NoChat Privacy Policy

What changed in version 1.5

• Find Nochi, the optional game while you wait at the Venue: what the back camera does on your phone, the short game video you can share, Nochi's message with your first name, the stamp book of dates at partner Venues, the Find Nochi usage events, and Nochi on nochat.site. Find Nochi does not process your face (sections 1, 2, 3.1, 4.3, 6, 8 and 12).
• Usage analytics and crash reports: what the App sends, that it starts only after you accept the Terms, and the Settings switch that stops it (sections 6 and 12).

What changed in version 1.4

• Venue ratings after a meeting: both guests are asked to rate the Venue once they have left it, and the App keeps a 500 m geofence around the Venue from the reveal until 24 hours after the meeting time to notice that they have. What the rating holds, what the Venue sees of it, what the other person sees, and how long it is kept (sections 2, 4.2 and 8).

What changed in version 1.3

• Arrival check and live location at meetings: precise location from 30 minutes before to 1 hour after the meeting time, background location if you allow it, your live position shared with the person you are meeting, arrival records, and records of completed meetings that Venues are billed for (sections 1, 2, 3, 4.1, 8, 9, 15).

What changed in version 1.2

• New data categories and retention periods for reports, blocks, the reliability score, no-show history, sanctions, moderation audit records and disputed attendance answers, and more detail on the safeguards that apply to partly automated sanctions (sections 2, 3.3, 8).

What changed in version 1.1

• New data: date of birth, age and zodiac sign, attendance confirmations, reliability score and sanctions, purchase records from RevenueCat, event tickets and reservations, venue billing through Stripe.
• Selfie verification now includes an anti-spoofing check and a match with your profile photos, still on your phone and without storing a selfie or face template (section 5).
• New processors: RevenueCat and Stripe (section 6).
• EU GDPR, the Portuguese e-privacy rules and the Turkish KVKK now apply alongside UK GDPR, with representatives in the EU and Turkey (sections 7, 9, 15).
• Automated decisions for reports and no-show sanctions, and how to ask for human review (section 3.3).

This policy explains what personal data NoChat collects, why, who receives it, where it is stored, how long we keep it, and your rights. It applies to the NoChat mobile app and the people who use it. Venue partners: section 13 covers the business contact data we process about you.

Which laws apply. NoChat is operated by BITRY LTD ("Bitry LTD", "we", "us"), a company established in the United Kingdom. Bitry LTD is the controller of your personal data. We process your data in line with:

• the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, because the controller is established in the UK;
• the EU General Data Protection Regulation (GDPR), because we offer the App to people in the EU (Art. 3(2) GDPR), and, in Portugal, Law No. 58/2019 and Law No. 41/2004 on electronic communications privacy;
• for users in Turkey, the Law on the Protection of Personal Data No. 6698 (KVKK) and its secondary legislation. For users in Turkey this policy, together with section 15.2, is our information notice (aydınlatma metni) under Article 10 KVKK; explicit consents are asked for separately in the App;
• for users in Azerbaijan, the Law "On Personal Data" No. 998-IIIQ;
• in any other country, the data protection law of the country where you live, where it applies.

Where these laws differ, we apply the stricter rule.

1. Summary

• We collect your phone number, first name, date of birth, photos, gender, who you want to meet, interests, approximate location, precise location around a scheduled meeting, your Meet/Pass choices, matches, meetings, arrival records and attendance answers, verification results, reports, device and security data, and purchase and ticket records.
• Your selfie verification runs on your phone. We do not store or receive your selfie or a face template. We store only the result and scores.
• We use your precise location only around a meeting, from 30 minutes before to 1 hour after the meeting time: to confirm that you arrived at the Venue and, if you allow it, to share your live position with the person you are meeting. Your live position is deleted 2 hours after the meeting time (section 4.1).
• We never show your date of birth to other users. We show your position only to the person you are meeting, only in that window and only if you share it. Other users see your first name, age, zodiac sign, photos, interests, approximate distance and whether you are Verified.
• A Venue receives only your first name and last-name initial, the booking time and the perk, so it can seat you. Venues do not receive your location. At events, door staff also see your main photo at check-in.
• Your data is hosted with Google Cloud / Firebase in the European Union (Belgium, region europe-west1). Some services process data in the UK, the US and Switzerland (section 7).
• We do not sell your personal data and we do not use it for third-party advertising.
• Find Nochi, the optional game while you wait at the Venue, runs on your phone with the back camera. It does not process your face, and its camera images and game video are not sent to us. We keep only a stamp book of your completed dates at partner Venues (section 4.3).
• You can delete your account in the App at any time.

2. What we collect

Note on last name: the App stores a last name so the booking can be shown to the Venue with an initial only.

Special category data.

• The gender(s) you want to meet may reveal your sexual orientation, which is special category data under GDPR Article 9 and may be data about sex life under Article 6 KVKK. We use it only to show you matching profiles, never show it to others as a label, and process it on the basis of your explicit consent.
• Face processing during verification is biometric processing (section 5), based on your explicit consent.
• Find Nochi uses only the back camera and does not process your face. Face processing in NoChat happens only in selfie verification (section 5).
• We do not ask for religion, political views, health or ethnic origin. Please do not put them in your profile. Photos can reveal such things; we do not use photos to infer them.

3. Why we use your data and on what legal basis

3.1. Purposes and legal bases

Azerbaijan. For users in Azerbaijan we rely on consent, the performance of the contract and legal obligations under Law No. 998-IIIQ.

3.2. Legitimate interests and consent

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details and you can object (section 9). You can withdraw consent at any time (section 9). Withdrawal does not affect processing before it. If you withdraw consent that a feature needs (for example location or gender preference), that feature stops working. If you do not allow background ("Always") location, the arrival check works only while the meeting screen is open, and attendance is decided from the "Did they come?" answers (section 4.1).

3.3. Automated decisions and profiling

• Ranking (Terms, section 6), including the zodiac boost, orders profiles. It does not decide whether you can use the Service.
• Verification decides only whether you get the Verified badge. You can retry, and you can ask a person to review a failure.
• Reports: a report that a user is under 18, and reports about the same account from three different people within 30 days, automatically hide the account from other users until a moderator reviews it. Hiding is not a finding that the rules were broken, and a moderator can lift it.
• No-shows: a warning and a 7-day suspension are applied automatically from the attendance answers given by the other user and, where there is one, the arrival record, which can override the answers (Terms, section 9). A 30-day suspension and a permanent ban are reviewed and confirmed by a person before they take effect. A suspension or a ban stops you using the Service, so it affects you significantly.

Safeguards. For all of these decisions you have the right to obtain human intervention, to express your point of view and to contest the decision, by writing to connect@bitry.io (Article 22(3) GDPR and UK GDPR; Article 11(1)(g) KVKK, which gives you the right to object to a result produced solely by automated analysis). A person who was not involved in the decision reviews your appeal, and we lift the measure if it was unjustified. We also record every moderator action, so that a decision can be checked afterwards.

4. Who can see what

• Other users see your first name, age, zodiac sign, photos, interests, approximate distance (rounded) and the Verified badge. Matched users also see the meeting time and, 30 minutes before, the Venue. Other users never see your phone number, date of birth, reliability score, sanctions or verification scores. They never see your exact location, except the person you are meeting, in the cases described in section 4.1.
• Venues see your first name + last-name initial, booking date and time, party size and the perk. For events, door staff see your first name + initial and your main photo when they check you in, through a link that expires after a few minutes. Venues may use this only to seat you or check your ticket (Venue Partner Agreement). Venues do not receive your location.
• Our staff and moderators see only what they need to handle reports, appeals, support and safety. They never see a selfie, because none is stored.

4.1. Arrival check and live location at a meeting

When. Only around a scheduled meeting: from 30 minutes before to 1 hour after the meeting time. Outside that window we do not use your location for these features.

• Arrival check. In that window, NoChat uses your precise location to confirm that you arrived at the Venue (within about 150 m). While the meeting screen is open in that window, the App sends your position to our servers about every 15 seconds for this check, whether or not you share your position with the person you are meeting. If you set location permission to "Always" (iPhone) or "Allow all the time" (Android), this also works in the background, even when the App is closed or not in use. For this, the App registers a geofence around the Venue only for that window and removes it afterwards. You can refuse or withdraw this permission in your phone settings. Then the check works only while the meeting screen is open, and attendance is decided from the "Did they come?" answers.
• Showing your position to the person you are meeting. Your position is shown to the other person only if you choose to share it for that meeting. You are asked on the meeting screen, and you can start or stop sharing there at any time. If you share it, the other person sees your exact position only while you are within 2 km of the Venue. When you are farther away, they see only your distance to the Venue, rounded to 100 m. If you do not share it, the other person sees nothing about your position. Your live position is deleted 2 hours after the meeting time (at the latest about 30 minutes after that). It is not kept anywhere else.
• Arrival record. When you arrive, we store on the meeting the time you arrived, your distance from the Venue at that moment, and whether it came from the background check or the open meeting screen. We do not keep coordinates or your route. We use it to decide attendance and no-shows fairly: location evidence can override the "Did they come?" answers. When both of you arrived, we record a completed meeting that the Venue is billed for, with the Venue, city, date and the two participants. The arrival record is kept as described in section 8.
• Arrival check data. To check that an arrival reported from the meeting screen is genuine, we also keep, for each person and each meeting, the time of the first position received in the window and the farthest distance from the Venue seen in the window (no coordinates). We use it only for that check. It is deleted 2 hours after the meeting time (at the latest about 30 minutes after that), and when you delete your account.
• Venues do not receive your location.
• Fake locations. To prevent fraud, positions from a mocked or fake GPS location may be rejected.

4.2. Rating the Venue after a meeting

You rate the place, never each other. After the meeting, once your phone reports that you have moved about 500 m away from the Venue, we ask you to rate it: 1 to 5 stars, a few optional labels (for example "clean" or "too loud") and an optional note of up to 300 characters. Rating is optional, you can skip it, and you can change it for 24 hours.

Location. To notice that you left, the App registers a 500 m geofence around the Venue, from the moment the Venue is revealed until 24 hours after the meeting time — in the same way, and only with the same permission, as the arrival check in section 4.1. Leaving it tells our servers the time and your rounded distance from the Venue; no coordinates and no route. If your phone never reports it, we simply ask you 3 hours after the meeting instead. Writing the rating itself does not use your location.

What the Venue sees. The Venue sees its average score, how many ratings it has, how the stars are spread and how often each label was chosen, and the text of the notes with only the month each was written in — and a month's notes only once at least 3 notes share that month. The Venue never sees who rated it, which meeting a rating belongs to, the day or the time, or anything about the other guest.

What the other person sees. Nothing of your rating. On the meeting they can see that you left the Venue and that you rated it — never when you left, never when you rated, and never the score, the labels or the note.

What we see. The full rating with your account and the meeting, so that we can keep the Venue pool honest, remove abusive text and decide whether a Venue stays in it.

4.3. Find Nochi (the game while you wait)

What it is. Find Nochi is an optional game with our cat mascot. The App offers it on the meeting screen only after you have arrived at the Venue and while the person you are meeting has not. You can close it at any time. It is not needed for anything else in the App.

The game camera. The game uses the back camera and Apple ARKit (iPhone) or Google Play Services for AR (ARCore) (Android) to find a table or the floor and hide Nochi there. On iPhones with a LiDAR sensor the phone also builds a 3D model of the objects around you, so that she can hide behind them. All of this runs on your phone. The camera images and the 3D model are not saved by the game or sent to us.

Your date's approach. Nochi reacts as the person you are meeting gets closer and when they arrive. For this the game uses only the distance and the arrival you can already see on the meeting screen (section 4.1): if they do not share their position, Nochi only reacts to their arrival. The game sends nothing about you or them.

No face data. Find Nochi uses only the back camera. It does not open the front camera, take a photo of you, or track or analyse your face or body. Face processing in NoChat happens only in selfie verification (section 5).

Nochi's message. After the game Nochi shows a short message made only from your first name (from your profile) and the time it took you to first catch her. It is shown on your phone and is not sent anywhere.

The game video. While you play, the App records the game view (the table and Nochi as they appear on the back camera) in its temporary storage on your phone. The microphone and the front camera are never used. Only if you tap to keep or share it, the App makes a short MP4 video (about 7 to 9 seconds) from the best moments, with the game's own sounds and the time it took you to find her. The video is kept only in the App's cache on your phone, for up to 24 hours, so that you can share it from the meeting screen after the date. It is deleted when you open the App after those 24 hours, when you sign out and when you delete your account. If you do not keep it, the recording is discarded when you leave the game, and at the latest the next time you open the App. The cache is not included in your phone's iCloud or Google backups. It is never uploaded to us. To share it, the App copies a caption to your phone's clipboard and opens your phone's share sheet, where you choose where it goes; a copy handed to the share sheet is deleted the next time you open the App. Nothing is posted automatically, and sharing earns no reward. Once you send it to another app or save it to your photos, that app's terms and your own choices apply. Other people in the café may be in the video: please ask them before you post.

The stamp book. When you and the person you meet have both checked in at a partner Venue, we add a stamp for that Venue to your stamp book. If you checked in and the other person did not come, you get a comfort stamp instead. Nochi earns outfits from completed dates and remembers when you are back at a Venue where you met before. We work these out on our servers from the arrival records, attendance and completed meetings we already keep (section 4.1). Meetings at a street meeting point get no stamp. Only you see your stamp book; the other person sees nothing of it. It is deleted with your account (section 8).

The shared link. The caption links to nochat.site/nochi. The link contains no identifier of you. That page counts visits and button clicks per day by page language, the utm_source tag and the city named in the link, if any. It sets no cookies, stores nothing in the browser, and stores no IP address or device data with the counts. To stop abuse, the IP address is used briefly in memory to limit requests and is never stored.

5. Selfie verification (face check)

5.1. How it works. The check runs entirely on your phone:

1. The App asks you to do random head movements (for example turn your head left or right). Face detection software on the device (Google ML Kit) checks that a live person did them.
2. An anti-spoofing model (MiniFASNet) checks that the camera sees a real face and not a printed photo or a screen.
3. A face-matching model (SFace) turns the live face and each of your profile photos into numbers in the phone's memory and compares them, to check that the photos show you.

5.2. What we store. We store only: pass/fail, the challenge results, the anti-spoofing and face-match scores, the method and model versions, a hash code identifying the photos checked, whether the App's security check (App Check) was present, your consent version, and the date and time.

5.3. What we do not store. No selfie photo, video, camera frame or face template (biometric template) is saved to your device storage, sent to our servers, or shared with anyone. The numbers used for the comparison exist only in the phone's memory during the check and are discarded.

5.4. Google ML Kit may send Google limited diagnostic information (such as device model, app ID and performance metrics). It does not include images.

5.5. Biometric data and consent. Processing your face to confirm that you are the person in your photos is biometric data processing under GDPR Article 9 and KVKK Article 6. In Azerbaijan, the law lists face images as biometric data, so your profile photos may count as biometric data too. We ask for your separate explicit consent before the camera opens. You can refuse and ask for manual verification instead. You can withdraw consent at any time: we then delete your verification result, the badge is removed and meetings cannot be scheduled until you are verified again.

5.6. The badge is removed when you change your profile photos. The badge is not an identity, background or safety guarantee (Terms of Service, section 5.3).

6. Processors and recipients

We use these service providers. Processors act on our instructions under written contracts, including data processing terms:

We may also disclose data to: law enforcement or authorities when required by law or to protect someone's life or safety; professional advisers (lawyers, accountants) under confidentiality; and a successor if our business is sold or reorganised, who will be bound by this policy.

7. International transfers

7.1. Where your data goes. Using NoChat means your data is transferred from the country where you live to the controller in the United Kingdom and to our hosting in the European Union (Belgium). Some services also process data in the United States (Google, Apple, RevenueCat, Stripe) and Switzerland (MapTiler).

7.2. From the EU to the UK we rely on the European Commission's adequacy decision for the UK. From the UK to the EU and Switzerland we rely on UK adequacy regulations.

7.3. To the United States we rely on the EU-US Data Privacy Framework and its UK Extension where the provider is certified, or on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum in the provider's data processing terms.

7.4. From Turkey. Transfers of data of users in Turkey abroad are made under Article 9 KVKK, using the standard contracts approved by the Personal Data Protection Board, which are notified to the Personal Data Protection Authority within 5 business days of signature.

7.5. From Azerbaijan. Law No. 998-IIIQ allows transfers abroad to countries with adequate protection and otherwise generally requires your consent, which you give in the App before your data is transferred.

7.6. You can ask us for a copy of the safeguards we use (section 16).

8. How long we keep data

When you delete your account, we delete your profile, photos, location, live position, arrival check data, decisions, matches, verification results, your Find Nochi stamp book and your bookings at Venues. The other person's pending meeting with you is cancelled. Blocks between you and other users are deleted in both directions. Data we must keep by law, and the limited safety record above, is kept only for the stated period, with restricted access.

Reports are the exception. Reports made about you are kept after your account is deleted, for the period above and in restricted form — accessible only to moderators, and only as evidence of what was reported and decided. Without them, someone who is reported can erase the record by deleting the account and signing up again. Reports that you made about other people are also kept, but your identity is removed from them, so that the person you reported cannot later be identified as having been reported by you. This is necessary for the safety of other users and to defend legal claims (Art. 17(3)(e) GDPR). In Turkey, data is deleted, destroyed or anonymised under our personal data retention and destruction policy.

9. Your rights

Depending on the law that applies to you, you have the right to:

• access the data we hold about you and receive a copy;
• rectify inaccurate data (you can edit most profile data in the App; date of birth is corrected through support, see Terms section 4.3);
• erase your data: use Account → Delete account in the App, or write to us;
• restrict processing in certain cases;
• data portability: receive the data you gave us in a structured, machine-readable format (JSON);
• object to processing based on legitimate interests;
• withdraw consent at any time (location, including background location: in your phone settings; sharing your live position: on the meeting screen, at any time; verification, gender preference and marketing consents: in the App or by writing to us);
• not be subject to solely automated decisions with legal or similarly significant effects, and to ask for human review (section 3.3);
• know who received your data and where it was transferred;
• in Turkey, the rights in Article 11 KVKK, including to ask that third parties who received your data are told about a correction or deletion, and to claim compensation for damage caused by unlawful processing.

How to ask. Send requests to connect@bitry.io (users in Turkey: see section 15.2). We may ask you to confirm that the account is yours (for example with a code sent to your phone number). We answer within one month (UK and EU GDPR; we may extend by up to two further months for complex requests and will tell you why) and within 30 days under KVKK. We do not charge for reasonable requests.

Complaints. Please contact us first so we can try to help. You can also complain to:

• the UK Information Commissioner's Office (ICO), ico.org.uk;
• in the EU, the data protection authority of the country where you live or work; in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt;
• in Turkey, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), after applying to us first (section 15.2);
• in Azerbaijan, the competent authority for personal data.

10. Security

We use encryption in transit (HTTPS/TLS) and Google Cloud's encryption at rest, access rules that limit who can read each type of data, App Check to block unauthorised apps, least-privilege access for staff, and review of access to safety data. No system is completely secure. If a personal data breach occurs, we will notify the ICO and the competent EU authorities within 72 hours where GDPR requires, notify the Turkish Personal Data Protection Board within 72 hours, inform affected users without undue delay where required, and meet any other notification duty.

11. Children

NoChat is only for people aged 18 and over. We require a date of birth at sign-up and do not knowingly collect data about anyone under 18. A report that a user is under 18 hides that account immediately until a moderator reviews it. If we confirm that a user is under 18, we suspend the account and delete the data, except what we must keep to prevent re-registration or to report to authorities. If you believe a minor is using NoChat, report it in the App or email connect@bitry.io.

12. Notifications, marketing and device storage

• Push notifications (for example a new match or a meeting reminder) are sent only if you allow them in your phone settings.
• Marketing emails or SMS are sent only with your prior opt-in consent, which you can withdraw at any time. For users in Turkey, consent to commercial electronic messages is registered in the Message Management System (İYS).
• Device storage. The App stores on your device only what it needs to work and stay secure (for example your login session and App Check tokens) and, for up to 24 hours, a Find Nochi game video you chose to keep (section 4.3). This is strictly necessary and does not need consent under Law No. 41/2004 and similar rules. We do not use advertising trackers or third-party advertising SDKs.
• Usage analytics and crash reports. Once you have accepted the current Terms, and while "Share usage analytics" in Settings is on (it is on by default), the App sends usage events to Google Analytics for Firebase and crash reports to Firebase Crashlytics, linked to your account ID. Events record steps in the App (for example sign-up, verification, a match, a meeting scheduled, a purchase), with your city, app language and whether you are Verified or have Plus. For Find Nochi the events are: a surface was found (nochi_scan_ok), the first catch with the time as a range such as 11–20 seconds (nochi_first_catch), the play scene reached (nochi_play_reached), how the game ended, "arrived" or "quit" (nochi_session_end), a video kept (nochi_clip_saved) and a tap on sharing the video (nochi_share_tap). These events contain no match or Venue, no place, no meeting time, no image and no face data. We use them to fix errors and to see which parts of the App work, in aggregate. You can turn the switch off at any time: collection stops and the identifier is cleared.
• Nochi on nochat.site. The nochat.site pages show Nochi in 3D and a short Find Nochi mini-game that runs in your browser (three.js) and does not use the camera. "Meet Nochi on your table" opens your phone's own AR viewer (Apple AR Quick Look, Google Scene Viewer or the browser's WebXR, which asks for camera permission); the camera image stays on your phone. The pages count, per day and without cookies or identifiers as in section 12.1, when the game is started, when Nochi is first caught, when a game is finished, when the waitlist button in the game is tapped, and when the AR viewer is opened. The 3D viewer and the game's 3D library are loaded from the jsDelivr CDN and the fonts from Google Fonts, which receive your IP address to deliver them.

12.1. Waitlist on nochat.site

Before NoChat launches, you can join a waitlist at nochat.site/waitlist.html without creating an account.

• What we collect: your email address, the language of the page, your confirmation that you are 18 or older, your consent together with the exact consent text and the time you gave it, and the utm_source and utm_campaign tags if the link you followed contained them. To stop abuse of the form we count sign-up attempts per IP address per hour. We store only a keyed hash of the IP address, never the address itself, and delete it within two hours.
• City, gender and invitations: you choose your city, and you may add your gender (woman, man, non-binary or prefer not to say). We never ask about sexual orientation. We use them only to plan which city opens first and to open it with a balance of people. Each entry gets a personal invitation code; if you joined through someone's link, we store their code and add one to their invitation count, which only decides priority at launch. We do not show your email to the person who invited you.
• Page counters: the home and waitlist pages count visits and completed sign-ups per day, by page and utm_source. No cookies are set, and no IP address, device data or identifier is stored with the counts.
• Why: to send you an email when NoChat launches. We send that email to everyone on the list. We do not use the list for anything else and do not share it, except with Google Cloud / Firebase, which stores it for us (section 6).
• Legal basis: your consent (Art. 6(1)(a) GDPR; for Turkey, explicit consent under Art. 5(1) KVKK). For the IP hash: our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK).
• How long we keep it: we delete your waitlist entry 12 months after NoChat launches, or earlier if you unsubscribe or ask us to delete it.
• How to withdraw consent: reply to our email or write to connect@bitry.io. Withdrawing does not affect emails sent before.

12.2. Partner venue waitlist on nochat.site

Before NoChat launches, cafés and restaurants can join a partner venue waitlist at nochat.site/partners-waitlist.html without creating an account.

• What we collect: the venue name and city; the contact person's name and business email address; if given, a phone number and the venue's Instagram or website; the confirmation that the person is authorised to act for the venue; the consent together with its exact text and the time it was given; the language of the page; and the utm tags and ref code if the link contained them. The form is protected with the same hashed, per-hour IP count as in section 12.1.
• Why: to contact the venue about joining NoChat as a partner venue, including telling it when partner registration opens and the launch date. We do not use the list for anything else and do not share it, except with Google Cloud / Firebase, which stores it for us (section 6).
• Legal basis: consent (Art. 6(1)(a) GDPR) and steps taken at the venue's request before entering into a partner agreement (Art. 6(1)(b) GDPR); for Turkey, explicit consent and the establishment of a contract (Art. 5(1) and 5(2)(c) KVKK).
• How long we keep it: until partner registration opens in the venue's city and 12 months after that, or earlier if you ask us to delete it. If the venue registers as a partner, section 13 applies from then on.
• How to withdraw consent: reply to our email or write to connect@bitry.io. We then stop contacting you about the partnership and delete the entry. Withdrawing does not affect contact made before.

13. Venue partner contacts

If you register a Venue on partners.nochat.site, we process the name, phone and email of the contact person and signatory, the Venue's business details (legal name, address, tax and VAT number), billing details, menu, photos and uploaded files, to run the partner account, bill the Venue through Stripe, list events, and communicate with you (including launch-date and billing notices). If the Venue opens a Stripe account for events, Stripe processes the identity checks it needs as an independent controller. The legal basis is contract (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK), legal obligation (6(1)(c); 5(2)(ç)) and our legitimate interests in running the partner programme (6(1)(f); 5(2)(f)). The Venue's menu PDF is read by Google Vertex AI (section 6). We keep this data for the term of the partnership and afterwards as long as tax and accounting law requires.

14. Changes to this policy

We will publish updates here with a new version number and effective date. For material changes, we will tell you in the App before they apply and, where the law requires, ask for your consent again.

15. Country-specific information

15.1. Portugal and the European Union

• EU representative (Art. 27 GDPR): Bitry LTD will appoint a representative in the European Union under Article 27 GDPR before offering NoChat to users in the EU. Until then, you and the supervisory authorities can contact us at connect@bitry.io about any data protection matter.
• Supervisory authority in Portugal: Comissão Nacional de Proteção de Dados (CNPD).
• Data protection impact assessment. We carry out a DPIA under Article 35 GDPR for location (including background location and live position sharing at meetings), meetings with strangers, gender preference and face verification before launch in the EU.

15.2. Turkey (KVKK information notice)

• Data controller: BITRY LTD (details at the top). Data controller representative in Turkey and VERBIS registration: before offering NoChat in Turkey, Bitry LTD will appoint a data controller representative and register with VERBIS as required by KVKK.
• Purposes and legal grounds: section 3.1 (Articles 5 and 6 KVKK).
• Method of collection: electronically, through the App, the partner panel, Stripe, the Stores and RevenueCat, and by email, partly by automated means.
• Recipients and transfers abroad: section 6 and section 7.4 (Articles 8 and 9 KVKK).
• Explicit consents we ask for separately in the App: (1) processing of biometric data for selfie verification; (2) processing of your gender preference, which may reveal data about sex life; (3) where needed, location, including background location for the arrival check and sharing your live position with the person you are meeting; (4) commercial electronic messages. Refusing (1) does not stop you using the rest of the App; (2) is needed for matching.
• Your rights under Article 11 KVKK: section 9.
• How to apply: in writing to our representative or to BITRY LTD, by registered electronic mail (KEP), secure electronic signature or mobile signature, or from the email address or phone number registered in the App, as provided in the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer within 30 days. If we reject your application, do not answer in time or you find the answer insufficient, you can complain to the Personal Data Protection Board within 30 days of our answer, and in any case within 60 days of your application.

15.3. Azerbaijan

We process data of users in Azerbaijan under Law No. 998-IIIQ "On Personal Data".

15.4. United Kingdom

Bitry LTD will register with the UK Information Commissioner's Office (ICO) before NoChat is made available to users; the registration number will be published at the top of this Policy. You can complain to the ICO at any time.

16. Contact

BITRY LTD (controller)
Registered in England and Wales, company number 16107519
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: connect@bitry.io
EU representative (GDPR Art. 27): to be appointed before NoChat is offered in the EU (section 15.1)
Data controller representative in Turkey (KVKK): to be appointed before NoChat is offered in Turkey (section 15.2)
Data protection officer: not appointed; data protection questions to connect@bitry.io