Privacy Policy

Categories of Personal Data We Collect

This chart details the categories of Personal Data that we collect and have collected over the past 12 months:

Sensitive Personal Data

Given the personal nature of the Services, we may collect the following types of information:

• Personal photos and images
• Private conversations and messages between Partners
• Personal beliefs, values, and relationship details
• Responses to personal questions and prompts

We recognize the deeply personal nature of this content and treat it with the heightened care described in this Policy.

Categories of Sources of Personal Data

We collect Personal Data about you from the following categories of sources:

You

• When you sign up for our Services or request more information.
• When you provide such information directly to us.
• When you create an account or use our Services.
• When you make a purchase or complete a transaction.
• When you participate in promotions, surveys, or contests.
• When you voluntarily provide information in free-form text boxes through the Services.
• When you send us an email or otherwise contact us.
• When you use the Services and such information is collected automatically.
• Through Cookies (defined in the “Cookies and Tracking Technologies” section below).

Third Parties

• Vendors: We may use analytics providers to analyze how you interact and engage with the Services, or third parties may help us provide you with customer support.

How We Use Your Data

Providing, Customizing and Improving the Services

• Creating and managing your account.
• Processing orders; billing.
• Providing you with the products, services or information you request.
• Assessing your service and product needs and preferences.
• Meeting or fulfilling the reason you provided the information to us.
• Providing support and assistance for the Services.
• Improving our Services, including through research, analytics, and product development.
• Personalizing the Services, website content and communications based on your preferences.
• Doing fraud protection, security and debugging.
• Carrying out other business purposes stated when collecting your Personal Data or as otherwise set forth in applicable data privacy laws.

Advertising and Marketing the Services

• Advertising, marketing and selling the Services.

Corresponding with You

• Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Candle or the Services.
• Sending emails and other communications according to your preferences.

Meeting Legal Requirements and Enforcing Legal Terms

• Fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities.
• Protecting the rights, property or safety of you, Candle or another party.
• Enforcing any agreements with you.
• Responding to claims that any posting or other content violates third-party rights.
• Resolving disputes.

If we collect additional categories of Personal Data or use your Personal Data for materially different purposes, we will update this Privacy Policy accordingly.

The categories of Personal Data described above may be shared with the following recipients for the purposes described in this Policy. We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a “sale” of your Personal Data. For more information, please refer to the state-specific sections below.

• Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:
  • Hosting, technology and communication providers.
  • Security and fraud prevention consultants
  • Payment processors
  • Support and customer service vendors
• Marketing and Advertising Partners. We work with advertising partners to promote Candle on third-party platforms. However, these partners receive only technical identifiers (such as device IDs or hashed email addresses) to measure campaign effectiveness and conduct other similar marketing activities. However, we do not share your private messages, partner conversations, shared photos, or responses to personal prompts with any marketing or advertising partner.
• Analytics Partners. These parties provide analytics on web traffic or usage of the Services. They include:
  • Companies that track how users found or were referred to the Services.
  • Companies that track how users interact with the Services.
• Parties You Authorize, Access or Authenticate

Third-Party Service Providers

We use third-party services to operate Candle, including, without limitation:

• Cloud Hosting Providers: PlanetScale provides database hosting (MySQL/Vitess) with SSL/TLS encryption in transit and encryption at rest.
• Authentication: Clerk (SOC 2 compliant) manages user login and account security. Learn more: Clerk Privacy Policy
• AI Services: OpenAI powers our AI features, including question generation, debate topics, date recommendations, and question rewording. When you use AI features, your prompts may be sent to OpenAI for processing. We do not share your photos or private conversations with OpenAI. Learn more: OpenAI Privacy Policy
• Analytics:
  • Amplitude provides product analytics to understand how users interact with our Services. Learn more: Amplitude Privacy Policy
  • AppsFlyer provides mobile attribution to measure advertising effectiveness. Learn more: AppsFlyer Privacy Policy
• Advertising Tracking:
  • Meta Pixel (Facebook/Instagram) tracks website visits and ad interactions. Learn more: Meta Data Policy
  • The TikTok SDK collects app activity and ad interaction data from TikTok campaigns. Learn more: TikTok Privacy Policy

These providers may have their own privacy policies governing their use of your Personal Data.

Legal Obligations

We may share any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Meeting Legal Requirements and Enforcing Legal Terms” in the “How We Use Your Data” section above.

Government and Law Enforcement Requests

We may disclose Personal Data to government authorities or law enforcement officials when required by law, regulation, or valid legal process (such as a subpoena, court order, or search warrant), or when necessary to protect the safety of any person.

Business Transfers

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).

No Data Selling

We do not sell your Personal Data. If our privacy practices change materially, we will notify you in accordance with applicable law.

Marketing Communications

You can opt out of receiving marketing emails from us by clicking the “unsubscribe” link in any marketing email or by contacting us at support@trycandle.app. Even if you opt out of marketing emails, we may still send you transactional messages about your account or purchases.

Targeted Advertising

You can opt out of targeted advertising by:

• Adjusting your preferences in your account settings
• Using browser-based opt-out tools such as the Digital Advertising Alliance’s opt-out page at https://optout.aboutads.info/
• Enabling the Global Privacy Control (GPC) signal in your browser, which we honor as a valid opt-out request

With your permission, we collect and use your location information to provide personalized recommendations.

Location Data Collection

With your permission, we may collect location information from your device to power location-based features. This allows us to recommend nearby events, activities, and date venues, provide location-specific content and suggestions, and improve our recommendations based on your area.

Controlling Location Access

You can control location permissions through your device settings at any time. If you disable location services, location-based recommendations may not be available, some features may not function properly, and we will no longer collect location information from your device.

We do not share your precise location with third parties except as described in the “How We Share Your Personal Data” section (such as with mapping or venue database providers necessary to deliver the feature).

This section explains how long we retain your Personal Data and the factors that determine retention periods.

General Retention Principles

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements.

Specific Retention Periods

Your Deletion Rights

You can delete your account and request deletion of your Personal Data at any time through your account settings or by contacting support@trycandle.app. We will process deletion requests in accordance with applicable law, except where retention is required (such as for tax or accounting purposes).

Inactive Accounts

If your account is inactive for an extended period, we may automatically close it. After automatic closure, your data will be handled as described below.

After You Close Your Account

Candle uses a two-layer deletion process:

Layer 1 - Active Systems: When you delete content or your account, we immediately remove your access to the data from our active systems so it is no longer accessible.

Layer 2 - Backups: Deleted data may persist in backups, archives, and disaster recovery systems for a reasonable period as necessary for:

• Fraud prevention and abuse detection
• Legal compliance and responding to legal requests
• System integrity and disaster recovery
• Dispute resolution and Terms of Service enforcement

While backup data is not accessible in normal operations, it has not been permanently destroyed.

Complete Deletion Requests: If you require complete destruction of all data including backups (for example, to comply with a legal obligation in your jurisdiction), contact us at support@trycandle.app and we will work with you to accommodate your request to the extent technically feasible and legally permissible.

We operate globally, which means your Personal Data may be transferred to, stored, and processed in countries other than your country of residence, including the United States and other countries where we, our affiliates, or our service providers operate.

Transfers from the EEA, UK, and Switzerland

When we transfer Personal Data from the European Economic Area (“EEA”), the United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection by the European Commission or other competent authority, we implement appropriate safeguards to protect your Personal Data, including:

• Standard Contractual Clauses: We use standard contractual clauses approved by the European Commission or the UK Information Commissioner’s Office, as applicable, which contractually require the recipient to protect your Personal Data to the same standards required in Europe.
• Adequacy Decisions: Where available, we transfer data to countries that have been recognized as providing adequate data protection.
• Other Safeguards: We may rely on other transfer mechanisms permitted under applicable law, such as binding corporate rules or derogations for specific situations.

California Resident Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your Personal Data:

• Right to Know: You have the right to request information about the categories and specific pieces of Personal Data we have collected about you, the sources of that data, the purposes for collecting it, and the third parties with whom we share it.
• Right to Delete: You have the right to request that we delete your Personal Data, subject to certain exceptions (such as data needed to complete a transaction or comply with legal obligations).
• Right to Correct: You have the right to request that we correct inaccurate Personal Data we maintain about you.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the “sale” or “sharing” of your Personal Data for cross-context behavioral advertising. We do not sell your Personal Data to third parties for monetary consideration. However, our use of certain analytics and advertising services (including Meta Pixel, TikTok SDK, AppsFlyer, and Amplitude) may constitute “sharing” under California law. You can opt out by adjusting your privacy settings in your account or by enabling Global Privacy Control (GPC) in your browser.
• Right to Limit Use of Sensitive Personal Information: If we collect sensitive personal information, you have the right to limit its use to what is necessary to provide the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise these rights, please contact us at support@trycandle.app. We will respond to verifiable requests within the timeframes required by applicable law.

Nevada Resident Rights

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at support@trycandle.app with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account.

Consumer Health Data

If you are a resident of Washington or Nevada, please review our Consumer Health Data Privacy Policy, which supplements this Privacy Policy and provides information about how we handle data that may be considered “consumer health data” under the Washington My Health My Data Act or Nevada SB 370.

Other U.S. State Privacy Rights

If you are a resident of Colorado, Connecticut, Montana, Oregon, Texas, Utah, or Virginia, you may have additional rights under your state’s privacy laws, including:

• Right to Access: You have the right to confirm whether we are processing your Personal Data and to access that data.
• Right to Correction: You have the right to correct inaccuracies in your Personal Data.
• Right to Deletion: You have the right to delete Personal Data you have provided to us or that we have collected about you.
• Right to Data Portability: You have the right to obtain a copy of your Personal Data in a portable, readily usable format.
• Right to Opt-Out: You have the right to opt out of:
  • Targeted advertising
  • The sale of your Personal Data (if applicable)
  • Profiling in furtherance of decisions that produce legal or similarly significant effects

To exercise these rights, please contact us at support@trycandle.app. If we deny your request, you may have the right to appeal our decision by contacting us.

Right to Appeal (Certain States)

If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, or Virginia, and we deny your privacy request, you have the right to appeal our decision. To appeal, contact us at support@trycandle.app with “Privacy Request Appeal” in the subject line, and include:

• Your original request and our response
• The reason you believe we should reconsider

We will respond to your appeal within the timeframe required by applicable law. If you are not satisfied with our response to your appeal, you may contact your state’s attorney general to file a complaint.

EEA, UK, and Switzerland Resident Rights

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) or equivalent laws, including the rights described above as well as the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection laws.

You can find your local data protection authority:

• EEA residents: https://edpb.europa.eu/about-edpb/about-edpb/members_en
• UK residents: Information Commissioner’s Office (ICO) at https://ico.org.uk/
• Switzerland residents: Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch/

The data protection authority you may contact is typically that of your habitual residence, your place of work, or the location where the alleged infringement occurred.

To exercise any of your privacy rights, you may:

• Email us at support@trycandle.app with “Privacy Request” in the subject line
• Submit a request through our online form at support@trycandle.app

Verification

To protect your privacy, we will verify your identity before fulfilling your request. We may ask you to provide information that matches what we have on file, such as your email address or account information.

Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We may require the agent to provide proof of authorization and may still verify your identity directly.