Privacy Policy for the ZoFound app

1. Controller and contact

The controller under the General Data Protection Regulation (GDPR) is:

LOVY (ZoFound is a brand owned and operated by LOVY) Sole proprietorship under Danish law (PMV), owner: Jan Lektonen Damsted 37, 6000 Kolding, Denmark · CVR no. 26132517

Privacy contact: privacy@zofound.com Support: support@zofound.com · General: hello@zofound.com

Data protection officer. We have not appointed a data protection officer.

to follow

2. At a glance

ZoFound is an adults-only service that brings people together — romantically (the “Romance” area) or platonically (the “Friendship” area). To make that work, we process:

• what you give us — profile, photos, interests, your intentions, your messages;
• what arises along the way — who you meet, when you are active, what you have bought;
• what we derive from it — suggestions, the summary of your profile, the outcome of verification and of moderation.

Our database, our server functions and the text conversations with the coaches run in the EU. Two processing operations take place outside the EU: the video conversation with the coach (Tavus, USA) and the sending of push notifications and email (OneSignal, USA). Both are described in clauses 9 and 10.

3. What data we process

Category	Examples	Source
Account and identity	first name, display name, email address or phone number, sign-in method (Apple, Google, phone), date of birth, gender, pronoun, language	you
Profile	photos, 3D avatar, descriptive text, interests, spoken languages, home city and country, intention (Romance and/or Friendship)	you
Search preferences (special category)	who you would like to meet — in particular the gender you are looking for	you
Location	the city you enter at sign-up; if you choose, an approximate device location (city-level) for “near you” suggestions; for events at a physical location, that location	you / your device
Connections and activity	suggestions, introductions, matches, who you message, read states, activity times, visibility and block lists, verification status	generated by use
Messages and calls	the content of your chat messages (stored with our provider Agora), call metadata (who, when, how long, accepted/declined), date arrangements	you
Conversations with the coaches	what you write and say to Zoe, Felix and Sara, the transcript of the video conversation, and the summary of your profile derived from it	you
Verification (special category)	the verification selfie, the result, the number of attempts, any lock-out	you / derived
Moderation and safety	reports you make or that concern you, assessments of text and media, warnings and measures	generated by use
Purchases	plan, unlocked features, quotas, transaction identifiers, purchase times — no payment details	Apple/Google via Adapty
Device and technical	push token, an app-generated installation identifier, device and app details, OS version, IP address on server calls, crash and diagnostic data, App Check signals	your device
Consents	which version of which notice you accepted or withdrew, when and in which language	you
Metrics	pseudonymised or aggregated usage figures used to run the service	derived

Please do not put health data, payment details, identity numbers or your exact home address into your profile or messages.

4. Purposes and legal bases

Purpose	Legal basis
Creating and running your account; providing your profile; suggestions, introductions and matches; messages, calls, communities, events and Speed Dating; date arrangements	Contract, Article 6(1)(b)
The gender you are looking for, and romantic intention (clause 5)	Explicit consent, Article 9(2)(a) together with Article 6(1)(a)
Verification of your profile (clause 7)	Explicit consent, Article 9(2)(a) together with Article 6(1)(a)
Approximate device location	Consent, Article 6(1)(a) (given in your device settings and withdrawable there)
Conversations with the coaches and the creation of your profile text	Contract, Article 6(1)(b); a coach reading a chat with another person additionally requires the consent of both participants, Article 6(1)(a)
Safety, moderation, abuse and fraud prevention, enforcement of our rules, block lists	Legitimate interests, Article 6(1)(f) (clause 8); for special-category content also Article 9(2)(g) and (f)
Purchase, unlocking and billing support	Contract, Article 6(1)(b); tax and accounting retention legal obligation, Article 6(1)(c)
Notifications about your own activity (message received, call, date, event)	Contract, Article 6(1)(b)
Marketing messages and newsletters	Consent, Article 6(1)(a)
Anonymous in-app usage statistics (Firebase Analytics, clause 15.3)	Consent, § 25(1) TDDDG and Article 6(1)(a) — off until you say yes
The coach’s reading of facial expression and mood in the video conversation (clause 6.3a)	Explicit consent, Article 9(2)(a) in conjunction with Article 6(1)(a)
Stability, debugging, capacity and cost control (pseudonymised metrics, crash reports)	Legitimate interests, Article 6(1)(f)
Answering enquiries you send us	Contract or legitimate interests, Article 6(1)(b) or (f)
Complying with legal obligations and establishing legal claims	Article 6(1)(c) and (f), Article 9(2)(f)

Withdrawal. You may withdraw a consent at any time with effect for the future (clause 12). The lawfulness of processing up to that point is unaffected.

5. Special categories of personal data

ZoFound processes two kinds of data that Article 9 protects specifically:

1. Data from which your sexual orientation may be inferred. The gender you wish to meet, and whether you pursue a romantic intention, allows conclusions about your sexual orientation. This is stored separately from your public profile; other users cannot read it.
2. The verification selfie — see clause 7.

For both we obtain your explicit consent. You may refuse or withdraw it; we then cannot offer the feature concerned.

How you give consent. After sign-up we show one step, “Your choices”, listing the optional consents — who you’re looking for, selfie verification and anonymous statistics — each with its benefit and purpose. We don’t ask about the coach’s reading in video here, but only where it is used: before your first video conversation (clause 6.3a). You can say “Yes to all”, choose individually under “Customize” (nothing is pre-ticked) or say “Not now”; a no is one tap, just like a yes. If you haven’t given a consent, we ask again exactly where the feature is used — never in ads or notifications. If you say no, we store nothing: you’ll see suggestions from everyone, and verification has a manual route (clause 7.5). We record which version of the text you agreed to, when, and in which language (Article 7(1)); you can see and change your choices under Settings → Privacy & legal. You withdraw one of the two special consents directly in the app under Trust & Privacy (“Withdraw”) — we will then delete the data concerned; you can also do so if you were verified before we recorded the consent. If you are verified without a valid consent to the selfie comparison (for example because you were verified before this text), we ask you for it again on the verification screen; until you have given it, we do not compare new profile photos with your selfie.

6. Artificial intelligence — the coaches and other AI features

6.1 You are talking to an AI. The coaches Zoe, Felix and Sara are AI systems. Their faces and voices are artificially generated and belong to no real person. We say so before you speak with a coach (Article 50(1) AI Act).

6.2 Text and voice are processed through Google Vertex AI (Gemini) in the EU region europe-west1. Google processes the content as our processor and does not use it to train its own models. What you write and say is not stored persistently there.

6.3 The video conversation with the coach is generated by Tavus, Inc. (USA). Your image, your voice and the transcript are transferred to the USA in real time (clause 10). We do not record the conversation. We store the transcript and an assessment of the session in our EU database in order to keep your profile up to date.

6.3a The coach’s reading during the video conversation. During the video conversation the coach reads your facial expression and mood to adapt the conversation (Article 50(3) AI Act). Because such a reading can be sensitive, we ask for your explicit consent in a separate window before your first video conversation (Article 9(2)(a)). The reading is used only in the conversation and its summary. If you say no, you can talk to the coach by text or voice instead; you can change your choice at any time — on the video coach’s start screen (“Turn on reading”) or under Settings → Privacy & legal.

6.4 Reading a chat only with both parties’ consent. So that a coach can help you write, it may read the most recent messages in a conversation — but only at the moment help is given, only if you have allowed it, and only if the other participant has given the same permission. Those messages are not stored in the process.

6.5 Suggestions. To show you relevant people, we map your profile to a numerical vector and search for similar profiles. The reason given for a suggestion is written by a language model. That is profiling within the meaning of Article 4(4); what it means is set out in clause 13.

6.6 AI-generated images in the service — such as event cover art — are labelled.

7. Verification

7.1 What happens. You take a selfie. We compare it automatically with the photos on your profile and compute a similarity score. If it exceeds a fixed threshold, you receive the “verified” mark. Several consecutive failed attempts lead to a time-limited lock-out of the verification attempt (currently 24 hours); your account remains usable.

7.2 How it works technically. We use no dedicated facial recognition system and no biometric database. We use a general multimodal embedding model at Google Vertex AI in the EU that compares image content as a whole. We store no biometric template and do not compare your image with other people’s: the comparison happens solely between your selfie and your own profile photos.

7.3 Legal classification. Because the purpose of this comparison is to confirm that both images show the same person, we treat the processing as biometric data for the purpose of uniquely identifying a natural person (Articles 4(14) and 9(1)) and base it on your explicit consent (Article 9(2)(a)).

7.4 Retention and purposes. The selfie is kept until you delete your account or withdraw your consent, and is deleted automatically in either case. We use it only for these purposes, which are shown word for word on the verification screen before you consent:

• re-verification if you change your profile photos;
• investigating abuse and fraud;
• future verification features — a new purpose requires a new consent.

Retention is covered by your explicit consent to verification (clause 5). New profile photos are compared with the selfie only while the consent is valid.

7.5 A route without the automatic comparison. If you don’t want to consent to the automatic image comparison, you can tap “Request a manual review” on the verification screen. We then open a case with our support, and the team agrees with you in the case how we confirm it’s you — without automatic face comparison.

8. Safety and moderation

8.1 What is checked. Messages in group and community chats are checked automatically in full. One-to-one chats are always checked against a fixed word list; further checking by a language model happens only for new accounts and after a report, and then only for a limited time. Images and videos are checked before publication.

8.2 What is stored. For a checked message we store not the text but only the outcome (category, time, measure). If you report a message, we store the reported text as a snapshot because a human must be able to assess the report.

8.3 Our balancing test (Article 6(1)(f)). Our interest is protecting people on a platform where strangers meet — against fraud, harassment and above all any form of risk to minors. We consider the interference proportionate because private one-to-one conversations between established accounts are not sent to a language model, because message text is not stored for checking, because metrics are pseudonymised, and because every measure affecting your account as a whole is taken by a human. You may object under Article 21; we will then assess in the individual case whether compelling legitimate grounds override — which will regularly be so where child protection and abuse prevention are concerned.

8.4 Blocking. When you block someone, we store that decision. So that a blocked person cannot defeat the block by deleting and recreating their account, we keep a pseudonymised identifier for the blocked person for 12 months. It contains no names and is used solely to restore an existing block.

8.5 App Check. Every call your app makes to our servers is checked for authenticity (Apple App Attest or Google Play Integrity), so nobody can address our interfaces from a tampered app.

9. Recipients and processors

We do not sell your data. We use the following providers as processors under Article 28:

Recipient	For what	Place of processing
Google Cloud / Firebase (Google Ireland Ltd. / Google LLC)	sign-in, database, file storage, server functions, App Check, crash reports	EU (europe-west1, eur3); individual services globally — see clause 10
Google Vertex AI (Gemini)	coach conversations in text and voice, verification comparison, moderation assessment	EU (europe-west1)
Agora (Agora Lab, Inc. / Agora Ltd.)	chat messages (storage), voice and video transport, signalling	to follow
Tavus, Inc.	video coach (image, sound, transcript)	USA
OneSignal, Inc.	push notifications, Live Activities, email	USA
Adapty	management of subscriptions and unlocked features	to follow
Apple (Apple Distribution International Ltd.)	app distribution, payment processing, Sign in with Apple	Apple’s own responsibility
Google (Google Commerce Ltd.)	app distribution, payment processing, Google sign-in	Google’s own responsibility

Apple and Google are independent controllers for payment processing; their own privacy notices apply.

We also disclose data where we are legally obliged to (for example to law enforcement) or where it is necessary to protect people — in particular where there is a suspicion of sexual abuse or sexual exploitation of minors (see our Child Safety Standards).

to follow

10. Transfers to third countries

Processing takes place in the EU as a rule. Two processing operations take place in the USA:

• Tavus — the video conversation with the coach (image, sound, transcript). You recognise the feature by a coach appearing on video. If you do not use it, no data is transferred to Tavus.
• OneSignal — sending push notifications and email (your push identifier, device type, language, country and the content of the notification).

For those transfers we rely on the European Commission’s standard contractual clauses (Article 46(2)(c)) and, where the provider is certified, on the adequacy decision for the EU-U.S. Data Privacy Framework (Article 45). You may request a copy of the safeguards at privacy@zofound.com.

Despite those safeguards, US authorities may under US law require access to data; a level of legal protection equivalent to the EU is not guaranteed in every case.

11. Retention periods

Data	Period
Account, profile, photos, messages, connections	until you delete your account
Deleted account	after the 14-day cooling-off period everything is deleted; individual posts in groups and events are kept anonymised (“Deleted user”) so the conversation remains readable for the other participants
Publicly displayed quotes	always removed on account deletion
Verification selfie	until you delete your account (purposes in clause 7.4)
Reports about content (including the reported text)	180 days
Moderation metrics	90 days
Pseudonymised summary of a sanction history after account deletion	12 months (longer where a case is open)
Pseudonymised identifier so a block survives	12 months
Push token and installation identifier	until account deletion, or until the token becomes invalid
Provided data copy (download)	8 days, then deleted automatically
Consent records	for as long as we may be asked to produce them, including after account deletion, in pseudonymised form
Purchase records and accounting documents	in line with statutory retention periods
Crash and diagnostic data	per the respective service’s periods, at most 12 months

12. Your rights

You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21), as well as the right to withdraw consent (Article 7(3)).

How to exercise them:

• Access and data copy: in the app under Profile → … → Account → Privacy → “Download my data”. You receive an archive with a readable overview, all data files in JSON and your media. The download is available for 8 days.
• Rectification: you can edit your profile yourself at any time.
• Erasure: in the app under Profile → … → Account → Delete account (clause 11).
• Restriction, objection, transfer to another provider and anything else: privacy@zofound.com.
• Withdrawing consents: location in your device settings; notifications in the app settings; a coach reading chat in the app’s privacy settings; everything else via privacy@zofound.com.

We reply within one month; for complex requests we may extend by two further months and will tell you. The first copy is free.

What a data copy does not contain. Under Article 15(4) the rights of others must not be adversely affected. Your data copy therefore does not contain: messages others have written to you (your own sent messages and the conversation’s basic details are included), the identity of people you have reported or blocked, the wording of reports about you, or internal model data such as the numerical vector of your profile. Every omission is named and explained in the archive.

Right to lodge a complaint (Article 77). You may complain to a supervisory authority — in Denmark to Datatilsynet (datatilsynet.dk) as the controller’s authority, or to the authority of your habitual residence, place of work or the place of the alleged infringement; in Germany therefore to the competent state data protection authority or the BfDI.

13. Automated decisions and profiling

13.1 Suggestions and introductions are profiling (Article 4(4)) but not an automated decision under Article 22: a recommendation has neither legal effect nor a similarly significant effect. You decide yourself whom to approach, can reject suggestions and can change your details at any time.

13.2 Moderation. Only content-level and participation-level measures are taken automatically (removing a post, a warning, a temporary mute, removal from an event). Every measure affecting your account as a whole is taken by a human. You receive a statement of reasons and may complain (Terms, clause 7.5).

13.3 Verification. The image comparison runs automatically and may result in a time-limited lock-out of the verification attempt. It does not remove your access to the app. You may request human review, express your point of view and contest the decision: support@zofound.com.

14. Notifications, email and marketing

14.1 Notifications about your own activity (new message, call, introduction, date, event) are part of the service. You control them in your device settings and in the app settings.

14.2 Marketing messages are sent only with your consent. Every such message contains an unsubscribe route, and you may withdraw consent at any time.

14.3 Security and legal notices (for example about a change to this policy, a measure against your account, or a data breach) are sent regardless of your marketing preferences.

15. Cookies, local storage and measurement in the app

15.1 The app uses no advertising or tracking technologies. There is no advertising in ZoFound, no ad network, and no disclosure of data for advertising purposes. On iOS we therefore do not ask for tracking permission (ATT) either.

15.2 On your device we store what is necessary to operate: your sign-in, your language choice, an app-generated installation identifier for delivering calls and notifications, and cached content.

15.3 Stability and usage measurement. We use Firebase Crashlytics (crash reports) to find faults and keep the app stable (legitimate interest, Article 6(1)(f)). Firebase Analytics (anonymous usage statistics) is off until you actively say yes — in the “Your choices” step after sign-up or under Settings → Privacy & legal (§ 25(1) TDDDG; Article 6(1)(a)). Consent is not a condition for using the app and can be withdrawn at any time with the same switch; measurement then stops and the data held on your device is reset. The statistics are not linked to your account (no user ID), and all advertising signals are always off.

15.4 A separate notice with a cookie overview applies to the websites zofound.com and zofound.de.

16. Children and young people

ZoFound is exclusively for people aged 18 and over. We do not knowingly process data about minors. If we learn that an account belongs to a minor, we suspend it immediately and delete the data. How we protect children from sexual abuse and exploitation, and how you can report such content, is set out at zofound.com/trust/child-safety.

17. Security of processing

We protect your data with encryption in transit, access restrictions at database level (rules that deny access by default), App Check, separate storage of particularly sensitive details, pseudonymisation in logs and metrics, and regular reviews. No system is perfectly secure; in the event of a personal data breach we notify the supervisory authority within 72 hours and, where there is a high risk to you, you as well (Articles 33 and 34).

18. Changes to this policy

We update this policy as the service changes. Each version carries a version number and an effective date at the top. For material changes we present the new version for your acceptance the next time you start the app; which version you accepted and when is stored in your account and forms part of your data copy.

19. Version and change log

Version	Effective from	Change
0.1.0	2026-06-25	Internal first draft (documents/privacy-policy.md).
1.0.0	2026-10-08	Complete rewrite under Article 13: controller named; data categories taken from the record of processing activities (113 rows); legal basis per purpose; special categories (search preferences, verification) addressed expressly; AI transparency under Article 50 AI Act; moderation with a balancing test; recipients, third-country transfers, retention periods, data subject rights with the concrete route in the app; Article 22; in-app measurement.

---

Related documents: Terms · Legal notice · Right of withdrawal · Community Guidelines.