Privacy Policy

1. Who is responsible for your data

The company that operates Sugar Attraction is the controller of the personal data described here.

The controller is All2U services s.r.o., Karpatské námestie 10A, 831 06 Bratislava – Rača, Slovenská republika, company ID (IČO) 52500471. Registered in the Commercial Register of the District Court Bratislava III, Section Sro, Insert No. 139452/B.

Write to info@sugarattraction.com about anything in this policy, including a request to exercise one of the rights in section 10. No data protection officer has been appointed, so those messages reach the controller directly rather than a separate officer.

2. Sensitive data, stated plainly

Having a profile on this service, and what you write in it, reveals information about your sex life and can reveal your sexual orientation. Article 9(1) GDPR treats that as a special category of personal data with a higher level of protection.

We process it on two grounds. The first is your explicit consent under Article 9(2)(a). You give it when you create your account by confirming that you accept the Terms of Service and this Privacy Policy, and this paragraph is that consent, stated plainly: by creating an account you expressly agree that we process the information in your profile, your media and your conversations that reveals your sex life or sexual orientation, for the purpose of providing the service. You can withdraw it at any time by closing your account; because the profile cannot exist without it, withdrawing means your account is closed. The second ground is Article 9(2)(e), for the information you have yourself deliberately made visible to other members on your published profile.

Public member profiles are not indexed by search engines.

3. What we process

• Account data: your email address, a cryptographic hash of your password (never the password itself), account status, and records of your sessions and devices.
• Profile data: display name, age, gender, city and country at reduced precision, what you are looking for, your expectations, your description and the lifestyle details you choose to add.
• Media: profile photos and short profile videos, private album media, and photos, short videos and voice messages you send in conversations.
• Verification data: your live video-selfie recording and the moderator’s decision, a photo selfie where you provide one, your telephone number if you verify it, and identity verification data if that becomes available.
• Communication data: introductions, message content, sending and read state, plus reports and blocks you make or that are made about you.
• Travel data: the destination city and period you choose to publish. We never publish or store a precise GPS position or a precise distance.
• Technical and security data: IP address, request and correlation identifiers, browser and device information, and security events such as sign-ins, password changes and blocked attempts.
• Activity presence: while you are signed in, we keep a short-lived timestamp of your latest authenticated request or WebSocket activity and derive an online, away or offline label for other members. The timestamp is held only in temporary Redis storage with a time limit; we do not build or retain a history of when you were online.
• Payment data: for a bank transfer, what your bank sends with it — the payer name, the account number (IBAN), the amount, the date and the reference — taken from our account statement or from our bank’s notification of the incoming payment, and kept with the accounting record. We never receive or store a card number; a card payment, once offered, is handled by the payment provider, which returns only a reference, the status and the amount.

4. Why we are allowed to process it

• Article 6(1)(b) — to provide the membership you asked for: your account, profile, discovery, messaging and paid access.
• Article 6(1)(c) — to meet legal obligations, including accounting and tax obligations and answering lawful requests from authorities.
• Article 6(1)(f) — our legitimate interest in keeping the service safe: moderation, fraud and abuse prevention, security monitoring and defending legal claims.
• Article 6(1)(a) — your consent, for anything optional, such as phone verification.
• Article 9(2)(a) and 9(2)(e) — for the special-category data described in section 2, and Article 9(2)(f) where data is needed to establish, exercise or defend a legal claim.

5. Verification and moderation

A live video selfie is reviewed by an authorised moderator, who makes the decision. Automated technical analysis only prepares the queue and is a supporting signal; we do not claim to run automated liveness or deepfake detection, and no badge is issued by a machine alone.

Identity documents are not kept for longer than is necessary, and are not stored at all where the check can be completed without storing them.

6. Your messages

Messages are deliberately not end-to-end encrypted. End-to-end encryption would make it impossible to act on a report or to answer a lawful request, and on a service of this kind that is not an acceptable trade-off. We tell you this instead of implying a protection we do not provide.

Instead, message content and attachments are encrypted on our servers with a per-item data key that is itself wrapped by a master key held in a separate key-management service. The database stores only the ciphertext, and object storage holds attachments and voice messages only in encrypted form.

In normal operation, message content can be read only by the participants in the conversation, by narrowly scoped automated safety services, and by a designated compliance administrator acting on an authorised investigation or legal request with a recorded reason and case reference. It is not available to moderators without a specific report, to customer support, to ordinary administrators, to database administrators reading tables directly, or to anyone monitoring operational logs.

Operational logs must never contain message text, media, tokens, passwords, keys or identity documents.

7. Who else processes your data

Some of the processing happens at service providers rather than on our own machines. Apart from the payment provider, each of them acts on our instructions under a data processing agreement, and none of them is allowed to use your data for their own purposes.

We name them by category rather than by brand, because a provider in a category can be replaced without changing what happens to your data, and a stale brand name in a policy is worse than an accurate category. The payment provider is the one exception, because its terms require it to be named. These are all of them:

• Hosting and infrastructure in the European Union — the servers, the database and the background workers that run the service.
• Object storage in the European Union — profile and message media, data exports and the audit archive, always in encrypted form.
• Email delivery — our own mail server sends every message, including sign-in, verification and account notices, and receives the replies and bounces. No outside provider handles your e-mail for us.
• Payments — by bank transfer to our business account. Your bank and ours are independent controllers of the transfer itself; we receive the details listed in section 3 and keep them with the accounting record. No card provider is in use; before any card checkout opens, this policy names the provider, its country and its role, and says what it receives — never your card number, which we do not see.
• Identity and video verification — not in use. If a specialist provider is ever contracted for it, this policy names the category and the safeguards before that provider processes anything.
• SMS delivery — OnlineCity ApS (GatewayAPI, Copenhagen, Denmark), which carries the one-time code for phone verification and the safety texts of a date plan. It receives the destination number and the text of that message, nothing else; the sender name shown on the phone may be replaced by the carrier.
• Reverse image search — Google Ireland Limited (Dublin, Ireland), whose Cloud Vision service looks a new profile photo up on the public web while we review it, so that a picture taken from a stock site, an agency or somebody else’s public profile shows up to our moderator with the pages it was found on. It receives a reduced copy of the photo and nothing else — no name, no profile, no account identifier — and we keep only the addresses of the pages it names, for as long as the photo itself. It runs only once the switch is on; until then no photo leaves. The request goes to the service’s European endpoint, so the processing stays in the EU.
• Your trusted contact, if you make a date plan — a person you name yourself. They receive, by e-mail and, once switched on, by SMS, the time and place you entered, the profile name of the member you are meeting, and whether you checked in. We store their name, address and any number sealed and only for that plan; every message they get carries a link to stop further ones.

We also disclose data to authorities where we are legally required to, following a documented process that verifies the authenticity, authority and scope of the request before anything is released.

8. Transfers outside the EEA

Hosting, the database and the object storage that holds your media are contracted in the European Union, so the processing described in this policy takes place inside the European Economic Area.

We will not move that data outside the European Economic Area without first putting a lawful basis for the transfer in place — an adequacy decision of the European Commission, or the Commission’s standard contractual clauses with the additional safeguards the case requires — and without updating this policy to say so before the transfer starts.

9. How long we keep it

Retention in this service is a configured policy, not a number compiled into the software, so it can be changed and then applied the same way across the database, the object storage and the audit archive. These are the rules that hold:

• Your account data, profile, media, messages and verification records are kept for as long as your account exists.
• The activity timestamp used for online, away and offline presence expires automatically from temporary Redis storage and is not copied into a presence history.
• When your account is closed, that data goes into a controlled erasure process that deletes what can be deleted and irreversibly strips the rest of anything that identifies you. A few records survive because the law requires it, and the rules below tell you which. We do not tell you the erasure is finished until it actually is.
• Messages you have already sent stay in the conversation of the person you sent them to, even after your account is gone. They are that person’s record of an exchange they took part in, and the terms say so before you send anything. Your name and profile are removed, so the messages show as coming from a former member.
• Accounting and payment records are kept for the period Slovak accounting and tax law requires, which is longer than the life of an account. They contain the transaction, not your profile or your messages.
• The audit trail of privileged actions and security events is kept in immutable storage. It records who did what to which record and why; it does not contain the content of your messages.
• An active legal hold suspends deletion of exactly the data it covers, for exactly as long as the hold lasts. Section 10 explains when that can happen.
• A record deleted from the live systems disappears from backups as those backups age out of their rotation; we do not open a backup to delete a single record from it.

The periods that hold today, decided by the operator and applied by the software:

• Content that was reported and kept as evidence of a moderation case: for as long as the case is open, then 90 days after a case closed without a sanction, or three years after the sanction ended (three years from the decision for a permanent ban). The owner of the content cannot delete it during that time, and closing the account leaves the file in place until the period ends; afterwards it is deleted and only the record without the content remains.
• An appeal against a moderation decision: your statement and our answer are kept with the moderation case for the same period as the decision they concern.
• Backups of the database: 30 days, rotated automatically. Photographs and videos are not backed up; they rely on the redundancy of the storage.
• Operational logs of the application and the web server, including IP addresses: 30 days.
• A date plan you made, including your trusted contact’s details: 30 days after its check-in hour, then deleted whatever state it reached. A queued SMS about it: cancelled unsent after six hours.
• A phone number you verify: kept sealed on your account while it is verified. When you remove it, or a code is never confirmed, the number is deleted after 30 days; until then only a keyed fingerprint of it remains, so the same number cannot move to another account within that time.
• The audit trail of privileged actions and security events: three years from the event, containing identifiers only.
• Daily product metrics: aggregate counts by day, country and gender (how many introductions were accepted, how many conversations got going, how many reports were filed and so on), computed from metadata and stored without any member identifier, indefinitely.
• Your answer to the optional question after a conversation goes quiet (“Did you meet?”): added to a daily count by country and gender and stored nowhere else, so it cannot be traced back to you or to the conversation.

10. Your rights

You can ask for access to your data, correction, erasure, restriction of processing, and portability. You can object to processing based on our legitimate interests, and you can withdraw any consent you have given, with effect for the future.

You exercise these rights by writing to us at the support address on the Contact page, and for access, portability and erasure you can also do it yourself — see the paragraphs below. Before we act on a written request, we check that it really comes from the account holder — otherwise the request itself would be a way to reach someone else’s data — and we answer within one month, as Article 12(3) GDPR requires. If a request is complicated enough to need longer, we tell you inside that month and say how much longer. Both the request and what we did about it are recorded in our audit trail.

Signed in, the privacy section of your account gives you a copy of your data without asking anyone. We put the personal data we hold about you into one file — your account, your profile and preferences, your conversations, the files you uploaded, your memberships and your receipts — in a machine-readable format with a plain-language summary alongside it. A few things are left out, mostly because they name another member, and the file itself lists every one of them and why. We ask you to re-enter your password before we start, because the file is your whole history with us and a signed-in device left unattended should not be enough to obtain it.

The file is stored encrypted and you download it through your account, never through a link that works on its own. It stays available for seven days and is then deleted from our storage, including every stored version of it. You can ask for one copy every thirty days; Article 12(5) GDPR allows us to set that limit on repeated requests, and we would rather tell you the number in advance than refuse you without explanation.

You can also close your account yourself, from the same privacy section. Because it cannot be undone, it takes two steps: we ask you to re-enter your password, then we email you a link, and nothing happens to your account until you use that link. Once you do, your profile comes down immediately and you have fourteen days to change your mind — sign in at any point in those fourteen days and cancel, and your profile goes back exactly as it was. After the fourteen days your account and its contents are erased and cannot be recovered.

Two things are worth knowing before you start. Your membership ends with your account and the remainder of a paid period is not refunded, as the refund policy says. And cancelling a closure brings your profile back but does not switch your membership renewal back on, because resuming a charge you had stopped is not something we will do on your behalf — you can turn it back on yourself.

Erasure is not absolute. Accounting duties, an ongoing fraud or abuse investigation, a legal claim or a valid legal hold can require us to keep precisely defined data for a limited time. If that happens we tell you which exception applies.

If you think we have handled your data wrongly, tell us first — it is the fastest way to have it corrected. You can also complain to a supervisory authority at any time, without asking us first.

Our supervisory authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk), because the controller has its seat in Slovakia. You can equally complain to the supervisory authority of the EU country where you live or work, or where you believe the problem happened.

If you live outside the European Economic Area, for example in the United States, you have the same rights towards us as members in the EU: to know what we hold about you, to receive a copy, to have it corrected or deleted, and to object. We do not sell personal data and we do not share it for targeted advertising; our only recipients are listed in section 7. Write to the same address, and where your local law sets a shorter time limit for an answer than one month, we keep to it.

11. Moderation decisions and appeals

When a report about you leads to a warning, a messaging restriction, a suspension or a ban, or when your profile or a photo or video is rejected, we tell you what was decided, on which ground and for how long, and how to appeal. You can appeal once per decision within six months: from Activity if you can sign in, or through the public appeal page with the e-mail address of your account if you cannot.

Your appeal statement and the reviewer’s answer are stored encrypted with the moderation case and read only by the administrators who handle appeals. The appeal is decided by a person who was not involved in the original decision, within 14 days, and the answer reaches you by e-mail and, where you can sign in, in Activity. The administrators are notified of new appeals by e-mail; that notification carries only identifiers and never your statement.

12. Automated decisions

Decisions about profiles, media, video selfies, reports and appeals are made by an authorised human moderator or by the operator. Automated checks only prepare and prioritise the review queue and flag possible risks; they do not decide on their own. The daily product metrics are computed automatically, but they are counts about the service, not decisions about you.

13. How we protect it

• Sensitive content is encrypted with per-item data keys wrapped by a master key in a separate key-management service.
• Media in object storage is always private; a client only ever receives short-lived pre-signed access to a specific object.
• Privileged actions are separated into distinct administrative roles with least privilege, multi-factor sign-in, and a fresh step-up verification with a recorded reason for the most sensitive operations.
• Every privileged action is written to a hash-chained audit trail that is archived in immutable, write-once storage.
• Your session lives in a secure host-only cookie and is never placed in browser storage.

14. Cookies and optional measurement

We use a secure, host-only session cookie to keep you signed in. If you choose a language or Discreet mode, first-party preference cookies remember those choices. They do not measure your visits.

With your optional permission, our own site stores the first page path you visit and the hostname of any external referring site in this tab’s session storage. We never store the referring URL, its search terms, URL query or fragment. If you register, we send those two values to our server, classify the source as direct, organic search or an external referral, and keep the values with your account until its deletion. They appear in your data export and are removed by account erasure. The figures shown to administrators are aggregated. We do not load Google Analytics, advertising tags or any third-party analytics script.

Before this optional measurement starts, you may allow or decline it with equally accessible controls; declining does not affect registration or membership. Your choice and its time are kept in first-party browser storage to remember it. You can change the choice through Analytics choices in the site footer. Declining later stops future capture and clears this tab’s unsent source; it does not silently erase a source already recorded with your account, which you may ask us to remove through your privacy rights. If we add another non-essential measurement service later, we will describe it and request any required permission before it runs.

15. Adults only

The service is for adults aged 18 and over. You confirm your age when you register. If we learn that an account belongs to a person under 18, we remove it and delete the associated data other than what we must keep in order to report the matter.

16. Changes to this policy

We publish any new version on this page with the date it takes effect. If a change materially affects how we use your data, we tell you before it applies.