Privacy Policy

This Privacy Policy explains how Supono Holdings (“we”, “us”) handles personal information when you use the Avela mobile app and this website (together, “Avela”). It applies together with our Terms of Service.

In short: we use your information to run a dating service: to show your profile to people you might like, to match you, to keep people safe and to process purchases. We don’t sell your personal information and we don’t show ads. Your exact location is never shown to anyone, verification selfies are deleted after the check, and your sexual orientation stays off your profile unless you choose to show it.

1. Who we are

Supono Holdings, United Arab Emirates, is the controller of your personal information. Registered address: [TODO: registered address]. Privacy contact: [TODO: privacy email].

EU representative (GDPR Art. 27): [TODO: appoint if Avela is offered in the EU]. UK representative: [TODO: appoint if offered in the UK]. Data protection officer: [TODO: name or confirm none required].

2. Information you give us

• Account. Your phone number or email address, or the account details Apple or Google share when you sign in with them. Sign-in runs on Google Firebase Authentication; we never see your Apple or Google password.
• Birthdate. Used to confirm you are 18 or over and to show your age. Your birthdate itself is never shown, and it can’t be changed once accepted.
• Profile. Name, photos and captions, bio, prompt answers, gender (and, if you add it, a more specific gender identity), sexual orientation, what you’re looking for, interests, job title, company, school, education, height, languages, lifestyle (drinking, smoking, exercise, pets, social media), family plans, communication style, love language, zodiac sign, favourite shows, films, teams and games, and your city.
• Preferences. Who you’re interested in, age and distance range, filters, and your settings (visibility, notifications, privacy switches).
• Photo verification (optional). Three selfies taken in the app. See section 4.
• Activity. Your likes, passes, Super Likes (and their notes), matches, Boosts, Top Picks, Double Date friends, pairs and invite codes, and group chats.
• Messages. What you send in chats, including group chats.
• Block contacts (optional). For the contacts you choose, your phone turns each phone number or email into a code (a one-way hash) and sends only the codes; your contact list isn’t uploaded. If you type a contact in by hand, we also keep the name you enter. We also keep codes made from your own verified phone number and email so people who block their contacts can avoid you.
• Reports, blocks and feedback. Who you report or block, the reason, your notes and, for illegal-content reports, the country and law you name. Feedback you send us in the app (type, text, rating).
• Public profile link (optional). If you claim a username and turn on your public web profile, a limited version of your profile is visible at a web address. It is hidden while you use Incognito and is not offered to search engines.
• Support. What you tell us when you contact us.

3. Information collected automatically

• Location. With your permission, the app reads your approximate location while you use it, never in the background. We round it to about 1 km before storing it, and also keep the city you choose. Other people see only a distance range (for example “Less than 5 km away”), and only if Show my distance is on. With Passport, we store the place you choose instead.
• Device and app. A device identifier created by the app, platform (iOS or Android), time zone, push notification tokens, and app integrity checks through Firebase App Check (Apple App Attest or DeviceCheck, Google Play Integrity).
• Server logs. Each request records your IP address, the address requested and the device identifier, for security and troubleshooting.
• Activity status. When you last used Avela (recorded at most every few minutes). Others see “Active now” or “Recently active” only if you allow it.
• Purchases. Your membership, its length and renewal status, and your Super Like and Boost balances, as reported by the App Store or Google Play through RevenueCat. We never receive your card details.
• Website. This website sets no cookies and loads no trackers by default. See the Cookie Policy.

The app contains no advertising or analytics SDKs. [TODO: update if analytics or crash reporting is added]

4. Sensitive information and photo verification

Some profile details can reveal sensitive information: your gender identity, sexual orientation, family plans, and drinking or smoking habits. They are all optional. You choose whether gender and orientation appear on your profile (orientation is hidden by default), and what you’re interested in is used only for matching, never shown. Where the law requires it, we rely on your explicit consent to process these details, which you can withdraw by removing them from your profile.

Photo verification is optional and needs your explicit consent each time you start it. The app guides your poses using face detection that runs on your phone. Your three selfies are uploaded to our storage, and Amazon Rekognition (an Amazon Web Services service) checks that each one shows a face and compares the forward-facing selfie with your approved profile photos. This involves facial geometry, which some laws treat as biometric information.

• The selfies are deleted as soon as a decision is made.
• We keep the result (verified or not, and why), when it happened, and the comparison scores. [TODO: decide a retention period for scores; today they are kept until the account is deleted]
• We don’t use verification for identity, age or background checks, and we don’t use your face data for anything else.

[TODO legal: check biometric consent and notice rules in launch markets, such as Illinois BIPA, Texas, Washington, the EU/UK (special category data) and UAE PDPL.]

5. How we use your information, and our legal bases

Photo screening is automated (Amazon Rekognition). If a photo is rejected, we tell you why, and our team can see the result. We don’t make other decisions about you by automated means that have legal or similarly significant effects; reports are reviewed by people.

We don’t sell your personal information, share it for cross-context advertising, or use it to show ads.

6. Who we share it with

• Other members. Your profile, age (unless hidden), distance range, verified badge, Passport badge, activity status and read receipts (if on), and, for Double Date, your pairs and group chats. Remember that anything you share with a match can be saved or shared by them.
• Service providers who process information for us under contract:
  • Amazon Web Services: photo and selfie storage (Amazon S3) and photo screening and face comparison (Amazon Rekognition), in the United States (us-west-2, Oregon).
  • Google Firebase: sign-in, chat message storage (Cloud Firestore), push notifications (Firebase Cloud Messaging) and App Check.
  • Apple and Google: sign-in if you choose it, app store payments, Apple Push Notification service, and the app integrity checks above.
  • RevenueCat: managing memberships and in-app purchases.
  • Our hosting provider for the main database and servers. [TODO: name the hosting provider and server location]
• For safety and the law. When we believe in good faith it’s necessary to comply with the law or a lawful request, protect someone’s safety, investigate fraud or abuse, or enforce our Terms. We report content that sexualises minors to the relevant authorities.
• Business changes. If Avela is merged, sold or reorganised, information may pass to the new owner under this policy.
• With your consent, or at your direction.

7. International transfers

We are based in the United Arab Emirates, and our providers process data in other countries, including the United States. Where the law requires it, we protect transfers with safeguards such as the European Commission’s Standard Contractual Clauses and the UK addendum. [TODO: confirm transfer mechanisms with each provider; UAE PDPL cross-border rules]

8. How long we keep it

• While your account is open, we keep what you need to use Avela.
• Selfies are deleted as soon as verification is decided. Original photo uploads are deleted once we’ve made the resized copies we show; photo location data (EXIF) is removed.
• When you delete your account, it’s immediate: you leave Discover; your email, phone, sign-in account, birthdate, locations, device identifier, username, contact codes and push tokens are erased; your name, bio, prompts, interests, job, company, school and city are cleared; your photos (all sizes) and verification sessions are deleted; your matches are closed; and your chats are deleted for both people. Your likes, blocks you made, feedback, Boosts, Block contacts list and Double Date data are deleted.
• What we keep after deletion, today: reports you made or that were made about you (with their evidence), blocks other people made against you, records of matches, purchases and credits, notifications, and some profile attributes (such as gender, orientation, what you’re looking for, height, languages, lifestyle, zodiac and preferences). [TODO legal + engineering: set retention periods and justification for each, e.g. safety records for a fixed time, purchase records for tax law, and erase the remaining profile attributes on deletion; then update this list]
• Server logs: [TODO: retention period].

9. Your choices and rights

Everyone

• See and edit your profile and settings in the app at any time.
• Download your data: Settings, then Account & data, then Export my data, for a JSON file with your account, profile, preferences, location, verification result, likes, matches, blocks, reports, purchases and Double Date data. [TODO engineering: the export doesn’t yet include chat messages stored in Firestore]
• Delete your account: Settings, then Account & data, then Delete account.
• Control visibility: pause your profile, hide your distance, age, gender, orientation and activity status, and use Block contacts.
• Withdraw consent: turn off location or notifications in your phone’s settings, remove sensitive details from your profile, or don’t start verification.

EEA, UK and Switzerland

You can ask to access, correct, delete, restrict or port your information, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. You can complain to your local data protection authority.

California and other US states

Depending on your state, you can ask to know what we collect and why, get a copy, correct it, and delete it, and you won’t be treated differently for asking. We don’t sell or share personal information for cross-context advertising, and we use sensitive information only to provide the service. If we decline a request you can appeal by replying to our answer. [TODO legal: state-specific notices, e.g. California notice at collection, Washington My Health My Data if drinking/smoking or family plans count as consumer health data]

United Arab Emirates and other countries

You have the rights your local law gives you. [TODO legal: UAE PDPL and any other launch markets]

How to ask: use the in-app tools above, or email [TODO: privacy email]. We may need to confirm it’s you before we act, and we answer within the time the law sets.

10. Security

We use encrypted connections, short-lived signed links for uploading photos, access controls, app integrity checks and an audit log of what our team does in admin tools. No system is perfectly secure; if you think your account is at risk, contact us.

11. Children

Avela is only for adults 18 and over. If the birthdate given at sign-up is under 18, the account can’t be used. If you think someone under 18 is using Avela, report them in the app with “May be under 18”, and we will remove them.

12. Changes to this policy

If we make material changes, we will tell you in the app or by email before they take effect. The date at the top shows the latest version.

13. Contact

Supono Holdings, [TODO: registered address]. Email: [TODO: privacy email]. Or see Contact and support.