Privacy Policy

1. Who We Are

Gramsy is a dating platform. This Policy takes effect on 26 March 2026. We act as data controller under the GDPR. For data-related queries:

2. Data We Collect

At registration

Email address, name or nickname, date of birth, gender.

In your profile

City, description, preferences, relationship format, photos.

Automatically

IP address, browser and device type, session data, cookies.

At payment

Transaction information via payment processor. We do not store card data.

In messages

Content of messages between users.

Profile views

When you open someone else's profile, a record is kept: whose profile was opened, who opened it, the time of the visit and how many times the profile was opened within an hourly period. The profile owner is only shown limited information: the hourly period and the number of visits, without the account or identity of the viewer; you can see your own history of profiles you opened.

Verification media

Photos or videos you submit to verify your profile, together with Gramsy and the one-time code shown in them. Only you and our moderators can see them — never other users, and never in public views, albums, or search. They are kept until you delete them or delete your account. Media from an unfinished verification draft is automatically deleted after 7 days. During verification a moderator may compare this media with photos on your profile, including photos in a private album; those private photos are only viewed for the check and are never published as a result. If a moderator still has doubts about your age, they may ask you to add to the check a photo of an age-confirming document with everything except the photo and date of birth covered; once your age is confirmed, you can delete that file yourself.

3. How We Use Your Data

To operate the Platform and provide its features
For security and fraud prevention
For content moderation — reviewing descriptions, nicknames, limits, photos and avatars for compliance with the rules. When you edit moderated fields we keep previous versions of the text and moderator decisions (when and why content was rejected), for audit and to let us show other users the last approved version while a new one is pending. These internal records are not shown to other users.
To send notifications and service communications
To improve the Platform using aggregated analytics
To help you complete your profile — at your request, we may suggest tags and profile field values based on the text you wrote or dictated and an updated version of that text, including with the help of third-party services (see Section 5)
To show activity — limited information about visits to a profile without the viewer's identity, and your own viewing history. These records are also used by our team to handle reports, moderate content and prevent abuse

We do not sell your data to third parties or use it for targeted advertising.

4. Legal Bases for Processing (GDPR)

Contract performance (Art. 6(1)(b)) — to operate your account and Platform features, including your own viewing history and limited information about visits to your profiles
Legitimate interests (Art. 6(1)(f)) — for security and abuse prevention, including the use of profile-view records to handle reports and prevent abuse
Consent (Art. 6(1)(a)) — for marketing communications (if you opted in)
Explicit consent (Art. 9(2)(a)) — for information about your preferences in relationships and intimacy. This is special category data, and we process it solely on the basis of your explicit consent. Without it, no profile is created.

4a. What Exactly You Consent To

This section is the full text of the consent you give when creating a profile. A short form is shown when you create a profile and on the re-consent screen; your account settings show the date of your consent and the withdrawal button. The complete wording is set out here.

What information. Who you are drawn to, your relationship format, your preferences and limits around intimacy, and the texts you write in your profile.

For what purposes. To show your profile to other members, suggest compatible people, keep the platform safe and moderated, and, when you ask for it yourself, help you complete your profile by suggesting tags and profile field values based on the text you wrote or dictated and an updated version of that text. All of this — including automatically and with the help of third-party services (see Section 5). If the assistant did a poor job, you can send us an example yourself; we look into it ourselves and do not pass it to third parties.

What it covers. Your whole account, including profiles you create later. Consent is given for the purposes of processing, not for one particular profile.

If other people appear in the profile. By filling in a profile for two or more people, you confirm that the others have read this section and agree.

How to withdraw. In your account settings. Withdrawal means your account is deleted: a profile cannot exist without this information. You will have 30 days to cancel the deletion. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3)).

What we keep as evidence. The date of consent and the version of the text it was given for, together with a record of withdrawal. These records are kept until the account deletion is complete.

5. Data Sharing

Payment processors — to the extent required for payment processing
Hosting providers — for data storage and processing
AI service providers (OpenAI, United States) — free text you have written: your profile description, headline, nicknames and description of limits, as well as text you type or dictate specifically for the assistant (it is not stored anywhere). It may be sent to OpenAI for translation while moderators review content, and, at your request, to analyse the free text you wrote and suggest tags and profile field values from the Gramsy catalogue and an updated version of that text (profile completion help). If you dictate the text, the recording goes to OpenAI too, only to be transcribed into text: we never store the recording itself. We do not separately store the transcript or the text you typed for the assistant. What you insert into your profile and save is kept as ordinary profile text. One exception: if you send us a poor example yourself, we keep the text you sent so we can look into it and fix the assistant. The basis for special category data is your explicit consent (Art. 9(2)(a) GDPR); for the remaining text it is legitimate interest (Art. 6(1)(f) GDPR) in platform safety and moderation quality. Transfers outside the EEA rely on the EU Standard Contractual Clauses (SCCs) incorporated into OpenAI's data processing agreement; OpenAI publishes the list of its sub-processors on its own website. Structured fields — who you are drawn to, your relationship format, the preference tags you have selected — are never sent to OpenAI at all. We do not send identifiers, account metadata or profile links alongside the text. But the text itself may contain information by which you can be recognised, so this transfer is not anonymisation. OpenAI does not train its models on API data per its published data-usage policy.
Law enforcement — upon lawful request

6. Data Retention

Account data: retained while the account is active, plus 30 days after a deletion request (waiting period).
Payment data: 7 years (legal requirement).
Messages: text content is erased upon account deletion. Message records (without content) may be retained for conversation integrity.
Security logs: IP addresses and user agents in security event logs are retained for fraud prevention (legitimate interest, Art. 6(1)(f) GDPR). Other personal data in logs is erased upon account deletion.
Moderation history: previous versions of moderated fields and moderator decision records (text snapshots, rejection notes) are retained while the account is active. Snapshots that contain special category information are kept on the basis of your explicit consent (Art. 9(2)(a) GDPR). Once consent is withdrawn they enter deletion along with the account: during the 30-day waiting period they are kept out of reach of other users, solely so that you can cancel the deletion, and are erased when it ends. On account deletion, your snapshots and moderator's personal comments are scrubbed during the 30-day waiting period; aggregated metadata (fact of review, verdict, timestamp) without your content is retained; this is necessary for anti-fraud and to prevent re-registration after sanctions (legitimate interest, Art. 6(1)(f) GDPR).
Registration source: when you create an account, a record of how you found the Platform may be stored: the derived traffic category (for example, search or advertising), the referring page address, campaign tags from the link, the landing page and the visit time (see the Cookie Policy for how this is collected). On account deletion, the addresses and tags are erased; the derived traffic category, the capture method and the visit time are retained in aggregate form for marketing statistics (legitimate interest, Art. 6(1)(f) GDPR). A short-lived server-side copy tied to a sign-in email link may exist between requesting the link and completing sign-in; it is deleted when the link is used and expires together with the link.
Consent records: the date of consent, the version of the text and any record of withdrawal are kept until the account deletion is complete: without them we could not demonstrate what you consented to and when (Art. 7(1) GDPR).
Profile views: up to 180 days, then deleted automatically. On account deletion, both the visits you made and the visits to your profiles are erased.

6a. Account Deletion

Users may request account deletion at any time from their account settings. Upon request:

The account enters a 30-day waiting period. During this time, the deletion can be cancelled by signing in.
During the waiting period, the profile and other user content are no longer shown to other users, and a neutral label is displayed in chats instead of the profile name.
After 30 days, the account deletion is completed and cannot be reversed.
Profile data and other personal content are deleted, including email, password, name, date of birth, profile description, preferences, photos, avatars, verification media, and message attachments.
Message text is deleted, while the conversation structure may be retained for the user's contacts.
Certain technical records, including irreversibly hashed contact identifiers, may be retained for fraud prevention, service security, and legal compliance.
The moderation log for the deleted account is anonymised: text snapshots and personal comments from moderators are cleared, leaving only the facts of review (field, verdict, timestamp) to prevent re-registration after sanctions.
The registration source record is reduced to aggregate service data: the referring address, campaign tags and landing page are erased; only the derived traffic category, the capture method and the visit time are kept.
Requesting deletion withdraws your consent to the processing of information about your preferences, whatever your reason for leaving. If you cancel the deletion within 30 days, your account resumes, but consent has to be given again.
During the waiting period processing is restricted to storage (Art. 18 GDPR): the information is out of reach of other users and is kept for one purpose only: so that you can cancel the deletion. Once the period ends it is erased.
A reminder is sent 3 days before the final deletion.

7. Your Rights (GDPR)

Right to access, rectify, erase, restrict, port your data, and to object to processing. Where processing is based on consent, you may withdraw it at any time (Art. 7(3)) — how to do so and what follows is described in Section 4a. Contact: . We respond within 30 days.

8. Security

Encryption in transit (TLS), least-privilege access controls.

9. Minors

We do not collect data from persons under 18. Notify us if a minor has registered:

10. Changes

We will tell you about material changes when you sign in: you will be asked to review the updated documents and accept them before continuing.