Privacy Policy
Effective date: May 1st 2026 Version: 1.0 Provider: PX7 Digital, Hyltebjerg Alle 43, Vanløse, Denmark.
This policy explains what personal data GoDating collects, why, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Danish data protection law.
We have written this policy in plain language. If anything is unclear, contact us at [email protected]
1. Who is responsible for your data
PX7 Digital / Jørgen Larsen ("GoDating," "we," "us") is the data controller for the personal data described in this policy.
Data Protection Officer: [email protected]
For privacy questions, exercising your rights, or filing a complaint, contact [email protected]
2. The data we collect and why
We only collect what we need to operate the service. We do not sell personal data.
2.1 Account and profile data
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account creation, login, transactional notifications | Performance of contract (Art. 6(1)(b)) |
| Name (display name) | Show on your profile | Performance of contract |
| Date of birth and age | Eligibility verification (18+); show age to other users | Legal obligation + performance of contract |
| Gender identity, shown-as, pronouns, dating preferences | Operate matching | Performance of contract |
| Approximate location area (postal-code level) | Show local profiles; never exact location | Performance of contract |
| Relationship intention, values, lifestyle, communication style | Operate matching | Performance of contract |
| Profile photos | Show on your profile | Performance of contract |
| Prompt answers | Show on your profile | Performance of contract |
| Locale preference | Display the service in your language | Performance of contract |
2.2 Activity data
| Data | Purpose | Legal basis |
|---|---|---|
| Likes, passes, comment-likes | Operate discovery and matching | Performance of contract |
| Matches and chat messages | Provide the chat feature | Performance of contract |
| Date suggestions and date-flow events | Provide date planning | Performance of contract |
| Reports and blocks you submit or receive | Operate safety and moderation | Legitimate interest (Art. 6(1)(f)) — preventing abuse |
2.3 Verification data (special category — Article 9)
Verification has two parts:
- Manual moderator review. When you request verification, a GoDating moderator reviews your profile and the verification selfie you submit (see point 2 below) and decides whether to grant a verified-profile badge.
- Verification selfie. You can submit a single still selfie performing a randomly-prompted gesture (e.g. "touch your right ear with your left hand"). The selfie is uploaded to our encrypted R2 storage at Cloudflare, is visible only to authorised GoDating moderators for the purpose of approving or declining your verification request, and is used to compute a perceptual-hash similarity score against your profile photos so a moderator can spot obvious mismatches. We do not store a biometric template (no facial-feature vectors) and we do not share the selfie with any third party.
Automated biometric verification using a third-party provider (Persona / Veriff / Onfido / similar) is not active. If we later activate such a provider, we will update this policy, the DPIA, the ROPA, and the subprocessor list before collecting any provider-side biometric data.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Verification selfie (still image) | Allow a moderator to confirm you are a real person and the same person shown in your profile photos | Explicit consent (Art. 9(2)(a), consent key photo_verification_art9) | Deleted within 90 days of the verification decision, or immediately on withdrawal of consent |
| Selfie SHA-256 hash + perceptual hash | Detect re-used / known-bad selfies; produce a similarity score against your profile photos | Legitimate interest (Art. 6(1)(f)) — fraud prevention | Retained as long as the verification request row is retained |
| Verification result (granted / declined / withdrawn) and badge state | Show the verified-profile badge to you and to other users | Legitimate interest (Art. 6(1)(f)) — service operation | Retained for the lifetime of the account |
You can withdraw your consent at any time from settings. Withdrawal immediately removes the verified-profile badge, deletes the stored selfie from R2, and you would need to re-verify before sending a first message in a new match.
2.4 Payment data (only if you subscribe to Serious or Serious+)
| Data | Purpose | Legal basis |
|---|---|---|
| Subscription status, billing events | Operate Serious and Serious+ subscriptions | Performance of contract |
| Card details (Stripe) or MobilePay account reference | Take payment | Performance of contract |
| Invoice records | Tax and bookkeeping compliance | Legal obligation (DK Bookkeeping Act) |
We do not see or store your full card number. Card details are handled directly by Stripe Payments Europe, Ltd. We store only the card brand and last four digits (display only) plus Stripe's customer and subscription identifiers. MobilePay one-shot payments via Vipps MobilePay AS are not yet active.
You have a 14-day right of withdrawal on the first time you subscribe to Serious or Serious+, per Danish consumer law. The right does not apply to subsequent renewal periods. We send a renewal-reminder email 5–8 days before each automatic renewal. See the Terms of Service section 7 for the full subscription terms.
2.5 Technical data
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, device type, browser, basic device fingerprint | Security, fraud prevention, abuse prevention | Legitimate interest |
| Server logs | Debugging and security | Legitimate interest |
| Strictly-necessary cookies | Authentication and session | Performance of contract |
| Functional cookies | Remember preferences | Consent where required (see Cookie Policy) |
We do not use third-party advertising cookies. We do not run cross-site tracking.
2.6 Communications
| Data | Purpose | Legal basis |
|---|---|---|
| Support correspondence | Help you with issues | Performance of contract |
| Marketing emails (only if you opt in) | Tell you about product news | Consent (Art. 6(1)(a)) |
You can withdraw marketing consent at any time. It does not affect transactional or safety notifications, which we are obliged or contractually required to send.
3. How we use the data
We use your data to operate the service: create your account, build and show your profile, suggest matches, deliver chat, recommend dates, take payment, prevent fraud and abuse, comply with our legal obligations, and improve the product.
3.1 Matching is not "solely automated decision-making" under Article 22
The matching algorithm ranks profiles for your daily discovery feed. It does not produce decisions with legal or similarly significant effects on you, and you remain free to like, pass, and act on every suggestion. You can read a plain-language explanation of how matching works in the app under Settings → How matching works.
3.2 Moderation involves human review
Reports and content flagged by our automated systems are reviewed by trained human moderators per our Community Guidelines. You always receive a statement of reasons for any moderation action against you and can appeal it under our DSA-aligned appeals process.
4. Who we share data with
We share personal data only with the processors below, each under a Data Processing Agreement.
| Processor | Service | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, edge compute, storage (Workers, D1, R2, KV, Durable Objects, Images, Queues) | All operational data | EU residency configured where supported |
| Not activated — biometric provider not selected | Photo verification | Selfie video, biometric features | Provider and region will be published before activation |
| Stripe Payments Europe, Ltd. | Card payments and self-service billing portal for GoDating Serious and Serious+ subscriptions | Card details (handled directly by Stripe; we never see them), billing address, billing events, invoices | EEA |
| Vipps MobilePay AS | MobilePay one-shot payments (planned, not yet active) | Payment data, billing events | Denmark / EEA |
| Resend | Transactional and (with consent) marketing email | Email address, message contents | EU / US under SCCs |
We do not sell personal data. We do not share personal data for advertising. We do not share personal data with brokers.
We may disclose personal data to law-enforcement authorities when legally compelled to do so, after assessing each request for proportionality and lawful basis. We publish an annual transparency report covering the volume of such requests.
5. International transfers
Where our processors transfer personal data outside the European Economic Area, transfers are protected by EU Standard Contractual Clauses or by equivalent legal mechanisms approved by the European Commission. Details for each processor are available in their public Trust documentation.
6. How long we keep data
We keep personal data only for as long as we need it. The table below mirrors §17.4 of our product specification.
| Data | Retention |
|---|---|
| Active account profile | While your account is active |
| Soft-deleted account | 30 days, then hard delete |
| Messages within an active match | While the match exists |
| Messages after unmatch | 30 days, then deleted |
| Messages after either user deletes their account | 30 days, then deleted |
| Photos | Deleted on request immediately; 30-day grace before storage purge |
| Reports (authored or about you) | 24 months; longer for actions on banned accounts |
| Moderation actions | 5 years for banned accounts; 24 months otherwise |
| Audit logs (administrative actions) | 24 months |
| Banned-user tombstone | Indefinite, minimal hashed identifiers only, to prevent re-registration |
| Biometric verification result | While account is active; raw video held by processor for max 24h then deleted |
| Server logs | 90 days |
| Subscription and invoice records | 5 years (DK Bookkeeping Act) |
When a retention period ends, we delete the data or irreversibly anonymize it.
6.1 Records retained after account hard-deletion
When you request permanent account deletion, GoDating erases all personal data as described above. Under the narrow exceptions in Article 17(3) GDPR, a small number of records survive the deletion cascade with no personally-identifying content:
| Retained record | Fields kept | All PII fields | Lawful basis | Retention period |
|---|---|---|---|---|
Safety event records (critical_safety_events) | Full event record | User's profile/email/photos erased by cascade; event record kept for evidential continuity | Art. 17(3)(e) GDPR — establishment, exercise or defence of legal claims; public interest in safety | 90-day minimum; extended while any related legal or law-enforcement proceeding is ongoing |
Billing event shell (billing_webhook_events) | stripe_event_id, event_type, received_at | Raw payload scrubbed to {"scrubbed":true}; user_id unlinked | Art. 17(3)(b) GDPR — legal obligation (Danish Bookkeeping Act, min. 5 years) | 5 years from event date |
Support ticket shell (support_tickets) | id, category, status, timestamps | Body, subject, IP, contact email, AI draft all scrubbed; user_id unlinked | Art. 17(3)(b) GDPR — legal obligation and regulatory audit trail (DSA) | 5 years from creation date |
Full legal rationale and quarterly review procedure: docs/legal/gdpr-article-17-retention.md.
7. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"). You can soft-delete or hard-delete your account from settings.
- Restrict how we process your data in specific circumstances.
- Object to processing based on legitimate interest.
- Portability — receive your data in a machine-readable format. You can export your account from settings; the export is delivered within 30 days (typically under one hour).
- Withdraw consent for any processing based on consent (e.g., biometric verification, marketing). Withdrawal does not affect prior lawful processing.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions; see §3.1.
- Lodge a complaint with the Danish Data Protection Authority (Datatilsynet, datatilsynet.dk) or your local supervisory authority.
To exercise any of these rights, use the in-app settings or write to [email protected]. We respond within one month.
8. Children
GoDating is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor is using the service, contact [email protected] and we will act promptly under our Community Guidelines and the law.
9. Security
We use Cloudflare's stack (Workers, D1, R2, KV, Durable Objects) with EU-resident data plane configured where supported. Internal access to user data is role-restricted, two-factor-authenticated, and audit-logged. Photos and chat content are accessible to administrators only when required by an open report or appeal, and any such access is logged.
No system is perfectly secure. If we become aware of a personal-data breach affecting you, we will notify you and the Danish Data Protection Authority as required by law.
10. Cookies
See our Cookie Policy. We use only strictly-necessary and (where you opt in) functional cookies. We do not use advertising cookies and do not run cross-site tracking.
11. Changes to this policy
If we make a material change to this policy, we will notify you in-app and by email at least 30 days before it takes effect. The current version is always available at the URL where you found this document.
12. Detailed regulatory disclosures
For full transparency we publish our complete data-protection working documents alongside this policy:
- Records of Processing Activities (Article 30 GDPR) — every processing activity, lawful basis, retention period, and recipient.
- Data Protection Impact Assessment — the risk analysis behind our photo, matching, and (planned) biometric processing.
- Cookie Policy — every storage mechanism we use, why, and how to opt out.
- Subprocessors — current list with locations and DPA status.
These documents are the source of truth; this policy is the user-facing summary.