PRIVACY POLICY

Welcome to the website (the “Site”) of ManuSoft Inc. (“Company,” “we,” “us,” or “our”), the maker of Pull. Through our mobile application (the “App”), we allow users to meet people to date or to train with, ranked by where and when they actually train (such services, including pull.dating (the “Site”) and the App, are referred to collectively in this Privacy Policy as the “Service”).

This Privacy Policy explains what Personal Data (defined below) we collect, how we use and share that data, and your choices concerning our data practices. This Privacy Policy is incorporated into and forms part of our Terms of Service.

If you live in Washington or Nevada, our Consumer Health Data Privacy Policy supplements this one and covers the one kind of consumer health data Pull collects.

Before using the Service or submitting any Personal Data to the Company, please review this Privacy Policy carefully and contact us if you have any questions. By using the Service, you agree to the practices described in this Privacy Policy and all provisions of this Privacy Policy. If you do not agree to this Privacy Policy, please do not access the Site or otherwise use the Service.

1. PERSONAL DATA WE COLLECT

We collect information that alone or in combination with other information in our possession could be used to identify you (“Personal Data”) as follows:

Personal Data You Provide: We collect the following categories of Personal Data from you when you use our Service, including when you sign up for an account, create or share content, and message or communicate with others:

• Your account: There are three ways in and they all end in the same place: your phone number, which we confirm with a four-digit code we text you; Sign in with Apple; or Sign in with Google. There is no password to set, so there is no password of yours anywhere in Pull, and there is no sign-in with Facebook. Your email address is what your account is identified by, and confirming it is not optional. If you came in by phone number we ask for the address and confirm it with a six-digit code we email you; if you came in through Apple or Google, they give us an address they have already confirmed, and we ask you for nothing further. Using one address for all three is also what lets you come back through a different door and find the same account, rather than a second empty one. An address nobody checked could be somebody else's, and an account keyed on somebody else's address is an account that person could later walk into, so we send a code and wait for it rather than taking the typing on trust. We do not use your address for marketing, we do not add you to a list, and there is nothing to unsubscribe from: it is how your account is found when you come back to it, and it is where receipts for anything you buy are sent. We also keep the codes we have issued while they are still valid, and a count of how often a number has asked for one, so that the App cannot be used to text somebody repeatedly.
• Your age: Onboarding asks for your date of birth and the check that you are 18 runs on our server. The date itself is stored, because an age has to be recomputed as you get older. It is never shown to anybody: what another person sees on your profile is a whole number of years. If the date you give is under 18 the account is refused, and we keep a record of that refusal so the same account cannot simply try again with a different date.
• Your profile: Your first and last name, your date of birth, and at least one photograph are required. Your gender and the genders you ask to be shown are required too, and read together they can reveal your sexual orientation - the agreement you give when you join covers storing them, and section 6 says on what basis. Everything else is optional: a short biography, answers to questions you pick from a list, who you are looking for, your home gym, the sports you train, which days of the week you train, whether you are here to date, to train or both, what kind of relationship you are looking for, how experienced you are, your interests, and ten details other apps would call vitals - height, weight, job, education, religion, sexuality, children, smoking, drinking and drugs. Two of those, your religion and your sexuality, are special category data, and section 6 says on what basis we hold them. We keep your search settings too: the distance and the age range you filter to, and the rest of the filter panel - sports, what you are looking for, children, smoking, drinking, education, a minimum number of training days, a height range, whether you are filtering to your own gym, and whether you are filtering to verified members.
• Your photographs, video and voice notes: Photographs you add are stored in a private bucket, not a public one, and the App is handed a short-lived link each time it draws one. Removing a photograph deletes the stored file itself, not just the row that points at it, and a job running continuously removes anything left behind. A voice note is stored with its length so the App can draw the bar.
• Your verification selfie, which is a biometric identifier: Verifying your photo is optional and nothing in Pull requires it. If you start it, the App runs a short randomised challenge - blink, smile, turn, nod - and sends one frame to our server, where three open-source models run on our own machine: a check that the frame is a live person rather than a photograph of one; a face-recognition model that turns the frame and your profile photograph into numerical face templates and measures the distance between them; and, on a frame that passes, a model that estimates an age from the face. That template is a biometric identifier under the Illinois Biometric Information Privacy Act, and comparable Texas and Washington laws. We collect it for two purposes and no others: to confirm the person in your photographs is you, and to estimate your age, which is how we keep under-18s off a service they are not allowed on. The release you sign in the App before the camera opens states both. It is never sold, leased, traded or otherwise profited from, and it is disclosed to nobody: the models run on our own server in Germany, no verification vendor is called and no template is sent anywhere. Our retention and destruction schedule for it: the face template exists only in memory for the seconds the comparison takes and is never written to a database or a file; the challenge frame is written to a private bucket you cannot read back, and is deleted by the same write that records the verdict. There is one exception and it is the reason the schedule is written down: if the age model reads under 18, the frames are kept for the person who reviews that decision, and your account waits until they have. Withdrawing your consent in the App deletes them even then. In every case a frame and the distances measured from it are destroyed within three years of your last use of Pull, whichever comes first. What survives a check after that is the verdict - verified or rejected, when, and the age that was read.
• Where you are: Pull asks your phone for your location during onboarding, and stores it as a single coordinate on the server. It is recorded again when you refresh it. We also store whether you granted or denied the permission, so the App knows whether to ask again. That coordinate is never sent to another person's phone. It reaches yours only in the copy of your own data you ask us for, because a portability copy that withheld your own position would not be one. Distance is computed on our server and returned as a whole number of kilometres, because an exact position is how somebody is followed home. You can decline the location permission; the App works without it, and you can set your area by hand instead.
• What you do with other people: Every like and every pass is recorded, both so that the same person is not dealt to you twice and so that a match can be created when two likes point at each other. Messages you send are stored, and so are their attachments: pictures, video and voice notes, and so is any emoji you react to a message with. Unmatching is recorded too, as is undoing a swipe - both are rationed on a free account, and a ration has to be counted against something. Blocks are stored, and so are reports: who you reported, why, anything you wrote, and how it was resolved.
• Communication Data: We collect information when you contact us with questions or concerns and when you voluntarily respond to requests for your opinion and feedback.
• Payment Information: We offer certain portions of the Service for a fee. Payment is taken on the hosted checkout page of our payment processor, Stripe, Inc. (“Stripe”), opened in your browser, so no card number, expiry date or security code ever reaches us. Accordingly, in addition to this Privacy Policy and our Terms of Service, information related to your payments or purchases is also processed according to Stripe's services agreement and privacy policy. What we keep is the record of the charge: what it was for, the amount, the currency, Stripe's identifier for the payment, whether it succeeded, and when it settled, was refunded or was disputed, together with the customer identifier Stripe issues you. Stripe itself holds a customer record for you, carrying your email address and a reference back to your account, and issues an invoice for each payment which carries the same address. Section 4 says what happens to those when you delete your account: the customer record is deleted, and the invoices stay.
• Device Data: If you turn on push notifications, Pull stores a push token and your platform, iOS or Android, so a notification can reach the right device. Turning notifications off removes it.

Internet Activity Data: Our servers keep ordinary request logs, which include an Internet Protocol address, the time of the request and which endpoint was called, for security and abuse prevention. We do not build browsing profiles from them.

Personal Data Collected from Third Parties/Publicly Available Sources: If you sign in with Apple or with Google we receive, from them, what the sheet they show you says you are sharing: an email address, and your name. Apple sends the name only on the very first time you ever use Sign in with Apple for Pull and never again, so we store it then; it fills in the name step, and you can change it. One thing more arrives from Apple, and it exists so that deleting your account works properly: a single-use authorization code, which we exchange with Apple for a token and keep against your account. Apple requires an app that offers Sign in with Apple to be able to revoke that sign-in when the account goes, and this token is the only way to do it; it is deleted with your account, and handing it back to Apple at that moment is the one and only thing we ever send to Apple about you. Nothing else arrives with either of them - no friends, no contacts, no photographs, no posts, no advertising identifier - we ask for nothing else, and we tell Apple and Google nothing about what you do in Pull. If you use Apple's Hide My Email, the address we receive is a randomised one Apple issues for Pull alone and forwards to your real mailbox; we never see the real address, and everything we would send you goes to the relay. Apart from those two sign-ins, we import nothing from any social network, and never read your contacts, your calendar or your photo library. Adding a picture opens the phone's own photo picker, which runs outside Pull and hands back only the pictures you chose.

Derived Data: We rank the deck from what you told us - the gym you named, the sports and days you train, and how far away somebody is - and from what you do with it: the ages and sports of the people you like are kept as a summary of what you seem to prefer. Two things are read rather than told. Every photograph you upload is checked by models that count the faces in it, estimate the age of the youngest, and score it for nudity and for graphic content; those readings are stored with the photograph and are how a picture of a child, or a pornographic one, is removed. No health or fitness data is read from Apple Health, HealthKit, Health Connect or Google Fit.

Cookies: This Site sets no cookies and the App uses none. We serve no advertising, join no advertising network and hold no advertising identifier, so there is no targeted advertising to opt out of.

Analytics: There is no analytics SDK of any kind in the App, and no analytics service on this Site.

Online Tracking and Do Not Track Signals: We do not track you across other websites or services, and we serve no targeted advertising, so a “Do Not Track” signal has nothing here to switch off.

Biometrics: The optional photo verification described in section 1 is the only place Pull derives a biometric identifier, and it is governed by the retention and destruction schedule stated there. Outside it, no face template, faceprint or other biometric identifier is derived from anything you upload, and nobody is ever identified or searched for by face: your photographs are never compared against you, against another user or against any database of people. What does run on them is detection rather than recognition - a model finds where a face is in the picture so that a second one can estimate its age, which is how a photograph of a child is kept off the Service. Neither produces a template, and neither can tell who anybody is. A voice note is stored and played back as a recording, is never analysed to identify the person speaking, and no voiceprint is derived from it.

2. HOW WE USE PERSONAL DATA

We may use Personal Data for the following purposes:

• To provide the Service;
• To create your account, rank your deck, make a match when two likes agree, and deliver the messages you send;
• To prove that you are 18, which we are required to do;
• To respond to your inquiries, comments, feedback, or questions;
• To send administrative information to you, for example, information regarding the Service and changes to our terms, conditions, and policies;
• To maintain and improve the Service;
• To authenticate your account and keep it secure;
• To enforce our Terms of Service;
• To prevent spam, fraud, abuse, criminal activity, illegal activity, or misuses of our Service, and to ensure the security of our IT systems, architecture, and networks; and/or
• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

Legal bases under the GDPR. Your phone number and the codes texted to it, your email address and the codes emailed to it, your profile and photographs, your location, your likes, passes and matches, your messages and their attachments, and your payment records are all processed for the performance of a contract with you. Your date of birth is processed to meet a legal obligation and to perform that contract. Three things are not covered by that and are processed only on your consent, given when you join by agreeing to this policy and to the Terms, and which you may withdraw at any time - the first two by clearing the fields in the App, the third by writing to privacy@pull.dating or by deleting your account: your gender together with the genders you ask to be shown, which read together can reveal your sexual orientation; the religion and the sexuality you may choose to put on your profile, which state a belief or an orientation outright; and the selfie and the face template of the optional photo verification, which is biometric data processed to identify you. All three are special category data under Article 9. The photo verification, the religion and the sexuality are optional and Pull works without them. Your gender and the genders you ask to be shown are required: Pull cannot deal you anybody without them, so withdrawing that consent clears those fields, and the religion and sexuality fields with them, and the App stops at the profile step until you give it again. A push token is processed with your consent, withdrawn by turning notifications off. Abuse counting, automated review of reported text, blocks and reports are processed in our legitimate interests in keeping the Service safe. Payment records are additionally kept to meet a legal obligation to keep records of what we are paid. Where we rely on legitimate interests you may object, as described in section 11.

Automated review. Two checks read what you write, both of them on our own server in Germany, and neither sends your words to another company. Nothing you write is sent to a text-classification service, an advertising network or a language-model API.

The first runs the moment you write. Your profile text and every message are matched against a list of patterns before they are saved, and text that matches is refused and never stored. It looks for five things: offers of paid sex, anything sexual involving somebody under 18, the payment demands romance scams are made of, slurs, and advertising - a link to paid content, a price list, or a pitch to buy something. It does not moderate swearing.

The second grades rather than refuses, using two open-source tools we run ourselves - a language model that rates abuse, and a pattern matcher that spots a cryptocurrency address, a card number or a bank account in a message to a stranger. It runs in three places: on what you wrote in a conversation somebody has reported, on messages as they are sent, and on the note attached to a Like. A message that scores high does not disappear - we ask the person who received it whether it bothered them. A note that scores high is not shown to the person it was sent to, and the sender is not told. Nothing but the text itself goes into either tool; both load from our own disk and reach no network at all.

An automated decision that can restrict your account. When three different people have reported you, or two have and one of those checks fires, your account is restricted for seven days: you leave the deck and you cannot send messages. A report of somebody being under 18 restricts on a single report, because that is the one case where being wrong in the other direction is unacceptable. Nothing you have written is deleted and this restriction lifts by itself. You have the right to have a person review any of the decisions below. Write to support@pull.dating and a person will look at your account and tell you what they found.

Two more, and both are about photographs. The models described under Derived Data read every picture uploaded to Pull, and a score high enough for nudity or graphic content, or an estimated age under fourteen, deletes that photograph and hides your profile until you replace it. No report is needed and none is involved. You can appeal it in the App.

The optional photo verification is the last of them. It compares a selfie to your own photographs and answers verified or rejected, which sets a badge. It also estimates your age, and this is the one automated decision on Pull that does not lift by itself: if it reads under 18, your account is held out of the deck and out of your conversations until a person has looked at it. We think that is the right way to be wrong about a child, and we know it is sometimes wrong about an adult. There is a button on that screen to ask for the review, and a person will do it.

Aggregated Information. We may aggregate Personal Data and use the aggregated information to analyze the effectiveness of our Service, to improve and add features to our Service, and for other similar purposes.

What allows us to hold any of it. If you live in the European Economic Area or the United Kingdom, the law asks us to name which of its permitted grounds each of those purposes rests on, so here they are. Most of it is the contract between us, Article 6(1)(b): your account, your profile, your photographs, the deck, your matches, your messages, the distance we show and anything you buy are how the Service is delivered to you, and there is no version of it that leaves them out. Two things the law itself requires of us, Article 6(1)(c): refusing a date of birth under 18, and keeping seven years of payment records as section 4 describes. Safety rests on our legitimate interests, Article 6(1)(f): blocks, reports, a restriction placed on an account, the request logs, and the limit on how often a number may ask for a sign-in code are there to keep the people here safe, and you may object to any of them. Three rest on your permission alone, Article 6(1)(a): the automated check on every photograph you upload, telling us who you want to see, and the religion and sexuality you may put on your profile. The second of those says something about your sexual orientation and the third states an orientation or a belief outright; the law treats both as special category data, so they rest on your explicit consent under Article 9(2)(a) - the agreement to this policy you give when you join, which names them here so that the agreement is an informed one. You can withdraw any of them whenever you like. Withdrawing does not make unlawful what was lawful while we held it, which is why section 4 keeps the record that you gave it.

3. SHARING AND DISCLOSURE OF PERSONAL DATA

In certain circumstances we may share the categories of Personal Data described above without further notice to you, unless required by the law, with the following categories of third parties. Your data is not sold, not rented, and not shared with advertisers or data brokers, and we disclose data to law enforcement only where we are legally required to, or where somebody is in immediate danger.

• Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we share Personal Data with vendors and service providers. Ours are Hetzner, in Germany, which hosts everything: the database, the sign-in server, your stored photographs, video and voice notes, notifications, the automated review described in section 2, the photo checks described in section 1, the media sweep, and our two database backups - a backup is a copy of the whole database, so each holds everything the database does. Twilio, in the United States, sends the text message carrying your sign-in code. Resend, in the United States, sends the email carrying your sign-in code and every other email the Service sends you, from a sending region in Ireland; it receives your email address and the words of that email and nothing else. Stripe, in the United States, takes card payments and holds the card details we never see. Apple and Google, in the United States, distribute the App; Apple delivers push notifications, and receives the revocation described in section 1 if an account that signed in with Apple is deleted. Cloudflare, in the United States, serves this website and carries the domain and the email to our published addresses; mail to those addresses is delivered into a Google mailbox, so Google receives anything you write to us. CARTO, in the United States, serves the map tiles the App draws when you set your location or pick your gym, which means it receives your device's address and the part of the map you are looking at. Pursuant to our instructions, these parties will access, process, or store Personal Data in the course of performing their duties to us. Four of them do not act only on our instructions, and saying otherwise would be untrue: Stripe is also a controller in its own right for fraud prevention and financial regulation; Apple and Google are controllers in their own right for store distribution and push delivery, neither of which they offer us a processing agreement for; and the Google mailbox our published addresses deliver into is an ordinary consumer account, covered by Google's own terms and by no agreement with us. We take commercially reasonable steps to ensure our service providers adhere to the security standards we apply to your Personal Data.
• Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of our assets, or transition of service to another provider (collectively a “Transaction”), your Personal Data and other information may be shared in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
• Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Service, or the public, or (v) protect against legal liability.
• Other Users: Certain actions you take are visible to other users of the Service. Anybody Pull deals you to sees your first name and the initial of your last, your age, your photographs, your biography, your answers, the sports and days you train, how many days a week and how experienced you are, the gym you named, the town or city you are in, the vitals you filled in, whether you are here to date or to train, whether your photo is verified, whether you are new, whether you were active today, and how far away you are in whole kilometres. That is the whole list. It is enforced by the database rather than by the App: there is no request a client can make that returns somebody's full last name, their date of birth, their phone number, their coordinate, or the gender they gave. Messages are visible only to you and the person you matched with. When you search for the gym you train at, what you type goes to our own server, which answers it from a map database we hold; it does not go to anybody else. The map you see while you do it is drawn from tiles served by CARTO, which is named in the list above and which therefore sees your device's address and the area you are looking at.

4. DATA RETENTION

We keep Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a business need to do so, or as required by law (e.g. for tax, legal, accounting, or other purposes), whichever is longer. In practice, your account and everything attached to it is kept until you delete it; photographs, video and voice notes until you delete them, at which point they are removed from storage; messages until either side's account is deleted; sign-in codes for minutes, after which they expire and are cleared; the Apple token described in section 1 until you delete your account, at which point it is spent revoking your Sign in with Apple and then destroyed; a refusal of an under-18 date of birth, and reports you filed, until you delete your account, at which point both go with it; a restriction on an account until it expires, and the record that it happened for as long as the account exists; the record of a permission you gave us - the photo check, or your gender and who you want to see - until you delete your account, kept even after you withdraw it because it is the proof that what we held was lawfully held while we held it; and two backups of the database, both in Hetzner's object storage in Nuremberg, Germany: a daily dump, of which the fourteen most recent are kept and anything older is deleted; and a continuous archive, from which the database can be restored to any moment in the last six days, after which it is overwritten. Payment records are the one thing that outlives your account, and it is worth being exact about what that means. They are kept for seven years from the charge even if you delete your account, because tax law requires a business to keep a record of what it was paid and because a card payment can be disputed months after it was made. In our own database, deleting your account unlinks your name, your number and your email address from the charge, and what is left is an anonymous line saying an amount was paid for something. At Stripe, deleting your account deletes the customer record Stripe holds for you, and the card saved on it, once nothing you bought is still running: at once if you hold no subscription, and otherwise when the period you have already paid for ends, so that period is not cut short. Every invoice Stripe has issued to you stays after your account is gone, and each carries the email address it was sent to. This is the exception in Article 17(3)(b) of the GDPR, for data we are required by law to keep, together with Article 17(3)(e), for data we need in order to establish or defend a legal claim. We would rather write that down than make a cleaner-sounding promise we could not keep. An invoice is a tax record and cannot be unwritten once it has been issued, which is why Stripe keeps it too. If you have never paid us anything, none of this applies to you and there is no payment record of yours to survive.

5. UPDATE YOUR INFORMATION

You can see and change your profile in the App at any time, and you can delete your account from inside the App, in Settings: it removes your sign-in, your profile, your photographs and your messages, it is immediate, and it cannot be undone. If you signed in with Apple, it also tells Apple to revoke that sign-in. Copies already written to a backup disappear when that backup is overwritten. Deleting your account also cancels a subscription bought through Stripe: the period you have already paid for runs to its end and it does not renew, and the customer record Stripe holds for you, with your saved card, is deleted once that period is over. One thing survives, and only for people who have paid us: the invoices Stripe has issued to you stay, carrying your email address, because an invoice is a tax record and the law sets how long one is kept. Section 4 explains that in full. You can download a copy of your data from Settings in the App, without asking us. Please contact us at privacy@pull.dating if you need to change or correct your Personal Data, or if you wish us to delete your account for you.

6. CALIFORNIA PRIVACY RIGHTS DISCLOSURES

Where provided for by law and subject to any applicable exceptions, California residents may have the right:

• To know the categories of Personal Data that Company has collected about you, the business purpose for collecting your Personal Data, and the categories of sources from which the Personal Data was collected;
• To access the specific pieces of Personal Data that Company has collected about you;
• To know whether Company has disclosed your Personal Data for business purposes, the categories of Personal Data so disclosed, and the categories of third parties to whom we have disclosed your Personal Data;
• To have Company, under certain circumstances, delete your Personal Data; and
• To be free from discrimination related to the exercise of these rights; and
• To limit our use and disclosure of your sensitive personal information. Three things we hold are sensitive personal information: your gender together with the genders you ask to be shown, which read together can reveal sexual orientation; the religion and the sexuality you may put on your profile; and the selfie and face template of the optional photo verification. We use each only to perform the Service you asked for - to deal you the people you asked to see, to show the profile you wrote, and to answer whether the person in your photographs is you - and for no other purpose; we infer no characteristics about you from any of them, and we disclose none of them to anybody beyond the members your profile is shown to. The photo verification, the religion and the sexuality are optional; your gender and the genders you ask to be shown are required to use Pull. Any of them can be removed in the App at any time, and removing your gender stops the App at the profile step until you give it again.

Section 1 describes what we collect in plain words. California asks for the same list in its own categories, so here it is again in the categories section 1798.140(v) of the Civil Code names, with what we actually hold under each, why, and how long it stays. Every category is collected from you, directly, when you use the Service, with one exception: if you sign in with Apple or with Google, your email address, your name and the Apple token described in section 1 come from Apple or Google rather than from you. Nothing comes from a data broker or a public source. The categories of third parties we disclose to are in section 3, and we sell and share none of it.

We have not sold or shared Personal Data in the twelve months preceding the date above, and we do not sell or share it now. We also do not disclose Personal Data to third parties for their own direct marketing, so there is nothing to report under California Civil Code Section 1798.83. If you would like to exercise any or all of these rights, you may do so by contacting us at privacy@pull.dating. Your authorized agent may submit requests in the same manner. Once we receive your request, we will verify your identity by sending a code to the phone number on the account.

Please contact us if you have questions about your rights or our disclosures under the CCPA, or to request access to an alternative format of this Privacy Policy.

7. CHILDREN

Pull is for adults. The Service is not directed to anyone under 18, the age check runs on our server at sign-up rather than in the App, and an account whose date of birth is under 18 is refused. If you have reason to believe that an individual under the age of 18 has provided Personal Data to Company through the Service please contact us and we will endeavor to delete that information from our databases.

8. LINKS TO OTHER WEBSITES

The Service may contain links to other websites not operated or controlled by Company, including Stripe's hosted checkout and the app stores (“Third Party Sites”). The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.

9. SECURITY

You use the Service at your own risk. You agree and acknowledge that we are a small-scale startup company and implement security features that are reasonable for a company of our size and resources. We implement reasonable measures, within our commercial capabilities at any given time, to protect Personal Data both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. What one account may read from another is enforced by row-level security in the database rather than by the App, photographs are held in a private bucket and served through short-lived links, and no exact coordinate is ever returned to a client. However, no Internet or e-mail transmission is ever fully secure or error free. Therefore, you should take special care in deciding what information you send to us via the Service or e-mail. If a breach of our security affects your Personal Data, we will tell you without undue delay, and within the time the law where you live requires, by a notice in the App or by email where we hold an address for you.

In addition, we are not responsible for circumvention by a third party of any privacy settings or security measures contained on the Service, or third-party websites. Finally, we cannot control the actions of users on the platform, who may seek to use third party apps or devices to record, store, or share content or communication without other users' prior consent. Please keep this in mind when using the Service.

10. INTERNATIONAL USERS

By using our Service, you understand and acknowledge that your Personal Data will be transferred from your location to our servers and, where applicable, to the technology partners listed in section 3. What covers each transfer differs, and the honest answer is not the same sentence for every party. Your account itself does not leave the European Economic Area. Your profile, your photographs, your messages, your location and the sign-in server are all on a machine in Nuremberg, Germany, so no transfer arises for the data that makes up your account. The backups described in section 4 are held by the same company in the same country as that machine, so no transfer arises for them either. One copy of your data does leave it and stays inside the EEA: the email carrying your sign-in code, which Resend sends from Ireland. Resend is an American company, which is why it is covered by the clauses that follow. The data processing agreements of Twilio, Stripe, Cloudflare and Resend each incorporate the EU Standard Contractual Clauses and the UK International Data Transfer Addendum and take effect with their terms rather than needing a separate signature; and Stripe additionally receives EEA, UK and Swiss data under the EU-US Data Privacy Framework. Apple and Google are not covered by anything we hold, because neither offers a transfer agreement for store distribution; both operate as controllers under their own published terms and their own transfer mechanisms, and we are not a party to that. The same is true of the Google mailbox our published addresses deliver into, and of CARTO, which serves map tiles directly to your device under its own terms.

11. YOUR CHOICES

In certain circumstances providing Personal Data is optional. However, if you choose not to provide Personal Data that is needed to use some features of our Service, you may be unable to use the Service. The App asks for four device permissions and no others - location, when you set where you are; the camera, if you take a photograph inside the App; the microphone, when you record a voice note; and notifications, if you turn them on - and every one of them is refusable. Depending on where you live you also have the right to ask for a copy of the data we hold about you and to know what we collect and who we disclose it to; to have inaccurate data corrected; to have your data deleted; to object to processing we base on legitimate interests; to restrict processing; to receive your data in a portable form; and to complain to your data protection authority. You can also contact us to ask us to update or correct your Personal Data, and you may delete your account. Please note that we will need to verify that you have the authority to delete the account and certain activity generated prior to deletion may remain stored by us and may be shared with third parties as detailed in this Privacy Policy.

12. CHANGES TO THE PRIVACY POLICY

The Service and our business may change from time to time. As a result, we may change this Privacy Policy at any time. When we do we will post an updated version on this page, unless another type of notice is required by the applicable law. By continuing to use our Service or providing us with Personal Data after we have posted an updated Privacy Policy, or notified you by other means if applicable, you consent to the revised Privacy Policy and practices described in it.

13. CONTACT US

If you have any questions about our Privacy Policy or information practices, please feel free to contact us anytime by e-mail at privacy@pull.dating, or by telephone or post at the address on our Contact page. ManuSoft Inc. decides why and how the data described here is handled, which under the GDPR makes it the controller and under United States state privacy laws the business.