Privacy Policy

1. Data Controller

Sitches is operated by [Company Name TBC], registered in the United Kingdom.

Contact for all privacy matters: privacy@sitches.app

2. What Data We Collect and Why

We collect only what is necessary to provide the service. Each category is listed below with its lawful basis under UK/EU GDPR.

3. Special Category Data (Article 9)

We process three categories of special category personal data. Each requires and receives explicit, informed consent before processing begins:

• Sexual orientation and relationship preferences — disclosed by users as part of their profile. Basis: explicit consent (Art. 9(2)(a)). You may withdraw consent by deleting these tags or your account.
• Biometric data for age estimation — where age verification is required, we use Private AV (Yoti) facial analysis to estimate whether you are 18+. This constitutes biometric processing under Article 9. Basis: explicit consent (Art. 9(2)(a)). You will be asked to consent to this specifically before age verification begins.
• HIV status and health information — users may optionally disclose this on their profile. We do not prompt for it; if provided, processing rests on explicit consent (Art. 9(2)(a)).

4. AI and Automated Processing

Chat message translation (OpenAI)

When a user enables the chat translation feature, the content of their messages is sent to OpenAI's API to perform the translation. You will be informed of this before enabling the feature and asked to consent.

OpenAI does not use API-submitted content to train its models by default (see OpenAI's API data usage policy). Messages are processed transiently and not retained by OpenAI beyond what is required to return the translation result.

Lawful basis for this transfer: consent (Art. 6(1)(a)).

Radar proximity matching

Our radar feature uses your device location to show you people nearby. Location is stored at neighbourhood resolution (cell-snapped, not GPS-precise) to reduce precision risks. No street-level coordinates are persisted.

Automated decision-making

We do not make fully automated decisions that produce legal or similarly significant effects on users (Article 22 GDPR). Matching is an informational display, not a binding determination.

5. Sub-Processors

We share personal data with the following third-party processors to operate the service. All transfers to US-based processors rely on Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.

We do not sell personal data to any party. We do not use advertising networks or tracking pixels.

6. International Data Transfers

Sitches is a UK-based service. Most of our sub-processors are based in the United States. Transfers to these processors rely on Standard Contractual Clauses (SCCs) approved under Art. 46(2)(c) UK GDPR and EU GDPR, supplemented by our assessments of the laws and practices in recipient countries.

Private AV / Yoti is based in the United Kingdom and no international transfer occurs for age verification processing.

7. Data Retention

8. Your Rights (Articles 15–22)

Under UK/EU GDPR you have the following rights. To exercise any of them, contact privacy@sitches.app.

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — ask us to correct inaccurate data.
• Right to erasure (Art. 17) — delete your account in-app at any time. All personal data is deleted within 30 days. You may also request deletion by email.
• Right to restriction of processing (Art. 18) — ask us to limit how we use your data in certain circumstances.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests (e.g. analytics).
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing. Withdrawal is available via app settings or by contacting us.
• Right to lodge a complaint — if you are a UK resident, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU, contact your local supervisory authority.

We aim to respond to all requests within 30 days. We will not charge a fee for reasonable requests.

9. Cookies and Tracking

The Sitches mobile app does not use cookies. Our public website may use technically necessary cookies only (session management, CSRF protection). We do not use advertising cookies, third-party tracking pixels, or analytics scripts that report to third parties.

10. Children

Sitches is not directed at or intended for use by anyone under the age of 18. We use age verification (Private AV / Yoti) to screen for users who do not meet this threshold. If we become aware that we have inadvertently collected data from a person under 18, we will delete it immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top and, for material changes, notify you via the app or email. Continued use of Sitches after a change constitutes acceptance of the updated policy.

12. Contact

For any privacy question, data request, or complaint:

Email: privacy@sitches.app
Data Controller: [Company Name TBC], United Kingdom

UK supervisory authority: Information Commissioner's Office (ICO)