Privacy Policy

1. Scope

This Privacy Policy explains how I'm Here handles personal data across the consumer app, partner portal, and admin portal. It covers website visitors, users who scan venue QR codes, account holders, waitlist contacts, venue owners, staff, and admins.

2. Data we collect

• Account and profile data: name, age, email address, password hash, email verification status, profile photo, intention, looking-for settings, vibe tags, subscription tier, account status, and deletion status.
• Venue presence data: QR scans, venue sessions, room entries, live or recently-left status, joined time, last active time, leave time, venue ID, entry source, free wave counts, and session expiration.
• Interaction data: waves, mutual matches, chat messages, feedback, blocks, reports, report reasons, moderation status, and limited report evidence snapshots.
• Device and security data: session IDs, access-token identifiers, refresh-token identifiers, IP address hashes, user-agent hashes, CSRF state, rate-limit signals, audit logs, and security events.
• Media and storage data: profile photos and QR images served through backend-controlled media endpoints.
• Notifications and communications: OTPs, password reset requests, email change OTPs, notification preferences, push subscription endpoint data, waitlist emails, partner invites, and delivery logs.
• Partner and venue data: owner emails, display names, assigned venues, venue contact email, venue address, schedule, live-mode settings, QR metadata, analytics, waitlist counts, and operational actions.
• Billing data: Stripe customer IDs, checkout session IDs, payment intent IDs, subscription IDs, charge IDs, refund IDs, plan type, status, amount, currency, and entitlement state.

3. How we use data

• Create accounts, verify email addresses, authenticate sessions, route users to the right portal, and protect each portal separately.
• Operate live venue rooms, show who is in the same venue right now, enable waves, create mutual matches, support chat, and expire inactive sessions.
• Provide partner tools for assigned venues, including live controls, QR access, waitlists, privacy-safe people views, safety views, and analytics.
• Send service messages, OTPs, partner invites, waitlist updates, push notifications, and account security messages.
• Process payments, subscriptions, refunds, entitlement updates, and billing portal sessions.
• Detect abuse, enforce safety rules, moderate reports, investigate incidents, audit sensitive actions, prevent fraud, and comply with legal obligations.

4. What other people can see

• Users in the same live venue room may see profile information needed for matching, such as first name, age, photo, intentions, vibe tags, and room presence status. They do not see your email address through the room UI.
• Mutual matches can see the chat thread for that match while it is available.
• Partners see operational, venue-scoped, privacy-safe views. They can see limited profile and room-presence information for assigned venues, waitlist status counts, and sanitised safety information. Partner safety views do not reveal reporter identity or private chat transcripts.
• Admins may access account, venue, moderation, billing, audit, and report information where needed to operate and secure the platform.

5. Sharing and service providers

Our database, cache, and media (photo and QR) storage are self-hosted on our own UK infrastructure and are not shared with outside companies. Only the four service providers below receive personal data, and each is bound by a data processing agreement that limits use to providing their service to us.

• Stripe (payment processing): your email, name, billing address, the card details you enter directly into Stripe's checkout, and subscription and charge metadata.
• Resend (email delivery): your email address and the contents of service emails such as one-time codes, password reset and account-unlock links, match and message alerts, invites, and waitlist notices.
• Cloudflare Turnstile (anti-bot check): a verification token and your IP address, used only when an extra login security check is triggered after repeated failed attempts.
• Browser and operating-system push services (for example Google, Mozilla, or Apple): only if you turn on notifications. The notification content is encrypted so the push service cannot read it.
• We may also share limited information with venues, partners, admins, legal advisors, law enforcement, or emergency responders when needed for safety, compliance, fraud prevention, dispute handling, or legal obligations.
• We do not sell personal information, and we do not let partners use operational data for unrelated advertising or resale.

6. Cookies, local storage, and similar technology

We keep cookie and storage use to the minimum needed to run the service. The items below are everything the consumer app sets in your browser. The authentication and security cookies are strictly necessary to sign you in and protect requests, so they are used without a separate consent step. Everything else is either functional or opt-in.

• ih_user_access (HTTP-only cookie, ~15 minutes): keeps you signed in for the current session. Strictly necessary.
• ih_user_refresh (HTTP-only cookie, ~30 days): renews your session so you are not signed out constantly. Strictly necessary.
• IH_XSRF_TOKEN (cookie, current session): CSRF protection for actions that change data. Strictly necessary.
• ih-cookie-consent (local storage): records that you have seen this cookie notice so it is not shown again. Strictly necessary.
• ih-user-flow-intent (session storage, cleared when the tab closes): remembers the venue or page you were heading to while you sign in or finish onboarding. Functional.
• ih-push-subscription-id and ih-push-nudge-dismissed (local storage): only created if you turn on push notifications. They store your push subscription reference and whether you dismissed the push prompt. Optional / opt-in.
• Web push also requires a service worker and a push subscription, which are created only when you enable notifications. You can manage push permissions in your browser and in notification settings at any time.

7. Retention

• We keep account and profile data while your account is active, unless deletion or legal retention rules apply.
• Venue sessions, room entries, scans, waves, matches, messages, reports, audit logs, billing records, and security records may be retained as needed for product operation, dispute handling, abuse prevention, accounting, tax, legal, safety, and audit purposes.
• OTP records and similar temporary security records are intended to expire or be cleaned up after they are no longer needed.

8. Your choices and rights

• You can update profile details, notification preferences, password, email, active sessions, blocked users, and billing access where those tools are available in the app.
• You can request access, correction, deletion, portability, objection, restriction, withdrawal of consent, or complaint handling where those rights apply under laws such as GDPR, CCPA/CPRA, and India's Digital Personal Data Protection Act.
• Some requests may require identity verification, and some data may be retained where necessary for safety, security, legal, billing, fraud prevention, or dispute reasons.

9. Security

• We use portal-separated authentication, HTTP-only cookies, CSRF controls, password hashing, hashed IP/user-agent fingerprints for sessions and scans, backend-proxied media, rate limits, audit logs, and role-scoped access controls.
• No system is perfectly secure. Tell us quickly if you believe your account, venue access, QR, or data has been misused.

10. Children and age limits

I'm Here is for adults. Consumer accounts require users to be 18 or older. We do not knowingly allow under-18 consumer accounts.

11. International data transfers

Your core data — your account, profile, messages, photos, and venue activity — is stored on our servers in the United Kingdom.

• The service providers in section 5 (Stripe, Resend, Cloudflare, and your browser or operating-system push service) are based in the United States, so the limited data they receive is transferred there.
• These transfers are protected by recognised legal safeguards, including the UK Extension to the EU–US Data Privacy Framework and Standard Contractual Clauses, together with the data processing agreements we hold with each provider.

12. Changes

We may update this policy as the service changes. If a material update affects how active users or partners use the platform, we may show a new notice or require acceptance before continuing.