Privacy Policy
1. Data Controller
The controller of your personal data is:
Maciej Janowski Dev
Sole proprietorship registered in Poland
E-mail: [email protected]
For any matters related to personal data protection you may contact us at the e-mail address above.
2. Data We Collect
2.1. Account data
- Apple ID — user identifier provided by Sign in with Apple (we do not receive your password)
- Age — provided during onboarding to verify the age requirement (18+)
- Dating goal — e.g. serious relationship, casual dating (used to personalise AI replies)
- Preferred dating app — e.g. Tinder, Bumble (used to match reply style)
- Language preference — the language in which you wish to receive replies
- Consent record — version and date of your consent to AI processing (proof of consent, Art. 7 GDPR)
- Technical Sign in with Apple token — stored solely to revoke the Apple association when you delete your account
2.2. Conversation screenshots
To generate a reply suggestion you upload a screenshot of a conversation from a dating app. Screenshots:
- Are processed solely for text extraction (OCR) and AI reply generation
- Are not stored permanently — the working copy on our server is deleted automatically no later than 10 minutes after processing completes
- The conversation text (after OCR) and the generated replies are included in quality records that contain no account identifier and are retained for up to 90 days — see section 5 (Langfuse)
2.3. Third-party data in screenshots
A conversation screenshot also contains messages from the other person. We process these solely in a technical capacity (OCR + reply generation) on the basis of a legitimate interest (Art. 6(1)(f) GDPR); we do not identify those persons, build profiles of them, or contact them (Art. 14(5)(b) GDPR — disproportionate effort given that the data is processed momentarily and without identifiers). By uploading a screenshot you confirm that you have the right to share the content of that conversation. Do not upload conversations that the other party would object to sharing.
2.4. Subscription data
Subscription status information is managed by Apple App Store and RevenueCat. We do not store payment data (card numbers, bank details).
3. Purposes and Legal Bases for Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service (generating AI replies) | Art. 6(1)(b) — performance of a contract |
| Personalising replies (age, goal, app) | Art. 6(1)(b) — performance of a contract |
| Account and subscription management | Art. 6(1)(b) — performance of a contract |
| Ensuring service security | Art. 6(1)(f) — legitimate interest |
| Handling complaints and enquiries | Art. 6(1)(f) — legitimate interest |
| AI quality records (without account identifier) | Art. 6(1)(f) — legitimate interest (service quality improvement) |
4. Screenshot Processing — Technical Details
The screenshot processing pipeline works as follows:
- You upload a screenshot from the Rizziusz app.
- The screenshot is sent to the Google Gemini API for text extraction (OCR). If Google Gemini is unavailable, the screenshot is sent as a fallback to the Anthropic Claude API — solely for the same purpose (OCR), with no change in the scope of processing.
- The extracted text is sent to the Anthropic Claude API to generate a reply suggestion.
- The generated reply is returned to you in the app.
- The working copy of the screenshot is automatically deleted from our server no later than 10 minutes later. The conversation text and generated replies are included in a quality record that contains no account identifier and is retained for a maximum of 90 days.
We do not build conversation profiles or analyse content for marketing purposes. Quality records are not linked to your account.
You give explicit consent to transmitting data to AI providers (Google, Anthropic) in the app — before uploading your first screenshot. You may withdraw consent at any time in the app: Settings → Privacy & Consents. All providers act as data processors: they guarantee data protection at least equivalent to this policy and do not train their models on your data.
5. Data Processors (Sub-processors)
To provide the service we rely on the following third parties:
| Party | Role | Location |
|---|---|---|
| Anthropic (Claude API) | AI reply generation; fallback OCR (text extraction from screenshots) when Google Gemini is unavailable | USA (Standard Contractual Clauses) |
| Google (Gemini API) | OCR — text extraction from screenshots | USA (Standard Contractual Clauses / EU-US Data Privacy Framework) |
| Langfuse (Langfuse GmbH) | AI quality records without account identifier, retained for up to 90 days | EU |
| RevenueCat | Subscription management | USA (GDPR-compliant) |
| Fly.io | Application server hosting | Frankfurt, Germany (EU) |
| Apple | Authentication (Sign in with Apple), payments | USA / EU |
6. Transfers Outside the European Economic Area
Some of our data processors are based in the United States. Transfers of data to the USA take place on the basis of:
- Standard Contractual Clauses approved by the European Commission — applicable to Anthropic, Google, and RevenueCat
- EU-US Data Privacy Framework — to the extent that the relevant party is certified
The application server (Fly.io) is located in Frankfurt, Germany, within the European Economic Area.
7. Retention Periods
| Data | Retention period |
|---|---|
| Account data (user profile) | Until account deletion |
| Screenshots (working copy on server) | Maximum 10 minutes — deleted automatically |
| Quality records (conversation text, your notes, profile fields and replies — without account identifier) | Up to 90 days (Langfuse) |
| Subscription data | In accordance with Apple and RevenueCat policies |
| Correspondence (complaints, enquiries) | Up to 3 years from the close of the matter |
Infrastructure backups (volume snapshots) are overwritten automatically on a cycle of at most a few days — data deleted from the system disappears from backups within that period at the latest.
8. Your Rights (GDPR)
As a user you have the right to:
- Access your personal data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure — the "right to be forgotten" (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability to another controller (Art. 20 GDPR)
- Object to processing based on legitimate interest (Art. 21 GDPR)
- Lodge a complaint with a supervisory authority — the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl
To exercise any of the above rights, write to us at: [email protected]. We will respond within 30 days.
9. Account and Data Deletion
You may delete your account at any time:
- In the app: Settings → Delete Account
- By e-mail: [email protected]
Upon account deletion all your personal data (profile, preferences, stored consents, working copies of screenshots) is permanently deleted from the system immediately, and we revoke the Apple account association (Sign in with Apple) provided that Apple has made the relevant token available to us. Quality records do not contain your account identifier and are not linked to it.
10. Age Restriction
The Rizziusz app is intended exclusively for persons aged 18 or over. We do not knowingly collect personal data from persons below that age. If you become aware that a person under 18 is using our app, please contact us — we will delete their data without delay.
11. Cookies and Tracking
The website rizziusz.pl does not use cookies or tracking tools. The mobile app does not contain advertising or analytics trackers from third parties.
12. Data Security
We apply appropriate technical and organisational measures to protect your personal data, including:
- Encrypted communication (HTTPS/TLS)
- Sign in with Apple authentication with cryptographic verification of Apple tokens
- Hosting in an EU data centre (Frankfurt) with appropriate security certifications
- Data minimisation — we collect only what is necessary to provide the service
13. Changes to This Privacy Policy
We may update this privacy policy to reflect changes in our practices or for legal reasons. We will notify you of material changes by:
- In-app notification
- Updating the date at the top of this document
Continued use of the app after changes have been made constitutes acceptance of those changes.
14. Contact
If you have questions about this privacy policy or the processing of your personal data, please contact us:
Maciej Janowski Dev
E-mail: [email protected]