Privacy Policy

Date Cards is a dating app developed and operated by Date Cards, based in Brussels, Belgium. This privacy policy applies to the Date Cards waitlist website at getdatecards.com and the Date Cards mobile application (iOS and Android).

Date Cards is the data controller for all personal data described in this policy. For any privacy-related questions or requests, contact us at hello@getdatecards.com.

Waitlist (website):

• Your email address
• Your language preference (EN, FR, or NL)
• Your referral code (if you joined via a friend's link)

Mobile app:

• Profile information you choose to provide (first name, age, photos)
• Approximate location (to show nearby venues and your general area for discovery, never in the background)
• Device token for push notifications (via Firebase Cloud Messaging)
• In-app activity (date card proposals, responses, matches, and messages you send)
• Purchase and subscription status for in-app purchases (through Adapty; we never see or store your card details)

Because Date Cards is a dating app, the gender you set and the people you choose to meet can reveal your sexual orientation, which is a special category of data under GDPR Art. 9. We process it only to run the core matching feature, and only with your explicit consent given when you create your profile. You can withdraw that consent at any time by deleting your account.

We do not collect other special categories such as health, biometric data, racial or ethnic origin, religious beliefs, or political opinions.

• To send you a confirmation email when you join the waitlist
• To send you the Date Cards updates you signed up for
• To track referral credits so we can reward you in the app
• To deliver push notifications for date card activity (app only)
• To process in-app purchases and manage your subscription
• To monitor app stability and diagnose crashes
• To improve the app through aggregated, anonymised analytics

Legal basis: Your consent under GDPR Art. 6, given when you submit your email or create an account. For the special-category data described above (sexual orientation), we rely on your explicit consent under GDPR Art. 9(2)(a). You may withdraw your consent at any time without consequence.

We do not use your data for advertising, behavioural profiling, or cross-app tracking. Your data is never sold.

The Date Cards mobile app may request the following device permissions:

All permissions are optional where possible. Refusing a permission may limit certain features but will not prevent you from using the core app.

We use a small number of trusted sub-processors to operate the service:

All sub-processors are bound by data processing agreements compliant with GDPR. We do not share your data with advertisers, data brokers, or any third party not listed above.

We take the security of your personal data seriously:

• All data is encrypted in transit (TLS 1.2+)
• Data at rest is encrypted by our database provider (Supabase/PostgreSQL)
• Access to production data is restricted to authorised team members only
• We conduct regular security reviews of our infrastructure and dependencies

In the event of a data breach that affects your rights, we will notify you and the Belgian Data Protection Authority (GBA/APD) within 72 hours, as required by GDPR.

Waitlist data is kept until you ask us to delete it. We will not retain waitlist data for more than 2 years.

App account data is kept for as long as your account is active. If you delete your account, your personal data is permanently deleted within 30 days, except where retention is required by law.

Date Cards is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will immediately delete their data and close their account.

If you believe a minor has registered on Date Cards, please contact us at hello@getdatecards.com so we can take action immediately.

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Restriction — limit how we process your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting prior processing
• Lodge a complaint with the Belgian Data Protection Authority (GBA/APD) at dataprotectionauthority.be

To exercise any of these rights, email hello@getdatecards.com. We will respond within 30 days.

Your account and activity data is stored in the European Union. Our primary database is hosted by Supabase in Frankfurt, Germany, and PostHog analytics runs on EU servers.

A few sub-processors may process limited technical data on servers outside the EU/EEA: Firebase Cloud Messaging (device tokens), Adapty (purchase and subscription data) and Sentry (crash diagnostics). These transfers are covered by Standard Contractual Clauses under GDPR Art. 46.

If we make material changes to this policy, we will notify waitlist members and app users by email at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

The latest version of this policy is always available at getdatecards.com/privacy.