to you first unless the law forbids it. We challenge requests that go too far and disclose the minimum.
  • Member requests to see, correct or delete data are handled through your app, and completed within 30 days at most.
  • Impact assessments. We give you the inputs for your DPIA: data flows, risks and the measures in place.
Special category data

We treat all member data as sensitive.

A dating profile can reveal a member’s sex life or sexual orientation, which the GDPR treats as special category data (Article 9). The Court of Justice has held that data from which this can be inferred counts too (case C-184/20). So every partner’s member data gets the same measures, as Germany’s BDSG §22 asks:

  • Encrypted in transit (TLS 1.2 or higher) and at rest (AES-256)
  • Every staff view of partner member data logged
  • Multi-factor sign-in for every staff, admin and cloud account
  • Access limited to named staff and reviewed every quarter (January 2027)
  • No member data in development or testing (November 2026)
  • Never used for our own purposes, sold or used to train AI
Where data goes

Data location and transfers.

Each partner chooses United States or EU hosting for its database and files. Some services, such as email, text messages, push notifications and error reports, are run by providers in other countries. The Sub-processors page shows each one, where it is and the safeguard that covers it.

Standard contractual clauses

Our DPA includes the EU clauses (Decision 2021/914) and the UK addendum, and we flow them down to every sub-processor outside the EU and UK.

In progress · Nov 2026

EU-US Data Privacy Framework

Self-certification for High Intent Media Inc. The General Court upheld the framework in September 2025 and an appeal is pending, so we rely on the clauses either way.

In progress · Nov 2026

EU hosting in full

For EU-hosted partners, whether backups, logs and support access also stay in the EU is being confirmed provider by provider.

To confirm · Nov 2026
Retention

How long we keep data, by default.

Each partner can set its own periods in its agreement. These are our defaults, and the reason for each.

Closed accounts
Profiles, photos and messages deleted within 30 days
Backups
35 days rolling, then overwritten
Security logs
At least 12 months, at most 24, to investigate incidents
Banned members
A minimum safety record kept 5 years, to stop banned members coming back (DSA Article 23 measures against misuse)
Face and ID checks
None collected until 30 November 2026. After that, see Age checks
Contract end
Data returned or deleted within 30 days, with written confirmation
Laws on this page

The privacy laws we build for.

General Data Protection Regulation (EU) 2016/679 (DSGVO)

In progress · Nov 2026

Official text: EUR-Lex

What matters
Article 9 (dating data can reveal sex life and sexual orientation), 22 (automated decisions), 28 (processor terms), 32 (security), 33 and 34 (breach notice), 35 (impact assessments), 44 to 49 (transfers).
Our part
Act only on your instructions, keep data secure, control sub-processors, tell you about a breach within 12 hours, help with member requests, delete at the end.

EU-US Data Privacy Framework, Decision (EU) 2023/1795

In progress · Nov 2026

Official text: EUR-Lex

What matters
The General Court upheld the framework in September 2025 (Latombe); an appeal is with the Court of Justice. We rely on the standard contractual clauses either way.
Our part
Self-certify High Intent Media Inc., alongside the clauses.

Federal Data Protection Act (BDSG)

In progress · Nov 2026

Official text: gesetze-im-internet.de

What matters
§22: specific measures for special category data. §38: when German companies must appoint a data protection officer.
Our part
Treat all member data as special category data, with the measures on the Privacy page.

UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025

In progress · Nov 2026

Official text: legislation.gov.uk

What matters
Processor terms, security, breach notice, and the UK addendum for transfers.
Our part
The same processor duties as under the EU GDPR, with the UK addendum in our DPA.

California Consumer Privacy Act, as amended by the CPRA

In progress · Nov 2026

Official text: cppa.ca.gov

What matters
Service provider terms, no selling or sharing, help with member requests.
Our part
Service provider terms in our US state addendum.

PIPEDA

In progress · Nov 2026

Official text: laws-lois.justice.gc.ca

What matters
Safeguards, breach records and reporting.
Our part
Safeguards, and the facts for your breach records.

Quebec Law 25 (Act respecting the protection of personal information in the private sector)

In progress · Nov 2026

Official text: legisquebec.gouv.qc.ca

What matters
Privacy impact assessments before data leaves Quebec.
Our part
The inputs for it: where data goes and how it is protected.
More in the Trust Center

Company and continuity

Who we are, who signs, and what protects you if anything goes wrong

Open

Security controls

Every control with its status, mapped to ISO/IEC 27001 and BSI C5

Open

Sub-processors

Who else handles member data, where, and under which safeguard

Open

Age checks and biometric data

How age and ID checks will work, and why none run until 30 November

Open

Moderation and online safety

Reports, decisions, appeals and the DSA and Online Safety Act duties

Open

AI register

Every AI system on the platform, its status and how the AI Act treats it

Open

Incidents

Our notice times, set against your own legal deadlines

Open

Laws register

Every law we build for, with its official text and who carries each duty

Open

Questions for our security or privacy team? security@highintentmedia.com and privacy@highintentmedia.com. Or request the security pack.

Savings and value estimate

What your platform costs you, in profit and value.

Loading the estimate…