Privacy Policy

1. Who we are

Graxe.ai, Inc. ("Graxe," "we," "us") is a Delaware corporation. We operate graxe.ai and the Graxe application (together, the "Service"). Graxe is a private matchmaking service for adults, admitting members from an open waitlist. For questions about this policy or your data, contact legal@graxe.ai.

2. What we collect

Information you give us

• Waitlist and account information. Name, email address, date of birth, and phone number. We collect birthdates because the Service is for adults 18 and over, without exception.
• Profile information. Photos, responses to prompts, and your stated preferences about who you are looking for. Some of the data we handle is sensitive by nature, including sexual orientation, relationship intentions, biometric verification data, and the outcome of any voluntary background screening. We process sensitive information only with your consent and only to run the Service.
• How you interact with matches. When you review profile cards, we collect interaction signals: which profiles you keep or pass, how long you spend reading each one, the order in which you read, and the outcomes of your matches. Some of the profiles we show you are chosen to learn what you like rather than because they are our best guess; they look like every other card, and keeping or passing them costs you nothing. We also compare what you tell us you are looking for with what you actually choose, and we learn from the difference. We use these signals to improve who we show you. These signals are measurements of your activity in the app; they do not include the content of your messages.
• Messages. Conversations you have with a match through the Service. We do not read your messages for marketing, and we never share them with advertisers. Automated systems and, where flagged, trained reviewers may review messages for safety, fraud prevention, and enforcement of our Terms. Automated systems may also process your conversations to provide features you choose to use, as described in Section 3; humans do not review your conversations for those features.
• Conversations hosted by GRAXE. GRAXE is Graxe's automated host. When two members have both agreed to talk, GRAXE opens the conversation, is present in it, and is always identified as automated. Before your first conversation we tell you that GRAXE reads it. GRAXE checks every message for safety before the other member sees it, may offer you words to send, and never sends anything as you or rewrites what you wrote. Questions GRAXE asks you privately, before or after an evening with a match, stay between you and GRAXE; your answer is never passed to the other member. Where a question is put to you both, such as whether you would each like to meet again, the answers are revealed only together, once both of you have answered, and never one at a time. A closed conversation is deleted thirty days after it closes.
• Voice input. Where the Service lets you speak instead of typing, your speech is turned into text by Apple's speech recognition on your device. Graxe receives the text only. We never record, store, or transmit audio of your voice, we do not create a voiceprint or any other biometric identifier from it, and there is no recording for us to hand to anyone. Apple's own handling of speech recognition is governed by Apple's privacy policy. Typing is always available instead.
• Events you book. If you reserve a seat at Graxe & Table or book a Graxe Xperience, we record the booking, whether you attended, and any cancellation. We do not receive your restaurant bill, what you ordered, or what you spent; that is between you and the venue.
• Plans with a match. When you and a match plan an evening through Graxe, we record the venue or venues, the times, a short note if you write one, whether the plan was accepted, and afterward whether you each say you went. Thirty days after the evening, the plan is reduced to the venue alone and the times, address, and note are removed. If you choose to share your plan with a trusted person, we create a page for them that shows the venue, the time, and your first name only; it never shows who you are meeting, and it expires the day after.
• Photographs at events. Where we have said photography will take place at an event, we hold the images taken and may use them to describe and promote Graxe, as set out in our Events Policy. You can withdraw that permission at any time by emailing legal@graxe.ai, or decline on the night.
• Payment information. Memberships bought in the app are processed by the app store; cover charges and event prices are processed by our payment processor. In both cases the card details go to that company, not to us. Graxe receives a record that a payment succeeded, the amount, and the last four digits. We never see or store your full card number.
• Communications with us. Support requests, feedback, and survey responses.

Information collected automatically

• Usage and interaction data. How you use the Service: the features you use, the choices you make within the app, the features and experiences you choose to use and how you engage with them, responsiveness, session activity, and how you interact with the introductions and suggestions we make. This information helps us make better introductions and suggestions and keep the Service honest.
• Device and log data. Device type, operating system, app version, IP address, identifiers, crash logs, and diagnostic data.
• Location. Your city, state, and ZIP code, which you give us. We use the city and state to judge whether an introduction is close enough to meet, and the ZIP code to suggest places near both members after a match. We do not collect your live position and the app requests no location permission for this purpose. When you plan an evening with a match, we record which venue you chose from our catalogue; we do not store the venue's map coordinates alongside your plan, and we look them up from the catalogue only when a map pin is displayed.
• Presence check-ins. If you hold a plan or a reservation for a room and choose to tap "I'm here" when you arrive, your phone checks on its own that you are within a short walk of the venue and tells us only whether that check passed. We record the fact that it passed, the venue, the event, and the time. No coordinate is ever sent to us or stored. Check-ins earn the marks that make up your collection and light the venue's live count, which is shown only when at least three members have checked in and never identifies anyone.

Information from others

• Invitations and referrals. If a member invites you, we receive the contact information they provide to send the invitation.
• Identity verification. Graxe verifies that members are real people who match their accounts. Verification uses your profile photographs, one verification selfie, and the photograph on your government-issued ID, and reads the name and date of birth printed on that ID to compare them with what you entered. Automated facial measurements generated from those images may constitute biometric identifiers or biometric information, including a scan of face geometry. The comparison runs on your own device using Apple technology. There is no outside verification provider: facial measurements and reusable biometric templates are never sent to Graxe's servers or to any third party, and Graxe receives only the verification result and the records needed to document that verification happened. We collect and process biometric information only with your written authorization, given before any capture. We never sell, lease, trade, or otherwise profit from it. Facial measurements are destroyed when the comparison completes, and the verification copies of your selfie and ID image are deleted when verification completes or is abandoned and in every case within 30 days of capture. We never compare your face against another member's. Full detail is in the Biometric Data Retention and Destruction Policy.
• Registry check. Before you join, the name and date of birth read from your government-issued identification on your device, together with your state, are compared against the National Sex Offender Public Website, the public registry maintained by the United States Department of Justice. Every member is checked the same way, after acknowledging a Registry Check Notice. Graxe keeps only the result (clear, under review, cleared, or held), the date, and a reference number; no registry record is copied or stored, and the result is never a badge, never part of matching, and never shown to another member. A match is reviewed by a person before anything happens, and you may dispute a result by emailing support@graxe.ai. The Registry Check Policy describes the check in full.
• Voluntary background screening. If you choose to complete an optional criminal background screening to display a screening tag, you authorize the screening provider directly under its own terms and privacy policy. The provider conducts the screening; Graxe receives only the outcome needed to display or decline the tag, and we do not receive, store, or review the underlying report or your criminal history details. Choosing not to complete a screening has no effect on your membership.

3. How we use your information

• To make introductions. Graxe uses automated systems to bring two compatible people together. These systems consider the information you provide, including your profile and stated preferences, together with your activity within the Service as described in Section 2. That is the product, and it cannot work without this processing.
• To provide suggestions. The Service may offer automated suggestions as part of the member experience, generated from the information you give us, your activity within the Service, and, with your consent, your location. A suggestion involving more than one member never reveals one member's underlying personal data, such as a precise location or home address, to another member. Suggestions provided to you are private to you.
• To reach you by text, if you choose. With your consent, we deliver suggestions and match notifications by SMS as well as in the app. These messages are written to be discreet and to keep unnecessary detail off your lock screen. You can turn them off at any time in your settings or by replying STOP, and doing so does not affect your membership. Text messaging is governed by our SMS Terms.
• To keep the Service safe. We use your information to verify eligibility, detect and prevent fraud, misrepresentation, spam, and abuse, and to enforce our Terms of Service, including by analysing the timing and pattern of activity to detect automated accounts and one person operating more than one account.
• To host conversations and plan evenings. GRAXE, our automated host, uses your profile, your activity, and what you tell it to make introductions, to open and chaperone conversations, and to suggest places to go and small gestures after a match. What one member tells GRAXE privately is never used to tell the other member what was said.
• To operate, train, and improve our systems. The automated systems that run the Service, including the systems that make introductions and suggestions, learn from the information described in this policy, including the information you provide and your activity within the Service. We use this data to develop, train, evaluate, and improve those systems, alongside diagnostics, research, and development of new features. Where practical we use de-identified or aggregated data for these purposes. Our systems are trained for the Service and nothing else.
• To communicate with you. Service messages, waitlist updates, and, with your consent, marketing you can opt out of at any time.
• To meet our legal obligations and protect the rights, safety, and property of our members, the public, and Graxe.

Automated decision-making and profiling

Introductions and suggestions on Graxe are generated by automated systems. That is profiling under some privacy laws, and we tell you so plainly. No decision produced by these systems has a legal effect on you; declining or ignoring an introduction or a suggestion carries no penalty. Where the law of your state or country gives you rights regarding profiling, including the right to opt out of profiling in furtherance of decisions that produce significant effects, you may exercise those rights as described in Section 6.

4. What we will not do

5. When we share information

Other members. Your profile is presented to members we introduce you to. That presentation includes a personality card, a short archetype derived from your activity in the app. It reflects how you engage, never your private answers: your messages, your seeking preferences, and your interaction signals themselves are not shown to anyone. After you and a match have each taken part in the same room, we may show each of you a single figure, the Reciprocation Read, which expresses how strongly both of your activity points toward one another. It is computed from both members' signals, appears only once both of you have taken part, and never reveals either member's individual answers.

• Service providers. Vendors that host our infrastructure, process waitlist submissions, send email, provide analytics, supply mapping and location information for location-based features, perform identity verification, conduct voluntary background screenings that members individually authorize, and support safety operations, under contracts that limit their use of your data to providing services to us. When we request information from a mapping provider, we send only what is needed to return relevant results, never your identity or any other member's. Our website waitlist form is processed by Formspree.
• Other members. Only what the product is designed to show: the profile content you choose to share, presented to an introduction when one is made. Graxe does not operate a public browsing or search experience.
• Payment processors. Apple or Google process memberships bought in the app under their own terms. Our payment processor handles cover charges and event prices. Each receives your card details directly and acts on its own account for the payment data it collects, under its own privacy policy.
• Venues and event partners. When you book a seat, we tell the venue how many people are coming and the name the reservation is held under. We do not send the venue your profile, your photographs, your preferences, or anything about who else is at the table or why.
• Suggestion partners. Some suggestions in the Service may feature venues, businesses, or products from partners that compensate Graxe; any such suggestion is identified as a partner suggestion where it appears. We share with those partners only aggregated or de-identified measurements of suggestion activity, never your identity, your messages, or your profile content. If you follow a link to a partner's site or service, that partner's own privacy policy governs from that point.
• Safety and legal. When required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect someone's safety, investigate fraud, or defend our legal rights.
• Corporate events. If Graxe is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy's commitments.

6. Your rights and choices

Depending on where you live, including under the Texas Data Privacy and Security Act, the California Consumer Privacy Act, and similar state laws, you have the right to:

• Confirm whether we process your personal data and access it;
• Correct inaccuracies in your personal data;
• Delete your personal data;
• Obtain a portable copy of data you provided to us;
• Opt out of the sale of personal data, targeted advertising, and certain profiling. We do not sell data or run targeted advertising, and we honor these rights regardless;
• Not be discriminated or retaliated against for exercising any of these rights.

To exercise any right, email legal@graxe.ai from the address associated with your account. We will verify your identity, respond within 45 days, and explain any extension or denial. When the app is available, you will also be able to delete your account and its data directly in the app’s settings; the email path above remains available whether you joined through the Apple App Store, Google Play, or the web. If we deny a request, you may appeal by replying to our decision with the word "Appeal" in the subject line; if your appeal is denied, you may contact your state Attorney General, including the Texas Attorney General at texasattorneygeneral.gov.

You may also withdraw consent for sensitive data processing at any time. Because that data is what allows Graxe to work, withdrawing consent may require closing your account.

What deleting your account does

When you delete your account, we erase at once everything that identifies you: your name, contact details, photographs, profile and every version of it, your answers to the interview, your behavioral signals, the learned representation our systems built of you, your plans and check-ins and collection, your sealed answers to a match, and every verification record. Your account becomes a blank placeholder with no name and no way back to you.

Two kinds of record stay, attached to that blank placeholder, because they are not only yours:

• Your consent records, which are our proof that you gave permission for what we did while you were a member. We keep them for four years after deletion, then delete them.
• Your key turns, the record that you and another member each chose to open a door to one another. Erasing yours would erase theirs. We keep them without your identity and with no end date.

If a legal hold applies to your account, for example because of active litigation, a regulatory request, or a safety review, deletion is paused for as long as the hold lasts. We will tell you a hold exists, though we may not be able to say why. We keep a log of every deletion that records what was erased and when, and deliberately never who.

7. Data retention

We keep personal data only as long as needed for the purposes described here: while your account is active, and afterward for a limited period to satisfy legal, safety, tax, and audit obligations, resolve disputes, and enforce agreements. When you delete your account, we begin deletion of your profile and content, subject to those limited holds. De-identified and aggregated data may be retained for research and service improvement.

Some things are held to a shorter clock:

• Biometric verification data is destroyed once verification is complete, and no later than the deadline set by the law of your state. We do not keep it for any other purpose and we never sell it.
• Voice is not retained at all, because no audio ever reaches us.
• Event bookings are kept for the period tax and dispute-resolution rules require, and then deleted.
• Event photographs are deleted when you withdraw your permission, or 24 months after your membership ends, whichever comes first.
• Details of an evening you planned with a match are reduced to the venue alone thirty days after the evening.
• Presence check-ins never contain a coordinate, so there is nothing about where you stood to keep or to delete.
• Consent records are kept for four years after you delete your account, without your identity, then deleted.
• Key-turn records are kept without your identity and with no end date, because they belong to two people.

Our retention schedule is written into our systems, table by table, and the code that deletes an account is checked against it automatically. What this page says and what the software does are the same list.

8. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of what we hold. In plain terms:

• Encryption. Your data is encrypted while it travels and while it is stored.
• Access is narrow and recorded. Only staff who need member data can reach it, each person signs in as themselves, and access is logged.
• Sensitive records are kept apart. Verification and screening records are stored separately from the data used to make introductions, and the systems that decide who you meet cannot read them. This is built into how the database is shaped, not left to policy.
• No card numbers. Payment details go to the app store or to our payment processor and never reach us, so there are no card numbers here to lose.
• No keys in the app. The credentials our systems use are held in managed secret storage. They are not shipped inside the app you download, where anyone could take it apart and read them.
• Deletion means deletion. When data reaches the end of its retention period it is deleted, not archived out of sight.

No system is perfectly secure, and nobody who tells you otherwise is being straight with you. If a breach affects you we will notify you as the law requires, and we will notify regulators where they require it too.

9. Age requirement

Graxe is for adults 18 and over. We do not knowingly collect data from anyone under 18, and we verify birthdates at registration. If you believe a minor has provided us data, contact legal@graxe.ai and we will delete it.

10. Website, cookies, and tracking

The graxe.ai website sets no cookies at all. Not advertising cookies, not analytics cookies, not preference cookies. We store nothing in your browser’s local or session storage either. You will not see a cookie consent banner here, and that is not an oversight. There is nothing to ask you to consent to.

Two things about the website are worth naming rather than leaving as an absence:

• Aggregate traffic measurement. We use Cloudflare Web Analytics, which is cookieless by design: it stores nothing on your device and does not follow you between sites. It tells us how many people visited a page, not who they were.
• Fonts are served by us. Our typefaces are hosted on our own infrastructure rather than loaded from a font provider’s network. Loading them from a third party would disclose your IP address to that company before you had done anything at all. It is a small thing and we did not want it.

We do not use third-party advertising cookies, tracking pixels, attribution SDKs, or session-replay tools anywhere. Where required, we honor browser-based universal opt-out signals such as Global Privacy Control.

The one third party that receives information you type is our waitlist form processor, named in Section 6, and it receives it only when you choose to submit the form.

11. Supplemental notice for the EEA, United Kingdom, and Switzerland

This section applies to you if you are in the European Economic Area, the United Kingdom, or Switzerland, and it supplements the rest of this policy. Where this section conflicts with anything above, this section controls for you. It is written to the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection.

Controller and representative

Graxe.ai, Inc., a United States company, is the controller of your personal data. Before membership opens in the EEA or the UK, we will appoint and name here a representative in the Union under Article 27 GDPR and, where required, a UK representative, together with any European affiliate entity that acts as controller or joint controller for European members. Until then, all requests should be directed to legal@graxe.ai.

Legal bases for processing

• Performance of a contract (Art. 6(1)(b)): creating your account, operating your profile, operating the features of the Service, making introductions, providing suggestions, providing messaging, and member support. This is the core of the Service.
• Consent (Art. 6(1)(a)): marketing communications, delivery of service messages by SMS, precise location, optional features we describe at the point of collection, and non-essential cookies. You may withdraw consent at any time without affecting prior processing.
• Explicit consent for special category data (Art. 9(2)(a)): data revealing your sexual orientation, biometric data processed for identity verification, and any other special category data you choose to provide is processed only with your explicit consent, and only to operate and improve the Service. Withdrawing this consent may require closing your account, because the Service cannot function without it.
• Criminal offense data (Art. 10): the voluntary background screening feature involves data relating to criminal convictions and offenses, which private companies may process in the EU and UK only where authorized by member state or UK law. For that reason, this feature may be unavailable or operate differently in the EEA, the UK, and Switzerland, and we will describe the position for your country before offering it to you.
• Legitimate interests (Art. 6(1)(f)): securing the Service, preventing fraud, misrepresentation, and abuse, enforcing our Terms, service analytics, and improving the Service, including training and evaluating the automated systems that operate it, in each case balanced against your rights and freedoms. You may object at any time, as described below.
• Legal obligation (Art. 6(1)(c)): retaining records and responding to lawful requests where the law requires it.

Automated decision-making and profiling

Introductions and suggestions on Graxe are produced by automated systems and constitute profiling under Article 4(4) GDPR. This processing is necessary for the performance of your contract with us: automated matching and suggestions are the service you sign up for. Suggestions that use your precise location are made only with your consent (Art. 6(1)(a)). We do not use your data to make solely automated decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22. If you believe an automated outcome has significantly affected you, you have the right to obtain human review, to express your point of view, and to contest the outcome by contacting legal@graxe.ai.

Your rights

Subject to the conditions in the GDPR, you have the right to:

• Access your personal data and receive a copy (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data (Art. 17);
• Restrict processing (Art. 18);
• Receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller (Art. 20);
• Object to processing based on legitimate interests, and to direct marketing at any time (Art. 21);
• Withdraw any consent at any time (Art. 7(3));
• Lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of an alleged infringement. UK residents may complain to the Information Commissioner's Office (ico.org.uk); Swiss residents to the Federal Data Protection and Information Commissioner.

We respond to requests within one month, extendable by two further months for complex requests, and we will tell you if we extend. Exercising your rights is free of charge.

International data transfers

Your personal data is processed in the United States. Where we transfer personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards under Articles 44 to 49 GDPR, principally the European Commission's Standard Contractual Clauses supplemented where needed, the UK International Data Transfer Addendum, and Swiss-recognized equivalents, together with technical and organizational measures appropriate to the transfer. If we certify to the EU-U.S. Data Privacy Framework or its UK and Swiss extensions, we will say so here. You may request a copy of the relevant safeguards at legal@graxe.ai.

Retention

We retain personal data according to the criteria in Section 7: no longer than necessary for the purposes for which it was collected, with limited legal, safety, and dispute-resolution holds. On request we will tell you the retention period, or the criteria used to determine it, for any category of your data.

Cookies in the EEA and UK

We set no non-essential cookies or similar technologies, so the prior-consent requirement under your country’s ePrivacy rules is not engaged and no consent banner is shown. If that ever changes, we will ask first, through a banner that lets you refuse as easily as accept and withdraw at any time, and this section will change before the cookie does.

No obligation to provide data

Providing personal data is not a statutory requirement. It is, however, necessary to enter into and perform the membership contract: without your account data, profile data, and the special category data described above, we cannot provide the Service.

12. Changes to this policy

We will post any changes here with a new effective date, and for material changes we will give you advance notice through the Service or by email. Continued use after the effective date means the updated policy applies.

13. Contact

Graxe.ai, Inc. · legal@graxe.ai