> Privacy and data transfers | Trust Center | Dating API: https://www.datingapi.io/trust/privacy [Trust Center](https://www.datingapi.io/trust) / Privacy and data transfers # Your members’ data stays yours. You decide why and how your members’ data is used. We process it only on your written instructions, as your processor under the GDPR and your service provider under US state law. Dating data is sensitive, so we treat all of it that way. Reviewed 18 October 2026 - [Overview](https://www.datingapi.io/trust) - [Company](https://www.datingapi.io/trust/company) - [Security](https://www.datingapi.io/trust/security) - [Privacy](https://www.datingapi.io/trust/privacy) - [Sub-processors](https://www.datingapi.io/trust/subprocessors) - [Age checks](https://www.datingapi.io/trust/age-and-identity) - [Online safety](https://www.datingapi.io/trust/online-safety) - [AI](https://www.datingapi.io/trust/ai) - [Incidents](https://www.datingapi.io/trust/incidents) - [Laws](https://www.datingapi.io/trust/laws) Our role ## Your processor, on your instructions. - **A standard data processing agreement** (in German, the AVV under Article 28 GDPR), with our technical and organisational measures, the EU standard contractual clauses, the UK addendum, Swiss terms and a US state privacy addendum. [Request it](https://www.datingapi.io/trust#request). - **Never sold, never shared,** never combined with other partners’ data for our own purposes, and never used to train AI models. - **Government requests** are passed to you first unless the law forbids it. We challenge requests that go too far and disclose the minimum. - **Member requests** to see, correct or delete data are handled through your app, and completed within 30 days at most. - **Impact assessments.** We give you the inputs for your DPIA: data flows, risks and the measures in place. Special category data ### We treat all member data as sensitive. A dating profile can reveal a member’s sex life or sexual orientation, which the GDPR treats as special category data (Article 9). The Court of Justice has held that data from which this can be inferred counts too ([case C-184/20](https://curia.europa.eu/juris/liste.jsf?num=C-184/20)). So every partner’s member data gets the same measures, as Germany’s BDSG §22 asks: - Encrypted in transit (TLS 1.2 or higher) and at rest (AES-256) - Every staff view of partner member data logged - Multi-factor sign-in for every staff, admin and cloud account - Access limited to named staff and reviewed every quarter (January 2027) - No member data in development or testing (November 2026) - Never used for our own purposes, sold or used to train AI Where data goes ## Data location and transfers. Each partner chooses United States or EU hosting for its database and files. Some services, such as email, text messages, push notifications and error reports, are run by providers in other countries. The [Sub-processors page](https://www.datingapi.io/trust/subprocessors) shows each one, where it is and the safeguard that covers it. ### Standard contractual clauses Our DPA includes the EU clauses (Decision 2021/914) and the UK addendum, and we flow them down to every sub-processor outside the EU and UK. In progress · Nov 2026 ### EU-US Data Privacy Framework Self-certification for High Intent Media Inc. The General Court upheld the framework in September 2025 and an appeal is pending, so we rely on the clauses either way. In progress · Nov 2026 ### EU hosting in full For EU-hosted partners, whether backups, logs and support access also stay in the EU is being confirmed provider by provider. To confirm · Nov 2026 Retention ## How long we keep data, by default. Each partner can set its own periods in its agreement. These are our defaults, and the reason for each. Closed accounts Profiles, photos and messages deleted within 30 days Backups 35 days rolling, then overwritten Security logs At least 12 months, at most 24, to investigate incidents Banned members A minimum safety record kept 5 years, to stop banned members coming back (DSA Article 23 measures against misuse) Face and ID checks None collected until 30 November 2026. After that, see [Age checks](https://www.datingapi.io/trust/age-and-identity) Contract end Data returned or deleted within 30 days, with written confirmation Laws on this page ## The privacy laws we build for. ### General Data Protection Regulation (EU) 2016/679 (DSGVO) In progress · Nov 2026 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) What matters Article 9 (dating data can reveal sex life and sexual orientation), 22 (automated decisions), 28 (processor terms), 32 (security), 33 and 34 (breach notice), 35 (impact assessments), 44 to 49 (transfers). Our part Act only on your instructions, keep data secure, control sub-processors, tell you about a breach within 12 hours, help with member requests, delete at the end. ### EU-US Data Privacy Framework, Decision (EU) 2023/1795 In progress · Nov 2026 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj) What matters The General Court upheld the framework in September 2025 (Latombe); an appeal is with the Court of Justice. We rely on the standard contractual clauses either way. Our part Self-certify High Intent Media Inc., alongside the clauses. ### Federal Data Protection Act (BDSG) In progress · Nov 2026 Official text: [gesetze-im-internet.de](https://www.gesetze-im-internet.de/bdsg_2018/) What matters §22: specific measures for special category data. §38: when German companies must appoint a data protection officer. Our part Treat all member data as special category data, with the measures on the Privacy page. ### UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025 In progress · Nov 2026 Official text: [legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2018/12/contents) What matters Processor terms, security, breach notice, and the UK addendum for transfers. Our part The same processor duties as under the EU GDPR, with the UK addendum in our DPA. ### California Consumer Privacy Act, as amended by the CPRA In progress · Nov 2026 Official text: [cppa.ca.gov](https://cppa.ca.gov/regulations/) What matters Service provider terms, no selling or sharing, help with member requests. Our part Service provider terms in our US state addendum. ### PIPEDA In progress · Nov 2026 Official text: [laws-lois.justice.gc.ca](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/) What matters Safeguards, breach records and reporting. Our part Safeguards, and the facts for your breach records. ### Quebec Law 25 (Act respecting the protection of personal information in the private sector) In progress · Nov 2026 Official text: [legisquebec.gouv.qc.ca](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1) What matters Privacy impact assessments before data leaves Quebec. Our part The inputs for it: where data goes and how it is protected. More in the Trust Center [### Company and continuity Who we are, who signs, and what protects you if anything goes wrong Open](https://www.datingapi.io/trust/company)[### Security controls Every control with its status, mapped to ISO/IEC 27001 and BSI C5 Open](https://www.datingapi.io/trust/security)[### Sub-processors Who else handles member data, where, and under which safeguard Open](https://www.datingapi.io/trust/subprocessors)[### Age checks and biometric data How age and ID checks will work, and why none run until 30 November Open](https://www.datingapi.io/trust/age-and-identity)[### Moderation and online safety Reports, decisions, appeals and the DSA and Online Safety Act duties Open](https://www.datingapi.io/trust/online-safety)[### AI register Every AI system on the platform, its status and how the AI Act treats it Open](https://www.datingapi.io/trust/ai)[### Incidents Our notice times, set against your own legal deadlines Open](https://www.datingapi.io/trust/incidents)[### Laws register Every law we build for, with its official text and who carries each duty Open](https://www.datingapi.io/trust/laws) Questions for our security or privacy team? [security@highintentmedia.com](mailto:security@highintentmedia.com) and [privacy@highintentmedia.com](mailto:privacy@highintentmedia.com). Or [request the security pack](https://www.datingapi.io/trust#request).