Privacy Policy
Last updated: 31 October 2026
Information about your relationships and sexuality is sensitive. We collect as little as we can, never sell it, and give you control over it.
1. Data controller
Blaxity, Inc (90 Washington Street, New York, NY 10006, United States) is the data controller for personal data processed through glauve.com and the app. Contact our privacy team at privacy@glauve.com or by phone at +1 929 571 6790.
2. What we collect
Account data: email address, password (stored only as a secure hash), date of birth (used only to confirm you meet our 24+ minimum age), display name, username, city, account type (couple or single).
Profile data you choose to share: bio, photos, interests, preferences and availability. Some of this reveals your sex life or sexual orientation, which is special-category data under Article 9 GDPR.
Activity data: likes, views, messages, posts, event RSVPs, photo access requests, reports and blocks.
Signup verification: each profile holder provides a government-issued photo ID and a mandatory selfie directly to Stripe Identity. Stripe Identity performs document checks and automated biometric matching between the selfie and the face on the identity document; it is not a comparison against ordinary profile photos. Glauve automatically reads the live verification result, checks the full verified date of birth against the declared date and the 24+ threshold, and requires a short-lived, single-use proof tied to the same email, account type and dates of birth before account creation. Pending, failed, missing, mismatched and test-mode results do not complete signup. Document photos may be uploaded; Stripe controls the selfie capture instructions. Glauve does not promise a bespoke head-turn or green-progress test. Glauve does not receive or store ID images, selfie images, biometric templates or document numbers from this signup process. Stripe processes the verification media under its own privacy notice. Glauve temporarily stores hashes of the email, declared birth dates and one-use capability, the account type, Stripe session references and per-holder result/redaction-request status, creation/expiry times and an account link when used. These hashes and references are still treated as personal data. Successful signup retains the account’s declared date of birth, a Verified status and completion timestamp, plus a consent record containing the accepted policy version/links and the age, terms and Identity consent confirmations and server-recorded time. A successful Verified status records that the DOB comparison passed, not a separate copy of the ID-extracted birth date.
Payment data: plan, payment status, receipts and the last four digits of your card, received from Stripe. Card numbers are handled only by Stripe.
Technical data: IP address, device and browser type, and security logs.
3. Why we use it and our legal basis
To provide the service you signed up for (contract): accounts, matching, messaging, galleries and events.
To process sensitive profile information (your explicit consent, Article 9(2)(a) GDPR). You can withdraw consent at any time by editing or deleting that information.
To keep members safe, prevent fraud and moderate content (legitimate interests and legal obligations).
To take payments, issue refunds and keep accounting records (contract and legal obligation).
For analytics on public pages only (consent, via our cookie banner). We never run analytics inside the signed-in app.
4. Who we share it with
We do not sell or rent personal data, and we do not share it for advertising.
We use service providers for cloud hosting and account data, payments and email delivery, automated content moderation and consent-based public-page analytics. Stripe Identity separately processes ID documents and selfies for signup verification, including facial matching, under its privacy notice at stripe.com/privacy. We request your explicit consent before starting that process. Do not submit identity documents to ordinary profile photo uploads or support emails.
Other members see only what your privacy settings allow. We disclose data to authorities only when legally required.
5. International transfers
Some processors are based outside the European Economic Area, including in the United States. Transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses with additional safeguards.
6. How long we keep it
Account and profile data: while your account is active. When you delete your account from Settings, we erase your photos, messages, matches and profile at that moment; copies held in encrypted backups disappear within 30 days. Data we must keep by law (such as payment records) is retained for the period stated in the Terms.
Payment and invoice records: 10 years, as required by French accounting law.
Signup verification: Verification proofs expire after 24 hours. Glauve requests Stripe redaction after checking a successful or rejected result and when a session is cancelled or expires. An hourly cleanup retries expired or terminal sessions and failed redaction requests. Stripe says redaction can take up to four days after the request; this is not immediate erasure. Proof rows are eligible for deletion once at least seven days have elapsed since creation and redaction has been requested for every holder; unsuccessful cleanup may extend that period until a retry succeeds. Account verification and signup-consent records remain while the account is active and are removed with account deletion, subject to lawful preservation. Other payment, moderation and security records follow the separate retention periods in the Privacy Policy. Legacy verification records, if any, are separate from this process, do not create a Verified badge, and can be requested for deletion through the privacy team. Security logs: up to 12 months. Waitlist entries: until you join or ask us to remove you, and at most 24 months.
7. Security
Data is encrypted in transit and at rest, access is restricted by row-level permissions, private photos are masked until you grant access, and staff access is limited and logged.
8. Your rights
You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent at any time. Email privacy@glauve.com; we reply within one month. You may also complain to your data protection authority (in France, the CNIL at cnil.fr).
9. Age
Glauve is only for people aged 24 and older. Each new profile holder enters a date of birth and completes ID and selfie verification; the verified date must match and meet the 24+ rule. We do not knowingly collect data from anyone under 24, and we delete such accounts when we find them, subject to legal preservation duties.
10. United States privacy addendum
This section applies if you live in a US state with its own consumer privacy law, such as California, Colorado, Connecticut, Texas or Virginia. It does not change anything else in this policy.
What we collect and why is described in sections 2 and 3 above. Under California law we do not sell or share personal information, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.
Your rights if you are a US consumer: to know what personal information we hold about you and how it was used; to delete it; to correct it; to opt out of any sale or sharing (we do not sell or share, so there is nothing to opt out of); to limit use of sensitive personal information, which for us means your photos, verification selfie and anything revealing your orientation or sex life; and not to be discriminated against for exercising any of these rights.
To make a request, email privacy@glauve.com with the subject "US privacy request", or use the same address for an authorised agent acting for you. We will confirm receipt within 10 days and answer within 45 days, extendable once by 45 days. We may need to verify your identity with information we already hold, such as the email on your account.
You can also exercise these rights directly in the app: edit or delete profile details in settings, and delete your whole account in settings.
We honour the Global Privacy Control (GPC) browser signal where our technology allows it: if your browser sends GPC, analytics cookies stay off on our public pages, which is the only place we would otherwise set them.
Appeals: if you are unhappy with how we handled a request under California law, reply to our decision and ask for a review; a second person on our team will look at it within 45 days.
11. Changes
We will email you before any significant change to this policy and show the new date at the top of this page.