Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME] ("Lorelai", "we", "us") handles personal data when you use the Lorelai apps, website, live sessions, games and wallet (the "Service"). We are the controller of your personal data. It applies together with our Terms of Service.

Information you give us

• Account details: name, email, phone number, date of birth, gender, password.
• Profile content: photos, videos, bio, interests, answers to profile questionnaires and dating preferences. Some of this, such as sexual orientation or religion, may be sensitive; you choose whether to share it.
• Content you create: messages, voice notes, stories and story drafts, comments, reactions, event details, and what you say and show in live sessions.
• Verification selfies, if you choose to verify (see Biometric data).
• Reports you submit and messages you send to support.

Payments and wallet

• Wallet balance and transaction history: deposits, entry fees, prizes, bets, subscriptions, payouts.
• Payment and payout details are collected and held by our payment provider, Stripe. We receive limited information such as card type, last four digits, and the result of identity checks needed for payouts.

Information collected automatically

• Device and log data: device model, operating system, app version, IP address, language, crash reports.
• Approximate location from your IP address or, if you allow it, your device, used for matching and to check where features like wagered games are allowed.
• Usage data: features you use, sessions you join or watch, and interactions such as likes and matches.
• Live audio and video while you take part in a session or call, transmitted through our streaming provider.

From others

• Information other members provide about you, such as reports or messages.
• Information from app stores and payment providers about your purchases.

We use personal data to:

• create and run your account and show your profile to other members;
• suggest matches and personalise Discover, search and events;
• deliver messages, calls, stories and live sessions, and make replays available;
• run games, calculate results and prizes, and keep games fair;
• process payments, wallet transactions, subscriptions and payouts;
• verify profiles when you ask us to;
• moderate content, handle reports, and detect and prevent fraud, cheating, abuse and security incidents;
• generate game questions and other AI-assisted features;
• send service messages, such as event reminders, security alerts and changes to our terms, and, where allowed, marketing you can opt out of;
• analyse and improve the Service;
• meet legal obligations, enforce our Terms, and respond to lawful requests.

• Media moderation. Photos, videos and commercials you upload are screened by automated tools on our own servers. When those tools are unsure, the image may be sent to Amazon Web Services' image analysis service (Amazon Rekognition) for a second check. Items that may break our rules are held for a human reviewer, and nothing is removed from your account permanently based on an automated check alone without a way to ask for review.
• Profile verification. Compares your live selfie with your profile photo. See Biometric data.
• AI-generated questions. To create game questions we send prompts to AI providers (Anthropic and OpenAI). We design those prompts to contain as little personal data as possible, such as broad interests, and our agreements do not allow these providers to use the data to train their models.
• Matching and recommendations. We use your preferences, activity and approximate location to rank profiles, sessions and events. This does not produce legal or similarly significant effects on you.

You can contact us to ask about, or ask for human review of, any decision made with automated tools.

Where data protection laws such as the GDPR apply, we rely on:

• Contract: to provide the Service you signed up for, including matching, messaging, sessions, games and your wallet.
• Consent: for sensitive profile information you choose to share, biometric verification, precise location, and certain marketing. You can withdraw consent at any time.
• Legitimate interests: to keep the Service safe, moderate content, prevent fraud and cheating, and improve the product, balanced against your rights.
• Legal obligation: for tax, accounting, anti-money-laundering and law-enforcement requirements.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

We share information:

• With other members, as the Service is designed: your profile with people who see you in Discover; your messages with the people you message; and your live session audio, video and chat with its audience, including replay viewers and, when a host turns on simulcast, viewers on other platforms.
• With service providers who process data for us under contract: hosting and databases (Supabase, Amazon Web Services), live video (LiveKit), payments and identity checks (Stripe), email (Resend), AI providers (Anthropic, OpenAI), and app stores.
• For safety and legal reasons: to comply with law, respond to valid legal requests, protect the rights and safety of members and the public, and prevent fraud.
• In a business transfer, such as a merger or sale, where the new owner must protect your data as this policy describes.
• With your consent or at your direction.

When you use the wallet, wagered games or spectator betting, we process transaction records, game results and the information needed to confirm your age and location and to meet financial regulations. Identity checks for payouts are carried out by Stripe, which acts as an independent controller for some of this data under its own privacy policy.

We keep financial records for as long as tax, accounting and anti-money-laundering laws require, even after you delete your account.

We keep personal data while your account is active and for as long as needed for the purposes above. Specifically:

• Stories disappear from view after 24 hours. Story drafts stay until you delete them.
• Live session recordings and replays are kept while they are available in the Service and are deleted when removed by the host, by us, or with your account.
• Reports and moderation records are kept as long as needed to keep the Service safe and handle appeals.
• Wallet and payment records are generally kept for 7 years, or longer if the law requires.

When you delete your account, we delete or anonymise your data within a reasonable period, except where we must keep it to meet legal obligations, resolve disputes, prevent fraud or enforce our Terms. Backups are overwritten in the normal course.

If you choose to verify your profile, we process images of your face to check that you are a live person and that you match your current profile photo. This is optional and only happens with your explicit consent, which you give each time you start a check.

The selfie photos taken during a check are analysed by our own servers and are never stored. If the check succeeds, we keep one encrypted numerical face template (not an image) so we can confirm that a new profile photo is still you. We do not use it for anything else, share it, or sell it.

You can remove your verification at any time in Settings, which deletes the template immediately. It is also deleted when your account is deleted. The Verified badge confirms a photo match only; it is not an identity or age check.

We protect your data with measures such as encryption in transit, access controls, and monitoring. Direct messages can be end-to-end encrypted, which means only you and the people you message hold the keys and we cannot read their content. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect unauthorised access to your account.

Depending on where you live, you may have the right to:

• access your personal data and get a copy of it in a portable format;
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent at any time, without affecting processing that already happened;
• opt out of marketing;
• not be discriminated against for exercising your rights.

You can do much of this yourself in Settings, including editing your profile, managing privacy and notification settings, removing verification, and deleting your account. For anything else, email support@lorelai.app. We may need to confirm your identity first, and we will respond within the time the law requires. You can also complain to your local data protection authority.

We and our service providers may process your data in countries other than yours, including the United States, which may have different data protection laws. When we transfer data from the EEA, UK or Switzerland, we use safeguards such as the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms.

Lorelai is only for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn that a minor is using the Service, we will close the account and delete their data. If you believe a minor is using Lorelai, please report them in the app or email support@lorelai.app.

We use cookies, local storage and similar technologies to keep you signed in, remember your settings such as language and theme, keep the Service secure, and understand how it is used. You can control cookies in your browser settings, but blocking essential cookies may stop parts of the Service from working. We do not use third-party advertising cookies.

We may update this Privacy Policy from time to time. We will post the new version in the Service and update the date at the top. If a change is significant, we will tell you in advance, for example by email or an in-app notice.

For privacy questions or to exercise your rights, email support@lorelai.app or write to:

[COMPANY LEGAL NAME], [ADDRESS]

EEA/UK representative or Data Protection Officer, where required: [DPO / EU-UK REPRESENTATIVE CONTACT]