Privacy Policy.

This policy covers the DateFrame mobile app and the website at dateframe.offensa.com. It is written to meet the EU and EEA General Data Protection Regulation (GDPR) and ePrivacy rules, the UK GDPR, Data Protection Act 2018 and PECR, the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act as amended (CCPA/CPRA), other US state privacy laws, and US federal law including the FTC Act.

1. Who we are

Offensa operates DateFrame and this website. Offensa is the "controller" under the GDPR, UK GDPR and FADP and the "business" under the CCPA for the personal information described here.

Operator: Andrei Tigaieriu, an individual trading as Offensa, based in Iași, Romania. Privacy contact: dateframe@offensa.com.

2. What we collect

You are never required to give us anything beyond what the service needs. Because the service reviews your dating profile, it needs your photos and text.

On the upload and review screens

• Screenshots you upload so the app can find your photos, bio and prompts. They are processed in memory to extract that information and are never stored by us.
• Profile photos you confirm (cropped and compressed on your device). We store them privately in Cloudflare R2 so the report and your studio can show them.
• Profile text you confirm or edit: your bio and prompt answers.
• Preferences you choose: dating app (Hinge, Tinder, Bumble or undecided), what you are looking for, focus and tone.
• The analysis and report we generate from the above, stored on our servers and on your device.

Technical and account-free identifiers

• Anonymous session token. A random token stored on your device. Our server keeps only its hash, never the token itself. It links your device to your stored photos and report. It is not tied to your name, email or phone number.
• Request data. Our host, Cloudflare, processes your IP address and request details (app version, time, endpoint) to deliver the service, block abuse and apply rate limits. We do not use this data to profile you.
• Usage counters. Daily counts per anonymous session (for example, how many analyses you started) to enforce fair-use limits.

Purchases

When purchases launch, Apple processes the payment. We never see your card or payment details. We learn only whether a report has been unlocked.

If you contact us

Your email address and the content of your message.

Website

The website sets no cookies and loads no analytics, advertising or social media scripts. Its fonts and images are served from our own domain. Cloudflare processes request data (IP address, browser, page, time) to deliver the site and block abuse.

3. AI processing

One AI provider works on our behalf as our processor: Anthropic (Claude API). It receives (a) copies of your screenshots with every photo area blacked out on your device, to read your bio, prompts and profile details; (b) the profile photos you confirm, to describe what each photo shows; and (c) your text, preferences and those descriptions, to write the report. Your original screenshots are never uploaded: photo detection and cropping run on your phone without AI.

Anthropic processes this data on our behalf and, under its commercial terms, does not use it to train its models. It may retain inputs for a limited period for abuse monitoring, as set out in its terms. See Anthropic's privacy policy.

We instruct both models not to infer sensitive traits (such as sexual orientation, ethnicity, religion or health) from your photos or text, and the service does not score attractiveness. We do not use facial recognition and do not create biometric templates or identify anyone. Your original screenshots never leave your device; the masked copies used to read text are not stored by us.

4. Sensitive information and your consent

Dating-related content can reveal sensitive information, such as sexual orientation, ethnicity or religion, even when you don't intend it to (for example, through photos, text or the app you pick). Where the law treats this as special-category data, we process it only on your explicit consent (GDPR Art. 9(2)(a) and equivalents), which you give on the upload screen before anything is sent.

You can withdraw consent at any time by deleting your data in Preferences ("Clear draft and start again"). That deletes your stored photos, profile text and reports from our servers. Withdrawal doesn't affect processing done before it. The service can't work without this processing, so if you withdraw, you can no longer use it for that profile. Without consent, don't upload.

5. Why we use it, and our legal bases

• Provide the review you ask for (extract your profile, generate the report, show it in the app). Basis: your explicit consent (Art. 6(1)(a) and 9(2)(a)) and, for the paid report, performing our contract with you (Art. 6(1)(b)).
• Purchases. Unlock and restore access. Basis: contract (Art. 6(1)(b)).
• Security, abuse prevention and rate limits. Basis: legitimate interests (Art. 6(1)(f)) in keeping the service safe and affordable, and legal obligations where they apply (Art. 6(1)(c)).
• Answer your messages and handle rights requests. Basis: legitimate interests and legal obligation.

Where we rely on legitimate interests, we have weighed them against your rights: we collect little, share it narrowly and run no advertising or cross-site tracking. You can object at any time (section 11).

What we do not do. We do not sell personal information, share it for cross-context behavioral advertising, build advertising profiles, or use your photos or text to train AI models.

6. Cookies, device storage and tracking

The website sets no cookies and shows no cookie banner. The app stores on your device the anonymous session token (in secure storage), your preferences, your draft and your report, so it works across launches. That storage is strictly necessary for the service you asked for. You can remove it by deleting your data in Preferences or deleting the app.

We do not track you across websites or apps, so there is nothing for a Do Not Track or Global Privacy Control signal to change. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing, which we do not do anyway.

7. Automated decisions

The review is generated by AI. It is a set of suggestions for you to accept or ignore. It is not a decision about you: it does not decide whether you can use any service, get any opportunity, or be treated differently, and has no legal or similarly significant effect on you (GDPR Art. 22). We do not make decisions about you based on it. If you want a person to look at anything about your review or data, email dateframe@offensa.com.

8. Who we share it with

We use a small number of providers ("processors" under the GDPR, "service providers" under the CCPA) that handle data on our behalf under contract and may not use it for their own purposes. We give each only what its job needs.

• Cloudflare hosts the website and API, stores your confirmed photos (R2) and your session, profile text and reports (database), applies rate limits, and sees request data such as IP addresses.
• Anthropic (Claude API) reads the text in your masked screenshots, reviews your confirmed photos and writes your report (section 3).
• Apple provides the App Store and processes payments. Apple is an independent controller of the purchase and account data it collects, under its own privacy policy.
• Offensa: only the operator can access stored data, and only to run, secure and support the service.
• Legal and safety. We may disclose information if required by law or a valid legal request, to protect someone's safety, or to enforce our rights, and as part of a merger or sale of the business (we would tell you first).

If we add a provider (for example, a purchase-management service when purchases launch), we will name it here before it handles your data.

9. International transfers

Cloudflare, Anthropic and Apple operate globally. Your information is processed mainly in the United States, and wherever Cloudflare's network handles your request. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on safeguards such as the European Commission's standard contractual clauses (with the UK International Data Transfer Addendum and Swiss amendments where relevant) and, where a provider is certified, the EU-US, UK Extension and Swiss-US Data Privacy Framework. You can ask us for a copy of the safeguards at dateframe@offensa.com.

10. How long we keep it

Anthropic may retain inputs for a limited period for abuse monitoring; that retention is governed by its terms, not by this table. Deleted data may also persist in provider backups for a short period before being overwritten.

11. Your rights: EEA, UK and Switzerland

Under the GDPR, UK GDPR and FADP you have the right to:

• be informed about how we use your data, as in this policy;
• access your data and get a copy;
• correct data that is wrong or incomplete;
• erase your data;
• restrict how we use it while a dispute is resolved;
• portability: receive the data you gave us in a common machine-readable format;
• object to uses based on legitimate interests;
• withdraw consent at any time, without affecting what we did before;
• human review of automated output (section 7).

How to use them. The fastest way to erase your data is in the app: Preferences, "Clear draft and start again". For anything else, email dateframe@offensa.com. Because we have no account, we may ask you to help us confirm the request relates to your data, for example by describing your profile or sending from the device. We reply within one month (30 days under the FADP), may extend by up to two further months for complex requests (and will tell you why), and do not charge a fee unless a request is clearly unfounded or excessive.

Complaints. You can complain to your data protection authority. For us, the lead authority is Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP). You can also complain in the EEA country where you live or work; in the UK to the Information Commissioner's Office; in Switzerland to the Federal Data Protection and Information Commissioner. We would appreciate the chance to fix the problem first.

12. Your rights: United States

California (CCPA/CPRA) notice at collection

This section applies to California residents and describes the past 12 months. We collect the categories below, for the purposes in section 5, and keep each for the periods in section 10.

• Identifiers: IP address and a random session token (hashed on our servers). Source: you and your device. Disclosed to service providers: Cloudflare.
• Photos and other audio, visual or similar information: the profile photos you confirm. Disclosed to service providers: Cloudflare (storage) and Anthropic (AI review).
• Customer and profile content: your bio, prompt answers, preferences and the generated report. Disclosed to Cloudflare and Anthropic.
• Commercial information: whether you unlocked a report (handled by Apple).
• Internet and network activity: request metadata and usage counters. Disclosed to Cloudflare.
• Sensitive personal information: your content may reveal sensitive information, such as sexual orientation or ethnicity. We use it only to provide the service you request, with your consent, and don't use it to infer characteristics about you. We do not use it for any purpose that would give you a right to limit its use.
• Not collected: precise geolocation, biometric identification data, government IDs, employment or education information.

Sale and sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. Disclosures to service providers are not sales.

Your rights in California and other states

Depending on where you live (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states), you may have the right to know and access the personal information we hold about you, correct it, delete it, receive a portable copy, and opt out of sale, targeted advertising and certain profiling (we do none of these). You will not be discriminated against for using any right. California's "Shine the Light" law lets you ask which third parties received your information for their direct marketing (none did). Nevada residents may opt out of sale; we do not sell.

How to ask. Delete your data in the app (Preferences), or email dateframe@offensa.com. We confirm receipt within 10 business days and respond within 45 days, extendable once by another 45 days with notice. Since we hold no names or emails, we verify requests by asking you to show control of the device or describe the profile you submitted. An authorised agent may ask on your behalf with your written permission.

Appeals. If we decline a request, you may appeal by replying with the subject "Appeal". We respond in writing within the time your state requires (generally 45 to 60 days) and explain how to contact your state attorney general, or in California the California Privacy Protection Agency, if you are still not satisfied.

US federal law

We aim to describe our practices accurately, as the FTC Act requires, and to handle your information in line with this policy. See section 13 on children and section 15 on security.

13. Age: 18 and over only

DateFrame is for adults aged 18 and over, and you confirm this in the app before you upload. It is not directed to anyone under 18, and we do not knowingly process the data of minors. If we learn that someone under 18 has used the service, we will delete their data. If you believe this has happened, email dateframe@offensa.com.

14. Photos and information about other people

Upload only your own profile. If a photo includes another person, you must have their permission to share it with us and for it to be processed by our AI provider (Anthropic). Don't upload other people's profiles, or photos of minors. If you think someone else's data was uploaded without permission, email us and we will delete it.

15. Security and breaches

Data travels over HTTPS. Photos are stored in private storage that is not publicly accessible, and are served only to the session that owns them. Only a hash of your session token is stored. We limit what we keep and for how long. No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your data, we will notify you and the authorities as the law requires.

16. Changes

We may update this policy, for example when we add a provider or feature. We will change the effective date above and, for material changes, tell you in the app or on this page before they apply. Earlier versions are available on request.

17. Contact

Questions, requests or complaints: dateframe@offensa.com. Operator: Andrei Tigaieriu, an individual trading as Offensa, Iași, Romania. See also our Terms of Service.