Kismat Privacy Policy

Effective: 28 June 2026 (version 4)

Summary: We collect what we need to run Kismat, we never sell your data, we do not target you with third-party advertising based on profiling beyond what your operating system advertising controls allow, you can export or delete everything from Settings, and you can lodge a complaint with the Austrian DPA at any time.

1. Who we are (controller)

Kismat is operated by P&P Management GmbH, registered with Handelsgericht Wien under FN 648928g, address Leebgasse 70, 1100 Wien, Austria ("we", "us", "Kismat"). We are the "data controller" under EU Regulation 2016/679 (GDPR) and Austrian DSG 2018 for personal data processed through the Kismat app and website.

Contact for privacy matters: support@kismat.at. We respond to GDPR requests within 30 days (extendable by two further months for complex requests, with notice).

We have not appointed a Data Protection Officer (DPO) as required only above the GDPR Art. 37 thresholds; you may still contact our designated privacy liaison at the address above.

2. What personal data we collect

2.1 Data you give us directly

Account credentials - email, password (stored as a salted bcrypt hash; we never see or store the plaintext), authentication provider for social logins (Apple sub, Google sub).
Identity attributes - display name, date of birth (to verify 18+ and to compute the age shown on your profile), gender (to enable matching).
Profile content - bio text, photos you upload, interests, looking-for intent, lifestyle questionnaire answers.
Communications - messages and Super-Like notes you send to other users; emails you send our support address.
Selfie verification - one or more selfie images captured live by the in-app liveness check. The image is compared on our own servers with your profile photos and is discarded within seconds when the check passes. Face data (biometric data): only if you give your explicit consent by ticking the face data box on the verification screen, we create a face template - a set of numbers describing your face, from which the selfie or photo cannot be rebuilt - from the selfie and from your profile photos that show exactly one face. We use it only to (1) confirm the selfie and your photos show the same person, (2) check that a newly added photo still shows you, and (3) make sure one face is verified on only one Kismat account. It is processed on our own servers and never shared with anyone or used to train anything. Without this consent no face template is created and the selfie check cannot run; nothing else in Kismat depends on it. You can withdraw your consent at any time in Settings > Privacy > Face data: all face templates are deleted immediately and your verified badge is removed (you can verify again later). Manual review: before you take the selfie, the verification screen tells you that if the automatic check cannot confirm you, the selfie is passed to a person. If you continue, a selfie that fails the automatic check is stored, encrypted, and shown to our trained moderation team next to your profile photos; it is deleted as soon as they decide, and at the latest after 14 days. While it waits you can start a new attempt after 24 hours, which replaces the queued selfie. (In older app versions without this notice, the selfie is held in memory for up to 15 minutes and stored only if you tap "Ask a person to review".)
Reports and appeals - any report you file against another user, plus context you provide.

2.2 Data collected automatically when you use the service

Activity - swipes (like / pass / super-like), matches, undos, time spent in screens, ad-view counts, in-app purchase history, subscription state.
Device + technical - platform (iOS / Android), app version, push-notification token, IP address (kept in security logs ≤ 30 days), language, time zone, device model, OS version.
Location - if you grant location permission: precise coordinates while the app is foregrounded (used to find matches near you). If you decline, we use coarse city-level location derived from your IP. You can revoke location access in OS settings or in Settings → Privacy.
Crash + diagnostic - non-personally-identifying crash stack traces (sent via Expo Updates' built-in error reporting only when the app crashes).

2.3 Special-category data (GDPR Art. 9)

By signing up for Kismat and choosing your gender preference / looking-for intent, you understand that we process data revealing your sexual orientation. Under GDPR Art. 9(2)(a), we rely on your explicit consent - given when you accept this Privacy Policy and the Terms at signup - as the lawful basis for processing this special-category data. You may withdraw this consent at any time by deleting your account; withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3)).

We process biometric data (face templates) only with your explicit consent and only for selfie verification, as described in Section 2 under "Selfie verification"; an optional manual review is visual only, by a person, with your explicit consent, and the image is deleted after the decision. We do not process special-category data revealing your race, religion, political opinions, trade-union membership, or health status. Your bio is free-text and may incidentally include such information; you choose what to share.

3. Lawful bases (GDPR Art. 6, Art. 9)

Purpose	Lawful basis
Running your account, matching, messaging, payments	Contract performance (Art. 6(1)(b))
Processing sexual-orientation indicators (gender preference, looking-for)	Explicit consent (Art. 9(2)(a))
Content moderation, fraud / bot detection, age-gating, abuse investigation, security logging	Legitimate interests (Art. 6(1)(f)) - operating a safe service for adults outweighs the limited intrusion on each individual processing
Responding to law-enforcement requests, complying with Austrian commercial law (UGB § 190 - 7-year accounting retention)	Legal obligation (Art. 6(1)(c))
Personalized advertising (where applicable)	Consent via App Tracking Transparency (iOS) / in-app dialog (Android) (Art. 6(1)(a))
Selfie liveness check + automated photo / text moderation	Legitimate interests + your consent at the moment you start the verification flow
Face templates (biometric data) for selfie verification: comparing your selfie with your profile photos, checking new photos still show you, and making sure one face is verified on only one account	Your explicit consent (Art. 9(2)(a)), given by ticking the face data box on the verification screen before the selfie is taken and recorded with date and version. Voluntary: you can use Kismat without it, only the verified badge needs it. Withdraw at any time in Settings > Privacy > Face data; all face templates are then deleted immediately.
Manual review of a failed selfie check	Your explicit consent, given on the verification screen before the selfie is taken (or, in older app versions, when you tap "Ask a person to review") (Art. 6(1)(a) and Art. 9(2)(a)); you can withdraw it at any time by writing to support@kismat.at, and the selfie is then deleted
Direct marketing of OUR own features and services to your account email (e.g. tier comparison, feature launch announcements)	Legitimate interests (Art. 6(1)(f)) + § 107 (3) Austrian TKG / Art. 13(2) ePrivacy Directive carve-out for own-customer marketing in connection with a comparable service. You may object at any time via the unsubscribe link in every such email or at support@kismat.at; the objection is honoured immediately and free of charge.
Invite a friend: checking that an invited member is a new, different person and not a returning, duplicate or second account of the person who shared the link, so the free Kismat Plus reward is not abused. We compare the two accounts (and other accounts invited by the same member) using: one-way keyed references (see Section 4), device identifiers, the shortened network address and phone model of sign-ins in the last 30 days, similarity of the email addresses, date of birth and first name, whether a profile photo is a copy of a photo on the other account (an image fingerprint, not facial recognition), and how many invites a member collects and how quickly. The result is a risk score. Invites with a high score are held for review by our team; an invite that turns out to be the same person is not rewarded, and Kismat Plus days already given for it are removed. You can ask for a person to look at the decision by replying in the Kismat Team chat in the app.	Legitimate interests (Art. 6(1)(f)) - preventing reward fraud and abuse of a free benefit. Face templates (biometric data) are not used for these checks.
Optional surveys, beta invitations, research interviews	Consent (Art. 6(1)(a)) - we ask before the first contact and the consent is specific, informed, and revocable.

You can object to processing based on legitimate interests on grounds related to your particular situation by emailing support@kismat.at (Art. 21). We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms (e.g. an active safety investigation).

4. How long we keep your data (retention)

Category	Retention
Account, profile, photos, matches, messages	While your account is active. Deleting your account erases these immediately.
Inactive accounts (no sign-in for 24 consecutive months)	We send two reminder emails (at 21 and 23 months of inactivity); if no sign-in follows, the account and all associated personal data are deleted under our legitimate-interest basis to avoid keeping data we no longer use. Counts reset on every sign-in; you can prevent deletion by signing in.
Match conversations after a match expires	30 days (moderation grace), then permanent deletion.
Photos after you remove them from your profile	≤ 24 hours on disk, asynchronously cleaned by our deletion sweeper.
Face templates (only with your explicit consent)	Until you withdraw your consent (Settings > Privacy > Face data) or delete your account, whichever comes first; then deleted immediately. A template of a photo is deleted together with the photo. The record of when you gave or withdrew consent is kept while your account exists.
Selfie verification images	Passed check: discarded within seconds. Failed check: stored encrypted for manual review until a moderator decides, at most 14 days (older app versions: held up to 15 minutes in memory unless you request a review).
Purchase and subscription receipts	7 years (Austrian UGB § 190 commercial accounting retention).
Security logs (IP, request logs)	≤ 30 days, longer only if part of an active fraud / abuse investigation.
Moderation reports + decisions	≤ 12 months after resolution, to enable repeat-offender detection and DSA appeal handling.
Invite a friend anti-abuse references (one-way keyed hashes of your email address, Apple / Google sign-in id and device id; they contain no readable data)	24 months after last use, also after you delete your account, so that a deleted account cannot be registered again to collect an invite reward. Nothing else about you is kept.
Invite a friend checks: a one-way keyed hash of the shortened network address an invite was used from, the risk score and the list of signals found, and the record of decisions on the invite	Network hash: 30 days (invite screen) or 90 days (used invite). Risk score, signals and decision record: 24 months, then deleted. Signals are stored as short codes and counts, never as addresses, emails or photos.
Anonymized aggregate analytics	Indefinite. By definition contains no personal data.
Backups	Encrypted, ≤ 30 days. Erasure requests are honored on the live system immediately and propagate through the backup rotation within 30 days.

5. Automated decision-making (GDPR Art. 22)

The following automated processes can have a legal or similarly significant effect on you:

Photo moderation - automated classifiers (including Google Gemini Vision) score uploaded photos for nudity, violence, weapons, drugs, and presence of minors. A score above our threshold automatically rejects the photo and may flag your account for human review on repeat offenses.
Age estimation at selfie verification - the verification flow uses Gemini's age-estimation signal to flag accounts where the selfie's apparent age is meaningfully below 18. Flagged accounts move to "pending review" and may be suspended pending manual confirmation.
Liveness scoring - the on-device liveness check produces a 0-1 score; below the threshold the verification fails automatically.
Bot / fraud detection - signals like impossible swipe rates, identical message templates across many recipients, IP risk score, and multi-account device fingerprints can result in automated suspension.

You have the right under GDPR Art. 22(3) to:

Obtain human intervention on any of the above decisions - email support@kismat.at.
Express your point of view on the decision.
Contest the decision via our internal complaint process (see Section 12 / our Notice and Action Policy).

We aim to respond to appeals within 5 business days. The appeal process is free.

6. Who we share data with (recipients)

We disclose personal data only to the categories of recipient listed below, only to the extent necessary, and only under written contracts that bind them to GDPR-equivalent confidentiality + processing duties.

Apple Inc. (Cupertino, USA) - "Sign in with Apple", App Store In-App Purchase processing, Push Notification Service. Transfer mechanism: EU-US Data Privacy Framework (Apple is certified) + Standard Contractual Clauses where applicable.
Google LLC / Google Ireland Ltd - "Sign in with Google", Google Play billing on Android, Firebase Cloud Messaging push, Google Gemini Vision (content moderation and the automated selfie-verification checks: requested pose, photo-of-a-screen detection, age estimate). Transfer mechanism: EU-US Data Privacy Framework + SCCs.
Google AdMob (Google Ireland Ltd / Google LLC) - ad delivery in the free tier (banner, interstitial, rewarded, and native ad surfaces). Ad personalization is OFF by default and only enabled if you accept it via the in-app Google UMP consent prompt (EU) or grant App Tracking Transparency on iOS. Without consent, AdMob serves only contextual (non-identifying) ads. We do not currently use third-party ad mediation; if and when we add additional mediation partners we will update this policy and re-prompt for consent where required.
OpenAI, L.L.C. (US) - OpenAI Moderation API, the first check for uploaded profile photos (sexual content, violence, self-harm, hate). The photo is sent for classification only. OpenAI does not use API data to train its models and may keep it for up to 30 days for abuse monitoring before deletion. Transfer mechanism: EU-US Data Privacy Framework + SCCs.
OpenRouter (US) - LLM gateway used for some content-moderation calls. Photos and message text sent for classification only. Per OpenRouter enterprise terms, your data is not used to train models. Transfer mechanism: SCCs.
Hosting + email - virtualhost.at (Austria). Database and image storage are physically located in the EU.
Law enforcement / regulators - only on receipt of a binding legal order, and only the minimum required. We log every disclosure and notify the affected user unless prohibited by the order. Where a request appears overbroad we challenge it.

We do not sell your personal data, we do not exchange it for monetary or other consideration, and we do not run third-party behavioural advertising on Kismat in the sense of cross-site profiling.

For full clarity on the ad model: free-tier users see ads inside the Kismat app via Apple's, Google's, and other established mediation partners' SDKs. The SDK passes signals selected by you in the OS-level controls - on iOS, your "Allow Apps to Request to Track" choice (App Tracking Transparency); on Android, your advertising-ID and ads-personalization toggles. If you have ad personalization off at the OS level, the SDKs receive only contextual (non-identifying) signals and serve non-personalized ads. We never sell or rent your account email, phone, message contents, or matching graph to advertisers under any circumstance.

7. International data transfers (GDPR Chapter V)

Your data is primarily processed within the European Economic Area (EEA). Some recipients (Apple, Google, OpenAI, OpenRouter) are based in the United States. For these transfers we rely on:

The EU-US Data Privacy Framework (DPF) where the recipient is self-certified - currently the case for Apple, Google, and Meta.
The European Commission's Standard Contractual Clauses (SCCs) (Module 2 / Module 3) where DPF self-certification is not in place, supplemented by transfer-impact assessments and supplementary technical measures (encryption in transit + at rest, access logging).

You can request a copy of the SCCs that govern a specific transfer at support@kismat.at.

8. Security (GDPR Art. 32)

We use the following technical and organisational measures:

Passwords stored as bcrypt hashes (cost factor ≥ 10); we never store plaintext.
All client-server traffic over TLS 1.2+. Internal service traffic is restricted by network ACLs.
Asymmetric (ES256) signing for the on-device selfie liveness proof - the private key lives only in the device's hardware keystore (Secure Enclave on iOS, StrongBox / TEE on Android).
Photos at rest on encrypted volumes. Database backups encrypted with AES-256.
Principle-of-least-privilege access for engineering. Access logs reviewed regularly.
Rate limiting on authentication, verification, and reporting endpoints to mitigate enumeration and brute force.
Automated dependency scanning (npm audit + Renovate) and a public security contact (support@kismat.at) for responsible disclosure.

9. Personal data breach notification (GDPR Art. 33-34)

If we suffer a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Austrian Datenschutzbehörde without undue delay and where feasible within 72 hours of becoming aware (Art. 33). If the breach is likely to result in a high risk to you specifically, we will notify you directly without undue delay (Art. 34) - by email to your account email and / or via in-app notice.

10. Children's data

Kismat is for adults aged 18 or older. Use by anyone under 18 is forbidden. We require date-of-birth confirmation at signup, run age-estimation at selfie verification, and apply automated photo moderation that flags any photo where a minor appears. If you become aware that a minor has registered or that anyone is sharing CSAM (child sexual abuse material) on the platform, email support@kismat.at immediately. CSAM is permanently retained only for the moment necessary to make a mandatory report to the Bundeskriminalamt Wien and / or NCMEC and is then deleted; the offending account is permanently terminated and reported to authorities (Austrian StGB §§ 207 / 207a / 208a).

11. Your GDPR rights and how to use them

Right	How to exercise	SLA
Access (Art. 15)	Settings → Privacy → "Export my data" - returns a JSON + HTML bundle of everything we hold on you	30 days
Rectification (Art. 16)	Edit your profile / email / settings any time	Immediate
Erasure (Art. 17)	Settings → Account → Delete account	Immediate; backup expiry within 30 days
Restriction (Art. 18)	Email support@kismat.at with a description of the processing you want restricted	30 days
Portability (Art. 20)	Same export as Access; the JSON file is machine-readable	30 days
Object (Art. 21)	Email support@kismat.at	30 days
Withdraw consent (Art. 7(3))	Delete account; for ad-tracking only, change ATT in iOS Settings or revoke in-app on Android	Immediate
Lodge a complaint with a supervisory authority (Art. 77)	Datenschutzbehörde, Barichgasse 40-42, 1030 Wien - dsb.gv.at	n/a

12. Privacy controls in the app

Settings → Privacy lets you turn off:

Read receipts (reciprocal - turning yours off hides receipts on others' messages too)
Typing indicator (reciprocal)
Online / offline status (reciprocal)
Map visibility - defaults off; you only appear on the nearby-users map when you opt in
Personalized ads - if you accepted ad tracking, you can revoke at any time

Profile privacy: switching your photo privacy to "private" blurs your photos for non-matches; matches see them at full resolution. This is a free feature - no paid tier bypasses another user's privacy choice.

13. Cookies and on-device storage

See our separate Cookie & Tracker Policy.

14. Changes to this policy

We may update this policy. Material changes (anything that affects what we collect, how we use it, or who we share it with) are announced in-app at least 30 days before they take effect; non-material clarifications take effect on publication. The "Effective" date and version number at the top of this document tell you which version is in force. Old versions remain available at support@kismat.at on request.

15. Contact

For privacy questions, data export, deletion, or any other request: support@kismat.at.

For abuse and safety: support@kismat.at. For security disclosures: support@kismat.at. For everything else: support@kismat.at.

Postal: P&P Management GmbH, Leebgasse 70, 1100 Wien, Austria.

Privacy Policy