Privacy Policy

The controller is HISECORE sp. z o.o., Nowy Świat 33/13, 00-029 Warsaw, Poland, KRS 0001099591, NIP 5223294892, REGON 528343145.

For privacy questions or to exercise your rights, email contact@sexty.chat. We have not appointed a Data Protection Officer.

• account data: Supabase user ID, email after account creation, locale and authentication metadata;
• profile and matching data: first name, gender, conversation preference, queue activity and number of searches started;
• conversation data: message content, timestamps, sequence, conversation participants, status, blocks and reports;
• billing data: Stripe customer, subscription and price IDs, status, billing period and webhook event metadata;
• security data: HMAC-hashed IP, endpoint counters, request identifiers, errors, security events and ban records;
• bot-verification data: Cloudflare Turnstile challenge result, action, hostname, IP address and browser/device signals processed to distinguish people from automated abuse;
• support data: sender, recipients, subject, plain-text email body, attachment metadata and reply status.

Stripe processes card and payment instrument data. Sexty does not receive full card details. We do not request your legal name, exact location or contacts for chat matching.

• to provide chats, matching, accounts and subscriptions under the contract, Article 6(1)(b) GDPR;
• to process accounting, tax, consumer and lawful authority obligations, Article 6(1)(c);
• to prevent abuse, secure endpoints, investigate reports, review conversations for authorised service-quality purposes, improve reliability and establish or defend claims, our legitimate interests under Article 6(1)(f);
• where we specifically ask for consent, Article 6(1)(a), which may be withdrawn without affecting prior processing.

Providing an email is optional until an account or payment is requested. Without data needed for matching, authentication or payment, the relevant feature cannot be provided.

We disclose data only as needed to providers acting under contracts and security obligations:

• Supabase for authentication, PostgreSQL database and realtime delivery, with the primary project region in Sweden;
• Vercel for hosting, network delivery and request infrastructure;
• Cloudflare for invisible Turnstile bot verification on sensitive forms, as described in the Turnstile Privacy Addendum;
• Stripe for Checkout, Billing, fraud prevention, tax-related checkout fields and the Customer Portal;
• Resend for transactional email and the support inbox;
• OpenAI where an enabled automated conversation feature processes recent conversation context.

We may also provide data to professional advisers, courts and competent authorities where legally required or necessary to protect rights and safety.

Some providers or their subprocessors may process data outside the EEA. Where required, transfers rely on an adequacy decision, the European Commission Standard Contractual Clauses and supplementary safeguards. Provider privacy and subprocessor information is available from the relevant provider.

We keep account, profile and conversation data while the account is active and for the period reasonably needed to provide continuity, handle deletion requests, prevent abuse and resolve claims. When you request deletion, we delete or anonymise data unless retention is required by law or necessary for a documented claim or safety investigation.

• expired API rate-limit buckets are operationally temporary and eligible for deletion after expiry;
• resolved routine system events are normally retained for up to 90 days, while unresolved security or moderation evidence may be kept longer;
• support correspondence and reports may be kept for up to 24 months after resolution;
• billing and accounting records are kept for statutory tax and accounting periods;
• Stripe event IDs are retained to prevent duplicate financial processing and document subscription state.

We use Row Level Security, server-only credentials, signed payment and email webhooks, endpoint limits, hashed IP identifiers, access controls and audit monitoring. Messages are available only to participants and authorised service processes or administrators when needed for service-quality review, support, moderation, security or law.

Chats are encrypted in transit but are not end-to-end encrypted. Do not share passwords, payment data, identity documents or other sensitive information with a stranger.

We use strictly necessary authentication cookies and browser storage to maintain the session, restore the current conversation and remember functional choices such as language. We do not currently use third-party advertising cookies. If optional analytics or marketing technology is introduced, we will update this notice and request consent where required.

Matching uses gender preferences, queue availability, prior recent matches, blocks and safety status. Automated conversation or translation features may generate text when enabled. These processes do not make decisions producing legal or similarly significant effects. You may leave, block or report at any time.

Subject to the GDPR, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent where consent applies. We may need to verify your identity before responding.

You may complain to the President of the Personal Data Protection Office in Poland at uodo.gov.pl or to your local EEA supervisory authority.

Sexty is only for adults aged 18 or older. We do not knowingly offer the service to children. If you believe a minor has used Sexty, contact us promptly.

We may update this Policy when processing, providers or law changes. The effective date above identifies the current version, and material changes will be communicated where required.