Legal
M8tcha Privacy Policy
Last Updated: September 13, 2026
This Privacy Policy explains how M8tcha, Inc. ("M8tcha," "we," "us," or "our"), the developer of the M8tcha: Find Your People mobile application and related websites and services (collectively, the "App"), collects, uses, discloses, and protects personal information when you use the App.
This Policy is designed to meet requirements under applicable U.S. privacy laws (including the California Consumer Privacy Act as amended by the CPRA ("CCPA")), the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and Apple App Store / Google Play disclosure requirements. If you do not agree with this Privacy Policy, please do not use the App.
1. Who We Are
- Company / Data Controller: M8tcha, Inc.
- Jurisdiction: Delaware C Corporation, United States
- Privacy Contact:[email protected]
- EU Representative (Art. 27 GDPR): Not applicable - we are established in the United States
- Data Protection Officer: We have not appointed a DPO as one is not required under Art. 37 GDPR
2. Eligibility & Age Requirement (COPPA)
M8tcha is a social matching app intended only for users aged 18 and over. The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13 in accordance with the U.S. Children's Online Privacy Protection Act ("COPPA"). We also do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from an underage user, we will delete it promptly. If you believe a minor is using M8tcha, contact us at [email protected].
3. Notice at Collection / Categories of Personal Information
This section also serves as our Notice at Collection under the CCPA. We collect the categories of personal information described below for the business and commercial purposes listed. We do not sell personal information and do not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.
The table below is also intended to align with M8tcha's Apple App Privacy "Nutrition Label" and Google Play Data safety disclosures.
| CCPA Category | Examples We Collect | Purpose | Sold / Shared? | Retention |
|---|---|---|---|---|
| Identifiers | Name, email, phone, user ID, device ID, IP address, account credentials | Account creation, login, security, customer support, fraud prevention, App functionality | No | While account is active + up to 30 days after deletion (longer if legally required) |
| Customer records / contact info | Name, email, phone, support communications | Account management, verification (SMS/OTP), support, security notices | No | Account life + up to 30 days; support records up to 12 months |
| Protected classification characteristics (if you choose to provide) | Gender, pronouns, sexual orientation, relationship preferences, religion, politics, or similar profile fields you opt to share | Matching and profile display you opt into | No | Until you remove it or delete your account |
| Commercial information | Subscription plan, purchase history, payment status (payment card data is processed by payment providers, not stored by M8tcha in full) | Process purchases, manage subscriptions, prevent fraud, customer support | No | While needed for billing, tax, fraud, and legal obligations |
| Internet / electronic activity | Product interaction, in-App usage logs, crash and performance diagnostics | Analytics, personalization, advertising/marketing (with consent where required), App improvement, security | No | Generally up to 12 months, then aggregated/anonymized where feasible |
| Geolocation data (precise) | Precise location from your device (with permission) | Nearby matching, distance features, safety/fraud signals | No | While needed for matching/safety features or until you revoke permission / delete account |
| Audio, electronic, visual information | Profile photos/videos, Room media you choose to share | Profile display, messaging/Rooms, App functionality | No | While account is active + up to 30 days after deletion |
| Inferences | Preferences or compatibility signals derived from profile and product interaction | Improve matching quality and personalize experience | No | While account is active or until no longer needed for matching |
| Sensitive personal information (CPRA) | Precise geolocation; account login credentials; contents of messages (to deliver the service); and any sexual orientation, religious/philosophical beliefs, or similar sensitive profile attributes you voluntarily provide | Provide the App you request (matching, messaging, security). We do not use or disclose sensitive personal information to infer characteristics for advertising, or for purposes outside those permitted under CCPA §1798.121 / CPPA Reg. §7027(m) | No | Same as related category above; sensitive profile fields deleted when you remove them or delete your account |
We do not collect categories of personal information beyond those described above and disclosed in our App Store / Play Store product pages. We will not collect additional categories, or use collected information for materially different, unrelated, or incompatible purposes, without providing notice as required by law.
Sources of personal information
- Directly from you: registration, profile, photos/videos, messages, support requests, preferences, and permissions you grant.
- Automatically from your device: device identifiers, diagnostics, usage data, and location (if enabled).
- From service providers / platforms: payment confirmation from Apple, Google Play, or Stripe; SMS delivery status from Twilio; security and infrastructure logs from hosting providers.
- From other users: reports, blocks, and content they share that may reference you.
Sensitive data - special category data (Art. 9 GDPR) & U.S. sensitive PI
Certain profile fields (e.g., sexual orientation, religious views, or similar attributes you voluntarily add) may constitute "special category data" under Article 9 GDPR and/or "sensitive personal information" under the CCPA. We only process optional sensitive profile attributes with your affirmative choice to provide them (and, where GDPR applies, your explicit consent). You may withdraw consent and delete this data at any time in Settings > Profile. We never use sensitive profile attributes for advertising or marketing.
4. How We Use Your Data (Purposes & Legal Bases)
Under U.S. law, we use personal information for the business and commercial purposes described in this Policy (providing the App, security, analytics, customer support, marketing with required consent/opt-out rights, and legal compliance). Where GDPR/UK GDPR applies, we also rely on the legal bases below.
| Purpose | Data Used | GDPR Legal Basis (where applicable) |
|---|---|---|
| Creating and managing your account | Name, Email, Phone, User ID | Art. 6(1)(b) - Contract |
| Matching you with other users | Location, Sensitive Info, Photos, Product Interaction | Art. 6(1)(a) - Consent (Art. 9(2)(a) for sensitive info) |
| Displaying your profile to other users | Name, Photos, Sensitive Info | Art. 6(1)(a) - Consent |
| Fraud prevention & platform safety | Device ID, User ID, Precise Location | Art. 6(1)(f) - Legitimate interest |
| Customer support | Email, Support Communications | Art. 6(1)(b) - Contract |
| App analytics & improvement | Product Interaction, Crash Data, Performance Data | Art. 6(1)(f) - Legitimate interest |
| Advertising & marketing (ours, and/or third-party) | Product Interaction | Art. 6(1)(a) - Consent (see §5) |
| Legal compliance, safety investigations | Any of the above, as required | Art. 6(1)(c) - Legal obligation |
5. Tracking, Cookies & Marketing Communications
App Tracking Transparency (ATT)
Where we or our partners use your Product Interaction data for advertising or marketing purposes that constitute "tracking" under Apple's guidelines, we will present Apple's App Tracking Transparency prompt before doing so. You can change your choice anytime in iOS Settings > Privacy & Security > Tracking. On Android, you can manage similar advertising preferences in your device settings.
If you decline tracking, we will not track you across apps/websites for that purpose, though we may still use limited data for first-party analytics and core App functionality.
Email, push, and SMS
We may send transactional messages (account security, receipts, service notices). Where we send marketing emails, you can opt out via the unsubscribe link. Where we send marketing SMS, we obtain any consent required by the Telephone Consumer Protection Act ("TCPA") and related laws; reply STOP to opt out of marketing SMS (message and data rates may apply). Push notifications can be controlled in your device settings.
6. Who We Share Data With
We disclose personal information to the following categories of recipients for the business purposes described in this Policy. In the preceding 12 months, we have disclosed the categories listed in §3 to service providers/contractors for business purposes (hosting, storage, payments, messaging, analytics/diagnostics, and support). We have not sold or shared personal information in the preceding 12 months.
- Other Users: Your name, photos, and profile details (including any sensitive info you choose to add) are visible to other users as part of matching.
- Service providers / contractors: Google Cloud (hosting), Cloudflare R2 (media storage), Stripe / Apple / Google Play (payments), Twilio (SMS/OTP), and email delivery providers. These parties process data on our behalf under contract and are not permitted to retain, use, or disclose it for their own purposes except as allowed by law.
- Advertising partners (only with your consent where required; see §5).
- Legal & safety: Law enforcement, regulators, or third parties where required by law, to protect users' safety, or to investigate fraud/abuse/Terms violations.
- Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy continuing to apply or notice as required.
We do not sell your personal information and we do not share it for cross-context behavioral advertising. If that ever changes, we will update this Policy and provide a "Do Not Sell or Share My Personal Information" link / mechanism as required.
7. International Data Transfers
M8tcha is based in the United States. If you use the App from outside the U.S., your information will be processed in the United States and possibly other countries. Where GDPR/UK GDPR requires safeguards for transfers from the EU/EEA/UK, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or adequacy decisions as applicable. Contact [email protected] to request information about relevant safeguards.
8. Data Retention
We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the App, comply with legal obligations, resolve disputes, and enforce agreements. Category-level retention is summarized in §3. In general:
- Account & profile data: while active, then up to 30 days after deletion for recovery, then deleted or anonymized.
- Sensitive profile attributes: deleted when you remove them or delete your account.
- Support records: up to 12 months.
- Diagnostics/analytics: up to 12 months, then aggregated/anonymized where feasible.
- Legal/safety records (e.g., fraud or harassment reports) may be retained longer as required by law.
9. Your Rights (GDPR / UK GDPR)
If you are located in the EEA, UK, or Switzerland, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict or object to our processing
- Data portability (receive your data in a structured, machine-readable format)
- Withdraw consent at any time, without affecting prior lawful processing
- Lodge a complaint with your local supervisory authority (EU:EDPB members; UK:ICO)
Contact [email protected] or use in-appSettings > Privacy > Manage My Data. We will respond withinone month where Art. 12(3) GDPR applies.
10. U.S. State Privacy Rights (including California CCPA/CPRA)
Residents of California and certain other U.S. states (including, depending on applicability thresholds, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, and others) may have rights to:
- Know / access the personal information we collected about you, including categories, sources, purposes, and disclosures
- Delete personal information (subject to legal exceptions)
- Correct inaccurate personal information
- Opt out of sale or sharing of personal information (we do not sell or share as defined by the CCPA)
- Limit use/disclosure of sensitive personal information (we do not use sensitive PI beyond CCPA-permitted purposes described in §3; if that changes, we will provide a Right to Limit notice)
- Opt out of targeted advertising / profiling where required by applicable state law
- Non-discrimination for exercising privacy rights (we will not deny goods or services, charge different prices, or provide a different level of quality solely for exercising CCPA rights)
How to exercise U.S. privacy rights
Submit a verifiable consumer request by either:
- Emailing [email protected] with the subject line "Privacy Request," or
- Using in-app tools under Settings > Privacy > Manage My Data /Settings > Account > Delete Account.
We will verify your identity (for example, by confirming control of your account email or requiring you to sign in) before fulfilling requests. You may use an authorized agent where permitted by law; we may require proof of authorization and may still need to verify your identity directly. We will respond within 45 days of receiving a verifiable request (or longer where permitted, with notice).
Do Not Sell or Share My Personal Information: Because we do not sell or share personal information as defined by the CCPA, no opt-out is currently necessary. You may still contact us to record a preference.
California Shine the Light (Civ. Code §1798.83): We do not disclose personal information to third parties for their own direct marketing purposes. California residents may request information about any such disclosures by emailing [email protected].
Nevada: We do not sell covered information as defined by Nevada law. Nevada residents may email us to request that we not sell their covered information in the future.
In-app & device controls
- Edit/delete profile data: Settings > Profile
- Delete your account: Settings > Account > Delete Account
- Location: iOS Settings > Privacy & Security > Location Services > M8tcha (or Android location settings)
- Tracking: iOS Settings > Privacy & Security > Tracking
11. Data Security
We use industry-standard technical and organizational measures (encryption in transit, access controls, regular security reviews) to protect your data. No system is 100% secure, and we cannot guarantee absolute security. Please use a strong password and protect your devices.
12. Children's Privacy
M8tcha is not directed to, and does not knowingly collect data from, children under 13 (COPPA) or anyone under 18. See §2.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date shows the latest revision. Material changes will be notified via in-app notice or email before they take effect where required. Continued use of the App after changes take effect constitutes acceptance to the extent permitted by law.
14. Contact Us
M8tcha, Inc.
Delaware, United States
Privacy requests: [email protected]
Authorized government requests: Law-enforcement protocols
Other support: Contact Information