Privacy Policy

Last updated: 15 September 2026

This is a translation of the French version. In the event of any discrepancy, the French version shall prevail.

FRENDE

The purpose of this Privacy Policy is to inform you of how bpm processes your personal data in connection with your use of the Application and the Services, in accordance with Regulation (EU) 2016/679 ("GDPR") and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended. It applies to all Services published by bpm that you use, excluding services provided and operated by third parties. It supplements the Terms of Use, of which it forms an integral part.

Article 1 — Data controller

The controller of your personal data is BPM, a simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register under SIREN number 993 678 648, publisher of bpm, whose registered office is located at 24 bis rue de Téhéran, 75008 Paris, France ("bpm").

bpm has not appointed a Data Protection Officer (DPO): under Article 37 of the GDPR, such an appointment is only mandatory for public authorities, or in the case of regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special categories of data. Any request relating to this Policy or to the exercise of your rights may be sent directly to the contact below:

• by e-mail: [email protected];
• by post: bpm, 24 bis rue de Téhéran, 75008 Paris, France.

Article 2 — Data we collect

2.1 Mandatory data at sign-up

• Identification data: first name, gender, date of birth.
• Phone number (depending on the sign-up method) or data provided by Apple or Google if you sign in with those accounts.
• At least three Profile photographs.
• Data relating to your activity on the Application.
• Technical data of your mobile phone or device.
• If you refuse geolocation: your city and country.

2.2 Data required for certain features

• Precise geographic location (with your consent).
• Search preferences (age, location, sports).
• Gender you are looking for — see the specific processing in Article 3.2.
• Text messages and voice messages sent and received.
• Data relating to reports and to requests sent to customer service.
• Data relating to purchases and subscriptions (excluding banking data, which bpm never collects).
• Data relating to Profile verification and the fight against fake profiles — see Article 3.1.
• Proof of identity, where bpm requests it under the conditions of Article 3.4 of the Terms of Use.
• Data relating to testimonials and satisfaction surveys.

2.3 Optional data

• Profile description, interests and sports habits, height, answers to Profile questions.

2.4 Automatically collected data

• Connection and activity data (sign-up date, login dates, online or offline status, interactions, notifications).
• Technical device data (IP address, mobile identifier, application version, phone version and model, operating system, language, advertising identifier).
• Technical transaction data (transaction number). bpm does not collect or process any banking data; the App Store and the Play Store do not share such data with app publishers.

2.5 Data we invite you not to share

bpm does not encourage its Members to include, in their Profile description or free-text answers, data falling within the special categories defined in Article 9 of the GDPR (racial or ethnic origin, political opinions, religious beliefs, sexual orientation, health data, etc.). If a Member nevertheless chooses to freely include such information in a free-text field visible to other Members, that information is deemed to have been manifestly made public by the Member concerned, within the meaning of Article 9.2.e of the GDPR.

Article 3 — Specific processing

3.1 Profile verification and the fight against fake profiles

To combat fake profiles, bpm carries out an automated analysis of Profile photographs to verify that a human face appears in at least one photograph. This check determines whether you can interact with other Members, under the conditions described in Article 8.1 of the Terms of Use.

In accordance with Article 12 of the Terms of Use, bpm is not required to disclose the details of its technical detection criteria where such disclosure would compromise the effectiveness of its systems; this reservation does not prevent the exercise of the rights set out in Article 10.

3.2 Gender you are looking for and data that may reveal sexual orientation

The search setting relating to the gender of the Members you wish to meet may reveal, when combined with your own declared gender, your sexual orientation, which is a special category of data within the meaning of Article 9 of the GDPR.

This processing is based on your explicit consent, obtained specifically and separately from the general acceptance of the Terms of Use, when you set up your search. By setting up your search, you specifically consent to bpm processing this information for the sole purpose of suggesting Profiles that match your criteria. You can change this setting or withdraw this consent at any time from the Application, without affecting the lawfulness of the processing carried out before the withdrawal.

Article 4 — Purposes and legal bases

The processing operations carried out by bpm and their respective legal bases are as follows:

Article 5 — Recipients of your data

Your personal data is accessible, within the limits of their respective duties, to authorised bpm teams. It may also be disclosed to the following categories of recipients:

• Hosting and technical infrastructure: Supabase (database, authentication and storage, infrastructure operated on Amazon Web Services), Amazon Web Services (AWS) and Vercel (hosting of web interfaces).
• Analytics and audience measurement providers: PostHog (product behaviour analysis) and Adjust (attribution measurement of installs and campaigns).
• Provider for the technical management of subscriptions and in-app purchases: RevenueCat.
• Distribution and payment platforms: Apple (App Store) and Google (Play Store), which process payment data directly without passing it on to bpm.
• Social networks and third-party advertising platforms, for the sole purpose of excluding users from marketing campaigns (e-mail and phone number transmitted in hashed, non-reversible form): Meta (Facebook, Instagram), TikTok and Google Ads.
• Administrative or judicial authorities, upon a request founded in law.
• Any third-party acquirer, in the event of a merger, transfer or restructuring of bpm, under the conditions set out in Article 29.4 of the Terms of Use.

These providers act as processors on behalf of bpm, under contractual commitments complying with Article 28 of the GDPR, and are not authorised to use your data for their own purposes.

Article 6 — Transfers of data outside the European Union

Some of the providers used by bpm are established in the United States or carry out all or part of their processing there. Your data may therefore be transferred outside the European Union.

These transfers are governed either by the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, where the provider concerned is certified under it, or by the standard contractual clauses adopted by the European Commission, together with supplementary measures where necessary, within the meaning of Chapter V of the GDPR. You can obtain a copy of these safeguards by contacting bpm at the contact details given in Article 1.

Article 7 — Retention periods

bpm retains your data for as long as necessary for the purposes pursued:

• Active Account: for as long as the Account is used.
• Inactive Account: after twenty-four (24) months of inactivity, the Account is deleted and the data is kept in a separate archive database for six (6) months before being permanently destroyed or anonymised.
• Banned Account: the information needed to prevent any re-registration is kept for twenty-four (24) months in the active database, then archived before permanent deletion.
• Account deleted by the Member via the Application, or data erased following an erasure request: in accordance with Article 14 of the Terms of Use, the data is kept in a separate archive database for six (6) months before being permanently destroyed or anonymised, for the sole purpose of meeting any legal obligations or handling an ongoing dispute or fraud.
• Precise geolocation data: kept for one (1) month, a period proportionate to the sole purpose of connecting Members.
• Proof of identity provided at bpm's request: kept only for the time needed for the verification, then deleted without delay and at the latest within one (1) month.
• Accounting documents, invoices and billing data: kept for ten (10) years in accordance with the legal obligation to retain accounting documents (Article L. 123-22 of the French Commercial Code), and for six (6) years for tax purposes (Article L. 102 B of the French Book of Tax Procedures).

The retention period for accounting and tax documents applies regardless of the deletion of the Account or the exercise of a right to erasure: these documents cannot be deleted early, including at the Member's request, until the legal period has expired.

Article 8 — Trackers and advertising identifiers

In the Application, bpm and its providers use identifiers and trackers, in particular your device's advertising identifier and the software development kits of its measurement and advertising providers, for technical operation, audience measurement and, with your consent, advertising measurement and personalisation.

On iOS, access to the advertising identifier requires your prior authorisation through Apple's App Tracking Transparency framework. You can change your choices at any time in your device settings and, where this feature is available, in the Application settings. On the bpm website, where applicable, non-essential cookies are only placed after your consent has been obtained via the dedicated banner, refusing being as easy as accepting.

Article 9 — Security of your data

bpm implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR, including: encryption of data in transit, access control to internal systems, separation of environments, and security incident management procedures. In the event of a data breach likely to result in a risk to your rights and freedoms, bpm notifies the CNIL and, where applicable, the persons concerned, under the conditions set out in Articles 33 and 34 of the GDPR.

Article 10 — Your rights

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights over your personal data:

• Right of access: to obtain the data concerning you, without infringing the privacy of third parties.
• Right to rectification: to have inaccurate or incomplete data corrected, completed or updated, partly directly from the Application.
• Right to data portability: to receive your data in a structured, commonly used and machine-readable format.
• Right to erasure: to request the erasure of your data, subject to the legitimate retention periods described in Article 7. This right is separate from the deletion of your Account, which you must carry out yourself from the Application (Article 14.2 of the Terms of Use).
• Right to restriction: to request the temporary freezing of the use of certain data.
• Right to object: to object to processing based on bpm's legitimate interest or carried out for direct marketing purposes, at any time and, for direct marketing, without having to give reasons. With regard to security and fraud prevention processing, bpm may, in accordance with Article 21.1 of the GDPR, continue the processing where it demonstrates compelling legitimate grounds that override your interests, in particular to protect the safety of other Members.
• Right to withdraw your consent at any time, for processing that depends on it (geolocation, preference for the gender you are looking for, personalised advertising), without affecting the lawfulness of prior processing.
• Right to set instructions regarding what happens to your data after your death, in accordance with Article 85 of the French Data Protection Act.
• Right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, save for the exceptions provided by law, under the conditions specified in Article 12 of the Terms of Use.

10.1 How to exercise your rights

You can exercise these rights by contacting us at the contact details given in Article 1, or directly from the Application where the feature is available. bpm responds within the one-month period provided for by the GDPR, which may be extended by two further months for complex requests.

10.2 Conditions of exercise

Where bpm has reasonable doubts about the identity of the person making a request, it may ask for additional information strictly necessary to confirm that identity before acting on it, in accordance with Article 12.6 of the GDPR, in particular to prevent a third party from exercising these rights on behalf of a Member without their authorisation. In accordance with Article 12.5 of the GDPR, bpm may refuse to act on a request that is manifestly unfounded or excessive, in particular because of its repetitive character, or charge a reasonable fee taking into account the administrative costs. A request may also not be fulfilled, in whole or in part, where it conflicts with a legal retention obligation (see Article 7), with the need to keep evidence in connection with an ongoing dispute or fraud-prevention procedure, or with the need to protect the rights of other persons.

10.3 Complaint to the CNIL

If you consider that your rights have not been respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or via its website www.cnil.fr.

Article 11 — Minors

bpm does not knowingly collect personal data from minors; access to the Service is strictly reserved for adults in accordance with Article 3 of the Terms of Use. If a Member has lied about their date of birth, the parents or legal representative of the minor concerned may inform bpm at the address given in Article 1 in order to request the erasure of the data. bpm undertakes to delete all personal data relating to a minor as soon as possible after verifying the request.

Article 12 — Changes to this Policy

bpm may amend this Privacy Policy, in particular to take account of legislative, regulatory or technical changes. Any substantial change will be communicated to you under the conditions set out in Article 25 of the Terms of Use.

Article 13 — Contact

For any question about this Privacy Policy or any request relating to your personal data:

• by e-mail: [email protected];
• by post: bpm, 24 bis rue de Téhéran, 75008 Paris, France.