1. Controller and contact
Mostafa Mekawy, an individual developer based in Poland, is responsible for the personal-data processing described here. Contact flirteraiapp@gmail.com for privacy questions, requests or concerns. This policy covers the Flirter.ai mobile application and related website. We distinguish our processing from processing independently carried out by the app store and other providers under their own terms.
2. Account and preference data
When you create or use an account, we process your user identifier, email address, authentication information handled by Supabase Auth, and profile information you provide, such as name, city, language and communication preferences. Google sign-in may provide authorized profile information such as name, email and avatar. We do not receive your Google password. We also maintain onboarding and activity information used by the app.
3. Content and generated results
Depending on the tool you choose, we process message text, conversation screenshots, profile descriptions or photos, match context, concerns, selected tone, date-planning preferences, budget, timing and notes. AI systems return suggestions and analyses. Saved history can include input text, extracted conversation text, results, date itineraries and favorite places. Generated content and relevant app state can also be cached on your device.
Sending a screenshot or photo to an AI provider is processing even if we do not save the original image in a separate cloud file bucket. Do not submit unnecessary personal information about yourself or other people, or intimate/specially sensitive material.
4. Location and maps
If you choose location assistance and grant the device permission, location information can help determine a city or map context. You can instead enter a city. Google Maps/Places/geocoding and directions services receive the queries and coordinates needed for the selected functionality. Stored date plans and favorites may contain venue names, addresses, place identifiers, coordinates and route data. This is not continuous background tracking. You can manage device permissions in system settings.
5. Purchases and usage
Google Play processes Android payments and payment methods. RevenueCat processes purchase and subscription information to validate receipts and manage entitlements. We use your app user identifier, plan, store/product identifiers, transaction-period references, subscription status and relevant timestamps to reconcile access. We keep credit balances, usage counters and transaction records to apply allowances and prevent repeated credit grants. We do not receive your full card number or bank credentials.
6. Reports, support and security
If you report a response, we store your user identifier, tool, reported output, reason, optional explanation, language, submission time and review information. Authorized operators can review it for safety and product improvement. We also process information you voluntarily send to support. Providers may collect technical request and security information such as IP addresses, timestamps and error details. Do not send secrets or unnecessary third-party information in reports or emails.
7. Why we process data
We process information to create and authenticate accounts, provide requested AI features, retain selected history, generate itineraries, verify purchases, deliver support and handle deletion. Contract performance is a basis for necessary service processing. Legitimate interests may support proportionate security, abuse prevention and quality/safety review after considering affected rights. Legal obligations may require particular records or disclosures. Where we rely on consent, we explain the choice and withdrawal mechanism.
Device permission does not replace any other legal basis required for processing, and acceptance of this policy is not blanket consent for every purpose. Do not submit sensitive data merely because a tool permits free-text input.
8. Providers and recipients
The following providers receive data relevant to their role:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Authentication, application database, backend Edge Functions and related infrastructure. | Account/profile data, saved tool records, credits, purchase reconciliation and reports are stored or processed here. |
| Google Gemini API | AI generation and image/text analysis. | Relevant user content and instructions. |
| DeepSeek API | Configured AI requests or fallback processing. AI processing is not exclusively handled by Google. | Relevant text content. |
| Google Maps Platform | Map, place, geocoding and directions requests. | Relevant coordinates or search text. |
| RevenueCat | Purchase validation and subscription entitlement management. | Store information and the app user identifier. |
| Google Play | Independently processes store-account, billing and payment information under its own policies. | Store account, billing and payment information. |
| Website hosting provider | Delivers this website. The specific hosting service will be identified once the site is published. | Requests necessary to deliver the website (for example IP address and request details). |
We may also disclose information where lawfully necessary to respond to legal requirements, protect rights or address misuse. We do not use submitted private conversations as public testimonials without separate permission. The reviewed mobile implementation does not contain an advertising SDK or a separate marketing-analytics integration. This website does not use analytics, advertising pixels or tracking embeds; it stores only your language preference locally in your browser if you choose a language. If the website adds analytics, advertising, chat widgets or other tracking, we will update this policy and implement any required choice before enabling them.
9. AI provider data practices and international processing
AI requests are sent to external providers rather than processed entirely on your device. Processing may occur outside Poland or the EEA. Google Gemini data treatment depends on applicable API terms and the account/service configuration; we do not promise that data is never retained, reviewed or used for provider improvement without verifying the terms that apply.
DeepSeek documents processing/storage in China; its API arrangements and any required international-transfer mechanism must be assessed before sending personal data. Obtain information about applicable arrangements by contacting us. We must identify and put in place the legally required safeguards before any transfer that requires them; this notice is not itself a transfer safeguard or an assertion that one has already been signed.
10. Storage and retention
Our primary app records are stored in Supabase, and session information, preferences and cached results/history can remain on your device. The current app does not have a general automatic expiry policy for saved tool history. We normally keep account-linked records while needed to provide your account and its saved features, or until deletion is requested, subject to lawful retention needs.
Reports currently have no automatic fixed-duration purge schedule. We retain reports for necessary review and follow-up and must periodically assess whether continued retention is justified. Limited transaction-reference records may remain after account deletion to prevent receipt replay or duplicate credit grants; a remaining transaction record may still be personal data even when its account link is removed.
Provider logs, backups and independently held store/provider records can have separate retention schedules. We do not promise instantaneous deletion from every backup or vendor system. Contact us for information or to request deletion beyond the in-app account records.
11. Deletion
Use the account-deletion option in the app's Profile/account controls or visit /delete-account to request deletion without opening the app. The app's account deletion removes the authentication account and associated profile, subscription mirror, credit records, saved tool sessions/history, date plans, favorite places, AI reports and account-specific free-request counters through the application's database relationships.
Limited billing-event/receipt reference records and aggregate counters can remain as described above. Backend deletion does not itself erase every device cache, provider backup or independently held vendor record. We review additional provider deletion requests where applicable. Deleting the account or uninstalling does not cancel Google Play renewals; manage the subscription in Google Play separately.
12. Your rights
Depending on applicable law, you can request access, correction, erasure, restriction, portability and objection to particular processing, and withdraw consent where processing relies on consent. Some rights have conditions or exceptions; we will explain where relevant. Contact flirteraiapp@gmail.com.
We may need proportionate evidence that you control the account, but will not ask for your password or full card details. We respond within the applicable legal deadline, generally one month under the GDPR, with any permitted extension explained. You may complain to your local supervisory authority; in Poland this is the President of the Personal Data Protection Office (UODO), https://uodo.gov.pl/en.
13. Adults only
Flirter.ai is intended for people aged 18 and older. Do not use the service or submit children's personal content if you are under 18. If you believe a child has supplied personal data, contact us so we can investigate and take appropriate action. We do not claim that a self-confirmation proves a person's age.
14. Security and changes
We use access controls and authentication to help protect information, including ownership controls for account records and restricted access to reports. No online service can guarantee complete security. This policy does not promise end-to-end encryption or confidentiality from providers required to process your request. We may update this notice when practices change and will provide additional notice where required. The effective date identifies the current version.