Privacy Policy

1. Who we are

Graxe.ai, Inc. ("Graxe," "we," "us") is a Delaware corporation. We operate graxe.ai and the Graxe application (together, the "Service"). Graxe is a private matchmaking service for adults, admitting members from an open list. For questions about this policy or your data, contact privacy@graxe.ai.

2. What we collect

Information you give us

• Waitlist and account information. Name, email address, date of birth, and phone number. We collect birthdates because the Service is for adults 18 and over, without exception.
• Profile information. Photos, responses to prompts, and your stated preferences about who you are looking for. Some of the data we handle is sensitive by nature, including sexual orientation, relationship intentions, biometric verification data, and the outcome of any voluntary background screening. We process sensitive information only with your consent and only to run the Service.
• Messages. Conversations you have with a match through the Service. We do not read your messages for marketing, and we never share them with advertisers. Automated systems and, where flagged, trained reviewers may review messages for safety, fraud prevention, and enforcement of our Terms. Automated systems may also process your conversations to provide features you choose to use, as described in Section 3; humans do not review your conversations for those features.
• Communications with us. Support requests, feedback, and survey responses.

Information collected automatically

• Usage and interaction data. How you use the Service: the features you use, the choices you make within the app, the features and experiences you choose to use and how you engage with them, responsiveness, session activity, and how you interact with the introductions and suggestions we make. This information helps us make better introductions and suggestions and keep the Service honest.
• Device and log data. Device type, operating system, app version, IP address, identifiers, crash logs, and diagnostic data.
• Location. Approximate location derived from your IP address or the city you provide. With your consent through a device permission, we collect precise location to power location-based features, which we describe when you enable the permission. Precise geolocation is sensitive data under some laws, and we treat it that way: we collect it only with your consent, use it only for the features described in this policy, and you can revoke the permission at any time in your device settings.

Information from others

• Invitations and referrals. If a member invites you, we receive the contact information they provide to send the invitation.
• Identity verification. Graxe verifies that members are real people who match their accounts. Verification is performed by an independent provider and may involve an image of your government-issued ID and a self-captured photo or short video. This can include biometric data, such as facial geometry, used solely to confirm you match your ID. We collect and process biometric data only with your explicit consent, we never sell it, and it is deleted by us and required to be deleted by our provider once verification is complete, or sooner where the law requires. The provider confirms the verification result to us.
• Voluntary background screening. If you choose to complete an optional criminal background screening to display a screening tag, you authorize the screening provider directly under its own terms and privacy policy. The provider conducts the screening; Graxe receives only the outcome needed to display or decline the tag, and we do not receive, store, or review the underlying report or your criminal history details. Choosing not to complete a screening has no effect on your membership.

3. How we use your information

• To make introductions. Graxe uses automated systems to bring two compatible people together. These systems consider the information you provide, including your profile and stated preferences, together with your activity within the Service as described in Section 2. That is the product, and it cannot work without this processing.
• To provide suggestions. The Service may offer automated suggestions as part of the member experience, generated from the information you give us, your activity within the Service, and, with your consent, your location. A suggestion involving more than one member never reveals one member's underlying personal data, such as a precise location or home address, to another member. Suggestions provided to you are private to you.
• To reach you by text, if you choose. With your consent, we deliver suggestions and match notifications by SMS as well as in the app. These messages are written to be discreet and to keep unnecessary detail off your lock screen. You can turn them off at any time in your settings or by replying STOP, and doing so does not affect your membership. Text messaging is governed by our SMS Terms.
• To keep the Service safe. We use your information to verify eligibility, detect and prevent fraud, misrepresentation, spam, and abuse, and to enforce our Terms of Service.
• To operate, train, and improve our systems. The automated systems that run the Service, including the systems that make introductions and suggestions, learn from the information described in this policy, including the information you provide and your activity within the Service. We use this data to develop, train, evaluate, and improve those systems, alongside diagnostics, research, and development of new features. Where practical we use de-identified or aggregated data for these purposes. Our systems are trained for the Service and nothing else.
• To communicate with you. Service messages, list updates, and, with your consent, marketing you can opt out of at any time.
• To meet our legal obligations and protect the rights, safety, and property of our members, the public, and Graxe.

Automated decision-making and profiling

Introductions and suggestions on Graxe are generated by automated systems. That is profiling under some privacy laws, and we tell you so plainly. No decision produced by these systems has a legal effect on you; declining or ignoring an introduction or a suggestion carries no penalty. Where the law of your state or country gives you rights regarding profiling, including the right to opt out of profiling in furtherance of decisions that produce significant effects, you may exercise those rights as described in Section 6.

4. What we will not do

5. When we share information

• Service providers. Vendors that host our infrastructure, process list submissions, send email, provide analytics, supply mapping and location information for location-based features, perform identity verification, conduct voluntary background screenings that members individually authorize, and support safety operations, under contracts that limit their use of your data to providing services to us. When we request information from a mapping provider, we send only what is needed to return relevant results, never your identity or any other member's. Our website signup form is processed by Formspree.
• Other members. Only what the product is designed to show: the profile content you choose to share, presented to an introduction when one is made. Graxe does not operate a public browsing or search experience.
• Suggestion partners. Some suggestions in the Service may feature venues, businesses, or products from partners that compensate Graxe; any such suggestion is identified as a partner suggestion where it appears. We share with those partners only aggregated or de-identified measurements of suggestion activity, never your identity, your messages, or your profile content. If you follow a link to a partner's site or service, that partner's own privacy policy governs from that point.
• Safety and legal. When required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect someone's safety, investigate fraud, or defend our legal rights.
• Corporate events. If Graxe is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy's commitments.

6. Your rights and choices

Depending on where you live, including under the Texas Data Privacy and Security Act, the California Consumer Privacy Act, and similar state laws, you have the right to:

• Confirm whether we process your personal data and access it;
• Correct inaccuracies in your personal data;
• Delete your personal data;
• Obtain a portable copy of data you provided to us;
• Opt out of the sale of personal data, targeted advertising, and certain profiling. We do not sell data or run targeted advertising, and we honor these rights regardless;
• Not be discriminated or retaliated against for exercising any of these rights.

To exercise any right, email privacy@graxe.ai from the address associated with your account. We will verify your identity, respond within 45 days, and explain any extension or denial. When the app is available, you will also be able to delete your account and its data directly in the app’s settings; the email path above remains available whether you joined through the Apple App Store, Google Play, or the web. If we deny a request, you may appeal by replying to our decision with the word "Appeal" in the subject line; if your appeal is denied, you may contact your state Attorney General, including the Texas Attorney General at texasattorneygeneral.gov.

You may also withdraw consent for sensitive data processing at any time. Because that data is what allows Graxe to work, withdrawing consent may require closing your account.

7. Data retention

We keep personal data only as long as needed for the purposes described here: while your account is active, and afterward for a limited period to satisfy legal, safety, tax, and audit obligations, resolve disputes, and enforce agreements. When you delete your account, we begin deletion of your profile and content, subject to those limited holds. De-identified and aggregated data may be retained for research and service improvement.

8. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold, including encryption in transit, access controls, and monitoring. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects you, we will notify you as required by law.

9. Age requirement

Graxe is for adults 18 and over. We do not knowingly collect data from anyone under 18, and we verify birthdates at registration. If you believe a minor has provided us data, contact privacy@graxe.ai and we will delete it.

10. Website, cookies, and tracking

The graxe.ai website sets no cookies at all. Not advertising cookies, not analytics cookies, not preference cookies. We store nothing in your browser’s local or session storage either. You will not see a cookie consent banner here, and that is not an oversight — there is nothing to ask you to consent to.

Two things about the website are worth naming rather than leaving as an absence:

• Aggregate traffic measurement. We use Cloudflare Web Analytics, which is cookieless by design: it stores nothing on your device and does not follow you between sites. It tells us how many people visited a page, not who they were.
• Fonts are served by us. Our typefaces are hosted on our own infrastructure rather than loaded from a font provider’s network. Loading them from a third party would disclose your IP address to that company before you had done anything at all. It is a small thing and we did not want it.

We do not use third-party advertising cookies, tracking pixels, attribution SDKs, or session-replay tools anywhere. Where required, we honor browser-based universal opt-out signals such as Global Privacy Control.

The one third party that receives information you type is our signup form processor, named in Section 6 — and it receives it only when you choose to submit the form.

11. Supplemental notice for the EEA, United Kingdom, and Switzerland

This section applies to you if you are in the European Economic Area, the United Kingdom, or Switzerland, and it supplements the rest of this policy. Where this section conflicts with anything above, this section controls for you. It is written to the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection.

Controller and representative

Graxe.ai, Inc., a United States company, is the controller of your personal data. Before membership opens in the EEA or the UK, we will appoint and name here a representative in the Union under Article 27 GDPR and, where required, a UK representative, together with any European affiliate entity that acts as controller or joint controller for European members. Until then, all requests should be directed to privacy@graxe.ai.

Legal bases for processing

• Performance of a contract (Art. 6(1)(b)): creating your account, operating your profile, operating the features of the Service, making introductions, providing suggestions, providing messaging, and member support. This is the core of the Service.
• Consent (Art. 6(1)(a)): marketing communications, delivery of service messages by SMS, precise location, optional features we describe at the point of collection, and non-essential cookies. You may withdraw consent at any time without affecting prior processing.
• Explicit consent for special category data (Art. 9(2)(a)): data revealing your sexual orientation, biometric data processed for identity verification, and any other special category data you choose to provide is processed only with your explicit consent, and only to operate and improve the Service. Withdrawing this consent may require closing your account, because the Service cannot function without it.
• Criminal offense data (Art. 10): the voluntary background screening feature involves data relating to criminal convictions and offenses, which private companies may process in the EU and UK only where authorized by member state or UK law. For that reason, this feature may be unavailable or operate differently in the EEA, the UK, and Switzerland, and we will describe the position for your country before offering it to you.
• Legitimate interests (Art. 6(1)(f)): securing the Service, preventing fraud, misrepresentation, and abuse, enforcing our Terms, service analytics, and improving the Service, including training and evaluating the automated systems that operate it, in each case balanced against your rights and freedoms. You may object at any time, as described below.
• Legal obligation (Art. 6(1)(c)): retaining records and responding to lawful requests where the law requires it.

Automated decision-making and profiling

Introductions and suggestions on Graxe are produced by automated systems and constitute profiling under Article 4(4) GDPR. This processing is necessary for the performance of your contract with us: automated matching and suggestions are the service you sign up for. Suggestions that use your precise location are made only with your consent (Art. 6(1)(a)). We do not use your data to make solely automated decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22. If you believe an automated outcome has significantly affected you, you have the right to obtain human review, to express your point of view, and to contest the outcome by contacting privacy@graxe.ai.

Your rights

Subject to the conditions in the GDPR, you have the right to:

• Access your personal data and receive a copy (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data (Art. 17);
• Restrict processing (Art. 18);
• Receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller (Art. 20);
• Object to processing based on legitimate interests, and to direct marketing at any time (Art. 21);
• Withdraw any consent at any time (Art. 7(3));
• Lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of an alleged infringement. UK residents may complain to the Information Commissioner's Office (ico.org.uk); Swiss residents to the Federal Data Protection and Information Commissioner.

We respond to requests within one month, extendable by two further months for complex requests, and we will tell you if we extend. Exercising your rights is free of charge.

International data transfers

Your personal data is processed in the United States. Where we transfer personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards under Articles 44 to 49 GDPR, principally the European Commission's Standard Contractual Clauses supplemented where needed, the UK International Data Transfer Addendum, and Swiss-recognized equivalents, together with technical and organizational measures appropriate to the transfer. If we certify to the EU-U.S. Data Privacy Framework or its UK and Swiss extensions, we will say so here. You may request a copy of the relevant safeguards at privacy@graxe.ai.

Retention

We retain personal data according to the criteria in Section 7: no longer than necessary for the purposes for which it was collected, with limited legal, safety, and dispute-resolution holds. On request we will tell you the retention period, or the criteria used to determine it, for any category of your data.

Cookies in the EEA and UK

We set no non-essential cookies or similar technologies, so the prior-consent requirement under your country’s ePrivacy rules is not engaged and no consent banner is shown. If that ever changes, we will ask first, through a banner that lets you refuse as easily as accept and withdraw at any time — and this section will change before the cookie does.

No obligation to provide data

Providing personal data is not a statutory requirement. It is, however, necessary to enter into and perform the membership contract: without your account data, profile data, and the special category data described above, we cannot provide the Service.

12. Changes to this policy

We will post any changes here with a new effective date, and for material changes we will give you advance notice through the Service or by email. Continued use after the effective date means the updated policy applies.

13. Contact

Graxe.ai, Inc. · privacy@graxe.ai