Skip to main content
Legal Framework

California Notice at Collection

Last updated: June 28, 2026 · v2

California Notice at Collection

Effective: 28 June 2026 (version 2)

Summary: If you live in California, this notice tells you what categories of personal information we collect about you, what we do with it, who we share it with, and the rights you have under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Our full practices are in our Privacy Policy; this is the California-specific summary required by Cal. Civ. Code section 1798.100(a).

1. Who we are

Kismat is operated by P&P Management GmbH, an Austrian limited liability company (FN 648928g, Handelsgericht Wien), Leebgasse 70, 1100 Wien, Austria. For the purposes of the CCPA we act as a "business" with respect to California consumers who use the Kismat app or website.

2. Categories of personal information we collect

The CCPA defines a fixed list of categories. The following table tracks each category against the data Kismat actually collects.

  • Identifiers - email address, phone number (only if you choose to verify it), Apple/Google sign-in identifier, device identifier, IP address.
  • Customer records (Cal. Civ. Code section 1798.80(e)) - name (display name only - you choose), date of birth, payment receipts (we do not store card numbers; Apple/Google process payment).
  • Protected classifications - gender, sexual orientation, age. These are integral to a dating product; we treat them as sensitive personal information (see section 6).
  • Commercial information - subscription status and purchase history.
  • Internet or other electronic network activity - app interactions (likes, swipes, messages metadata), pages viewed on kismat.at, push-notification tokens.
  • Geolocation data - approximate location for distance filtering. We collect coarse city-level location by default; precise GPS only when you explicitly grant the OS permission to power the "Set my city" or map features.
  • Audio, electronic, visual information - profile photos, liveness selfies (face-verification frames), chat photos.
  • Inferences - compatibility scoring, soft-fraud signals (account-age, verification status), engagement segments used to surface candidates.

Biometric information - only with your explicit opt-in on the verification screen: face templates (numbers describing your face) used for selfie verification, kept until you withdraw consent in Settings > Privacy > Face data or delete your account. A selfie you send for optional manual review is kept only until a moderator decides, at most 14 days. We never sell or share biometric information.

We do not collect: financial-account numbers, government-issued identifiers (passport / driver licence / SSN), or "sensitive" categories like genetic data, race, religious or philosophical beliefs, or trade-union membership.

3. Sources of personal information

  • Directly from you (signup form, profile editor, photos uploaded, messages sent).
  • From your device (OS-level identifiers, push tokens, approximate IP location).
  • From third-party login providers if you sign in with Apple or Google (email + provider-side user id).
  • From Apple App Store / Google Play (purchase receipts via App Store Server Notifications and Google Play Real-Time Developer Notifications).
  • From other users (if they report you - their identity is not disclosed to you).

4. Business or commercial purposes

  • Operate and personalize the service (matching, messaging, notifications).
  • Verify identity and detect abuse (liveness, photo-cluster moderation, anti-bot signals).
  • Enforce our Terms of Service and Community Guidelines (review reports, take moderation action).
  • Process payments (subscription renewals, refund handling) via Apple/Google.
  • Comply with legal obligations (DSA, GDPR, mandatory reporting of CSAM under Austrian StGB).
  • Internal analytics on aggregated, de-identified data to improve the product.
  • Customer support.

5. Categories of third parties we disclose to

  • Cloud infrastructure - cPanel-managed Linux hosting in the EU (data residency: Austria/Germany), Google Cloud Storage for photo assets.
  • Payment processors - Apple App Store, Google Play (we never see card numbers; we receive purchase confirmations and renewal events).
  • Push delivery - Apple Push Notification service, Firebase Cloud Messaging.
  • Email delivery - our SMTP provider for transactional email.
  • AI moderation - OpenAI (Moderation API), OpenRouter and Google Gemini for text/image content moderation and automated selfie-verification checks. Moderation calls are stateless; we send the content under review and receive a categorical decision back. No long-term retention by the model providers per their data-processing terms.
  • Authorities - if compelled by valid legal process (court order, search warrant, or mandatory reporting obligations such as Austrian StGB section 207a regarding child protection).

6. Sensitive personal information

The CCPA recognizes sexual orientation, sex life, and certain other categories as "sensitive personal information." Kismat's product purpose is enabling consenting adults to find each other for the relationship intent of their choosing, which inherently involves your sexual orientation and gender. We process this data only to operate the dating service and we do not use it to infer characteristics about you for purposes other than matching, safety, and the service itself. You can correct or remove your sexual orientation / gender / intent at any time from Profile - Edit profile.

7. Sale or sharing of personal information

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising as that term is defined under the CCPA. We do not have a "Do Not Sell or Share My Personal Information" link because there is nothing to opt out of - the underlying activity does not happen.

We do show ads to free-tier users via mediated mobile advertising networks (AppLovin MAX, Google AdMob, Meta Audience Network, Unity Ads, Pangle, IronSource). The mediation SDK passes a limited set of signals (advertising identifier, coarse location, device type) to ad networks for ad selection. You can disable personalized advertising at the OS level: iOS - Settings - Privacy & Security - Tracking - Allow Apps to Request to Track. Android - Settings - Google - Ads - Reset advertising ID + opt out of ads personalization.

8. Retention

We keep personal information only as long as we need it. Specifics:

  • Active account data: until you delete the account.
  • Deleted accounts: hashed identifiers retained 30 days for fraud prevention, then purged.
  • Payment records: 7 years for tax law compliance (Austrian Bundesabgabenordnung section 132).
  • Moderation decisions on reported content: 12 months after the decision (DSA recordkeeping).
  • Server logs: 14 days, then deleted.

9. Your California rights

As a California resident, you have the right to:

  • Know what personal information we have collected about you.
  • Delete personal information we have collected.
  • Correct inaccurate personal information.
  • Limit the use of sensitive personal information (in our case, this means you may close the account; we cannot run the dating product without your gender and orientation).
  • Be free from retaliation if you exercise any of the above.

How to exercise: in the app, Settings - Privacy & Data - Email my data (Know / portability) or Delete account (Delete). For correction, edit your profile or email support@kismat.at. We respond to verifiable requests within 45 days, with a 45-day extension if reasonably necessary, and we never charge a fee.

10. Authorized agents

You may use an authorized agent to submit requests on your behalf. Provide written authorization signed by you, and we may verify your identity directly to confirm the agent's authority before acting.

11. Verification

We verify a CCPA request by matching information you provide in the request against information we already hold for the account (email, signup date, last sign-in). We will not require you to create an account just to make a request.

12. Children

Kismat is for adults 18 and older. We do not knowingly collect personal information from children under 16, and we do not sell or share personal information of minors under 16. If you believe a minor has signed up, email support@kismat.at and we will close the account.

13. Contact

California privacy questions: support@kismat.at. We acknowledge requests within 10 days and substantively respond within 45 days.

Questions? Talk to a human.

Privacy, data rights, account questions - reach the right inbox below. We reply within 30 days as required by GDPR.

Email LegalEmail Privacy