Privacy Policy

This is a translation provided for convenience. The French version ("Politique de confidentialité") is the authoritative text and prevails in case of discrepancy.

IDELOVA is a values-based dating service. To work, it processes data that touches your private life, some of which is sensitive (religious beliefs, political opinions, and the sexual orientation your preferences may reveal). This policy explains transparently what we do with your data. It applies to the website https://www.idelova.com and to the iOS and Android apps (the "Service").

It is written in accordance with the Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and its Ordinance (DPO), and with the European Union's General Data Protection Regulation (GDPR), which applies to persons in the EU/EEA (Art. 3(2) GDPR).

1. Controller

Summit & Co. Sàrl Dedicated data protection e-mail: privacy@idelova.com

Representative in the European Union (Art. 27 GDPR): ⟦Représentant UE — à désigner⟧. You may contact the representative with any question about this processing; the representative does not replace us but facilitates your requests.

We are not required to appoint a data protection officer; requests are handled by the person responsible for compliance, reachable at the address above.

2. The data we process

We do not collect contact lists, browsing history outside the Service, health data or biometric data within the meaning of the law (see section 5).

3. Why and on what basis we process your data

Under Swiss law, processing is lawful when it complies with the principles of the FADP (Art. 6 FADP) and does not unlawfully infringe personality rights; your express consent is obtained for sensitive data and profiling (Art. 6(7) FADP). For persons in the EU/EEA, each processing operation rests on a legal basis under Art. 6 GDPR and, for sensitive data, on an exception under Art. 9(2) GDPR.

Withdrawing consent. In Settings → Privacy you can withdraw your consent to the sensitive questions at any time: your answers to those questions are then deleted immediately. You can also delete or change any other answer, the genders you are interested in or your photos in your Profile, or delete your account. Withdrawal does not affect the lawfulness of earlier processing. Without questionnaire answers, the compatibility score and discovery cannot work; without a gender preference, no Profile can be shown to you.

What others see. Your answers are never displayed as such to other members: only the compatibility score and the list of values you have in common are shown. A residual inference risk remains: from the score or a shared value, someone could guess one of your answers. If that concerns you, do not answer the sensitive questions or do not mark them as a "dealbreaker".

What we do not do. We do not sell your data. We do not display advertising and do not pass your data to advertising networks. We do not use your sensitive data for any purpose other than those described above.

4. Profiling and automated decisions

• Compatibility score and discovery order. This is profiling within the meaning of Art. 5(f) FADP and Art. 4(4) GDPR. The logic is as follows: for every question you have both answered, we check whether the other person's answer is among those you accept, weighted by the importance you indicated; we do the same in the other direction; the score is the geometric mean of the two satisfactions, reduced when few questions are shared (fewer than 8). An unmet "dealbreaker" question excludes the Profile from discovery. Discovery then presents active Profiles matching your filters (age, distance, intent), taking into account the score, recent activity, any Boosts and the exclusion of blocked or already-seen people. The score is symmetrical: both people see the same number.
• No decision with legal effects or similarly significant effects on you is taken solely by automated means (Art. 21 FADP; Art. 22 GDPR). The score determines neither your access to the Service, nor your price, nor any sanction.
• Assisted moderation. Automatic filters may flag a photo or message (nudity, scam-related keywords, links). Any measure affecting your account (photo rejection, suspension, ban) is decided by a human being; you can contest it (see our Digital Services Act information).
• Usage limits (likes per day, crushes per week) are applied automatically according to your free or Premium status, without profiling.
• Refusal of re-registration. When an e-mail address is on our blocklist (section 8), creating a new account with that address is refused automatically. This refusal merely enforces a ban decided by a human being, which you can contest under our Digital Services Act information; if the ban is lifted, so is the block.

5. Selfie verification: no biometrics

When you request verification of your Profile, you take a selfie reproducing a randomly indicated gesture. A human moderator visually compares this selfie with your profile photos. We use no facial recognition software and we create and keep no biometric template, fingerprint or measurement; the selfie is therefore not biometric data within the meaning of Art. 5(c)(4) FADP or Art. 9 GDPR. The selfie is stored in a private area accessible only to the moderation team and deleted 30 days after the decision. Only the outcome (verified / rejected), the date and the identity of the reviewer are retained.

6. Who has access to your data

6.1 Other Users

Your Profile (first name, age, approved photos, city, job title, bio, intent, verification badge, approximate distance, compatibility score and up to five shared values) is visible to the Users to whom it is shown according to their search preferences. Your exact date of birth, e-mail address, precise position and detailed questionnaire answers are never displayed; only the values you have in common with a person are shown to them. In incognito mode (Premium), only people you have liked can see your Profile.

6.2 Our team

Authorised team members (support, moderation, administration) access only the data strictly necessary for their tasks, through distinct technical roles; every moderation action is logged. Messages are read only in the context of a report, a safety investigation or a legal obligation.

6.3 Our processors

We use providers that process data on our behalf, bound by a data processing agreement (Art. 9 FADP; Art. 28 GDPR).

Processors receive only the data needed for their role: for example Stripe receives your e-mail, your country and the payment data you give it directly; Brevo receives your e-mail address and the content of the e-mails we send you, never your questionnaire answers or your messages; Apple and Google receive no Profile data from us; Expo receives only the notification token and the notification text, which never contains the content of a message — only the sender's first name and a generic mention such as "New message".

The current list of our processors is available on request at privacy@idelova.com; we inform you before any addition involving a transfer to a new country.

6.4 Other recipients

• Authorities and courts, where the law requires it (see section 9).
• Professional advisers (lawyers, accountants, auditors), bound by confidentiality.
• Successor in the event of a transfer of the business, after prior notice.

7. Transfers outside Switzerland and the EU/EEA

Your data is primarily hosted in Switzerland (Zurich). Some processors are established in the European Union (countries recognised by the Federal Council as providing adequate protection, Annex 1 DPO) or in the United States. For the United States we rely, depending on the provider, on its certification under the Swiss-U.S. Data Privacy Framework (recognised by the Federal Council since 15 September 2024) and/or on the European Commission's standard contractual clauses (Decision 2021/914) with the Swiss annex recognised by the FDPIC, together where appropriate with supplementary measures (encryption in transit and at rest, minimisation). You can obtain a copy of the applicable safeguards by writing to privacy@idelova.com.

8. Retention periods

Where we keep data beyond account deletion, it is isolated, accessible only to authorised persons and used exclusively for the purpose that justifies its retention. The pseudonymised moderation records and the blocklist cannot identify you without a secret key held on our servers; only the moderation team can access them, and they are deleted automatically when their retention period ends.

9. Requests from authorities and legal obligations

We disclose data to authorities only on the basis of a binding decision (order of a Swiss court or public prosecutor, request under the Federal Act on the Surveillance of Post and Telecommunications or the Criminal Procedure Code, order of an EU authority under Art. 9 and 10 DSA transmitted in accordance with applicable law) or where a serious and imminent danger to a person's life or integrity justifies it. Requests from foreign authorities are handled through mutual legal assistance, in compliance with Art. 271 of the Swiss Criminal Code. We review every request, limit it to what is strictly necessary and, unless legally prohibited or where an investigation would be at risk, inform the person concerned. We report to the competent authorities content giving rise to a suspicion of a serious offence endangering a person's life or safety (Art. 18 DSA).

10. Security

We apply technical and organisational measures appropriate to the risk (Art. 8 FADP, Art. 1 to 6 DPO; Art. 32 GDPR): encryption in transit (TLS) and at rest, role-based access control and security rules at database level (each User accesses only their own data and the Profiles shown to them), photos in a private area accessible only via short-lived signed links, passwordless authentication, logging of administrative actions, encrypted backups, least privilege and regular reviews. No system is infallible, however: in the event of a security breach likely to result in a high risk to you, we inform you and notify the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible, and the competent EU supervisory authority within 72 hours (Art. 24 FADP; Art. 33 and 34 GDPR).

11. Your rights

You have the following rights (Art. 25 to 32 FADP; Art. 15 to 22 GDPR):

• Access: to know whether we process data about you and obtain a copy.
• Portability: to receive the data you provided to us in a structured, commonly used format.
• Rectification: to correct inaccurate data.
• Erasure: to have your data deleted.
• Restriction and objection: to request the restriction of processing or object to processing based on our legitimate interest, and to any direct marketing.
• Withdrawal of consent, at any time, for processing based on consent.
• Automated decisions: not to be subject to a decision based solely on automated processing which produces legal effects (we take none).

How to exercise them, directly in the Service:

• Settings → Export my data: you receive a JSON file containing all the data of your account (access and portability).
• Settings → Delete my account: your account and data are deleted immediately as set out in section 8 (erasure), except for the data that section 8 requires or allows us to keep (invoices, proof of cancellation, pseudonymised moderation record and, in the event of a ban, the blocklist hash); a subscription purchased on the website is cancelled at the same time. Remember to cancel beforehand any subscription purchased through the App Store or Google Play — the app reminds you.
• Settings → Privacy: you withdraw your consent to the sensitive questions; those answers are deleted immediately (withdrawal of consent).
• Profile: you can change or delete your photos, bio, answers and preferences at any time (rectification).

For any other request, write to privacy@idelova.com from your account's e-mail address (or attach something that allows us to identify you). We reply free of charge within 30 days; this period may be extended by one month for complex requests, in which case we inform you. We may refuse or limit a request in the cases provided by law (for example to protect the rights of other Users, including the content of messages they sent, or where the request is manifestly abusive), giving reasons.

Complaints. You may contact the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch). If you reside in the EU/EEA, you may also lodge a complaint with the supervisory authority of your country of residence, place of work or place of the alleged infringement (Art. 77 GDPR), for example the CNIL in France, the BfDI or the Land authority in Germany, the DSB in Austria, the Garante in Italy.

12. Minors

The Service is prohibited to persons under 18. We do not knowingly collect data from minors. If you believe a minor is using the Service, report them via the "Report" function or at safety@idelova.com: the account is suspended immediately, the data is deleted after verification and, where necessary, the authorities are informed.

13. Cookies and similar technologies

The website uses only strictly necessary cookies (session, language, consent choice) and, with your agreement, audience measurement tools. The apps do not use cookies; they store your session token and preferences locally. See the Cookie Policy. We use no advertising identifier (IDFA / GAID) and do not request Apple's tracking permission.

14. Changes

We may update this policy when the Service or the law changes. Material changes (new purpose, new type of data, new transfer) are announced by e-mail or in the Service at least 30 days in advance and, where the law requires, submitted for your consent. The date of the last update appears at the top of this page; earlier versions are available on request.

15. Language

This policy exists in French, German, Italian, English, Spanish and Portuguese; the French version prevails.