PRIVACY POLICY

1. Controller

The controller is Menso Digital Ltd (Company No. 17010102, ICO registration ZC089517), Suite 10477, 5 Brayford Square, London E1 0SG, United Kingdom. For data protection requests: Privacy team — [email protected]. General support: [email protected].

2. Data we process

To provide the service we process the following categories:

• Account data: phone number, email address, the identifier returned by Apple or Google if you sign in with them, date of birth, gender.
• Profile data: name, photos, bio, occupation, interests and other fields you fill in.
• Verification data: the selfie you take for identity verification, the short-lived camera frames used for the pose (liveness) challenge, and the verification result derived from them. This is biometric (special category) data and is processed only with your explicit consent, which you give when you accept the Community Rules during sign-up, solely to confirm that you are a real person and that your profile photos are yours. We do not create, store or search a face template (faceprint): only two numeric scores (face similarity and liveness), the requested pose and the pass/fail result are kept.
• Location data: approximate location for the distance filter, at the precision you allow; if you use Passport (Plus and Premium), the city you choose.
• Communications: in-app messages, reports and support correspondence.
• Usage and device data: session records, IP address, device model, operating system, app version, crash and error logs, push notification tokens, and in-app usage events.
• Install source (app, Android only): the referral information Google Play provides for your installation (for example, which of our links you came from), the install time and a random installation identifier; if you create an account, the installation is linked to it. We do not collect your device's advertising identifier or ad click identifiers.
• Payment data: subscription status and transaction identifiers from the App Store or Google Play. We never see or store card details.

3. Purposes

• Creating your account, signing you in and delivering the service.
• Showing, filtering and ranking profiles in discovery.
• Preventing fake and impersonating accounts through selfie verification.
• Reviewing reports, preventing abuse and fraud, keeping the platform safe.
• Running subscriptions and keeping billing records.
• Sending notifications and answering support requests.
• Measuring app usage with our own analytics and Google Analytics 4, debugging and improving the service.
• Measuring which of our ads and links bring people to OnlyMens, so we can improve our campaigns.
• Meeting legal obligations and responding to legal claims.

4. Legal bases

We rely on the following bases under GDPR Art. 6 (and the equivalent provisions of Turkish KVKK Art. 5): performance of a contract (running your account and the service), legal obligation (statutory retention and reporting duties), legitimate interests (security, abuse prevention, product improvement, app analytics and measuring which of our ads and links bring people to OnlyMens) and consent (biometric verification data — given when you accept the Community Rules during sign-up — as well as precise location and marketing messages).

You can withdraw consent at any time; withdrawal does not affect processing carried out before it. If you withdraw verification consent your verified badge and the features that depend on it are removed. You can turn off app analytics at any time in Settings → Analytics.

5. Visibility and sharing rule

The core product rule is part of your privacy: women's profiles are never shown to men in discovery, search or suggestions. A man sees only the woman who wrote to him, and only inside that conversation. Profile views are shown to men as a count only, never as an identity or a photo.

6. Service providers

We work with a small set of processors: cloud hosting and database, object storage for photos and verification images (Cloudflare R2), SMS and email delivery, push notifications, error and performance monitoring, app analytics (Google Analytics 4, Google Ireland Limited, which receives pseudonymous in-app usage events from our servers), and payment validation (Apple and Google). Face verification is performed by Amazon Web Services (AWS Rekognition): the selfie and the pose frames are sent to it for a single comparison and detection call and are not added to any face collection, so no persistent face template is created or stored there. Face data is never used for advertising or profiling, is never sold, and is shared with no other third party. Each provider receives only the data it needs and is bound by contract. You can request the current list at [email protected].

7. International transfers

Some providers are located outside your country. Such transfers rely on appropriate safeguards, such as the European Commission's standard contractual clauses and the conditions of KVKK Art. 9. Contact [email protected] for details or a copy of the safeguards.

8. Retention

• Account and profile data: while your account is open; deleted or anonymised within 30 days after a deletion request.
• Verification images: the pose (liveness) frames are processed in memory and never stored. The selfie is stored in private storage that is not publicly accessible and is deleted within 30 days after the verification decision. After that only the result remains: the pass/fail outcome, the two numeric scores and the requested pose, kept with the account. If you ask us to delete your account, the selfie and every other image are deleted at the end of the 30-day grace period, along with the account.
• Photos you delete: removed from your profile and from public delivery immediately; a private copy is kept for 30 days so our moderation team can review safety reports, then permanently deleted, or together with your account if you delete it.
• Messages: while your account is open; removed on your side when you delete them.
• In-app usage events: 12 months.
• Report, moderation and safety records: 12 months after the report is closed, to prevent repeat abuse.
• Payment and invoicing records: the period required by law (6 years, as required by tax and accounting law).
• Technical logs: 90 days.

9. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and not to be subject to solely automated decisions with legal effects. Send your request to [email protected]; after verifying your identity we will respond within 30 days. You may also lodge a complaint with your supervisory authority (in Türkiye, the Personal Data Protection Authority).

10. Security

We encrypt data in transit and at rest, restrict access with role-based permissions, and write every admin action to an audit log. No system is perfectly secure; in the event of a breach we will notify you and the competent authority within the period required by law.

11. Cookies and similar technologies

On onlymens.net we always use the strictly necessary cookies and local storage the site needs to work, including the entry that records your cookie choice. These require no consent.

One of them is the om_lang cookie. It holds nothing but a language code: when you pick a language from the switcher we store it there, so the site opens in that language next time instead of guessing from your browser settings. It is never used to identify or track you.

Analytics and advertising cookies are used only if you accept them in the cookie banner. Until you accept, no analytics or advertising script is loaded and no such cookie is written. If you accept, we may use Google Analytics 4 and Google Tag Manager (Google Ireland Limited) to measure how the site is used, Google Ads to measure how our ads perform, and the Meta Pixel (Meta Platforms Ireland Limited) for the same purpose on Meta platforms. These providers may process data outside the EU/EEA under the European Commission's standard contractual clauses. Google's consent signals are set to "denied" by default and only switched to "granted" after you accept (Google Consent Mode v2).

You can withdraw or change your choice at any time from "Cookie settings" in the footer, and you can delete the stored choice by clearing your browser's site data. Rejecting has no effect on your use of the site or the app.

The app does not use cookies or third-party advertising SDKs.

12. Children

OnlyMens is for adults aged 18 and over. Accounts found to belong to minors are closed and the data deleted. If you believe such an account exists, report it to [email protected].

13. Changes

We may update this policy. For material changes we will notify you in the app or by email. The effective date is shown at the top of this page.