ZoFound — Privacy Policy

This Privacy Policy explains how ZoFound processes your personal data and your rights under the EU General Data Protection Regulation (GDPR) and applicable national law.

1. Who is responsible (data controller)

The data controller is to follow. Contact: to follow · Data Protection Officer (if appointed): to follow. You can complain to your supervisory authority — in Denmark, Datatilsynet; in Germany, the competent state DPA / BfDI.

2. The data we process

We process the following categories, depending on how you use the Service:

Category	Examples	Source
Account & identity	name/first name, email, sign-in identifiers, age/birthday, gender, pronoun	you (onboarding)
Profile	photos, bio, interests, connection intent (romance/friendship), “what others should know”	you
Location	onboarding city, and — if you grant permission — GPS coordinates / nearby city, refreshed opportunistically	you / device
Connections & activity	matches, who you message, engagement counts, reveal/escalation state, verification status	generated by use
Messages & calls	1:1 chat content, voice/video call metadata; date-negotiation state	you (chat is delivered via Agora)
AI interactions	your messages to Zoe, date preferences, and — with your consent — recent chat messages read on-demand, not stored (see §4)	you
Purchases	subscription/entitlement status and history (no card numbers — handled by the app store)	app store
Device & technical	push tokens, device/app info, IP, diagnostics, crash logs, App Check signals	device

We do not seek special-category data; please don’t put sensitive data (health, religion, exact home address, finances) into your profile or chats.

3. Why we process it & the legal basis

Purpose	Legal basis (GDPR Art. 6)
Provide the Service (accounts, profiles, matching, messaging, calls, events)	Contract (Art. 6(1)(b))
Process nearby/location features	Consent for precise GPS (Art. 6(1)(a)); contract for the city you provided
Zoe reading recent chat to assist you	Consent (Art. 6(1)(a)) — see §4
Safety, moderation, fraud/abuse prevention, security	Legitimate interests (Art. 6(1)(f)) and legal obligation where applicable
Push notifications / Live Activities about your matches & dates	Consent/contract depending on type
Subscriptions & billing support	Contract + legal obligation (accounting)
Product analytics & improvement (aggregated/pseudonymised)	Legitimate interests

4. AI processing (“Zoe”) — on-demand, not stored

Zoe is an automated assistant built on third-party AI models (currently Google Vertex AI Gemini, and Tavus/Daily for the coach avatar). Two things to know:

• What’s stored: your own preferences and the agreed facts of a date negotiation are saved so Zoe can continue helping you. Your raw conversation with Zoe is held in app memory for the session and is not kept as a durable transcript by us.
• Chat-history reading is consent-based and on-demand. If you grant the “Zoe may read chat” permission, Zoe may read recent messages only at the moment she needs them — solely to choose how best to help (e.g. judge mutual willingness to talk, draft a message, suggest a venue). Those messages are processed in memory and are not stored, and we send them for processing only when you have consented. Because a conversation contains the other person’s messages too, this reading runs only when both participants have given the equivalent consent. AI providers process this content as our processor and do not use it to train their models. You can withdraw this consent at any time (see §8); withdrawal stops future reading.

5. Who we share data with (sub-processors)

We use trusted providers that process data on our behalf, under data-processing agreements:

Provider	Role
Google Firebase / Google Cloud	authentication, database (Firestore), cloud functions, hosting, App Check
Google Vertex AI (Gemini)	the Zoe AI assistant (text, voice, classification)
Tavus / Daily.co	AI-coach video avatar
Agora	real-time messaging (chat), voice, and video transport
Adapty	subscription/entitlement management (over the app stores)
OneSignal	push notifications & Live Activities
Apple App Store / Google Play	app distribution and payment processing

We also share data where legally required (e.g. lawful requests) and to protect users (safety/abuse). We do not sell your personal data. to follow

6. International transfers

Some providers may process data outside the EU/EEA. Where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and provider data-residency controls. We aim to keep core processing (database, AI) in the EU (e.g. europe-west1). to follow

7. How long we keep it (retention)

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Account data is kept while your account is active; on deletion we remove your personal data subject to backups and legal holds. Specific per-category retention periods are maintained in to follow. to follow

8. Your rights

Under GDPR you can: access your data, rectify it, erase it (“right to be forgotten”), restrict or object to processing, request portability, and withdraw consent (e.g. location, Zoe chat-reading, push) — without affecting prior lawful processing. To exercise these, use in-app controls (Settings → Privacy / Account) or contact to follow. You can also complain to your supervisory authority (§1).

9. Security

We use industry measures including encrypted transport, access controls, App Check, and pseudonymisation in logs. No system is perfectly secure; we work to protect your data and will notify you and the authorities of a qualifying breach as required by law.

10. Children

ZoFound is strictly for adults (18+). We do not knowingly process data of minors; if we learn an account belongs to a minor we will remove it.

11. Changes to this Policy

We may update this Policy as the Service evolves. For material changes we will notify you and, where required, ask you to re-accept. The version and effective_date are shown at the top. The version you accepted is recorded against your account.

12. Contact

to follow · Privacy: to follow · DPO (if any): to follow

---

Related: Terms of Use · Acceptable Use Policy.