Privacy Policy
This English translation is provided for convenience; the French version prevails.
Draft — to be reviewed by a lawyer or a DPO before publication. This policy follows the data mapping in the specifications (§10) and the processing operations actually implemented. The service providers have not yet been chosen: they are described by category.
Last updated: [TO BE COMPLETED: publication date] · draft version of 26 September 2026
1. The essentials
- We collect what is needed to offer you a match and organise a date, nothing more.
- Your sensitive answers (religion, for example) are optional, subject to a separate consent, never shown to your match and never used in the reasons for a match.
- Your match sees only your first name, your age, your approved photos, your introduction and the reasons for your compatibility. Never your surname, your address or your phone number.
- Your precise location is read only when you check in on arrival at the date, and it is not stored.
- Your data is hosted in the European Union. We do not sell any data.
- You can download all your data, withdraw your consents or delete your account from Me › My data.
2. Data controller and DPO
The data controller is [TO BE COMPLETED: company name, address, SIREN number].
Data Protection Officer (DPO): [TO BE COMPLETED: name or firm, dedicated email address]. A DPO has been appointed because the service processes sensitive data on a large scale.
3. The data we process
| Data | Why | Legal basis | Retention period |
|---|---|---|---|
| Identity and contact details: first name, date of birth, gender, phone number, email, Apple or Google identifier | Create and secure your account, verify your age | Performance of the contract | Lifetime of the account, then 1 year (handling of disputes) |
| Identity document and animated selfie | Verify your age and identity, combat fake profiles | Explicit consent (facial comparison: biometric data) | Deleted after verification; only the result (verified or not, date, provider) is kept |
| Profile: photos, introduction, prompts, occupation, height, availability, date preferences (budget, alcohol, atmospheres) | Build your profile and organise dates | Performance of the contract | Lifetime of the account |
| Gender and gender sought (orientation) | Suggest compatible people | Dedicated explicit consent, obtained at registration and revocable (withdrawal pauses the profile) | Lifetime of the account |
| Questionnaire answers (non-sensitive) | Calculate compatibility, produce your relationship portrait | Performance of the contract | Lifetime of the account |
| Sensitive answers (spirituality or religion, for example) | Refine compatibility if you so wish | Explicit, separate and revocable consent | Lifetime of the account; erased immediately if you withdraw your consent |
| Approximate area (neighbourhood, location rounded to about 1 km, travel radius) | Suggest people and venues nearby | Performance of the contract | Lifetime of the account |
| Precise location at check-in | Confirm your arrival at the date venue (within 300 m) | Consent (location permission) | Not stored: compared with the venue then discarded |
| Location when an alert is triggered | Come to your assistance | Vital interests, legitimate interest (safety) | Erased after 30 days |
| Matches, responses to matches, choices of time slots and venues, pre-date questions and answers, recognition sign | Organise the date | Performance of the contract | Lifetime of the account |
| Post-date feedback (attendance, impressions, chemistry, whether photos matched, wish to meet again) | Open the conversation in the event of a mutual yes; improve matching | Performance of the contract; legitimate interest (improvement of the service) | 12 months, then archived without identifiers (month of the date and answers only) |
| Reliability: no-shows, late cancellations, confirmations | Prevent no-shows, apply the rules of the Terms | Performance of the contract; legitimate interest | Lifetime of the account |
| Messages and photos exchanged after a mutual yes | Allow you to chat | Performance of the contract | Duration of the conversation; deleted when the account is closed |
| Trusted contact (first name and phone number of a friend or relative) | Sharing the date and alerts | Consent; vital interests | Until you remove it, at most the lifetime of the account |
| "Don't show me my contacts" option: encrypted (irreversible) fingerprints of the numbers in your address book | Avoid suggesting someone you know | Consent | Until the option is deactivated; the numbers themselves never leave your phone |
| Reports, moderation decisions, appeals, requests for human intervention | Member safety, obligations under the Digital Services Act | Legal obligation; legitimate interest | [TO BE COMPLETED: period, for example lifetime of the account + limitation period] |
| Subscription and payment (plan, status, dates, transaction identifier) | Invoice, manage free months and referrals | Performance of the contract; legal obligation | 10 years for accounting records; no card data is stored by Aparté |
| Consents (type, version, date, withdrawal) | Prove your choices | Legal obligation | Lifetime of the account + 5 years [TO BE CONFIRMED] |
| Notification tokens, notifications sent | Keep you informed (match, reminders, safety) | Performance of the contract | Lifetime of the account |
| Technical data: error logs, usage metrics | Fix bugs, measure the quality of the service | Legitimate interest or consent depending on the tool | [TO BE COMPLETED: period depending on the tool chosen] |
We never collect your ethnic origin, and no ethnic filter is offered.
4. Sensitive data
Some questions concern so-called "sensitive" data within the meaning of Article 9 of the GDPR: your orientation (the gender of the people you wish to meet) and, optionally, your spirituality or religion.
- Orientation: at registration, we ask for your explicit consent: "I agree that Aparté may use my gender and the gender I am looking for to suggest dates to me." This consent is essential for matching; you can withdraw it at any time, in which case your profile is paused.
- Separate consent for optional questions: a distinct screen asks for your explicit consent before any optional sensitive answer. Without this consent, you can use Aparté normally; only those questions are hidden from you.
- Separate, encrypted storage: sensitive answers are stored separately and encrypted in the database, with a key kept in a dedicated vault. Only you and the match calculation service can read them in plain text.
- Never displayed: your match never sees your sensitive answers, and they never appear in the reasons for a match.
- Use at your discretion: for each sensitive answer, you can decide whether or not it is used in the compatibility calculation.
- Withdrawal at any time: if you withdraw your consent (Me › My data), your sensitive answers are erased immediately, without losing the rest of the service.
5. Matching, a form of profiling
To offer you a match, we analyse your answers and those of other members: this is profiling. It is necessary for the contract you enter into with us. The page "How we choose your match" explains its criteria. You can at any time ask for a member of the team to review your situation (Me › My data › Request human intervention), express your point of view and challenge a decision.
6. Who sees your data
- Your match, once you have subscribed: first name, age, approved photos, introduction, prompts, compatibility score and reasons. In connection with the date: the recognition sign you choose (visible one hour before) and your answers to the 5 questions (visible once the other person has answered yours).
- No one else among the members: there is no catalogue of profiles.
- Your trusted contact, if you share your date or trigger an alert: venue, time, first name and photo of your match, and your location in the event of an alert.
- Our team, according to their role (moderation, support), only when necessary. Each time support consults an account, the reason is recorded and the consultation is entered in an access log.
- The partner venue, when a booking is possible: a first name and the time, never your profile. [TO BE CONFIRMED: data passed on to the venue.]
- Our processors (section 7), within the limits of their assignment.
- The authorities, upon a lawful request.
7. Our processors
Each service provider acts on our instructions, under a contract compliant with Article 28 of the GDPR.
| Category | Assignment | Provider | Data location |
|---|---|---|---|
| Hosting and database | Store the account, answers, photos and messages | [TO BE COMPLETED: hosting provider] | European Union |
| Identity verification (KYC) | Check the identity document and animated selfie | [TO BE COMPLETED: KYC provider] | [TO BE COMPLETED] |
| Text messaging | Login code | [TO BE COMPLETED: SMS provider] | [TO BE COMPLETED] |
| Payment and subscriptions | Collect payments and manage subscriptions | [TO BE COMPLETED: Apple, Google, subscription manager, web payment provider] | [TO BE COMPLETED] |
| Notifications | Deliver notifications | [TO BE COMPLETED: notification service, Apple, Google] | [TO BE COMPLETED] |
| Mapping and venues | Travel times, information about venues | [TO BE COMPLETED] | [TO BE COMPLETED] |
| Usage measurement (analytics) | Usage statistics | [TO BE COMPLETED: tool hosted in the EU preferably] | [TO BE COMPLETED] |
| Error tracking | Detect and fix bugs | [TO BE COMPLETED] | [TO BE COMPLETED] |
| Automated moderation | Detect nudity, contact details, hate speech | [TO BE COMPLETED] | [TO BE COMPLETED] |
8. Transfers outside the European Union
We favour service providers that process data within the European Union. If a transfer outside the EU is necessary (for example for notifications or store payments), it is governed by an adequacy decision (including the EU-US Data Privacy Framework) or by the European Commission's standard contractual clauses, supplemented where necessary by additional measures. [TO BE COMPLETED: list of transfers and safeguards, once the providers have been chosen.]
9. Security
- Hosting in the European Union, encryption in transit and at rest, enhanced encryption of sensitive answers.
- Row-level access rules: each member can read only their own account and their current match, never the rest of the membership.
- No matching calculation on your phone: other members' answers never pass through it.
- Photos resized and re-encoded on your phone before upload, which removes their metadata (including the location where they were taken); then served via temporary links, visible only to your match and to moderation.
- Team access restricted by role and logged.
- Procedure for notifying personal data breaches to the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority) within 72 hours, and to you if the risk is high.
10. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time, the right not to be subject to a decision based solely on automated processing, and the right to set out instructions regarding what happens to your data after your death.
In the app, under Me › My data:
- Download my data: all your data in a single machine-readable file (access and portability).
- Edit my profile and my answers (rectification).
- Manage my consents: sensitive data, location, communications, contacts option.
- Request human intervention on matching or a decision.
- Challenge a moderation decision within 6 months.
- Delete my account (erasure).
You can also write to our DPO: [TO BE COMPLETED: email address]. We respond within one month, which may be extended by two months for complex requests; we would inform you of this.
If you believe that your rights have not been respected, you may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr).
11. Deleting your account
When you delete your account, any subscription taken out on our website is cancelled, and then your photos, profile, answers (including sensitive ones), matches, messages and consents are erased. We keep only what the law requires or permits, for the period indicated in section 3: accounting records, information needed to handle a dispute, and the information needed to prevent an excluded person from re-registering (fingerprint of the verified identity and of the device). [TO BE CONFIRMED: duration and content of this anti-re-registration retention.]
Date feedback older than 12 months, already archived without identifiers, is kept to improve matching: it cannot be used to identify you.
12. Minors
Aparté is reserved for adults. Any registration by a person under 18 is refused; if we discover an account belonging to a minor, it is deleted.
13. Communications and trackers
Service-related notifications (match, reminders, safety) are necessary for the service to operate. Promotional communications are sent only with your consent, which can be withdrawn at any time. [TO BE COMPLETED: website trackers and measurement tools, with consent collection where required.]
Website waiting list
While the app is not yet available in your city, you can leave your email address on the website to be told when it opens.
- Data: email address, chosen city (and, if you select "Other city", its name), website language, sign-up page, sign-up and consent dates.
- Purpose: to let you know when Aparté opens in your city and to send you news about the launch. No other use, never sold or transferred.
- Legal basis: your consent (a checkbox that is never pre-ticked), which you can withdraw at any time: an unsubscribe link in every email, or a simple request to the team.
- Retention: until Aparté opens in your city, then for 12 months at most; or until you unsubscribe, if earlier.
- Recipients: the Aparté team (access restricted to administrators, every consultation logged) and our database host, acting as a processor (see sections 7 and 8).
14. Changes
We will inform you of any significant change to this policy before it takes effect.