Member privacy notice

1. Who is responsible for your data

The controller is Cyproom. For anything about your data write to info@cyproom.com. We are a small business and have not appointed a data protection officer; the operator answers every request personally.

2. What we collect when you create an account

• Sign-in: your e-mail address and your mobile number, which we confirm with a code.
• About you: date of birth, gender (woman / man / non-binary), the first name others will see, your district and area (a town or village from a list, never an address), your relationship status (never married / divorced / separated / widowed), how long you would drive for a first date, the languages you can date in and what you are looking for. We ask about your relationship status for the rule in section 3 of the member terms; it is not shown on your card.
• “Find my area”: if you tap this button, your browser (only with your permission) gives your location to the page; the page itself picks the nearest area on the list and fills in only that. Your location never reaches us and we do not store it anywhere.
• Who you want to meet (women / men / everyone). Because this can reveal your sexual orientation, it is special-category data and we keep it only with your explicit consent (section 5).
• Questionnaire answers: the ages you are interested in, children (whether you have or want them), your preferences for a partner (children, smoking, drinking) and, if you fill them in, your field of work, education, lifestyle, values and when you are usually free. The optional questions about smoking, drinking (which may say something about health) and faith (together with how much the same faith matters to you) are special-category data: we keep the answer only with your explicit consent, otherwise nothing. We also keep which things in common you switched on in “How others will see you”.
• Your own words: the sentence “I’m looking for someone who…” and your answers to one or two questions you choose from a list (e.g. “My perfect Sunday…”), together with the language you wrote them in (we tell it from the letters).
• Photos (2–5): private, never public, shown with a watermark carrying the viewer’s name; we remove location and camera data (EXIF/GPS) on upload. We also keep the results of their automatic checks, a numeric fingerprint of each photo for the duplicate check, which one is the main photo and whether we made it the main one (section 10).
• “Hide from people you know” list: the phone numbers and e-mails of people you never want to be introduced to. We store them only as keyed hashes (scrambled values that cannot be turned back into the number or e-mail), use them only to keep you apart, and never contact those people. Telling them would defeat the purpose of the list and could put you at risk, so we do not inform them (GDPR Art. 14(5)(b)). If you choose it, we also keep your “Your own neighbourhood” setting (not to introduce people from your own area or very close to you, up to 10 minutes’ drive).
• ID check result (see section 6): verified yes/no, the date of birth from the document, the document’s country, which check you chose (with or without selfie), a keyed hash of the document number and, if you took a selfie, whether the main photo of your profile matched the selfie, which photo was the main one at the time, and which other photos did not seem to be you. Also whether the document’s date of birth differed from the one you had given (yes/no). For each check we also keep its Stripe reference, the outcome (for example “the date of birth cannot be read”), when you saw the result or we e-mailed it to you, and when we asked Stripe to delete it.
• Consents: which consent you gave or withdrew, when, for which version of the text and in which language, together with a fingerprint (SHA-256) of the exact text you saw, which we archive word for word.
• Availability: whether you paused your account (since when and until when) and whether you said “I’m away this week” (from which day).
• Reminders: how many reminder e-mails we sent you and when, whether we sent you the e-mail saying you are ready for introductions (or you already saw that in the app), and whether you asked us to stop sending reminders (section 4).
• E-mail and phone changes: when you change your e-mail we keep the old and the new address and when it happened, so you can undo it from the old address; the old address and the old number stay as keyed hashes among the account’s keys, so “Hide from people you know” lists and abuse prevention keep working.
• From the waitlist: if you were on the waitlist, we link your account to that entry (including when we invited you and who invited you, for the free openings from invitations) and pre-fill your gender, languages, district and the language of your e-mails from it — you can change them any time. While we open in waves, only people with an invitation can create an account; the invitation e-mail has a sign-in link that is valid for 7 days.
• Sessions and security: the device or browser name and approximate times you were signed in; our server’s standard logs (IP address, browser, page); anti-abuse counters with scrambled IP addresses.
• Look-up by the operator: so that we can find a profile quickly when we look into a report or a message, we also keep a cryptographic fingerprint (keyed hash) of your first name; it is erased together with the account.
• Reports, blocks and support messages you send or that concern you, and our decisions about them, and your “Write to us” messages (the text encrypted, which screen it came from, and your e-mail if you were not signed in); these messages also go to the service operator’s mailbox so they can reply.
• Test accounts: an account the operator opens in his own preview, or one made by an automated test, is marked as a test and does not count in statistics, invitations or introductions. Members’ accounts never get this mark.

For areas and driving times we use only public data, computed once from the centres of the areas, without any member data. Area locations: © OpenStreetMap contributors (ODbL). Populations: Statistical Service of Cyprus, Census 2021. Driving times: computed with OSRM on OpenStreetMap data.

3. What we will add when the service opens

• Weekly introductions: who was introduced to whom, the reasons shown on the card, your yes/no answers and optional reason chips, and who has seen your full card (“Who has seen me”).
• Payments: what you bought, when and the result. Stripe processes your card; we never see your full card number.
• 7-day conversations: the messages you exchange, the date you propose or accept, and the automatic checks on them (see section 10).
• Private feedback after a date: whether you met, whether you would see the person again and whether you felt safe. It is never shown to the other person.

We tell you about these now so that nothing comes as a surprise; we will remind you in the app before each one starts.

4. Why we use your data, and on what legal basis

• To provide the account and the introductions you asked for (sign-in, profile, ID check result, introductions, conversations, “Who has seen me”, support): to perform our contract with you (GDPR Art. 6(1)(b)).
• “Who I want to meet”, faith, smoking and drinking: only with your explicit consent (Art. 9(2)(a)), and only to choose your introductions.
• The selfie and face match in the ID check: only with your explicit consent (Art. 9(2)(a)). You can choose the ID-only check instead.
• Safety, fraud and abuse prevention (one account per person, risk signals, moderation, reports, the “Hide from people you know” list, the operator looking up a member, security logs): our legitimate interest, and yours, in a safe and honest service (Art. 6(1)(f)).
• Accounting, tax and answering lawful requests (for example under the EU Digital Services Act): legal obligation (Art. 6(1)(c)).
• News about Cyproom by e-mail: only if you opt in (Art. 6(1)(a)). Service e-mails (codes, the result of your ID check, your new introductions, safety notices) are part of the contract.
• Reminders to finish your account: if you stop halfway, we send at most 3 e-mails (24 hours, 4 and 10 days after you signed up) with a link straight to the next step, and one e-mail when you are ready for introductions. Basis: our legitimate interest in helping you finish what you started (Art. 6(1)(f)). You stop them with the “Stop sending me reminders” link in any of these e-mails (it opens a page with one button), or in My account. The subject lines never say what kind of service Cyproom is.

We never use your data for advertising, never build an advertising profile, never sell or rent it, and never try to guess your orientation, ethnicity or religion from your photos or behaviour.

5. Your separate consents

• (a) Member terms — needed to have an account. You accept them with the “Create account” button, below the links to the terms and to this notice. Accepting them is our contract with you, not a consent; we record the terms and this notice separately, with the exact text you saw, and e-mail you a copy.
• (b) Sensitive answers — four separate consents, each with its own box right under the question it covers: (1) “who I want to meet” — needed for introductions; (2) smoking, (3) drinking and (4) faith — each optional: choose “I’d rather not say” and we keep nothing. The box is asked for only when you give an answer, with one short sentence and, under “What does this mean?”, exactly what we do with the answer. It is never ticked in advance and we do not keep the answer without it. None of these answers is ever shown on your card or to another member. The people we introduce you to can, however, tell from the introduction itself that you want to meet someone like them. If you untick the box, choose “I’d rather not say” or tap “Withdraw” in My account, we delete the answer at once; without “who I want to meet” we cannot introduce you to anyone until you give it again.
• (c) The selfie part of the ID check (biometric) — optional; you give it with one tick inside the “ID + selfie” option, next to the equal “ID only” option. If you withdraw it, we delete the result of the selfie comparison (and which photos were held back because of it) and your card says “ID checked”. If the comparison had clearly shown someone else, the risk signal created then stays, for the safety of members, for as long as section 11 says; the similarity scores in our log are deleted automatically after 90 days.
• (d) News e-mails — optional: an unticked box on the “Create your account” screen, separate from the terms. You can change it any time in My account.

Each consent has its own box, next to what it covers, is never ticked in advance and is never bundled with another or with accepting the terms. We keep when you gave it and the exact text you saw. You can withdraw each one separately at any time in My account (the sensitive answers also right at the question). Withdrawing does not affect what we did before.

6. The ID check and Stripe

• The ID check is run on Stripe’s secure pages by Stripe Identity (Stripe Payments Europe Ltd, Ireland). You show an identity document and, if you agree, take a selfie that Stripe compares with the document. If you took a selfie, we then compare it once with your profile photos. For this comparison Stripe gives us the selfie through a link that expires after 30 seconds; it stays only in our own server’s memory, is compared by open-source software (OpenCV) with no outside AI company, and is never stored. We keep no face “fingerprint”.
• Only the main photo decides the result: if it matches, your card says “ID and selfie checked”. If it does not (or the comparison cannot be done in time), the check still passes as “ID checked”, without a new check, and we tell you what to change if you also want the selfie label. Another photo where it was not clear that it is you is not shown in introductions until a person has looked at it; if it clearly did not seem to be you, nobody sees it, we tell you, and you can put up another one or tap “It’s me — request a manual review”. The check never fails because of such a photo. If the main photo clearly shows someone else, or if, in an ID-only check, the document’s date of birth is five or more years away from the one you gave, that is a risk signal: the account is paused, we send you a statement of reasons and you can appeal, and a person reviews the appeal; if no second signal arrives, the pause lifts by itself after 7 days (member terms, sections 8–9).
• To improve the comparison, our server log keeps, for 90 days, one line per comparison: the check number and, for each photo position (1st, 2nd…), numbers only — the similarity score and the size of the face —, without images, without a face “fingerprint” and without names. If you later change your main photo, your card says “ID checked” again until you take a new selfie.
• Right after the result and this comparison — whatever the result, and also when a check fails or is left unfinished — we ask Stripe to delete (redact) the check’s images and details on our side; Stripe completes this within up to 4 days. If the date of birth cannot be read from your document, we ask you to use another one (for example a passport); we do not rely only on the date you typed. The date on the document replaces the one you typed; if it shows — or Stripe tells us — that you are under 18, we delete your account at once. If the same document is already on another Cyproom account, the check does not complete; we note it for a person to look at and send, at most once a day, an e-mail with a one-time sign-in link, valid for 3 days, to that account’s address (without showing it yours). We keep only: verified yes/no, the date of birth from the document, the document’s country and a keyed hash of the document number (so the same document cannot open a second account) and, if you took a selfie, the comparison results described in section 2.
• For this check Stripe acts as our processor, but Stripe is also an independent controller of some of the data for its own purposes, such as preventing fraud across the businesses it serves and meeting its legal duties. Stripe says it may keep some data — for example biometric identifiers for up to one year — even after we ask for deletion.
• Stripe’s own privacy policy explains this: stripe.com/privacy. You can contact Stripe about the data it keeps at privacy@stripe.com.

7. Who sees your data, and who processes it for us

• Other members see only what the service needs: on an introduction card, your first name, age, your area (for a village of fewer than 1,000 people only “A village in … district”) and roughly how long the drive between you is, up to 3 things in common taken only from those you switched on in “How others will see you” (languages, what you are looking for, plans for children, weekends, values, work, education) — never from the sensitive answers (who you want to meet, smoking, drinking, faith) —, your answers in “In your own words”, whether you did the ID check (and with a selfie) and one reduced-size watermarked photo; after a mutual yes, all your photos. They never see your surname, e-mail, phone, exact location, relationship status, private answers, dealbreakers or your “no”.
• OVH (France, EU) — the server where the site and the database run.
• Cloudflare — network security and delivery of the site.
• Brevo (Sendinblue SAS, France, EU) — sends our e-mails. Brevo records delivery and counts opens and clicks anonymously (not linked to you); the links in our e-mails first pass through Brevo’s servers.
• sms.to (Intergo Telecom Ltd, Cyprus) — sends your phone code by SMS; your number also passes through the mobile networks that deliver the message.
• No outside AI companies: the automatic checks in section 10 run on our own server. We do not send your photos, texts or messages to AI providers.
• Stripe (Stripe Payments Europe Ltd, Ireland) — the ID check (section 6) and, later, payments.
• Authorities, only when the law requires it or to protect someone’s life or safety (for example the police in a case of threats).

We have data processing agreements with our processors. If we add a new processor, we update this notice before it receives any of your data.

8. Transfers outside the EU

Our server and database are in the EU (OVH, France). Some of our providers, mainly Cloudflare and Stripe, may process data in the United States or other countries; they do so under the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses. If your phone number is from a country outside the EU, the code necessarily travels through that country’s mobile network. You can ask us for a copy of the safeguards.

9. Cookies

When you are signed in, we use one strictly necessary cookie (cy_s) that keeps you signed in; it does not need consent and is not used for anything else. Two more strictly necessary cookies exist only in the member area: cy_lang remembers the language you chose before signing in (1 year), and cy_restore keeps the “Would you like to keep it?” question for 30 minutes when you sign in during the deletion period. The public pages of the site set no cookies; they only read cy_s to show you “My account”. We use no advertising, analytics or social-media cookies or pixels. If you allow browser notifications, that permission is given in your browser and you can withdraw it there.

10. Automated processing — and where a person decides

• Introductions are recommendations. The system picks them with both people’s dealbreakers, your answers, fairness rules and a score that learns from members’ answers and feedback. They have no legal effect and do not decide anything about you; you are always free to say no.
• Automatic checks run on photos: whether the main photo shows one clear face, whether there is nudity, whether a photo is blank or too dark, and whether the same photo is already in your account or in another account (we compare a small numeric fingerprint of the image; the same photo in another account is a risk signal). If your main photo cannot be used and another photo clearly shows only you, we make that one your main photo and tell you; you can change it at any time. For every automatic rejection you can ask a person to check it.
• In your profile texts we check automatically only for contact details (a phone number, e-mail, link or social-media account) and tell you what we found. In chat messages (when they start) contact details are hidden until a date is agreed, and we check automatically for threats, sexual content and scam patterns. Nobody reads your chats unless a conversation is reported.
• The ID check is automatic (Stripe and our own comparison with your photos) and without it you are not included in introductions. If it does not pass, we tell you why and what to do; you can try again, choose the ID-only check, or write to us so that a person looks at it. For a photo that was held back there is the button “It’s me — request a manual review”. A pause from the ID check (section 6), like every pause, comes with a statement of reasons and an appeal that a person reviews.
• Automatic pause: a risk signal (for example independent reports, a “did not feel safe” answer, or the two ID-check signals in section 6) pauses an account; the pause lifts by itself after 7 days if nothing else happens.
• Reports and blocks: to know whether reports come from different people, we compare keyed hashes (scrambled, not reversible) of the reporters’ phone numbers, browsers and networks — never the plain values. Nobody is ever told who reported or blocked them. A report keeps an encrypted copy of what it points at (the text or the photo), so that a person can review it.
• Suspension is always decided by a person, comes with a statement of reasons and can be appealed. Special-category data and chat content are never used in the risk score.

So we do not take decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR Art. 22). You can always ask for a person to look at anything that happened automatically, give your point of view and contest it.

11. How long we keep your data

• Account deleted by you, or after a withdrawal: hidden at once and erased for good 30 days later, together with your sign-in records and your waitlist entry, if you had one. Copies in our encrypted backups disappear as the backups are replaced. If you sign in again within those 30 days, we first ask whether you want to keep it; the deletion is cancelled only if you press “Yes, keep it” (we then e-mail you). After a withdrawal you have to accept the terms again.
• Inactive accounts: paused after 60 days without signing in and erased after 12 months, after two warning e-mails.
• Unfinished sign-ups (terms never accepted): erased after 30 days without signing in. If the date of birth you choose shows that you are under 18, we first show it back to you so you can fix a mistake; we do not store it. If you confirm it is right, the account is erased at once.
• Profile and the other data in section 2 (answers, relationship status, drive time and area, availability, reminders, the fingerprint of your first name, the link to the waitlist): as long as the account exists. An answer you change or remove is gone at once; a sensitive answer is gone as soon as you withdraw its consent.
• Photos: as long as the account exists, or until you delete them. If an upload fails halfway, whatever was already written is deleted automatically within about two hours.
• ID check: images and details redacted at Stripe right after the result; we keep the results listed in section 6 and the reference numbers of the checks while your account exists. When the account is erased, only the reference number remains, with nothing else, until Stripe confirms the deletion (usually a few days). Stripe may keep some data as an independent controller (section 6). The similarity scores of the comparison (numbers only) stay in the server log for 90 days.
• E-mail changes: the old and the new address of a change are erased 30 days after the 7-day undo link has run out (the hashes stay while the account exists). “Write to us” messages: 12 months after they were answered, or 24 months after they were sent if they were never answered; if the account is erased, they stay without the member number until then.
• Conversations (when they start): deleted 30 days after they close, or 90 days if one was reported.
• Payments (when they start): kept as long as accounting and tax law requires.
• Reports, blocks and moderation decisions: blocks as long as both accounts exist; reports, statements of reasons, appeals and notices of illegal content 12 months after the case is closed; risk signals (and the note “the same document on another account”) 12 months. When an account is erased, the reports about it, its decisions, its risk signals and its blocks go with it; reports it sent stay, without the sender’s name, until their case is closed.
• Operator’s action log (what the operator looked at or changed in your account and why, with your member number and nothing else): 12 months, also after the account is erased.
• Server logs: about 90 days. Our mail server’s delivery logs: about 5 weeks.
• Sign-in codes and links expire within minutes, except the link in the invitation e-mail (7 days) and in reminder e-mails and the same-document e-mail (3 days), which work once; sessions end when you sign out or they expire.

If an account was suspended for a serious breach, we keep a minimal record (the reason and keyed hashes of the phone and document number) for 12 months after the suspension, or after the account is erased if that is later — longer only while a legal case about it is still open — so that the same person cannot simply open a new account.

12. Your rights

• Access — see what we hold about you.
• Rectification — correct your data; most of it you can change yourself in your profile.
• Erasure — the Delete my account button in My account.
• Restriction — ask us to limit how we use your data while something is checked.
• Portability — the Download my data button in My account gives you a file with your data.
• Objection — object to uses based on our legitimate interest (reminders you can stop yourself, from the e-mail or in My account).
• Withdraw consent — each consent separately in My account or, for the sensitive answers, right at the question.

For anything you cannot do yourself in My account, write to info@cyproom.com. We answer within one month and may ask you to confirm it is really you. You can also complain to the Commissioner for Personal Data Protection in Cyprus: www.dataprotection.gov.cy.

13. Security

The site works only over HTTPS. Your e-mail, phone number, date of birth and other personal details are encrypted in the database, and look-ups use keyed hashes. Photos are delivered only through short-lived private links to the person allowed to see them, with a watermark, and every full view is logged. Links to your own photos are valid for one hour and only inside your account; links to other people’s photos for a few minutes. Only the operator can access member data, and only when needed. If a data breach ever puts you at risk, we tell you and the Commissioner without undue delay. No system is perfectly secure, and screenshots on a website cannot be blocked — which is why sharing other members’ photos or messages is forbidden.

14. Age

Cyproom is only for adults (18+), and everyone in the pool has passed an ID check. If we learn that someone under 18 has an account, we close it and delete the data.

15. Changes to this notice

If this notice changes, we update the date above. We tell you about important changes by e-mail before they apply, and we ask again for your consent where the law requires it.