TheOne — Privacy Policy and Terms of Use

1. Who we are and who is responsible for your data

The entity responsible for your personal data — the **controller**, in the language of European law — depends on where you live.

Company registration: Georgia Secretary of State, Control Number 24108657

Where two or more of our entities are involved in the same processing, they act as **joint controllers** and have agreed in writing which of them answers which obligation. You may exercise your rights against any of them, and we will route the request internally. A summary of that arrangement is available on request.

Where we process data on another party's instructions rather than our own — for example where a merchant sells through our Storefront and determines the purpose of their own mailing list — we act as a **processor** for that party and their privacy notice governs, not ours.

2. Where this policy applies

This policy applies to everything we operate under the TheOne brand: the websites and applications at `theoneapi.org` and its subdomains, our mobile applications, our public APIs, the events we run, and the support channels through which you reach us. We refer to all of it collectively as **the service**.

Some features carry their own supplementary notice — photo verification, identity verification, and any feature that processes biometric data. Where a supplementary notice exists, it applies **in addition** to this one, and where the two conflict on that feature, the supplementary notice governs.

This policy does **not** cover:

• third-party services you reach through a link from ours, which have their own policies;
• payment card handling by our payment processor, which is governed by its own notice;
• a merchant's own use of data you give them directly through the Storefront;
• any product we later launch under a separate policy, which we would tell you about at the point of launch.

3. Definitions

Legal documents that avoid defining their terms tend to hide the important choices. These are ours.

4. The data we collect

We have grouped the data by where it comes from, because that is what determines your control over it. Data you give us, you can usually change or withdraw. Data generated by use is harder to avoid without leaving the service. Data from third parties is the category people are least aware of, so it has its own section.

4.1 Data you give us

4.2 Data generated by your use of the service

4.2.1 How we count an audience without identifying it

When you watch something while you are signed out, we still need to know how many people watched it. A creator cannot be told honestly how their work performed if part of the audience is invisible. We do that without keeping anything that identifies you.

At the moment you press play we combine your IP address, your browser's user-agent string and a secret value we generate at random each day, and we store only the resulting hash. **Neither the address nor the user-agent is written into the viewing record itself.** The hash cannot be reversed, and nobody can arrive at it from your address without that day's secret.

That secret is deleted after 36 hours and is never written down anywhere else. Once it is gone, the stored hash cannot be connected back to you — not by us, not by anyone who obtains our records, and not by anyone who compels us to produce them. Not because we would decline, but because the information needed to do it no longer exists. Because the secret is different every day, the value recorded for you today and the value recorded tomorrow cannot be matched to one another either, so this cannot be used to follow you from one day to the next.

To be exact about the boundary: this describes the viewing record. Your IP address may still appear separately in the security and access logs described in §4.2 and §9, which exist to detect intrusion and abuse and are kept and deleted on their own schedule. We do not join those logs to viewing records to work out who watched what.

Where we cannot generate that day's secret, we record a value unique to the single request, which identifies nothing at all. We can then count plays but not people, and we say so wherever the figure appears.

None of this applies when you are signed in. Then your viewing is recorded against your account, as the table above describes, and the access and erasure rights in §10 apply to it.

4.3 Data we receive from others

4.4 Data we do not collect

Stating the boundary is as useful as stating the scope. We do not:

• receive or store your full payment card number, CVC, or online banking credentials;
• read files on your device outside what you explicitly select and upload;
• collect precise location in the background when the relevant feature is off;
• record audio or video except when you deliberately capture it in the service;
• buy contact lists to add people who never asked to hear from us;
• purchase personal data about you from data brokers to enrich your profile for advertising;
• keep the IP address or browser user-agent of a signed-out viewer as part of the record of what they watched — see §4.2.1 for what we keep instead.

4.5 Device permissions

Every permission below is optional at the operating-system level. Declining one disables the feature that depends on it and nothing else. You can change your mind at any time in your device settings.

4.6 Data about other people

If you give us information about someone else — an emergency contact, a referred friend, a person named in a report — you are responsible for having a lawful basis to do so, and for telling them we hold it where the law requires it. We process it only for the purpose you gave it to us for. A person who appears in our records only because you named them may exercise their own rights under §10, and we will honour those rights even though they have no account.

Information about people who are not members is covered by our supplementary notice at https://theoneapi.org/legal/non-members.

5. Why we use your data, and on what legal basis

European law requires a lawful basis for every purpose. The table is the summary; the subsections that follow explain the ones where the reasoning is not obvious.

Where we rely on **legitimate interests**, we have carried out a balancing assessment weighing that interest against your rights and freedoms, and we have recorded it. You can request a summary at privacy@theoneapi.org, and you can object under §10.

5.1 Providing the service you asked for

The contract we are performing is the one in Part B: you activate a mode, and we deliver that surface. This is the basis for the ordinary mechanics — storing your profile so it exists tomorrow, delivering a message to the person you sent it to, showing a listing to people searching for one, admitting you to an event you bought a ticket for.

Two consequences follow that people sometimes find surprising, so we state them plainly:

• **We cannot deliver Dating without publishing a profile.** Discovery is the product. Your visibility controls determine *who* sees it and *what* they see, but there is no version of the surface in which nobody sees anything.
• **We cannot deliver messaging without retaining messages for the recipient.** Deleting your copy of a conversation does not delete theirs, because their copy is their data too.

5.2 Payments, tax, subscriptions and credits

Purchase data is processed to charge you, to grant what you bought, and to keep granting it for as long as you have paid for it. Tax location is determined at checkout and retained because tax law requires us to be able to show, years later, why we charged the rate we charged.

Consumable credits are recorded in an **append-only ledger**: every grant, spend and refund is a separate immutable entry rather than an edit to a running total. This is deliberate. It means a disputed balance can be reconstructed exactly, and it is why §9 keeps the ledger longer than the account.

5.3 Personalisation and recommendations

We rank and filter what you see. The inputs are what you have told us you want, what you have done in the service, and the general popularity and quality signals of the content itself. The purpose is relevance, not manipulation: we do not rank content to maximise the time you spend in the service at the expense of what you came for.

You can influence this directly — adjust your discovery preferences, hide or block, tell us a recommendation was wrong — and you can object to profiling under §10.

5.4 Safety, integrity and security

This is the purpose with the broadest data reach, so it deserves the most explanation.

We use personal data to detect and act on: fraud and payment abuse; harassment, threats and stalking; illegal content, including sexual content involving minors; impersonation and catfishing; spam and coordinated inauthentic behaviour; automated access; underage accounts; and attempts by banned people to return.

The mechanics involve automated detection, human review, and — where an account presents a risk to others — immediate action before review. It involves linking accounts to each other through shared signals, because ban evasion cannot be stopped otherwise. It involves retaining certain signals after an account closes, for the same reason.

We consider this a legitimate interest not only of ours but of every other member, and in the case of content that is illegal, a legal obligation. Where sensitive data is caught up in an investigation — for example a report that quotes something you said about your health — we process it under the substantial-public-interest basis, and only to the extent the investigation requires.

**Cross-service safety.** Where we operate more than one brand or surface and a person is banned from one for conduct that would be banned everywhere, we may act across all of them. A ban for harassment on Dating is not confined to Dating.

5.5 Advertising and marketing

We advertise our own service on third-party platforms, and we may show promotions for our own features inside the service.

• **Own-service marketing by email, SMS or push** is sent with your consent where the law requires it, and you can withdraw it at any time from the message itself or in settings. Withdrawal is honoured without exception and without asking why.
• **Advertising our service elsewhere** may involve providing a platform with a hashed identifier so it can either exclude you from a campaign or build an audience resembling our members. We do not provide your profile content or your activity for this.
• **We do not sell your data and we do not share it for cross-context behavioural advertising.** If that ever changes, we will say so before it takes effect and provide an opt-out first, and we will honour the Global Privacy Control signal.
• **Measurement.** We measure whether a campaign worked. This produces aggregate numbers, not a dossier.

5.6 Research, improvement and model development

We analyse how the service is used in order to fix it, improve it and build new things. Where that analysis can be done on aggregated or de-identified data, it is.

We develop and evaluate models for ranking, matching, spam detection, content classification and safety. Where those models are trained on member content, we apply the following limits, and we state them as commitments rather than intentions:

1. **Private messages are not used to train recommendation or ranking models.** They are processed by safety classifiers, in an automated way, for the purpose of detecting abuse — and for no other purpose.
2. Training uses the minimum data necessary and, wherever the task allows, de-identified or aggregated inputs.
3. We do not sell member content to third parties for their model training.
4. You can object to processing based on legitimate interests, including this, under §10.

5.7 Legal compliance and claims

We process data to comply with the law that applies to us: tax and accounting retention, consumer protection, sanctions screening, content-moderation obligations, and lawful requests from courts and authorities. We also process it to bring or defend legal claims, which is why some records outlive an account — a claim can be brought after you have left.

5.8 Automated decision-making and profiling

We use automated systems in three places that matter to you.

Decisions with a **legal or similarly significant effect** — permanently banning an account, removing content, refusing a refund, or refusing a verification — are not made by an automated system alone. Either a person decides, or a person reviews the automated decision before it becomes permanent. Where an urgent risk requires immediate action, the automated restriction takes effect first and a person reviews it afterwards, and always immediately if you ask.

You have the right to obtain human intervention, to express your point of view, and to contest the decision. Do that through the appeal route in Part B §8. The reviewer will be someone who was not responsible for the original decision.

We do not use automated decision-making to set an individual's price on the basis of profiling.

6. How and with whom we share data

**We do not sell your personal data.** We do not share it for cross-context behavioural advertising. We do not disclose it for money or other valuable consideration.

What we do is set out below. Every recipient category is real; we have not listed hypothetical ones to give ourselves room.

A current list of the specific processors we engage, and the countries they operate in, is available on request at privacy@theoneapi.org.

6.1 What we require of processors

Every processor is engaged under a written contract that: limits them to our documented instructions; requires confidentiality; imposes security measures at least equivalent to our own; restricts sub-processing to parties bound by the same terms; requires them to assist with your rights requests and with breach notification; and requires deletion or return of the data at the end of the engagement. We assess each processor before engaging them and review them periodically.

6.2 How we handle government and law-enforcement requests

We assess every request against the law that supposedly authorises it. We require valid legal process. We refuse or challenge requests that are overbroad, procedurally defective, or unlawful. Where the law permits it and there is no ongoing investigation that notice would prejudice, we tell the affected member before disclosing.

An emergency-disclosure request — where there is an imminent risk of death or serious physical harm — is handled on a fast path, and we disclose only what is necessary to address the emergency.

6.3 Sharing you initiate

Some features exist to let you share deliberately: sharing a profile or listing outside the service, sharing details of a plan with a friend or an emergency contact, or connecting an external account. When you use them, the recipient gets what you sent them, and what they do with it is outside our control and outside this policy. Other members can use the same features with your content, subject to the visibility settings you have applied.

7. Affiliates and group companies

Where we operate as part of a group, we and our affiliates share data with each other for the following purposes, and no others:

• **Safety across the group** — identifying accounts and behaviour patterns that are harmful, so that a person banned from one service can be prevented from simply moving to another.
• **Shared operations** — hosting, security, customer support, payments, analytics, finance and legal, where it is more sensible to run one function than several.
• **Improvement of shared systems** — including recommendation and safety systems used by more than one brand.
• **Group reporting** — consolidated audit, financial reporting and planning, generally on aggregated data.

Each affiliate is bound by terms equivalent to this policy. Sharing for these purposes rests on our legitimate interests, or on a legal obligation where the group is subject to one collectively.

A current list of affiliates is at https://theoneapi.org/legal/affiliates.

8. International transfers

We are established in United States and host primarily in the European Union. Some of the recipients in §6 process data outside the EEA and the United Kingdom, in particular in the United States.

Where we transfer personal data outside the EEA, the UK or Switzerland, we rely on one of the following:

Contractual mechanisms alone are not sufficient, so we also apply supplementary measures: encryption in transit and at rest, key management that limits who can decrypt, minimisation of what is transferred, access controls and logging, and a documented policy of assessing, challenging and — where lawful and appropriate — refusing disproportionate government requests. We reassess transfers when the legal position in a destination country changes.

You can request a copy of the transfer mechanism relevant to a specific recipient at privacy@theoneapi.org.

9. How long we keep data

We keep personal data only as long as we need it for the purposes in §5, or as long as the law requires. The categories below are the operative rules; where two apply, the longer governs, and where an open claim, dispute, investigation or preservation order exists, retention continues until it is resolved.

9.1 What happens when you close your account

Closure is deliberately two-stage.

**Immediately, within the same request:**

• your profile stops being visible on every surface — you leave discovery, listings, search and recommendations at once;
• your account can no longer be signed into with your credentials;
• pending marketing is stopped.

**During the grace period of 30 days:**

• your data is retained so that you can restore the account by signing in;
• it remains invisible to everyone else throughout.

**After the grace period:**

• the irreversible purge runs across our data stores. It is executed per record, keyed on your account identifier;
• the categories in the table above that we are required or permitted to keep survive it, in the narrowest form that serves their purpose;
• an audit record of the deletion itself is retained, naming which tables were purged and which could not be reached, because a deletion you cannot evidence is a deletion you cannot prove.

**What survives, and why.** Tax records, because the law says so. The safety window, because harm surfaces late. The credit ledger, because if you are owed a refund after closing your account, the ledger is the only thing that proves it. Messages in another member's inbox, because they are that member's data. Aggregated statistics, because they are no longer about you.

**What we will not do.** We will not retain your profile, your photos, or your content for our own use after the purge. We will not resurrect a deleted account for anyone other than you.

9.2 Inactivity

If you do not sign in for two years, we will notify you at your registered address and, absent a response, close the account and apply the deletion schedule above. Purchased entitlements that have not expired are honoured if you return within the grace period.

9.3 Suspension

While an account is suspended, the profile is not visible but the data is retained, because a suspension is temporary by definition and the account may be reinstated. You may ask us to delete it during the suspension instead, and we will.

10. Your rights

Depending on where you live, you have some or all of the rights below. Some are named differently in different laws; we have used the European names and noted the common alternatives.

10.1 How we handle a request

**Verification.** We will ask you to verify your identity before acting, in proportion to the sensitivity of what you are asking for. For a signed-in request, being signed in is usually enough. For a request that would disclose data or delete an account, we may require more. We will not ask for a government identity document unless the request cannot be verified any other way, and we delete anything you send for verification once the request is closed.

**Timing.** We respond within **one month**. Where a request is complex or you have made several, we may extend by a further two months and will tell you within the first month, with reasons. US state laws generally give 45 days with a 45-day extension; we apply whichever period is shorter for you.

**Cost.** Free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — in particular where it is repetitive — and we will explain why.

**Refusals.** We can refuse a request that is unlawful, that we cannot verify, or that would infringe someone else's rights, trade secrets or intellectual property. A request for another member's data will be refused; they must ask themselves. If we refuse, we will tell you why and how to challenge it.

**Authorised agents.** You may use an agent where your law allows. We will require proof of the authorisation and, usually, verification of you directly.

**Appeals.** If we refuse, you may appeal by writing to privacy-appeals@theoneapi.org with the subject "Privacy Request Appeal". We will respond within the period your law provides. If you are a resident of a US state with a comprehensive privacy law, you may also complain to your state Attorney General; California residents may complain to the California Privacy Protection Agency.

10.2 What a data export contains

Your download includes: account and profile data; your content, including photos and messages you sent; your purchase and subscription history and your credit ledger; your usage history in a structured form; your consent and preference records; and the inferences we hold about you where they constitute personal data.

It does not include: data about other people that happens to sit alongside yours; internal notes whose disclosure would prejudice an ongoing safety investigation; security and anti-fraud signals whose disclosure would tell a bad actor how to evade detection; and material protected by legal privilege or trade secret. Where we withhold something, we will say that we have and on what ground.

10.3 Controls in the service

Some things are faster to change than to request.

10.4 Complaints

Tell us first if you can: privacy@theoneapi.org. We would rather fix it than litigate it.

You may complain to a supervisory authority regardless. Our lead authority is none - we have no establishment in the European Economic Area. You may instead complain to the authority where you live, where you work, or where you believe the infringement happened. In the EEA the list is published by the European Data Protection Board; in the UK it is the Information Commissioner's Office; in Switzerland the Federal Data Protection and Information Commissioner. You also have the right to an effective judicial remedy.

11. Cookies and similar technologies

We use cookies, local storage, software development kits, pixels and similar technologies. The categories are summarised below; the complete treatment, including the inventory, consent mechanics and the position on Global Privacy Control, is in **Part D**, and the live inventory is at https://theoneapi.org/legal/cookies.

Our own audience measurement is described in §4.2.1. It sets no cookie, reads nothing from your device and stores nothing there, so it is not governed by the choice above; it relies on our legitimate interests under §5, and you can object to it under §10.

You can change your choice at any time at https://theoneapi.org/settings/privacy, and you can control cookies in your browser. Declining non-essential cookies does not reduce your access to the service; it reduces our ability to measure it. Some mobile operating systems provide their own tracking control, which we honour independently of the setting here. We honour the Global Privacy Control signal where it is presented.

12. Security

We apply technical and organisational measures proportionate to the risk, including:

• encryption in transit for all traffic, and encryption at rest for stored data;
• key management that limits which systems and which people can decrypt what;
• authentication protections including password hashing with a modern algorithm, multi-factor authentication where offered, and detection of credential-stuffing and takeover attempts;
• least-privilege access for staff, granted by role, reviewed periodically, and revoked immediately on role change or departure;
• logging of staff access to member data, with the case that justified it;
• network segmentation between surfaces, so a compromise of one is not a compromise of all;
• separation of duties, code review and change control for anything touching member data;
• vulnerability management, dependency scanning, and periodic penetration testing;
• backup and tested restoration, with backups held under the same protections as production;
• vendor security assessment before engagement and periodically afterwards.

**Support staff see only what a case requires**, and internal notes are kept in a store separate from the customer-visible conversation, so that an internal comment cannot leak into a reply by accident.

**No system is perfectly secure.** Protect your side of it: use a password you use nowhere else, enable multi-factor authentication, be sceptical of anyone asking you to move a conversation off-platform or to send money, and sign out on shared devices. We will never ask you for your password.

If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it where the law requires, and we will notify you directly, without undue delay, where the breach is likely to result in a high risk to your rights and freedoms.

13. Children and minors

**The Dating surface is restricted to people aged 18 or over.** No exception, in any country.

Other surfaces require you to be at least 16, or the age of digital consent in your country, whichever is higher.

We do not knowingly collect personal data from anyone below the applicable minimum age. We use date of birth at registration, signals that suggest a stated age is false, and — where we have reason to doubt an account — verification, to enforce this.

If you believe an underage person is using the service, report it through https://support.theoneapi.org. Reports of this kind are prioritised. If we determine that an account belongs to someone below the minimum age, we close it and delete the data, retaining only what is necessary to prevent the account being recreated and to comply with any reporting obligation.

Where content involving the sexual exploitation of a minor is identified, we remove it, preserve the evidence, terminate the account and report it to the competent authorities, including the National Center for Missing & Exploited Children where applicable.

Our age-assurance practices are described at https://theoneapi.org/legal/age-assurance.

14. Data transparency

Most privacy policies describe what a company *may* do. This section describes what we actually publish, on what schedule, so that the description above can be checked rather than trusted.

14.1 What we publish, and when

Where a legal restriction prevents us from reporting a specific figure, we say that a restriction applies rather than omitting the line silently.

14.2 Algorithmic transparency

Every surface that ranks or recommends does so from stated inputs. This is the summary; the detailed notice is at https://theoneapi.org/legal/ranking.

**Promoted and paid placement is always labelled** as such, and paying for placement never changes the factual information shown about a listing.

**Private messages are never an input to ranking or recommendation.** They are processed only to deliver them and to run safety classifiers over them.

14.3 Where your data lives

Where a processor operates outside these regions, the transfer mechanisms in Part A §8 apply.

14.4 Advertising transparency

We do not run third-party advertising inside the service. Where we promote our own features, the promotion is labelled. Where we advertise the service on a third-party platform, we may provide that platform with a hashed identifier so that it can exclude you from a campaign or find an audience resembling our members — and nothing else. We do not provide your profile content, your messages or your activity for advertising purposes.

If we ever introduce third-party advertising, we will say so before it starts, describe the data involved, and provide the controls the law requires before the first ad is served.

14.5 Notice before a practice changes

A new purpose for data we already hold is a change in practice, not a housekeeping edit. Before we begin processing your existing data for a materially new purpose, we will notify you, explain the purpose and its legal basis, and — where the basis is consent — ask for it and not proceed without it.

14.6 Your own transparency

Inside the service you can see, without asking us:

• what data we hold about you, through the export in Part A §10.2;
• your consent history — what you agreed to, when, and what you withdrew;
• your purchase and credit ledger, entry by entry;
• your enforcement history: every action taken against your account, the rule relied on, and the outcome of any appeal;
• the sessions and devices currently signed in, with the ability to revoke any of them.

This is at https://theoneapi.org/settings/privacy/data.

14.7 Independent scrutiny

We support scrutiny we do not control. Where the law provides for it, we grant vetted researchers access to data necessary to study systemic risks, under terms that protect member privacy — details at https://theoneapi.org/legal/research-access. We commission independent audits where the law requires them, and publish the outcome. Our security disclosure programme at https://theoneapi.org/.well-known/security.txt authorises good-faith research and commits us not to pursue researchers who stay within it.

15. Changes to this policy

We will change this policy over time. When we do:

• the updated version is published here with a new effective date and version number;
• **for material changes we notify you before they take effect** — in the service, by email, or both — with at least 30 days' notice;
• where a change requires your consent, we ask for it, and processing under the new purpose does not begin until you give it;
• the previous version remains available at https://theoneapi.org/legal/archive, and a summary of what changed is in Part D §4.

Continuing to use the service after a change takes effect means you accept it, except where consent is required.

16. How to contact us

Region-specific postal addresses and representatives are in Part E.