Your life is yours.

Controller

EMEM2 OÜ · 17555268 · support@kustly.com

Loosi tee 21, Haaslava küla, Kastre vald, Tartu maakond, 62107, Estonia

Service providers and payments

We use SK Authentigate for identity verification, Google Cloud for hosting and photo content checks, Google Workspace for email and protected invoice archives, and Stripe for web payments. Kustly does not store card details. Invoices, subscriptions and notification delivery records are private.

Web notifications

If you enable web notifications, we store this browser's push address, encryption keys, language and notification preferences. Your browser provider (such as Google, Apple, Mozilla or Microsoft) relays encrypted notifications. Notifications do not display names or message contents. You can disable them in settings; signing out or session expiry ends this subscription. Technical delivery records are retained for up to seven days.

Cookies

We use a secure session cookie and language and appearance preference cookies. We do not use advertising or analytics cookies. Logging out removes the session cookie. Authentication providers and Stripe may use their own cookies on their pages.

Website traffic statistics

We count public page loads on our own server. Statistical records contain only the time rounded to the minute, public page path and response status; we aggregate these into page-load counts. We do not store IP addresses, cookies, browser identifiers, query parameters or user identifiers for statistics. We do not use Google Analytics. Private account, profile and chat pages are excluded. The statistics report covers page loads from the last 90 days. Counts do not identify unique people and may not include every in-app page transition.

What we store

The application separates pseudonymous identity verification metadata from the profile you choose to create. Profile fields include verified first name, automatically calculated age, gender derived transiently from an Estonian personal code, preferences, biography, languages, city and photos. We privately store your verified date of birth to update your age on your birthday without another identity check. It is not returned in profile responses and is removed with your profile when you close your account. Chats, blocks and reports support the service.

Meeting goals

Your selected meeting goals are visible to other members on your profile. You can change or remove them. Your discovery search filters are private and are not shown to other members.

What stays out of your profile

SK provides Kustly with the data needed to verify identity and adulthood. During each eID authentication we process the personal code transiently; Kustly does not store or log the raw personal code. To recognise the account, we retain a technical identifier derived from the SK user identifier using a secret key. This is pseudonymous personal data, not anonymous information.

Raw national personal codes are never stored or logged. Your verified first name, age and gender appear on your profile. Your surname, personal code, exact GPS coordinates and internal identity fingerprint are not displayed. Uploaded photos are re-encoded to remove metadata.

Sign-in details

Using the portal requires a confirmed email address. We store the address and confirmation status. If you set a password, we store a secure one-way hash, not the password itself. Linking Google stores its account identifier and verified email. Linking Google satisfies the email confirmation requirement but does not replace identity verification. Sign-in details are not shown to other members.

The email confirmation deadline is 96 hours, starting at the first account sign-in or the start of verification. For an older unconfirmed account, it starts at the first sign-in after this requirement was introduced. Subsequent sign-ins, correcting the address or requesting a new email do not restart the deadline. A confirmation link is single-use and valid for up to 24 hours; requesting a new link invalidates the previous one.

If an address has been added, we send reminders after approximately 24, 48 and 72 hours while it remains unconfirmed. The last email warns about deletion. An unconfirmed account is deleted after 96 hours. At least 24 hours remain after the final warning is submitted to the mail server; submission failure postpones deletion. Without an email address we cannot send reminders: a warning is shown at sign-in and the account is still deleted after 96 hours.

Photo content checks

Every uploaded or replacement photo is checked for inappropriate content and the presence of a person using Google Cloud Vision's global service. Processing may take place outside the European Union. Photos may be approved automatically only when both checks pass; uncertain results go to human review. This does not verify who appears in a photo. Moderation decisions are recorded and can be reviewed by staff.

Why we process data

We process account creation, identity and age verification, profile display, matches, conversations and subscription data to perform the service contract. Security, abuse prevention and incident investigation rely on our legitimate interest in protecting members and the service, balanced against members’ rights. Accounting data is processed to meet legal obligations. Optional browser notifications are activated with your permission and can be disabled in settings.

Security and activity logs

To troubleshoot problems and protect the service, we record authentication outcomes, technical failures, photo upload outcomes, email submission states, email confirmation and administrator actions. Authorised staff access these records for their duties. Mail-server acceptance does not prove inbox delivery or that an email was read. These logs are separate from anonymous website traffic statistics.

Retention and deletion

We retain the profile, private birth date, ordinary photos and sign-in details while the account is in use. Account closure removes the profile and conversation content, ends sessions and initiates deletion of ordinary photo files. Deletion cycles in backups and provider systems may differ from those in the active service.

Authentication attempt and technical event logs use a 30-day retention cutoff; expired entries are removed during the next successful cleanup. Technical browser-notification delivery records have a seven-day cutoff. These periods do not automatically apply to moderation and accounting records or to all email submission records.

After closure, the pseudonymous identity identifier, restrictions, moderation evidence including rejected photos, and accounting documents remain separately retained. Their purposes are preventing repeated abuse, handling incidents and claims, and meeting legal obligations. Closing an account does not remove a ban. Contact support to request an assessment of the grounds for retention and the possibility of deletion.

Your rights

You can request a copy of your personal data, correct inaccurate data and request deletion or restriction of processing. Where applicable, you may request data portability, object to processing based on legitimate interests and withdraw consent. These rights are not absolute: for example, the law may require accounting records to be retained. We explain any refusal to fulfil a request.

Contact support@kustly.com. We may need to verify the requester’s identity; do not send a personal code, document copy, password or confirmation link by ordinary email. We normally respond within one month. If a complex request requires an extension, we explain it within that month. You can complain to the Estonian Data Protection Inspectorate if you believe your data rights have been infringed.