Privacy Policy
In accordance with the GDPR (EU 2016/679) - Last updated: July 2026
1. Data Controller
The data controller is identified in the legal notices. Contact: atypiklove.com/contact
2. Data Collected
The following data is collected when you register and use the service:
Identity data
Username, first name or display name chosen by the user
Contact data
Email address
Profile data
Date of birth, gender, preferred match, biography, city, photos
Health data (sensitive category)
Neurodivergent conditions voluntarily disclosed by the user
Usage data
Likes, matches, messages, credit history
Technical data
IP address, browser type, connection logs
Device notifications (optional)
After you enable them and grant browser permission, Atypiklove stores the Web Push subscription's technical address, its encryption keys and your per-device preferences. This data is used only to deliver notifications through your browser's push service, which may be operated by Apple, Google or Mozilla depending on the device. The subscription is detached when you disable it, sign out or delete your account.
Tests and questionnaires
The draft and result remain only in this browser's local storage for 7 days. No result is sent to our servers, stored or linked to your account, and nothing appears on your profile. Raw answers and detailed mini-game events are not retained. Google Analytics is not loaded on test pages.
Depending on its content, inferred information may be considered health data. The first-version tests do not provide a diagnosis and do not infer any neurodivergent characteristic. Read the CNIL definition.
Sensitive data (Art. 9 GDPR)
Information about atypisms constitutes health data under the GDPR. Its collection and display are based on your explicit consent. To withdraw consent, deselect every atypism in Edit my profile and save. They are then removed from your profile and are no longer shared with other members.
Edit my atypisms3. Purposes and Legal Bases
Account creation and management
Contract performance
Connecting users
Contract performance
Messaging between users
Contract performance
Credits and subscription management
Contract performance
Optional completion of tests
Performance of the service at your request
Content moderation and security
Legitimate interest / legal obligation
Service improvement (aggregated data)
Legitimate interest
Optional email notifications
Legitimate interest / contract performance, with an opt-out at any time
Marketing newsletter
Explicit consent
Transactional and legal emails
Contract performance / legal obligation
4. Retention Period
Your data is kept for the duration of the contractual relationship. Upon account deletion, your personal data is erased within 30 days unless required by law, except for billing data (10 years, legal obligation).
Messages are permanently deleted when an account is deleted.
IP addresses, their approximate city-level location, authorized locations and sign-in logs are retained for up to 6 months to secure accounts, then deleted or anonymized. Access is limited to authorized administrators. No sanction is based solely on an IP location.
When a purchase is made, the declared country of habitual residence is compared with the billing and connection country and, where relevant, region to apply mandatory consumer rules and retain evidence of the contract. The full address and raw IP are not included in this record. IP location remains a secondary indicator and a mismatch only triggers manual review, never automatic denial of a right. This minimal record is retained for the legal periods applicable to contracts and billing.
5. Processors and international transfers
Vercel Inc. (USA)
Application hosting. Transfer governed by Standard Contractual Clauses (SCCs).
Supabase Inc. (France)
Database and authentication. Data hosted in France (Paris, eu-west-3 AWS) - European Union. Transfer governed by SCCs.
Stripe Inc. (USA)
Payment processing. PCI-DSS certified. Transfer governed by SCCs.
Anthropic PBC (USA)
Automated AI content moderation (Claude). Bios, posts and photos are analysed on publication; comments and private messages only if reported. No account identifier is transmitted. Transfer governed by SCCs.
Mailjet / Sinch (European Union)
Delivery of optional notifications, marketing newsletters and transactional account emails. Data transmitted: email address, display name. Data hosted in the EU.
Google Ireland Ltd. (Google Analytics)
Anonymised audience measurement (Consent Mode v2). No measurement data is transmitted if you decline analytics cookies. Transfer governed by SCCs.
6. Your Rights
Under the GDPR, you have the following rights:
- ·Right of access - obtain a copy of your data
- ·Right of rectification - correct inaccurate data
- ·Right to erasure - request deletion of your account
- ·Right to data portability - receive your data in a structured format
- ·Right to object - object to certain processing
- ·Right to withdraw consent - at any time, without retroactive effect
You can do the following directly from your account:
To exercise these rights, contact us via atypiklove.com/contact. If your complaint is unresolved, you may contact your national data protection authority or the French CNIL.
7. Cookies
Atypiklove uses strictly necessary cookies (authentication session) and Google Analytics 4 for audience measurement. GA4 is configured with Consent Mode v2: if you decline analytics cookies, it runs in anonymous mode without setting measurement cookies. No advertising cookies are used.
The public preference centre uses a strictly necessary HttpOnly cookie for 30 minutes. It contains only the link's opaque token, is unavailable to JavaScript and is not used for analytics.