Privacy Policy
In accordance with the GDPR (EU 2016/679) - Last updated: 2026-09-26
1. Data Controller
The data controller is identified in the legal notices. Contact: atypiklove.com/contact
2. Data Collected
The following data is collected when you register and use the service:
Identity data
Username, first name or display name chosen by the user
Contact data
Email address
Profile data
Date of birth, gender, preferred match, biography, city, photos
Health data (sensitive category)
Neurodivergent conditions voluntarily disclosed by the user
Usage data
Likes, matches, messages, posts, comments, reactions, poll votes, credit history
Technical data
IP address, browser type, connection logs
Security and fraud prevention data
Country derived from the IP address at sign-up, digital fingerprint of published photos, outcome of photo verification, automatic behavioural signals, notes written by people who report an account
Device notifications (optional)
After you enable them and grant browser permission, Atypiklove stores the Web Push subscription's technical address, its encryption keys and your per-device preferences. This data is used only to deliver notifications through your browser's push service, which may be operated by Apple, Google or Mozilla depending on the device. The subscription is detached when you disable it, sign out or delete your account.
Tests and questionnaires
The draft and result remain only in this browser's local storage for 7 days. No result is sent to our servers, stored or linked to your account, and nothing appears on your profile. Raw answers and detailed mini-game events are not retained. Google Analytics is not loaded on test pages.
Depending on its content, inferred information may be considered health data. The first-version tests do not provide a diagnosis and do not infer any neurodivergent characteristic. Read the CNIL definition.
Sensitive data (Art. 9 GDPR)
Information about atypisms constitutes health data under the GDPR. Its collection and display are based on your explicit consent. To withdraw consent, deselect every atypism in Edit my profile and save. They are then removed from your profile and are no longer shared with other members.
Edit my atypisms3. Purposes and Legal Bases
Account creation and management
Contract performance
Connecting users
Contract performance
Messaging between users
Contract performance
Credits and subscription management
Contract performance
Optional completion of tests
Performance of the service at your request
Content moderation and security
Legitimate interest / legal obligation
Service improvement (aggregated data)
Legitimate interest
Optional email notifications
Legitimate interest / contract performance, with an opt-out at any time
Marketing newsletter
Explicit consent
Transactional and legal emails
Contract performance / legal obligation
Fraud and romance scam prevention
Legitimate interest
Photo verification before the first message
Explicit consent
4. Retention Period
Your data is kept for the duration of the contractual relationship. Upon account deletion, your personal data is erased within 30 days unless required by law, except for billing data (10 years, legal obligation). Rejected photos are retained in private storage accessible only to administrators, to review moderation decisions and preserve evidence in disputes. Deletion is scheduled after 7 days. A documented legal hold with a recorded reason suspends deletion until release, followed by a new 7-day period. Information needed to understand the decision is retained for 30 days, or for the duration of a legal hold and 30 days after its release. Deleting the account does not erase evidence under legal hold.
Messages are permanently deleted when an account is deleted.
IP addresses, their approximate city-level location, authorized locations and sign-in logs are retained for up to 6 months to secure accounts, then deleted or anonymized. Access is limited to authorized administrators. The country derived from the IP address at sign-up is the exception: it is kept for the lifetime of the account, because it determines the prevention measures described below.
Romance scam prevention relies on three processing operations. The country derived from the IP address at sign-up determines whether an account can be created and whether tighter sending limits apply to it; no other measure, in particular no account suspension or deletion, is taken on the basis of a location alone. Every published photo receives a 64-bit digital fingerprint, which makes it possible to recognize the same image on another account without the image being reconstructable or a face being readable from it; the fingerprint disappears with the photo. Finally, automatic signals, computed on our servers and never sent to a third party, may bring an account to an administrator's attention: only in that case is an extract of at most 500 characters of the message concerned shown to them, and that record is deleted no later than 90 days afterwards. None of these signals produces a decision on its own: they only feed a human review queue.
Accounts created from a country under closer scrutiny must, before sending their first message, submit a photo of themselves performing a randomly drawn gesture. That photo and the profile photo are sent to our moderation provider for the duration of the analysis. The verification photo is stored nowhere, neither by us nor in a moderation record: only the outcome and its date are kept on the profile. Declining this verification leaves the whole service accessible, except for sending messages.
When a purchase is made, the declared country of habitual residence is compared with the billing and connection country and, where relevant, region to apply mandatory consumer rules and retain evidence of the contract. The full address and raw IP are not included in this record. IP location remains a secondary indicator and a mismatch only triggers manual review, never automatic denial of a right. This minimal record is retained for the legal periods applicable to contracts and billing.
To protect authentication forms from bots, the country estimated from your IP address by Vercel is used to select Cap (hosted on Railway) or Cloudflare Turnstile. The selected service receives your IP address and technical challenge data. No GPS location is requested. This selection does not create a new location history.
5. Processors and international transfers
Vercel Inc. (USA)
Application hosting. Transfer governed by Standard Contractual Clauses (SCCs).
Supabase Inc. (France)
Database and authentication. Data hosted in France (Paris, eu-west-3 AWS) - European Union. Transfer governed by SCCs.
Stripe Inc. (USA)
Payment processing. PCI-DSS certified. Transfer governed by SCCs.
Anthropic PBC (USA)
Fallback AI moderation when Mistral is unavailable. Photo verification, where applicable: verification photo and profile photo. Translation of reported content at an administrator's request. No account identifier is added to the submitted content. Transfers are covered by Standard Contractual Clauses.
Mistral AI
Moderation of custom profile text, posts, poll options, comments and photos. Private messages are analyzed only when reported, with brief context and the reporter's note. A sample of allowed texts undergoes quality checks. Requests use the European endpoint. No account identifier is added to the submitted content.
Mailjet / Sinch (European Union)
Delivery of optional notifications, marketing newsletters and transactional account emails. Data transmitted: email address, display name. Data hosted in the EU.
Google Ireland Ltd. (Google Analytics)
Anonymised audience measurement (Consent Mode v2). No measurement data is transmitted if you decline analytics cookies. Transfer governed by SCCs.
6. Your Rights
Under the GDPR, you have the following rights:
- ·Right of access - obtain a copy of your data
- ·Right of rectification - correct inaccurate data
- ·Right to erasure - request deletion of your account
- ·Right to data portability - receive your data in a structured format
- ·Right to object - object to certain processing
- ·Right to withdraw consent - at any time, without retroactive effect
You can do the following directly from your account:
To exercise these rights, contact us via atypiklove.com/contact. If your complaint is unresolved, you may contact your national data protection authority or the French CNIL.
7. Cookies
Atypiklove uses strictly necessary cookies (authentication session) and Google Analytics 4 for audience measurement. GA4 is configured with Consent Mode v2: if you decline analytics cookies, it runs in anonymous mode without setting measurement cookies. No advertising cookies are used.
The public preference centre uses a strictly necessary HttpOnly cookie for 30 minutes. It contains only the link's opaque token, is unavailable to JavaScript and is not used for analytics.