Privacy Policy

1. Scope

This Policy describes how Sync REM Solutions Kft. ("we", "us") processes personal data across the AI & Sync service, including the website, the mobile application, host event creation, participant registration and onboarding, live in-person events, compatibility scoring, moderation, communication, payments and support.

We process personal data under Regulation (EU) 2016/679 ("GDPR") and applicable Hungarian data-protection law. Where we act as a data processor rather than a controller, we say so explicitly and identify the relevant controller and processing context where appropriate (see §3.9 and §7.6).

This Policy applies to personal data processed by us in connection with the AI & Sync service. It does not govern processing carried out by third-party providers acting as independent controllers for their own purposes; those providers provide their own privacy information where applicable.

2. Controller

• Legal name: Sync REM Solutions Kft. (Sync REM Solutions Korlátolt Felelősségű Társaság)
• Registered address: 2040 Budaörs, Szabadság út 219. 1. em. 2. ajtó
• Company registration number: 13-09-248909
• Tax identification number: 33113551-1-13
• Data-protection contact: support@aiandsync.com
• Supervisory authority: the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

We have not appointed a Data Protection Officer.

If you have questions about how we process your personal data or wish to exercise your data-protection rights, you may contact us using the details above.

3. Data We Collect

3.1 Account and authentication

Held by our authentication provider (§7.1) and mirrored in our database: email address, given and family name, phone number where provided, provider user identifier, role (participant / host / administrator), last-login timestamp, account timestamps. Passwords and session credentials are held by the provider and are never visible to us.

Authentication and account-management data may also include information generated in connection with sign-in, account security, authentication events and session management.

3.2 Profile

Nickname and host display name; date of birth; gender; biography, "about me", prompts and free-text answers; height, hair colour, eye colour, tattoos, piercings; job title and education level; smoking, drinking, diet, exercise; pets; sleep schedule; children and intent regarding children; marital history; religion; personality; relationship intent; values; languages; interests; preferred partner age range.

Some of these fields may constitute, reveal or permit inference of special-category personal data in particular circumstances, as described in §4 below. The classification depends on the information actually provided and the processing context; not every field listed above is special-category data merely because it may relate to a sensitive topic.

3.3 Photographs and selfies

Up to three profile photographs, and a live selfie taken in the application at the moment you join an event. Both are stored by our storage provider (§7.5) using URLs generated by our storage provider. Profile photographs are displayed to other participants at events you join. The event selfie is displayed to participants at the relevant event so that they can recognise you.

Profile photographs are visible to other participants at events you join. The event selfie exists so people can recognise you that night.

Unless otherwise stated in this Policy, photographs and selfies are not used for advertising or biometric identification. We do not create or retain a biometric template from the selfie.

Voice intro (optional). If you choose to record one: a spoken introduction of up to 30 seconds, its length, and a waveform drawn from it while recording. It is stored by our storage provider (§7.5), is part of the snapshot taken when you join an event (§3.4), and can be played by other participants at events you join. The microphone is used only while you are recording it. You can replace or delete it at any time; an event you have already joined keeps the version it froze. Your voice is not used for advertising or biometric identification, and we do not create a voiceprint.

3.4 Event participation

Which events you register for and how you arrived (direct, host invitation, join code, QR); check-in state; profile- and questionnaire-completion state; consent acceptance and the version accepted; matchmaking questionnaire answers; your "how to find me" note and appearance note; capacity and eligibility outcomes.

At the moment you join a live event we take a frozen snapshot of your profile (including any voice intro), preferences, photographs and prompts. That snapshot — not your live profile — is what other guests see and what scoring reads for the duration of the event. Editing your profile mid-event does not change it.

The snapshot is created for the purposes of operating the event, presenting participants to other joined participants, and performing the compatibility calculation applicable to that event. It is retained in accordance with §6.

3.5 Live event activity

Presence status (open, in conversation, heading out, away), last-seen timestamps and heartbeats; swipes (like or pass); mutual matches; compatibility scores and their per-field breakdown; QR scans you perform of other guests; blocks you place or receive.

These records are used to operate the live event, provide the matching and interaction features you request, maintain safety and security, and enforce event rules.

3.6 Safety and moderation

Reports you file or that are filed about you, including the category and up to 500 characters of free text; the host's response and any administrator verdict, action and reason; moderation records for your uploaded photographs, voice intro and text — for a voice intro that was flagged or refused, a transcript of it — including the raw category scores returned by our moderation classifier; blocks; removal records including who removed you, when, and why.

Moderation scores are technical classification outputs used to support content-safety and moderation processes. They are not treated as statements that a person possesses any particular characteristic unless the underlying content itself provides such information.

3.7 Support

Support ticket subject, message body, your email address, your package tier, and any attachments you upload.

Attachments may contain personal data relating to you or other individuals. Please do not include information that is not necessary to resolve your support request.

3.8 Payments (hosts only)

Order number, amount, currency, status, discount code, refund amount, failure reason, and the identifiers returned by our payment processor. We never receive or store card numbers, CVV codes, or billing addresses — those are collected directly by the payment provider (§7.3).

3.9 Invitations (host-provided)

If you create an event you may invite people by email address. We store that address with an invitation token, status and expiry.

Where a host provides an invitee's email address solely so that we can send the invitation on the host's behalf, the host determines the purpose of that invitation and we process the email address on the host's documented instructions, subject to the applicable controller–processor arrangement. We may nevertheless process limited information independently where necessary to operate, secure or defend the service or to comply with law.

The invited person does not need to create an account merely to receive an invitation.

3.10 Technical and log data

IP address and coarse location derived from it during the request; device and browser identifiers in request headers; server and webhook logs; rate-limiting records keyed to IP address or account; error reports and performance traces (§7.8). We do not record your screen — see §7.8.

3.11 Mobile device data

Push notification tokens, where registered.

We do not collect: precise geolocation, advertising identifiers, device fingerprints, your contacts, or biometric templates. The microphone is used only to record the optional voice intro (§3.3), and only while you are recording. The application requests no location permission and contains no location code.

4. Special-Category Data (Article 9)

Some profile fields reveal, or allow inference of, special categories of personal data:

We do not treat every field listed above as special-category data in every circumstance. Where a field or combination of fields reveals special-category personal data, we apply the additional requirements of Article 9 of GDPR.

Every one of these fields is optional, and choosing not to answer costs you nothing — the protections listed below explain how our scoring treats an unanswered one, and it is not as a mismatch. Where a field you have answered reveals special-category data, answering it is your consent to us processing it for matching, under Article 9(2)(a).

You can withdraw that at any time, without contacting us, by setting the field to "Prefer not to say" in your profile. Our scoring then drops the characteristic entirely, and drops the matching preference you stated about it, so you are never filtering other people by something you have withheld yourself.

Withdrawal does not affect processing already carried out, and it does not reach the frozen copies taken at events you have already joined — those are described in §3.4.

Our scoring system applies specific protections to religion and marital history:

• Declining a field removes it from the calculation entirely. It does not count against you.
• Declining and simply leaving a field blank are made indistinguishable in the score, the breakdown and the coverage figure — so nobody can determine, by observing how their score changes, that you declined.
• If you decline a field, your own stated preference on that field is dropped too. You cannot withhold a characteristic and filter others by it.
• No user-set priority ("green flag" / "red flag") may name one of these fields. This is enforced when the software loads, not merely checked at runtime.
• None of these fields ever appears in the informational labels returned to other users.

5. Purposes and Legal Bases

Where we rely on legitimate interest we have balanced that interest against your rights and concluded it does not override them. You may object under Article 21 (§10).

6. Retention

7. Recipients and Processors

Each processor below is bound by an Article 28 data-processing agreement and acts only on our documented instructions, except where noted.

7.1 Authentication — Kinde. Email, name, phone where provided, password, session data. Kinde also notifies us when an account is created or signs in.

7.2 Database and hosting — Neon (PostgreSQL) and Vercel (application hosting). All data described in §3. Both storage and processing are in the European Union: Neon holds the database in AWS Europe (Frankfurt), eu-central-1, and our Vercel application functions execute in Vercel's Frankfurt region, fra1. Server-rendered pages, API routes, server actions and scheduled jobs therefore run in the EU. Vercel also processes the cookieless website measurement described in the Cookie Policy §5 — Vercel Web Analytics and Vercel Speed Insights — on our behalf: page-view and page-speed records that are not tied to your IP address, told apart by a per-request hash Vercel discards after 24 hours, and kept only as aggregated statistics.

Two qualifications we would rather state than leave you to discover. Vercel and Neon are US-established companies, so their personnel and support systems may be able to access data in the course of operating the service, and that access is covered by §8. And requests reach us through Vercel's global edge network before arriving at the Frankfurt functions — routing, caching and edge middleware run at whichever edge location is nearest to you, which may be outside the EU.

7.3 Payments — Stripe (Merchant of Record). Host package purchases are sold through Stripe Managed Payments, under which Stripe is the seller of record: it issues the receipt and is responsible for the transaction taxes. Stripe is therefore an independent controller for the purchase transaction, not solely our processor, and processes payment data for its own regulatory purposes — fraud prevention, anti-money-laundering, and payment-network and tax compliance — under its own privacy policy. It receives the host's email address, name, amount, currency, and our order and user identifiers, and collects card and billing-address data directly from the payer. We receive back the order number, amount, currency, status, discount code, refund amount, failure reason and Stripe's identifiers; we never receive card numbers, CVV codes or billing addresses.

7.4 Email — Brevo (production) and an SMTP relay (development). Recipient addresses and message bodies for transactional email. Brevo also holds our marketing contact lists, segmented by whether you are a user, a host, or a non-account subscriber.

7.5 File storage — Vercel Blob. Profile photographs, voice intros, event selfies, event cover images and support attachments. Stored with public access at unguessable URLs. Access to photographs is controlled through the application, except where this Policy explicitly states otherwise.

7.6 Moderation — OpenAI. Profile text is submitted to OpenAI's moderation endpoint for classification before publication. A voice intro is sent to OpenAI's transcription service as an audio file, and the transcript is classified in the same way as profile text. Photographs are submitted as a link: we send the storage URL and OpenAI retrieves the image from it, so the photograph itself leaves the EEA. Those URLs are unguessable but are not access-controlled (§7.5), and they remain valid after the check. Classification is the only purpose: we do not use OpenAI for facial recognition, biometric identification, or any attempt to identify who is in a photograph. The returned category scores are stored against the content in our moderation queue.

7.7 Compatibility scoring — our own scoring service. For each candidate we send an opaque participant identifier, gender, and your complete frozen profile and preference snapshot (approximately 46 fields, including religion, education, and intent regarding children). We do not send your name, photographs, biography, raw date of birth (age is derived before transmission), or your "one thing that matters" answer, which is deliberately excluded from the transmitted schema. The service is stateless, stores nothing, and logs field names only — never values.

7.8 Error tracking — Sentry. Exception reports, stack traces, performance traces, and the short trail of actions leading to an error. No session replay: Sentry can reconstruct what a visitor saw and did, including page content, and we have switched that off entirely rather than offering it as something to consent to.

7.9 Push notifications — Expo. Push tokens and notification content, where push is enabled.

7.10 Support alerting — Discord. When you open a support ticket, a message is posted to an internal Discord channel so the team is alerted. It contains the ticket subject, the full text of your message, your email address, your package tier, the ticket category, status and priority, the event name where one applies, and the URLs of any files you attached. Attachments are rendered in the channel.

7.11 Hosts. A host sees, for participants of their own event only: name and nickname, profile photographs, the match pairs and compatibility scores generated for that event, and any report filed at that event. Hosts cannot see other hosts' events or participants.

7.12 Other participants. At a live event you have joined, other joined participants see your frozen snapshot: photographs, voice intro if you recorded one, live selfie, nickname, age, occupation, prompts, interests, your "how to find me" note, your presence status and your compatibility score with them. They do not see your email address, phone number, exact date of birth, or your stated preferences.

7.13 Advisers and authorities. Accountants, auditors and lawyers under professional confidentiality; public authorities only where legally required.

7.14 Match descriptions — OpenRouter, and the model provider it routes to. At questionnaire events on our premium package, a short note describing why two participants were paired is written by a language model. The request goes to OpenRouter, which forwards it to whichever provider serves the model we have selected; both therefore process the content of the request.

What is sent, for a pair of participants, is limited to: the wording of a survey question they answered the same way, which of that question's two ends they both landed on, and whether the agreement was strong or moderate. Our own code establishes that list before anything leaves our systems.

We do not send names, nicknames, photographs, biographies, "how to find me" notes, ages, dates of birth, genders, email addresses, compatibility scores, event names, or the identifiers of the participants or the event. We do not send the answers themselves — the value a participant chose is converted into the question's own wording and discarded before the request is built. No question that touches sex life, or religious or philosophical belief, is in the questionnaire at all — these are special categories under Article 9, and the protection is that such a question is never asked. Every question a host can put in a questionnaire can therefore also appear in a description.

The generated text is stored against the match and shown to both participants, under a heading labelled "AI-generated". It describes a pairing already made and has no effect on who is matched, on any score, or on the order anything is shown in.

The host decides whether these notes are published. When results are released the host chooses whether to include them, and the choice applies to every guest at that event or to none of them. Where the host declines, the text is withheld on the server and never reaches the participant's device. See §9.

We do not sell personal data and do not share it with advertising networks or data brokers. There is no advertising SDK or attribution tool in the service. The only website measurement is Vercel Web Analytics and Vercel Speed Insights, which set nothing on your device and are not tied to your IP address; the Cookie Policy (§5) says exactly what they record, and §7.2 above names the processor.

8. International Transfers

Kinde, Stripe, OpenAI, Vercel, Neon, Sentry, Expo and OpenRouter (together with the model provider it routes to, §7.14) are established outside the EEA or may route data through non-EEA infrastructure. Vercel and Neon are listed here even though our database and application both run in Frankfurt (§7.2): the region determines where the data sits and executes, not who can reach it, and both are US companies whose staff and support systems may access it in the course of operating the service. Those transfers rely on European Commission adequacy decisions where available, and otherwise on Standard Contractual Clauses under Article 46(2)(c), with supplementary technical measures. Because Stripe acts as an independent controller for the purchase transaction (§7.3), any transfer to it relies on the controller-to-controller module of those Clauses, or on Stripe's own transfer safeguards, rather than on the controller-to-processor module used for our other providers. The transfer to OpenAI (§7.6) includes user photographs and voice intros. The transfer under §7.14 carries no directly identifying data — no name, photograph, free text or identifier — only the wording of survey questions two participants answered alike. You may request a copy of the safeguards from support@aiandsync.com.

9. Automated Decision-Making

We rank the people shown to you at an event using an automated compatibility score, and for host-run questionnaire events we generate suggested pairings automatically.

Neither produces legal effects or similarly significant effects on you: the score orders a list and never hides anyone, a match requires both people to independently choose each other, and host-run pairings are triggered and released by a human host.

The logic involved. Scoring is fixed, human-written logic, not a learned model: the same inputs always produce the same result, and nothing changes based on how you or anyone else has behaved in the app. Your stated answers are compared with the other person's, and the figure reflects both how well they fit what you said you wanted and how well you fit what they said they wanted, so a high figure requires both directions to be good. Marking a characteristic as a green or red flag increases how much it counts in your direction, up to a cap; flags change weighting only and never filter anyone out. Leaving an answer blank is not counted as a mismatch.

What it reads. The profile and preference fields listed in §3.2 — age (derived as a number; your date of birth itself is never sent), height, hair and eye colour, tattoos and piercings, education, smoking, drinking, diet, exercise, pets, sleep schedule, children and intent regarding children, marital history, personality, religion, relationship intent, values, languages and interests — together with the preferences you stated about each and your green and red flags. For questionnaire events it reads your answers to that event's questions, your gender, and your age and age preference where the event uses them.

What it does not read. Your name, photographs, biography, prompts, date of birth, location, device, messages, or anything about how you have behaved — no swipes, no past matches, no engagement history. Your free-text "one thing that matters" answer is excluded from the data structure entirely and is never sent to the scoring service. That service holds no database: it receives data, returns a number and keeps nothing, and its logs record field names, never values.

Sensitive characteristics. Religion and marital history carry the specific protections set out in §4.

You may request human review of an outcome, ask how a score was reached — we hold the per-characteristic breakdown and will provide it for any score concerning you — contest the outcome, and correct any input. There is currently no way to take part in an event without being scored — joining means being ranked. Contact support@aiandsync.com.

Written match descriptions. At questionnaire events on our premium package, a language model writes the short note shown with each match. It is given only the survey questions two participants answered the same way and which end they both landed on — never a name, a photograph, anything either has written, or the compatibility score — and it runs after the pairing is decided and saved. It describes; it does not decide, and it cannot change who is matched or any score. It is labelled "AI-generated" where it appears, and it is published only if the host elects to include it when releasing results — for every guest at that event or for none. See §7.14.

Future model development. Matching itself is fixed, human-written logic, and no model is trained on your data. We may in future retain and use event, matching and interaction data to develop and evaluate models that improve how well matching predicts compatibility. If we do, we will tell you before it starts, you will be able to opt out without losing access to the service, and the fields listed in §4 will be excluded. Data retained on this basis is used to improve matching quality only: it is not used for advertising or marketing profiling, and it is not sold or shared with data brokers.

10. Your Rights

You may exercise the following free of charge via support@aiandsync.com:

• Access (Art. 15) — a copy of the data we hold about you.
• Rectification (Art. 16) — profile fields are directly editable in the application.
• Erasure (Art. 17) — see the Account Deletion policy for what is erased, what is retained and why.
• Restriction (Art. 18) and portability (Art. 20).
• Objection (Art. 21), including to processing based on legitimate interest, and to direct marketing at any time and without reason.
• Withdrawal of consent (Art. 7(3)), including the explicit consent in §4.
• Not to be subject to solely automated decisions (Art. 22) — see §9.
• Complaint to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or to the authority where you live or work.

You can delete your account from within the application, or by email. We respond within one month of verifying your identity, extendable by two months for complex requests under Article 12(3).

11. Cookies

See the Cookie Policy for the full list, including duration and purpose. In summary: cookies strictly necessary for authentication, security and language selection are set without consent; anything else requires your opt-in through the consent banner, which you can change at any time. Our page-view and page-speed measurement sets no cookie and stores nothing on your device, and is described there in §5.

12. Marketing

We send marketing email only with prior opt-in consent, and every message carries an unsubscribe link. Transactional messages — invitations you accepted, receipts, event logistics, safety notices — are part of the service and are not affected by marketing consent.

13. Security

TLS for all traffic; signed and verified inbound webhooks; constant-time comparison of service credentials; role-based access control on production data; separation of authentication credentials (held by our provider) from application data; ownership checks so hosts reach only their own events; rate limiting on scanning, reporting and support; server-side enforcement of the minimum age and of every eligibility rule, so a modified client cannot bypass them; deliberate suppression of rejected field values from validation errors on the scoring endpoint, because those values are special-category data.

Two limits worth stating plainly: files in storage are reachable by anyone holding the URL, and no service can guarantee absolute security. We notify the supervisory authority and, where the risk is high, affected users, under Articles 33 and 34.

14. Children

AI & Sync is for adults aged 18 or over. The minimum age is enforced on our servers when a date of birth is saved and again when you join an event, so a modified application cannot bypass it. We do not perform document-based age verification.

If we learn we hold data on a person under 18 we delete it without undue delay. Report a suspected minor through the in-app report action, choosing "Underage", or by email — see the Child Safety Standards.

15. Breach Notification

We notify the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) within 72 hours of becoming aware of a notifiable personal-data breach (Art. 33), and affected individuals without undue delay where the risk to them is high (Art. 34).

16. Changes

We update this Policy when the service or the law changes. The date at the top reflects the current version. Material changes are announced in the service or by email at least 14 days before taking effect.

17. Contact

Sync REM Solutions Kft.

2040 Budaörs, Szabadság út 219. 1. em. 2. ajtó

support@aiandsync.com