1. Data controller

The controller of personal data processed in the Jaty Service is WHIPO sp. z o.o., a Polish limited liability company with its registered office at ul. Waltorni 15/1, 05-090 Dawidy Bankowe, Poland, tax identification number (NIP): 5342666118. For matters concerning personal data, you may contact the controller at this postal address or by email: [email protected].

This policy explains what data we process when you use the Jaty dating service, for what purposes, for how long and what rights you have.

2. What data we process

• Account data – email address, password (encrypted), first name, gender, who you are looking for, date of birth, city and search preferences. If you sign in with Facebook, we receive basic data needed to create the account from Facebook, such as your name and email address.
• Profile – description, photos and any additional information you choose to provide (e.g. height, education, religion).
• Activity in the service – hearts, matches, messages, profile views, blocks and last activity time.
• Moderation and security – reports, warnings, moderation decisions and their reasons, the connection country determined from the IP address and a verification photo if we ask for one.
• Technical data – cookies and similar technologies described in the cookie policy, notification settings and a push notification subscription if you enable it.
• Correspondence – the content of messages you send us by email or through the contact form, including complaints and appeals.

Providing account data is voluntary but necessary to use the service. Other profile information is up to you.

Some information, such as religion or who you are looking for (which may indicate sexual orientation), belongs to special categories of data. You provide it voluntarily and it is visible in your profile; we process it based on your explicit consent, which you can withdraw by removing the information from your profile or deleting your account.

3. Purposes and legal bases

We do not sell users’ personal data or use it for advertising.

4. How long we keep data

• Account data, profile, activity and messages – until the account is deleted.
• Moderation history (reports, warnings, decisions and related logs, including after a ban) – until the account is deleted. A person with a blocked account can request its deletion by emailing [email protected].
• Notice about a deleted or blocked account – the name or nickname from the profile, in a notification for people who had a pair or conversation with the account: for 30 days after deletion, and for a block (together with a thumbnail of the profile photo) until it is lifted or the account is deleted.
• Verification photo – until a moderator makes a decision, after which it is deleted.
• Correspondence, complaints and appeals – for as long as needed to handle them, and then until any claims become time-barred.
• Analytics data – as described in the cookie policy; data saved with an account – until the account is deleted.
• Backups – up to 12 months. They are used only to restore the service after a failure; the data in them is not otherwise used or processed during that time.

The service may also delete inactive accounts and archive or delete older content in accordance with the terms.

5. Recipients of data

Data may be shared with entities that help us run the service and process it on our behalf or as separate controllers:

• hosting, server infrastructure and network protection and acceleration providers;
• email and browser push notification service providers;
• the provider of artificial intelligence tools used for moderation (section 11);
• analytics providers – Google Analytics only with consent, and Simple Analytics (section 12);
• Meta Platforms (Facebook) – if you sign in with Facebook;
• public authorities where required by law.

Profile data is visible to other users of the service. Messages are seen only by their recipient; they are not published or shared with other users.

6. Transfers outside the EEA

Some providers, e.g. of AI tools, analytics or infrastructure, may process data outside the European Economic Area, including in the USA. In that case the transfer relies on mechanisms provided for in the GDPR, such as a European Commission adequacy decision or standard contractual clauses.

7. Automated decisions

As part of moderation, AI tools may on their own decide to remove content, issue a warning or block an account, in line with the rules set out in the terms. You have the right to obtain human intervention, express your point of view and contest such a decision – email [email protected]. We do not use profiling for marketing purposes.

8. Your rights

You have the right to:

• access your data and receive a copy of it;
• rectify your data – you can change most of it yourself in the account settings;
• erasure of your data;
• restriction of processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time – without affecting the lawfulness of processing before withdrawal.

To exercise these rights, email [email protected] or use the contact form. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

9. Deleting your account

You can delete your account at any time in the account settings (“Delete account”) or ask us to delete it by emailing [email protected]. Deleting the account removes the account data, profile, messages and moderation history, except for your name or nickname in the deletion notice that people you have a pair or conversation with see for 30 days (section 4); backups retain the data for no longer than the period stated in section 4.

When an account is deleted, we keep only gender, age, city and the stated reason for leaving for statistical purposes, without data that could identify a specific person.

10. Security, links and policy changes

We use technical and organisational measures to protect data against unauthorised access, loss or destruction.

Links to other websites may appear in the service. They operate independently of Jaty and have their own privacy rules, which we recommend reading.

This policy may change, e.g. as the service develops or the law changes. We will announce material changes in the service or by email.

11. Data used in AI moderation

To detect violations of the terms, spam and fraud, we check public descriptions, photos, account information, warning history and the content of sent private messages. Private messages are therefore subject to moderation even though they are not publicly visible.

We use AI tools from an external provider, to which checked content and account data may be sent. The provider may process data outside the European Economic Area (section 6).

The moderation rules are set out in the terms. For appeals, we record the assessed content, the reason for the decision and its outcome. A ban does not mean that all data is deleted. You can appeal a decision by emailing [email protected] – appeals are reviewed by a human.

To protect against fake accounts, we compare the country of the connection (based on the IP address) with the city stated in the profile. If they do not match, we may ask for a verification photo. A moderator reviews the photo, and it is deleted once a decision is made.

12. Visit statistics and external tools

We use Simple Analytics for visit statistics. This measurement is separate from registration data saved with an account. We enable Google Analytics only after analytics consent and rely on consent for this processing. Measurement purposes and provider information about cookies and privacy are described in our cookie policy. Using the service or accepting this policy does not constitute consent to optional tracking.

13. Registration source information

After analytics consent, when an account is created, we may save the first generic page path visited and the source from the utm_source parameter, such as a campaign name. These values are read from the first_page_visited and first_utm_source cookies. This also applies to registration through Facebook.

The purpose is to understand where people creating accounts come from. This data is linked to an account and is not anonymous. Missing values do not block registration or account features. Source measurement is based on consent (Article 6(1)(a) GDPR). It is optional and is not a condition of entering into an agreement to use the service. Accepting the terms does not replace prior consent to optional cookie storage and access.

Saved information remains part of the account data after the browser is closed or cookies are deleted. To request access, rectification, erasure or restriction of processing, email [email protected]. These rights apply under the conditions set out in the GDPR. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).