Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

[LEGAL OPERATOR NAME]
[REGISTERED ADDRESS LINE 1]
[REGISTERED ADDRESS LINE 2]
[COUNTRY]
Email: [LEGAL CONTACT EMAIL]

Data Protection Officer (if applicable): [DATA PROTECTION OFFICER EMAIL if applicable]

2. Data We Collect

Account & Registration Data

• Username (public-facing display name)
• Email address (used for account communication; not publicly displayed)
• Password (stored as a bcrypt hash — we never store plaintext passwords)
• Age (you must confirm you are 18 or older)
• Country
• BDSM role (e.g. Dominant, Submissive, Switch, Curious) — special category data
• Comfort level (Exploring / Curious / Open / Experienced / Devoted)

Profile Data (optional, provided by you)

• Bio / personal description
• City / location
• Gender, relationship status, star sign
• Physical attributes: height, weight, hair colour, eye colour, hair length, figure
• Kink interests and tags — special category data
• Looking-for preferences
• Profile photos (uploaded by you)

Activity & Usage Data

• Chat messages sent in public channels and direct messages (including image attachments)
• Profile visits you make to other users (and visits others make to your profile)
• Login streak data (consecutive daily logins)
• Credit transaction records (purchases and usage history)
• IP address (collected implicitly by our web server and proxy)

Payment Data

Credit purchases are processed by PayPal. We store the PayPal order ID, amount, credit pack purchased, and transaction status. We do not receive or store your full payment card details — these are handled exclusively by PayPal. Please review PayPal’s Privacy Policy.

3. How We Store Your Data

Your data is stored in a SQLite database on a VPS hosted within the European Union. Data is not transferred to third countries outside the EEA except where necessary for payment processing via PayPal (US-based company operating under SCCs).

Browser Storage (localStorage)

We store the following items in your browser’s localStorage (not HTTP cookies):

• cs_token — your JSON Web Token (JWT) for authentication. Valid for 30 days.
• cs_user — a cached copy of your public profile object (username, role, credits, etc.)
• cs_age — a flag confirming you have passed the age gate (value: “1”)

These items exist entirely within your browser and are not transmitted to third parties. Clearing your browser storage or logging out removes them.

4. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6(1)(b)) — processing necessary to provide the service you registered for.
• Legitimate interests (Art. 6(1)(f)) — server security, abuse prevention, fraud detection.
• Consent (Art. 6(1)(a) and Art. 9(2)(a)) — for special category data (BDSM role, kink interests, comfort level), processing is based on your explicit consent given during registration. You may withdraw this consent at any time by deleting your account.
• Legal obligation (Art. 6(1)(c)) — where required by applicable law (e.g., tax records for payment transactions).

5. Special Category Data

Information relating to sexual orientation, BDSM preferences, kink interests, and comfort level constitutes special category data under GDPR Article 9. By registering and completing your profile, you explicitly consent to us processing this data for the purpose of operating the community platform and enabling member matching. This data is never sold, rented, or shared with advertisers.

6. Third-Party Services

• PayPal — payment processing. PayPal may set cookies during checkout on their own domain. See PayPal Privacy Policy.
• Socket.io — real-time communication library served directly from our own server; no third-party Socket.io servers are used.
• Groq AI — used exclusively by administrators to generate blog content. No user personal data is transmitted to Groq.

We do not use Google Analytics, Meta/Facebook Pixel, TikTok Pixel, or any other third-party tracking or advertising pixels.

7. Data Retention

• Account data is retained for as long as your account is active.
• Upon account deletion, personal profile data is removed within 30 days, except where retention is required by law (e.g., payment records may be retained for up to 7 years for tax purposes).
• Chat messages may persist after account deletion (displayed as “[deleted user]”). You may request deletion of your messages separately.

8. Your Rights (GDPR)

• Right of access (Art. 15) — request a copy of all data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — request deletion of your account and data.
• Right to restriction of processing (Art. 18) — limit how we use your data.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to withdraw consent — at any time, for consent-based processing (including special category data).

To exercise any of these rights, contact us at: [LEGAL CONTACT EMAIL]

You also have the right to lodge a complaint with your national data protection supervisory authority: [SUPERVISORY AUTHORITY NAME AND COUNTRY]

9. Security

We implement appropriate technical and organisational measures to protect your data, including password hashing (bcrypt), JWT-based authentication, HTTPS encryption in transit, and restricted server access.

10. Children

KinkDate.eu is strictly an 18+ platform. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has registered, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be announced via the platform. Continued use after notice constitutes acceptance of the updated policy.

12. Contact

For privacy-related enquiries: [LEGAL CONTACT EMAIL]