Kismat Privacy Policy

Version 12. Effective: 6 November 2026.

This policy explains which personal data Kismat processes, why, on which legal basis, who receives it, how long we keep it and what rights you have. It applies to the Kismat apps for iPhone and Android, the web app and the website kismat.at.

In short

Kismat is operated by P&P Management GmbH in Vienna. We are responsible for your data.
We do not sell your data and we do not exchange it for money or other benefits.
Profile photos and verification selfies are checked by software that runs on our own servers. In addition, a reduced copy of each profile photo is checked for harmful content by the moderation service of OpenAI. No other AI service receives your photos or selfies.
Chats are encrypted on the way and stored encrypted in our database. They are not end-to-end encrypted: our safety systems and, when a report is made, our team can read them.
Other members never see your exact location, at most a rounded distance with a deliberate offset.
Face data (biometric data) is created only if you tick the face data box before a selfie check. You can withdraw that consent at any time in the app.
You can request a copy of your data and delete your account in the app at any time. If a safety report involves you, a limited safety record is kept for up to 12 months after deletion (section 10).

1. Who is responsible (controller)

P&P Management GmbH, Leebgasse 70, 1100 Wien, Austria, registered at the Handelsgericht Wien under FN 648928g ("Kismat", "we", "us") is the controller under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Austrian Data Protection Act (DSG).

Contact for everything about your data: support@kismat.at, or by post to the address above. Write "Data protection" in the subject so your message reaches the right person quickly.

We have not appointed a data protection officer. Messages about data protection are handled by the people responsible for data protection at Kismat.

2. Data we process

2.1 Account and sign-in

Email address and password. The password is stored only as a salted hash (bcrypt); we never see it in plain text.
If you sign in with Apple or Google: the account identifier and email address that Apple or Google gives us (with Apple this can be a relay address).
Sign-in history: date and time, type of app or browser, operating system, the approximate city of the sign-in (worked out on our own server from the IP address, without sending it to anyone), and a shortened IP address. We use this to warn you by email about sign-ins from a new device or place and to protect accounts.
Device identifiers of the app (for example the installation identifier) and the network a new account was created from, to stop banned members from coming back and to limit mass sign-ups (section 6).

2.2 Your profile

Name, date of birth (to confirm you are 18 or older and to show your age), gender, who you want to meet, what you are looking for (your intent) and your age and distance preferences.
Photos, bio and the optional details you choose to add, for example lifestyle answers about smoking, drinking, diet or children, and religion.
Your city or area, your search radius and, as a Plus member, the extra cities you choose with Passport.
Settings such as Private Mode, visibility, language and notification preferences.

Your profile is visible to other members as described in section 7.1. If you switch on Private Mode, your photos are blurred and your name is hidden for everyone you have not matched with.

2.3 How you use Kismat

Likes, passes, Super Likes and their notes, matches, unmatches, blocks and reports.
Messages and media you send in chats, photo requests, and the time you were last active.
Blind Date sessions: with whom and when. Video and sound go directly between the two devices and are not recorded by us (section 5.5).
Profile views: who viewed which profile and when (kept for 30 days).
Your conversation with our team in the Your Kismat thread and emails you send us.
Use of invite links (invite a friend).
Feedback you choose to give: the reason you pick and an optional short text when the app asks why you are leaving or, once, when your deck first runs out, together with the type of app and the age of your account. Our team can see these answers together with your account.
On the website and web app: how you found us when you signed up (a tracked link or campaign, a source such as a search engine, the address of the site you came from and the page you landed on). This is read once from the page and not stored on your device. It is saved with your account only if you sign up.

2.4 Location

If you allow it, the app uses your device location to calculate distances and your city. We store your latest location on our server. Other members only ever see a distance that is rounded and shifted by a random offset of 1 to 5 km that is fixed for each pair of members, or "Near you" below 5 km. They never see your coordinates. Some views show the distance only to Plus members; free members see no distance there, although lists such as Near You can still be grouped by rough distance. We also limit how often and how far a location can be changed, so that nobody can find out where you are by moving their own location around. If you do not allow location access, you choose your city yourself.

Near You lists members near you with that rounded distance. Accounts created from 5 November 2026 appear on Near You from the start, and the app says so when you finish signing up. You can switch it off any time in Settings > Privacy; while it is off, you are not listed there and you do not see Near You yourself.

Our team can see an internal map of members for safety and service planning. On that map every position is blurred by several hundred metres, access is limited to the management and every view is logged.

2.5 Payments

If you buy Kismat Plus we process the plan, price, dates, subscription status, the transaction or invoice reference of Apple, Google or Stripe, cancellations, withdrawals and refunds, and the record of the confirmations you gave at checkout (for example your request that Plus starts immediately). We never receive your full card number: card details are handled by Apple, Google or Stripe.

2.6 Device and technical data

Platform, app version, operating system, device model, language, time zone and the push token that lets us send you notifications.
Error reports from the app and the website, sent to our own server when something goes wrong (kept for 30 days).
When the app checks for an update, the update service learns your IP address, an installation identifier and the app version (section 8).

2.7 Data from other people

Other members may report you, send you messages, or invite you. People who are not members can send us a notice through our reporting form. We process this information to run the service and to keep it safe.

Someone can sign up with an email address that is not theirs. The owner of that address then receives our confirmation email, with a link to confirm the address and a link to delete the account if they did not sign up. Opening the email or a link changes nothing: a person has to press the button on the page that opens. The confirmation link works for 7 days and the delete link for 30 days. The delete link stops working once the address is confirmed. It does not delete a banned account or an account with a running subscription; if that happens, write to us.

3. Sensitive data (Article 9 GDPR)

3.1 Sexual orientation

Who you want to meet, together with your own gender, can reveal your sexual orientation. We use it only to show you people and to show you to them. During sign-up we ask for your explicit consent with a separate box that is not pre-ticked (Article 9(2)(a) GDPR); the consent is recorded with date and time. Members who joined before 19 October 2026 did not see this separate box: the app shows them the same question once on the home screen, and they can answer "Not now" (we ask again after seven days) or withdraw in Settings > Privacy. Until they answer, we rely on the choice they made in their profile.

You can withdraw this consent at any time in Settings > Privacy > "Who you want to meet", or by writing to support@kismat.at. We then delete your "who you want to meet" preference and pause discovery: you no longer see other members and they no longer see you, because matching cannot work without this choice. Your matches and chats stay. You can give the consent again in the same place and set the preference anew. You can also delete your account. A withdrawal does not affect processing that took place before it.

3.2 Religion

Adding your religion is optional, and you can choose "Prefer not to say". If you add it, it is shown on your profile, and other members can use it in their filters to sort the profiles they see. We process this information only with your explicit consent (Article 9(2)(a) GDPR): when you pick a religion, a separate box that is not pre-ticked asks for it, and the consent is recorded with date and time. Members who added a religion before this box existed are shown the same question once on the home screen; unticking it removes the religion from their profile. You can withdraw at any time in Settings > Privacy > "Religion on your profile" or by removing the religion in your profile; it is then deleted from your profile and from any religion preference you saved.

3.3 Face data (biometric data)

Face templates are created only with your explicit consent for selfie verification. Section 5.3 explains exactly what happens.

3.4 Other information

We do not ask for health data, political opinions, trade union membership or ethnic origin. Your bio and your messages are free text: please think about what you share. Lifestyle answers about smoking, drinking or diet are not sensitive data in themselves, but you decide whether to add them.

4. Why we process data and on which legal basis

4.1 To provide Kismat (contract, Article 6(1)(b) GDPR)

Your account, profile, the deck, Near You, matching, chat, Blind Date, Plus features and the Your Kismat thread.
Emails and notifications about your account, your matches, messages and your purchases.
Payment, cancellation, withdrawal and refunds.
Answering your questions and requests.

4.2 With your consent (Article 6(1)(a) and Article 9(2)(a) GDPR)

Processing that can reveal your sexual orientation (section 3.1) and your religion if you add it (section 3.2).
Face templates for selfie verification (section 5.3) and the review of a selfie by a person (section 5.2).
Device location (permission on your device).
Push notifications (permission on your device or in your browser).
Personalised ads on Android (section 5.6) and Google Analytics cookies on the website (Cookie Policy).
News and offers by email or notification, optional surveys and the feedback questions described in section 2.3.

You can withdraw every consent at any time with effect for the future. Section 12 tells you where.

4.3 Because of our legitimate interests (Article 6(1)(f) GDPR)

Safety and moderation: photo checks, handling reports, review holds, recognising banned members and reported members who return, the stolen-photo check, limits on mass sign-ups and contact-detail checks in early messages (sections 5 and 6). Our interest, and the interest of every member, is a service that is safe for adults and free of scams and fake profiles.
Security: sign-in alerts, rate limits, server logs and error reports.
Preventing abuse of invite rewards: checking that an invited member is a new, different person (section 6.6).
Improving our safety checks: the decisions our team makes about photos are recorded together with the scores of the automatic checks, so that we can measure and improve those checks.
Drafting support replies: our team can use an AI writing aid to suggest a reply to your support message (section 8). A person always reads and sends the reply.
Protecting people whose email address was used: the confirmation email with its delete link (section 2.7).
Understanding how people find Kismat: the sign-up source described in section 2.3, used to see which links and campaigns work.
Our own offers by email: we may email members about similar Kismat features and offers (§ 174 (4) TKG 2021). Every such email has an unsubscribe link, and you can object at any time free of charge.
Legal claims: keeping a safety record after account deletion (section 10.2) and the record of consents you gave (section 10.6).

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests by writing to support@kismat.at (Article 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms (for example an open safety case), or the processing is needed for legal claims. You can object to direct marketing at any time without giving reasons.

4.4 Legal obligations (Article 6(1)(c) GDPR)

Keeping accounting records and invoices (§ 132 BAO, § 212 UGB).
Handling notices of illegal content and orders from authorities, informing authorities where the law requires (Digital Services Act).

5. Photos, selfie verification, face data, Blind Date and ads

5.1 Checks of profile photos

Every photo you upload is checked before or shortly after it appears. The checks run on our own servers with software models we operate there: face detection and face count, a nudity check, image quality, screenshot detection, an image description model (also used to recognise screenshots and copies of your own photos), an estimate of whether a photo may show a child, image fingerprints, and a model that estimates whether a photo was made by an AI image generator (with a high score the photo is held for our team; it is never removed automatically). In addition, a reduced copy of each profile photo is sent to the moderation service of OpenAI, which checks for sexual content, violence, self-harm and hate. OpenAI does not use this data to train its models and may keep it for up to 30 days to monitor abuse. Google Gemini and OpenRouter no longer receive any member images.

Possible outcomes:

The photo is approved.
The photo is held for a person on our team, for example when it may show a child, may be a screenshot or AI-generated, may break our rules, or when someone has uploaded many photos that were held or removed. While a photo is held, other members do not see it and you see that it is in review.
The photo is scheduled for removal when a rule is clearly broken (for example a blank or very blurry photo, a clear screenshot, a group with four or more faces, no face on the main photo, clear nudity, or a photo you have already uploaded). You receive the reason in the Your Kismat thread. The removal happens after a short delay, and you can reply in the thread if you think it is wrong; a person then looks at it.

Photos that may show a child are never published automatically and never deleted automatically: a person decides.

Stolen-photo check. We compare the image fingerprints of new photos with the photos of other accounts (this is a comparison of images, not face recognition). If the same photo is used on another account, the photo is held for our team and we may ask the member concerned to confirm it is them with a selfie within 24 hours (section 6.4).

What we keep: the results of the checks for each photo (12 months), the image fingerprints (while the photo exists), and the image description values used for comparison and for calibrating our checks (12 months, and deleted together with the photo).

5.2 Selfie verification

Selfie verification is optional. You take a live selfie with a requested pose. On our own servers we check the pose (hand position), the image quality, whether it is a photo of a screen, nudity, an estimate of your age, and whether the face matches your profile photos (using face templates, section 5.3). The result is one of three: passed, please try again (with the reason), or review by a person. A selfie is never rejected automatically. An estimated age under 18 always goes to a person.

Before you take the selfie, the screen tells you that a selfie that cannot be confirmed automatically goes to a person on our team. If you continue, that selfie is stored encrypted until our team has decided and at the latest for 14 days, then deleted. You can withdraw this consent by writing to support@kismat.at; the selfie is then deleted.
In every other case the selfie image is deleted right after the check, at the latest within one hour.
For every attempt that passes or goes to review we keep a short record of the results (how closely the selfie matched each profile photo, the pose, the screen check, the age estimate and the nudity check), without the image, so our team can check and explain decisions. It is deleted after 12 months or when you delete your account.

5.3 Face data (biometric data)

Only if you tick the face data box before the selfie, we create a face template: a set of numbers that describes a face, from which the image cannot be rebuilt. We create it from the selfie and from those of your profile photos that show exactly one face. We use it only to:

confirm that your selfie and your photos show the same person,
check that a new photo with one face still shows you while you hold the verified badge,
make sure that one face is verified on only one Kismat account.

Face templates are processed only on our own servers, are never shared and never used to train anything. They are not used for invite checks or the safety record. Legal basis: your explicit consent (Article 9(2)(a) GDPR), recorded with date and version. You can withdraw it at any time in Settings > Privacy > Face data: all your face templates are deleted at once and your verified badge is removed.

What depends on verification. You can use Kismat without selfie verification. The following depend on a passed selfie check: the verified badge; switching on Private Mode; and, as one of the ways out, some review holds (section 6.4), which our team can also lift after reviewing your account if you ask in the Your Kismat thread. Invite rewards can also require a passed selfie check, as shown on the invite screen.

5.4 Verified badge

The badge is given when at least two of your photos match your selfie. It is removed when you delete one of those photos, when a new photo with one face does not match your selfie, when your account is placed on a review hold, when you withdraw your face data consent, and when your account is banned. You can verify again later.

5.5 Blind Date

Blind Date connects two adult members for a short video call. Video and sound are sent directly between the two devices and are encrypted. To set up the connection, both devices exchange network addresses through connection servers (including Google's public STUN servers); if a direct connection is not possible, the encrypted stream is passed through a relay server that cannot see the content. We do not record calls. When a participant reports a session, a still image of the moment can be saved as evidence for our team and kept for 12 months.

5.6 Ads (Android, free members)

On Android, free members can choose to watch a short video ad to get extra likes. Ads appear only when you choose to watch one, never in the first 48 hours after sign-up and never for Plus members. The iPhone app shows no ads. Ads are delivered by Google AdMob. Before any ad is loaded, Google's consent dialog asks whether ads may be personalised; your choice is recorded and you can change it at any time in Settings > Legal & Support > Ad privacy choices. Without consent, Google shows non-personalised ads, which still use some device information for frequency limits, fraud prevention and counting. Google learns that an ad was requested from the Kismat app. We do not pass your profile, messages, email address or member number to Google. For ads, Google is responsible for its own processing under its own terms.

6. Safety measures and automated decisions

To keep Kismat safe we use automated tools. Some of them can restrict an account for a while. None of them bans an account: only a person on our team can ban. Every account restriction and every photo removal is explained to you with the reasons (statement of reasons). A photo waiting for review is shown to you as in review, without a separate message. You can always ask for a person to look at it, give your view and contest the decision (Article 22(3) GDPR) by replying in the Your Kismat thread or writing to support@kismat.at.

6.1 Discovery and matching

Who appears in your deck is worked out by automated rules: mutual gender preferences, your own age range (widened by up to 3 years if you choose), the same intent first and then others, distance within your radius (widened when there are few people nearby, never beyond 500 km, and only inside your country or the country of a city you added with Plus), recent activity and profile quality, for example approved photos. At the moment both widenings apply to everyone and cannot be switched off in Filters, because Kismat is still growing. Members without an approved main photo with a face are not shown. Plus features such as Super Likes and Priority likes show your like earlier to the person you liked.

6.2 Reports

A report hides the two of you from each other. Every report reaches our team. When several independent members report the same account within 30 days, the account is placed on a review hold automatically until a person has looked at it. Only reports from members who have a confirmed email address, whose account is older than 72 hours, who actually interacted with the reported member and who are not linked to another reporter of the same member (shared device, network, email or sign-in account) count toward such an automatic hold. To check these links we store keyed one-way codes of devices and networks with the report for 60 days.

6.3 Messages and bios

Bios and the first messages of a chat are checked by fixed rules (no AI) for phone numbers, links, social media handles and typical scam patterns. Such details may be removed, or a message may be held for a safety check; you are told the reason.

6.4 Review holds

A review hold pauses your profile in discovery and stops new first messages; existing chats continue. You receive a notice with the reason. Besides reports, a hold can start when:

many new accounts are created on one device (more than 3 in 30 days) or from one network (more than 10 in 24 hours),
a new account shows the device, network, normalised email address or Apple or Google account of a banned member (possible ban evasion),
a new account matches the safety record of a member who deleted their account while reported (section 10.2),
a member does not answer a request to confirm with a selfie within 24 hours that their photos show them (section 5.1),
our risk scoring points to a likely fake or scam account, if we have switched on automatic holds for it.

Our team computes advisory risk scores from signals such as reused photos, photos our team removed as fake, failed checks, reports, how many members block or unmatch someone, sign-up patterns, how quickly and how far away someone sends likes, messages our filters stopped (contact details, links, scam scripts, offers of illegal goods or services, threats and abuse), whether the same message text is sent to many members (an automatic comparison of the sender's own messages; only the number of members is kept, and our team does not read the messages for this), and whether someone chats with many members in several countries far away. The scores are used to sort the work of our team; on their own they never ban or hide anyone.

6.5 Age

Kismat is only for people aged 18 or older. At sign-up you confirm your date of birth. An age estimate is made only during selfie verification (section 5.2) and when photos are checked for signs of a child (section 5.1). Results that point to a minor always go to a person.

6.6 Invite a friend

To check that an invited member is a new, different person, we compare the two accounts (and other accounts invited by the same member) using keyed one-way codes of email addresses, Apple or Google sign-in identifiers and device identifiers, the shortened network address and phone model of sign-ins in the last 30 days, the similarity of email addresses, date of birth and first name, whether a profile photo is a copy of a photo on the other account (image fingerprint, not face recognition), and how many invites a member collects and how quickly. The result is a risk score. Invites with a high score are held for review by our team; an invite that turns out to be the same person is not rewarded, and Kismat Plus days already given for it are removed. You can ask for a person to look at the decision in the Your Kismat thread. Face templates are not used.

6.7 Location checks

When your device updates your location, we check whether the location looks genuine. We compare the country of your location with the country of your internet connection, which we work out from your IP address. Android phones also tell us when a location comes from an app that fakes GPS. We keep only a daily yes or no for 30 days, not the IP address or the location used for the check. Shared relay services such as iCloud Private Relay are not compared.

The result feeds a risk score that helps our team decide which accounts to look at. A VPN or roaming can cause a mismatch, so this check never restricts, hides or bans an account by itself and never places a review hold. We do this for our legitimate interest in keeping Kismat safe and free of fake profiles (Art. 6(1)(f) GDPR). You can object at any time.

One exception: without Kismat Plus, a move of your location into another country is taken over only when your internet connection is in that country too. Otherwise your previous location stays, and you can still use Kismat there. Plus members are not checked this way.

7. Who receives your data

7.1 Other members

Members who can see you in the deck, in Near You, in likes or in chats see your profile: name, age, photos, bio, the details you added, your intent and, where it is shown, the rounded distance (section 2.4). In Private Mode they see blurred photos and no name until you match. Your matches see the messages you send them. Photo links are signed for the viewer and expire, so photos cannot be opened or copied from outside the app.

7.2 Service providers who work for us (processors)

Hetzner Online GmbH, Germany: servers that run the Kismat service, the database and the stored photos.
virtualhost.at, Austria: hosting of the website kismat.at, sending of our emails and our support mailbox.
OpenAI (USA): content check of profile photos (section 5.1).
OpenRouter (USA), with the AI model provider Anthropic (USA): only when our team uses the writing aid for support replies. The subject and the latest messages of your support conversation are sent to get a suggested reply. No images are sent. A person always decides what is sent to you. If you do not want this for your conversation, tell us and we will not use it.
Expo (650 Industries, Inc.), USA: delivery of app updates.
Google (Google Ireland Ltd. and Google LLC): Firebase Cloud Messaging for push notifications on Android, and Google Analytics on the website if you allow it.

7.3 Companies that process data under their own responsibility

Apple: Sign in with Apple, App Store purchases and refunds, push notifications on iPhone.
Google: Sign in with Google, Google Play purchases and refunds, AdMob ads on Android (section 5.6).
Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): card payments on the website, fraud prevention and its legal duties as a payment provider.
Your browser provider (for example Google, Mozilla, Apple or Microsoft) delivers web push notifications; their content is encrypted.

Push notifications can show the name and photo of the member who wrote to you. They are delivered through Apple or Google, which therefore process this content to deliver it. You can turn off previews on your device.

7.4 Authorities and others

Courts, police and other authorities, when we are legally obliged, for example by a binding order, and only the data the order covers. When information gives rise to a suspicion of a criminal offence involving a threat to the life or safety of a person, we inform the police (Article 18 Digital Services Act). Our Notice and Action Policy explains the details.
Our legal and tax advisers, who are bound to confidentiality.
A buyer or successor of the Kismat business, if the business is transferred; we will tell you in advance.

Data that never leaves our servers: face templates, the location calculation, the conversion of IP addresses into a city (we use a local database for this), and the checks of messages and bios.

8. Transfers outside the EU

Our servers are in the EU (Germany and Austria). Some recipients are based in the USA (OpenAI, OpenRouter, Anthropic, Expo, and Apple, Google and Stripe for parts of their services). For these transfers we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards at support@kismat.at.

9. Security

All connections use TLS encryption.
Passwords are stored only as salted hashes.
The database tables holding accounts, profiles, messages, Super Likes, support messages and sign-in tokens are encrypted at rest.
Photos are stored as files on our servers and are served only through signed links that are bound to the viewer and expire, with a limit on how many photos one member can open per hour.
Access for our team is limited to what each role needs, protected by two-factor authentication and logged; email addresses are masked in our admin tools.
Rate limits protect sign-in, verification, reporting and messaging.

Backups. Every night an encrypted copy of the database is made on our server and kept for 14 days. The key needed to read these copies is kept separately from them and is not on the server. Encrypted copies are also kept on a computer used for our technical administration within the EU, without a fixed deletion date. Photos are not part of these copies. Data you delete stays in these copies until they are deleted. If we ever have to restore a copy, we delete again everything that was deleted after the copy was made.

You can report a security problem to support@kismat.at.

10. How long we keep data

10.1 While you use Kismat

Account, profile, photos, matches: until you delete them or your account.
Removed photos: deleted when you remove them; leftover copies are cleaned up automatically, normally within 48 hours.
Messages: until you or your match unmatches (the conversation is then deleted for both, unless a block or report keeps it for safety) or until an account is deleted. A conversation of a blocked or reported pair is kept until one of the two accounts is deleted.
Matches without any message: removed after 7 days.
Profile views: 30 days.
Sign-in history: 180 days; the shortened IP address is removed after 30 days.
Server logs: up to 30 days, longer only while needed for a specific security or abuse investigation.
Security records of attacks (IP address, the path tried, client type and country, for scanning and repeated failed sign-ins): 30 days. Addresses blocked for attacks: while blocked and up to 180 days after.
Sign-up checks against automated accounts (IP address and its network, the domain of the email address but not the address, platform, how long the form took, a background puzzle your device solves, and the resulting score): 30 days. This check does not decide whether you can sign up.
Error reports: 30 days. Record of sent notifications: 90 days.
Reports and moderation decisions: 12 months after the decision. Evidence images from reports: 12 months.
Photo check results, decisions on photos and image description values: 12 months.
Stolen-photo matches and selfie confirmation requests: 12 months.
Selfie images: deleted right after the check, at the latest within one hour; selfies sent to a person: until the decision, at the latest 14 days. Selfie check record: 12 months.
Face templates: until you withdraw your consent or delete your account; a template of a photo is deleted with the photo.
Keyed codes for report credibility: 60 days.
Rewarded ad sessions: 90 days.
Anonymous clicks on our tracked links: 13 months.
Feedback answers and sign-up source: until you delete your account.

10.2 When you delete your account

Deleting your account (Settings > Account > Delete account) erases your account, profile, photos, matches, messages and the other data linked to it at once. The following are kept, each only for the stated purpose:

Safety record (12 months). If, in the 12 months before deletion, you reported someone or were reported, or your account had an open review hold or a ban, we keep a limited safety record: the reports with the roles of the people involved, the reported messages and up to the last 50 messages of a reported conversation, the decisions, the evidence images (moved to a restricted area) and, if you were the reported member, keyed one-way codes of your normalised email address, Apple or Google sign-in identifier, device identifiers and photo fingerprints. It is used only to protect members, to recognise a reported member who returns, for legal claims and for authorities. It is deleted 12 months after the newest report, or 12 months after deletion for holds, bans and open cases. The delete screen tells you about this. Legal basis: Article 6(1)(f) and Article 17(3)(e) GDPR.
Reports you filed stay with the reported member's case, without your account (you appear only as "a member who deleted their account").
Invoices and payment records: 7 years (§ 132 BAO, § 212 UGB).
Store purchase references of deleted accounts: 24 months, so that a still-running Apple or Google subscription can be handled.
Consumer rights requests (for example withdrawals): 3 years after they are closed. Records of subscription transfers: 3 years.
Record of consents (what you agreed to, when, the text version, IP address and app): 3 years after deletion, as evidence.
Invite checks: keyed one-way codes of email address, Apple or Google sign-in identifier and device identifier: 24 months after last use, so that a deleted account cannot be registered again to collect an invite reward. Network codes: 30 days (invite screen) or 90 days (used invite). Risk score, signals and decisions: 24 months.
Email block list: a one-way code of your email address, so that we never email you again after deletion.
Feedback answers: the text is deleted with your account, including text you type in the delete flow. The reason you picked, the type of app and the age of your account stay for our statistics, without any link to you.

10.3 Inactive accounts and accounts without photos

If you do not sign in for 24 months, your account is deleted. We remind you by email after 21 and 23 months.
We may delete an account that has never had an approved photo and has not been used for 90 days. We warn you by email 14 days before.
If you sign up with an email address and never confirm it, we remind you by email and delete the account from 30 days after sign-up. We warn you at least 7 days before.

10.4 Banned accounts

A banned account cannot be deleted by its owner and is kept as long as the ban applies, so that the ban can be enforced and reviewed. You can ask for a review of the ban at any time.

10.5 Backups

See section 9.

10.6 Records we keep as evidence

We keep a tamper-evident record of each consent you give or withdraw and of each acceptance of our Terms (date and time, the exact text version, IP address and app). It is kept while your account exists and for 3 years after deletion.

11. Children

Kismat is only for adults aged 18 or older. If we learn that a member is under 18, we close the account. Photos that may show a child are held for a person and never published automatically. If you believe a member is under 18, or you see sexual content involving a minor, report it in the app or at kismat.at/report right away. We report sexual abuse material involving minors to the reporting office of the Austrian Bundeskriminalamt and keep the evidence only as long as the authorities need it.

12. Your rights

Access and data portability (Articles 15 and 20 GDPR): request a copy of your data in the app under Settings > Account; we email it to the address of your account (once every 24 hours). You can also write to us.
Rectification (Article 16): edit your profile and settings at any time. Your date of birth cannot be changed after sign-up; write to us if it is wrong.
Erasure (Article 17): Settings > Account > Delete account. The exceptions are listed in section 10.2.
Restriction (Article 18) and objection (Article 21): write to us.
Withdrawing consent (Article 7(3)): face data in Settings > Privacy > Face data; ads on Android in Settings > Legal & Support > Ad privacy choices; location and push notifications in your device settings; analytics cookies through "Manage Cookies" at the bottom of the website; news and offers in your notification settings or with the unsubscribe link; feedback answers by writing to us (we then delete the text and remove the link to you); sexual orientation, religion and selfie review as described in sections 3 and 5.
Automated decisions (Article 22): ask for a person, give your view and contest the decision (section 6).
Complaint (Article 77): you can complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Wien, dsb.gv.at, or to the authority in your EU country.

We answer within one month. For complex requests this can be extended by two more months; we tell you if so. Exercising your rights is free. We may ask you to confirm your identity, for example by writing from the email address of your account.

13. Cookies and storage on your device

See our Cookie Policy.

14. Changes to this policy

When we change this policy, we publish the new version here with a new version number and date. Before changes that affect what we collect, why we use it or who receives it take effect, we tell you in the app or by email. Earlier versions are available on request.

15. Contact

P&P Management GmbH, Leebgasse 70, 1100 Wien, Austria. Email: support@kismat.at.

Privacy Policy