Privacy Policy

1. Introduction

Human's Reality SAS ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our dating platform.

We comply with the General Data Protection Regulation (GDPR) (EU) 2016/679 and French data protection law (Loi Informatique et Libertés).

2. Data Controller

3. Data We Collect

3.1 Information You Provide

• Account Information: Email, password (hashed), name, birth date, gender
• Profile Information: Photos, bio, location (city), dating preferences (age range, gender preference, maximum distance)
• Communications: Messages sent through our chat system after unlocking

3.2 Automatically Collected Data

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, features used, time spent, interactions with other users
• Location Data: Approximate location based on IP address (used for distance calculations and matching)
• Cookies: See our Cookie Policy

3.3 Video Call Data

Important: Video calls are peer-to-peer connections facilitated by Agora RTC. We do NOT record, store, or have access to the content of your video calls. Video streams are encrypted end-to-end.

4. How We Use Your Data

We use your personal data for the following purposes:

4.1 Service Provision (Legal Basis: Contract)

• Create and manage your account
• Match you with other users based on preferences and location
• Facilitate video calls and messaging
• Process your decisions (YES/PASS) on matches

4.2 Safety and Security (Legal Basis: Legitimate Interest)

• Detect and prevent fraud, abuse, and violations of our Terms
• Verify account authenticity
• Investigate reports of inappropriate behavior
• Comply with legal obligations

4.3 Improvement and Analytics (Legal Basis: Legitimate Interest)

• Analyze usage patterns to improve the service
• Develop new features
• Optimize matching algorithms
• Conduct research and analytics (anonymized)

4.4 Communication (Legal Basis: Consent or Legitimate Interest)

• Send service notifications (new matches, messages)
• Provide customer support
• Send marketing communications (with your consent - you can opt out anytime)

5. Data Sharing

We do NOT sell your personal data. We may share your data with:

5.1 Other Users

• Your profile information (name, photos, bio, age, city) is visible to users who match with you
• Profile photo clarity increases progressively through the "3 Lives" system
• Messages are only accessible after completing 3 lives with a match

5.2 Service Providers

• Supabase: Authentication and database hosting (EU servers)
• Vercel: Web hosting and infrastructure (EU/US servers with GDPR compliance)
• Agora RTC: Video call infrastructure (peer-to-peer, encrypted)
• Pusher: Real-time messaging delivery
• Cloudflare: CDN and DDoS protection

All service providers are contractually bound to GDPR compliance and data processing agreements (DPAs).

5.3 Legal Requirements

We may disclose your data if required by law, court order, or to protect rights, safety, or property.

6. International Data Transfers

Your data is primarily stored on servers within the European Union. Some service providers (e.g., Vercel, Agora) may transfer data outside the EU/EEA. In such cases, we ensure adequate safeguards through:

• EU Standard Contractual Clauses (SCCs)
• Provider's certification under EU-U.S. Data Privacy Framework (if applicable)
• Other appropriate safeguards under GDPR Article 46

7. Data Retention

We retain your personal data for as long as necessary to provide the service and comply with legal obligations:

• Active Accounts: Data is retained while your account is active
• Deleted Accounts: Most data is deleted within 30 days of account deletion
• Legal Obligations: Some data (e.g., for fraud prevention, legal compliance) may be retained for up to 3 years
• Messages: Messages are deleted when either user deletes their account or upon request

8. Your Rights (GDPR)

Under GDPR, you have the following rights:

9. Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: HTTPS/TLS for data in transit, encryption at rest for sensitive data
• Password Security: Passwords are hashed using bcrypt
• Access Controls: Role-based access, least privilege principle
• Regular Audits: Security assessments and penetration testing
• Incident Response: Procedures for data breach notification (within 72 hours to CNIL if required)

10. Children's Privacy

Our service is NOT intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

11. Cookies and Tracking

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the service. The "Last updated" date at the top indicates when this policy was last revised.

13. Contact Us