Privacy policy

This policy applies to everyone who uses EliteDulce, wherever they live. Sections 1–14 apply everywhere. Section 15 contains additional information and rights for users in particular countries and regions; all regional sections are shown to everyone.

1. Who we are

The company below is the controller of your personal data, wherever you live. We are established in Denmark, so the Danish Data Protection Agency (Datatilsynet) is our lead supervisory authority under the GDPR.

Company name

EliteTreat ApS

CVR number

46250559

Address

Guldsmedsvej 13, 2640 Hedehusene, Danmark

Contact

Contact form

Data protection officer: [UDFYLDES: databeskyttelsesrådgiver (DPO) – navn og kontaktoplysninger, eller begrundelse for, at der ikke er udpeget en].

2. Where this policy applies

The policy applies to the EliteDulce app for iOS and Android, the web app, the website, and the events and video features we organise. How we use cookies on the website is described in the cookie policy. If a feature has its own privacy information, it is shown before you use the feature.

3. The information we process

• Account: phone number and/or email, login methods and devices.
• Profile: first name, date of birth, photos, segment, field, bio, prompts, interests, education and any other details you choose to add.
• Special categories: your gender identity, who you want to see (“Show me”) and your sexual orientation can reveal information about your sex life. We only process them with your explicit consent, which you give during sign-up before you are asked.
• Location: an approximate point, rounded to a grid of about 1 km before it is used to find profiles near you. Others only see the distance, never your position. If you switch on Missed Connections, we store your approximate locations for 7 days.
• Use: likes, matches, messages and how you use the app, so the service works and can be improved.
• Purchases: what you bought and when. Card details are handled by the payment provider and the stores, not by us.
• Verification: for photo verification our partner compares a video selfie with your profile photos, with your explicit consent; we only keep the result. For age verification with an electronic ID we are only told whether you are over 18.
• Photo check: when you upload a profile photo, our own server automatically checks that it shows a face and that your photos show the same person. For this we store a face template (a series of numbers, not an image) of each photo until the photo or your account is deleted. The template never leaves our servers and is only used to prevent fake profiles. If a photo shows no face, or not the same person, we ask you to confirm your identity with a selfie. The photo check only runs if you have said yes to it. If you turn it off in the settings, we delete the templates straight away.
• Contacts: only the ones you choose to upload, stored in a form that cannot be read.
• Messages: your messages are stored so they can be delivered. We do not scan them on our servers; warnings about abusive messages and blurring of nude images happen with a model on your phone or in your browser, and the image does not leave the device for that purpose.
• Calls, video and Speed Date: relayed through our own server (LiveKit) in the EU, without recording.
• Date check: the trusted contacts you choose (name and phone number) and the time of your date. If you do not respond, we send them a text message.
• Device and notifications: an installation ID and a push token so we can send notifications via Apple and Google (Firebase Cloud Messaging).
• Ads in the app: if the app shows ads, this is done through Google AdMob. Personalised ads require your yes in the consent window (Usercentrics) and, on iPhone, also in Apple's tracking dialog (App Tracking Transparency). If you say no, the ads are not personalised and the advertising ID is not used.
• Safety: reports, blocks and the outcome of verification.

4. Purposes and legal bases

• To provide the service you asked for (contract, GDPR art. 6(1)(b)).
• To use gender, “Show me” and orientation to show you the right profiles (explicit consent, art. 9(2)(a)). You can withdraw your consent; we can then no longer find profiles for you.
• Photo verification and the processing of your face data in the video selfie (explicit consent).
• The photo check of profile photos and the face templates it stores (explicit consent, Art. 9(2)(a)).
• To protect members from scams, spam and abuse (legitimate interest, art. 6(1)(f)).
• To meet bookkeeping rules and requests from authorities (legal obligation, art. 6(1)(c)).
• Marketing by email, SMS and push, and personalised ads, only with your consent.

The legal bases are described in GDPR terms. Section 15 explains how they correspond to the rules where you live.

5. No sensitive data to advertisers

Gender, “Show me” and orientation are never shared with advertising partners and are never used to target ads. We do not sell your personal data.

6. Recipients

We use these processors and partners:

• Hosting: Hetzner (servers in the EU) and Sentry (server error logging, EU region).
• Photos: Cloudinary (storage and processing of images).
• SMS and email: GatewayAPI or 46elks (SMS) and Brevo (email).
• Notifications: Apple Push Notification service and Google Firebase Cloud Messaging.
• Verification: Veriff (photo verification and ID documents) and Idura (age with MitID, BankID or FTN). We only receive the result.
• Ads and consent: Google AdMob and Usercentrics. For personalised ads, Google is an independent controller for its own use of the data.
• Payments: Apple (App Store) and Google (Google Play), who are independent controllers for the purchase.
• Statistics: Plausible in the EU, without cookies.

Processors may only use the data on our instructions. Other members see your profile, but never your phone number, email or exact position. We may share information with the police and other authorities when the law requires it or when it is necessary to protect someone’s life, health or safety.

7. International transfers

Our servers are in the EU. If you live outside the EU, your data is therefore transferred to and stored in the EU. Any transfers from the EU/EEA to countries outside it, for example when Google or Apple process data in the USA, are based on the European Commission’s standard contractual clauses or an adequacy decision (for the USA, the EU-U.S. Data Privacy Framework where the recipient is certified). Section 15 describes how transfers are protected under the rules where you live.

8. Retention

• Messages: until the match ends or the account is deleted. Messages attached to a report: 12 months after the case is closed.
• Moderation cases: 2 years after the last action.
• Purchases and invoices: 5 years under Danish bookkeeping rules.
• Consents: 5 years after they are withdrawn.
• Logs: 30–90 days. Backups: 35 days.

The same periods apply wherever you live, unless the law where you live requires a shorter or longer period.

9. Deletion and export

You can delete your account immediately or with 90 days to change your mind. See delete account. You can download a copy of your data as a ZIP file from the settings; the link is valid for 7 days.

10. Profiling

The order of profiles is calculated from your filters, activity and the likelihood of a mutual like (see the terms, section 5). It is not a decision with legal effects for you. You can opt out of personalised offers in the settings.

11. Your rights

Wherever you live, you can ask for access to your data, have it corrected or deleted, receive a copy of it, object to processing and withdraw a consent. Depending on where you live, you may have further rights; see section 15. Write to us via the contact page or under Settings → Help in the app. We may need to confirm your identity before we act on a request. We answer within the time limit set by the law that applies to you, and in the EU/EEA within one month. You can also complain to a data protection authority; section 15 lists the authorities.

12. Age

EliteDulce is only for people aged 18 and over, or older if the age of majority is higher where you live. We do not knowingly collect data about children. If we find an account belonging to a younger person, we close it.

13. Changes

If we change this policy materially, we will tell you in the app before the change takes effect. Consent is asked for again if a purpose changes.

14. Contact

Write to us about privacy via the contact page or under Settings → Help in the app. The company details and the data protection officer are in section 1, and the representatives and contacts for particular regions are in section 15.

15. Regional information

The sections below supplement sections 1–14 for users in the region concerned.

15a. European Union and the EEA

• Law. The GDPR applies. The legal bases are listed in section 4.
• Your rights. You have the right of access, rectification, erasure, restriction, data portability and to object, and the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not make such decisions).
• Complaints. You can complain to the data protection authority in the country where you live or work or where the alleged infringement took place. Our lead authority is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark – datatilsynet.dk. Examples of other authorities: Integritetsskyddsmyndigheten (IMY) in Sweden – imy.se, and Datatilsynet in Norway – datatilsynet.no. All EU/EEA authorities are listed by the European Data Protection Board.

15b. United Kingdom

• Law. The UK GDPR and the Data Protection Act 2018 apply, with the same legal bases and rights as in section 15a.
• Transfers. Your data is stored in the EU, which the United Kingdom recognises as providing adequate protection.
• UK representative: [UDFYLDES: repræsentant i Storbritannien efter UK GDPR art. 27 – navn og adresse].
• Complaints. You can complain to the Information Commissioner’s Office (ICO) – ico.org.uk.

15c. Switzerland

• Law. The Federal Act on Data Protection (FADP) applies.
• Transfers. Your data is stored in the EU, which Switzerland recognises as providing adequate protection.
• Swiss representative: [UDFYLDES: repræsentant i Schweiz efter FADP art. 14 – navn og adresse, hvis påkrævet].
• Complaints. You can contact the Federal Data Protection and Information Commissioner (FDPIC) – edoeb.admin.ch.

15d. United States

This section applies to residents of US states with comprehensive privacy laws, such as California, Colorado, Connecticut, Virginia and others, to the extent those laws apply to us.

• What we collect and why. The categories of personal information we collect, the sources, the purposes and the retention periods are described in sections 3, 4 and 8. Sexual orientation, gender identity and face data from verification are sensitive personal information; we only process them with your consent and only for the purposes in section 4.
• No sale. We do not sell your personal information. Personalised ads require your consent, and withdrawing it in the settings also works as an opt-out of targeted advertising and “sharing” for cross-context behavioural advertising. Where the law requires it, we treat a Global Privacy Control signal from your browser as such an opt-out.
• Your rights. Depending on your state, you can ask to know and access the personal information we hold about you, have it corrected or deleted, receive a portable copy, opt out of targeted advertising, sale and profiling, and limit the use of sensitive personal information. We will not treat you differently because you use your rights.
• How to make a request. Use the contact page or Settings → Help in the app. An authorised agent may make a request on your behalf if they can show that you have authorised them. We verify requests by matching them to your account.
• Appeal. If we refuse your request, you can appeal by replying to our answer with the words “Privacy request appeal”. If you disagree with the outcome of the appeal, you can contact the attorney general of your state.

15e. Canada and Québec

• Law. The Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws apply. Your data is stored in the EU and may be accessed there by our processors.
• Complaints. You can complain to the Office of the Privacy Commissioner of Canada – priv.gc.ca.
• Québec. The Act respecting the protection of personal information in the private sector applies. Person in charge of the protection of personal information: [UDFYLDES: ansvarlig for beskyttelse af personoplysninger efter Québec Law 25 – titel og kontaktoplysninger]. You can complain to the Commission d’accès à l’information du Québec – cai.gouv.qc.ca.

15f. Brazil

• Law. The General Data Protection Law (LGPD) applies. The legal bases in section 4 correspond to performance of a contract, consent (specific and highlighted consent for sensitive data), legitimate interest and compliance with a legal obligation under the LGPD.
• Your rights. You have the rights in article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about sharing and withdrawal of consent.
• Transfers. Your data is transferred to the EU on the basis of the mechanisms the LGPD allows.
• Data protection officer (encarregado): [UDFYLDES: encarregado efter LGPD – navn og kontaktoplysninger].
• Complaints. You can complain to the National Data Protection Authority (ANPD) – gov.br/anpd.

15g. South Korea

• Law. The Personal Information Protection Act (PIPA) applies.
• Transfer abroad. The personal information listed in section 3 is transferred to and stored with our server provider in the EU when you use the service, for the purpose of providing the service, and is kept for the periods in section 8. You can refuse the transfer by not using the service or by deleting your account.
• Destruction. When the retention period ends, electronic files are deleted in a way that cannot be restored.
• Domestic agent and privacy officer: [UDFYLDES: indenlandsk repræsentant i Sydkorea efter PIPA art. 31-2, hvis påkrævet, og ansvarlig for persondata – navn og kontaktoplysninger].
• Complaints. You can contact the Personal Information Protection Commission (PIPC) or the Personal Information Infringement Report Center (privacy.kisa.or.kr).

15h. Japan

• Law. The Act on the Protection of Personal Information (APPI) applies.
• Transfer abroad. Your personal data is transferred to and stored in the EU, which Japan’s Personal Information Protection Commission recognises as having a personal information protection system equivalent to Japan’s.
• Your rights. You can ask us to disclose, correct, stop using or delete your retained personal data via the contact page.
• Complaints. You can contact the Personal Information Protection Commission (PPC) – ppc.go.jp.

15i. India

• Law. The Digital Personal Data Protection Act, 2023 applies as its provisions come into force. We process your personal data on the basis of your consent or for the legitimate uses the Act allows, and you can withdraw consent as easily as you gave it.
• Your rights. You can ask for information about the processing, correction, completion and erasure of your data, and you can nominate a person to exercise your rights if you die or become incapacitated.
• Grievance officer: [UDFYLDES: grievance officer for Indien – navn og kontaktoplysninger]. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

15j. Australia

• Law. The Privacy Act 1988 and the Australian Privacy Principles apply.
• Overseas disclosure. Your personal information is disclosed to our server provider and other processors in the EU.
• Complaints. Contact us first. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) – oaic.gov.au.

15k. Other countries

If you live in a country not mentioned above, you have the rights that the data protection law of your country gives you, in addition to the rights in section 11. Write to us via the contact page, and we will tell you how we handle your request and which authority you can complain to.