Privacy Policy

In plain words

I’m an AI. When we talk, your voice goes straight from your phone to ElevenLabs, the American company that gives me my voice and my ears. From now on they keep a recording of our call for two years, and then it deletes itself. If you delete your account before that, we ask them to erase it straight away. I’d rather tell you that plainly than let you find out later.

From what you say, I write down a lot. Not just your words: what I think you value, roughly what your personality is like, and — this is the one people don’t expect — what I think your religion is. If you mention a church wedding or Semana Santa, I may write down “Catholic” even if you never said the word. I might be wrong. You can tell me so.

I also work out a rating of your photos that I never show you, and it affects who you can meet.

Because I only introduce men to women and women to men, using me says something about who you’re attracted to. European law treats your faith and who you’re attracted to as data that needs your explicit permission. That permission is separate from accepting the Terms, and you can take it back.

A real person on our team reviews every introduction before you see it. They see your photos, your profile, and my written assessment of you.

You can delete your account from inside the app. It really deletes it.

And if all you have done so far is leave your email on this website, that is a separate record with no account attached to it. Write to privacy@withsarah.app and we delete it. Section 17 explains why that has to be an email today.

1. Who we are

Menovite OÜ is the data controller — the company that decides what happens to your data and is legally answerable for it.

Company

Menovite OÜ

Register

Estonian Commercial Register (e-Äriregister), registry code [REGISTRY CODE]

Registered address

Tartu mnt 67/1 — 13b, 10115 Tallinn, Estonia

Privacy contact

privacy@withsarah.app

Data Protection Officer

[DPO CONTACT — or the recorded assessment that none is required]

“Sarah” is our product. She is not a company and not a legal person. When this notice says “we”, it means Menovite OÜ.

2. Sarah is an AI system

Sarah is an artificial intelligence system. Her voice is synthetic, generated by software. She is not a human matchmaker, there is no person listening live, and everything you say to her is processed by AI models operated by us and by the third parties named in section 9.

Article 50 of the EU AI Act requires that anyone interacting with an AI system be told so. This notice and the Terms are where we tell you.

3. What we collect

3a. What you say out loud

• Live microphone audio of your calls with Sarah: the onboarding conversation (typically 10–15 minutes), the call after a date, the call where you explain why you passed on someone, and — if you don’t turn up to a date — a phone call to the number you verified.
• A word-for-word transcript of every one of those calls, stored by us, including which turns you interrupted. Whatever you said about your family, your faith, your last relationship, your work or how you’re doing is in there verbatim.
• A recording of the call, held by ElevenLabs. See section 11 — that is the part of this notice we most want you to read.

3b. What you enter

Your name, exact date of birth, gender, height, a short bio, your city, your photos, a verification selfie, your email address (which may be an Apple private relay address) and your phone number. Your Apple account identifier. If you paid, a Stripe customer record.

3c. What your device gives us

• Your precise location. GPS coordinates from your phone, to roughly 100 metres, used for the 25 km matching radius and to pick a venue.
• Your push notification token and your notification settings.
• Your IP address, used only to rate-limit requests and stop abuse. We do not store it in our database.

3d. What we work out about you

This is the group people don’t expect, so it gets its own list.

• Big Five personality scores (openness, conscientiousness, extraversion, agreeableness, neuroticism), each with a confidence level and written reasoning.
• Your religion and denomination, how devout we think you are, and how much we think you need a partner who shares your faith. See section 4.
• Your political leaning (left / centre / right / not mentioned). We extract this today. Nothing in our matching uses it. [DECISION REQUIRED BEFORE PUBLICATION — either this line stays and is true, or the extraction is removed from the code and this line goes]
• Values scores: how traditional you are, how family-oriented (including whether you want children), how career-driven.
• Your deal-breakers, core values and relationship priorities, in your own words.
• Your interests, hobbies, lifestyle and habits, including sleep schedule, social style and fitness level.
• A physical attractiveness score derived from your photos and selfie, with sub-scores for facial symmetry, skin, proportions and photo quality. We never show you this. It affects who you can be matched with.
• Face recognition templates — mathematical representations of your face, computed from every photo you upload and from your selfie, capable of identifying you.
• Mathematical representations of your interests, values and lifestyle (“embeddings”), used to find people similar to you.
• Sarah’s written assessment of you — a short summary you see on your home screen, and a longer, franker analysis you do not see, which is shown to our reviewers and fed into her later conversations with you.
• A record of every person the system scored against you, their score, and why they were or weren’t shown to you.

If you signed up on withsarah.app before installing the app, we also hold what you gave us there — see section 17.

4. What Sarah infers, and how

Some of what we hold you never told us. We worked it out. European law requires us to say so clearly.

Religion. We never ask your religion on a form. Sarah listens to your conversation and our AI decides. It is specifically instructed to conclude that you are Catholic from behaviour — a church wedding, baptising children, Semana Santa, going to Mass — even if you never use the word “Catholic”. It also assigns a score for how devout you seem and how much you appear to want a partner of the same faith.

This matters because faith is the single heaviest thing in our matching. For someone whose conversation suggests faith is central to them, it can account for up to about two thirds of their match score. For someone secular, it drops to around one eighth. You are never blocked from meeting someone of a different faith.

It is a guess and it can be wrong. If we have it wrong, write to privacy@withsarah.app and we will correct it or remove it. Section 12 is honest about the fact that there is no self-service screen for this yet.

Sexual orientation. We do not ask and we store no orientation field. But at launch Sarah only introduces men to women and women to men. So using the service reveals that you are seeking a different-sex partner. Under European law that is data about your sexual orientation, inferred from the design of our product. We are treating it as such rather than pretending otherwise. This is a current limitation of the product, not a position on who deserves to be matched.

Attractiveness. We score your photos using a facial-geometry model with different weightings for men and women. The score is internal, is not shown to you or to your match, and filters who you can be introduced to.

Personality and values. Inferred by an AI from a single conversation. Treat them as an impression, not a diagnosis. Sarah is not a psychologist and nothing here is a clinical assessment.

5. Why we process your data, and on what legal basis

6. Special-category data and your explicit consent

Two of the things we hold are “special category” data under Article 9 GDPR: your religious beliefs (inferred — see section 4) and your biometric face data (used to confirm that your photos and your selfie are the same person).

Your sexual orientation is also special-category data, inferred from the fact that you are using a service that introduces men to women.

For these we rely on your explicit consent. That means:

• It has to be asked separately from accepting the Terms. Accepting the Terms is not consent to this.
• Nothing may be pre-ticked. You have to actively agree.
• You can withdraw it at any time. There is no in-app switch for it yet — write to privacy@withsarah.app and we act on it. Withdrawing does not make what we did before unlawful, but it stops it going forward.
• If you withdraw consent to the faith inference, the faith dimension is removed from your matching and the remaining dimensions are rebalanced. You are not blocked from being matched.
• If you withdraw consent to biometric verification, we cannot verify you, and verification is required before you can be introduced to anyone. That is a real consequence and we would rather state it than bury it.

7. How Sarah decides who to introduce you to

You are entitled to understand the logic. In plain terms, for each person:

1. 01Hard filters. Opposite gender, inside your age window, inside a height range, and not someone you have already been introduced to.
2. 02Location. Within roughly 25 km of you.
3. 03A shortlist is cut, partly on the internal attractiveness score and partly on faith compatibility.
4. 04Scoring on four things: how compatible your faiths are, how close your values are, how similar your interests and lifestyle are, and your personality profile. How much faith counts varies from person to person — a lot if your conversation suggests faith matters to you, very little if it doesn’t. The other three are rebalanced around it, and are also nudged over time by the feedback you give after dates.
5. 05A human reviews it before you ever see it.

Neither of you is shown the other’s scores, weightings or ranking. We don’t publish the exact weights or the code.

This is automated profiling, and it decides whether you are introduced to anyone at all. You can ask a person to look at it — see section 12.

8. Human review

Every introduction is reviewed by a member of our team before it is released. They see both people’s photos, profiles, compatibility information, the internal attractiveness score, and Sarah’s full written analysis — including the frank version you don’t see.

Reviewers are bound by confidentiality. We tell you this because it is the kind of thing that feels like a betrayal if you learn it afterwards.

9. Who else gets your data

We do not sell your data and we do not use it for advertising.

10. Data leaving the EU

Several of the companies above are in the United States. That means your data — including your call recordings and transcripts — leaves the European Union.

[TRANSFER MECHANISM — per US processor, state EU-US Data Privacy Framework certification and/or Standard Contractual Clauses. Verify per processor. Do not publish a generic claim here.]

You can ask us for a copy of the safeguards at privacy@withsarah.app.

11. How long we keep things

We will be straight with you, because the honest answer today is not the reassuring one.

What we hold. Everything in section 3 is kept for as long as your account exists. Call recordings are the exception, and the paragraph below is about them. For everything else we do not currently run an automatic deletion or anonymisation schedule — not for our own copies of transcripts, personality profiles, faith inferences, face templates, selfies, photos, embeddings or matching logs. If you delete your account, it goes (section 13). If you don’t, it stays.

[RETENTION SCHEDULE STILL REQUIRED for the artefacts named above — our own copies of transcripts, personality profiles, faith inferences, face templates, selfies, photos, embeddings and matching logs. The call-recording schedule below is set, applied and verified; these are not, and this placeholder must not be removed until they are.]

What else survives deleting your account: your payment records at Stripe (we are required to keep accounting records), your email subscriber record at Kit if you signed up on this website, and the website signup itself — those are stored separately from your app account and are not removed automatically. Ask us at privacy@withsarah.app and we will delete them.

12. Your rights

You can:

• See what we hold (access) — there is an export button in the app under Settings → Privacy.
• Correct it (rectification).
• Delete it (erasure) — section 13.
• Pause it (restriction) — you can turn off introductions without deleting your account.
• Object to processing based on our legitimate interests.
• Take it with you (portability) — the export is machine-readable JSON.
• Withdraw consent — section 6.
• Ask a human to look at a match decision, tell us why you disagree, and contest it.
• Complain — section 22.

Honest limits of the in-app export today. The export gives you your account details, profile, full call transcripts, introductions, feedback and bookings. It does not include the derived data in section 3d — your personality scores, faith inference, political leaning, values scores, attractiveness score, Sarah’s written analysis, your photos, your face templates, your embeddings, or your precise coordinates. It also leaves out introductions that were never approved for you to see.

That is not good enough for a full access request, and we are not going to pretend otherwise. Until the export is complete, write to privacy@withsarah.app and we will send you everything we hold on you, including all of the above, within one month. That is your legal right, and email is how we honour it today.

There is also currently no self-service screen where you can see and correct your inferred religion, your personality scores or your attractiveness score. Email us and we will show you and change it.

We answer within one month.

13. Deleting your account

In the app: Settings → Privacy → Delete My Account. It asks you to confirm, and then it deletes.

This is a real deletion, not a deactivation. It removes your account record, your profile, your photos and your verification selfie from storage, your call transcripts, your personality and values profile, your faith inference, your attractiveness score, your face templates, your embeddings, your location, your device tokens, your preferences, your introductions, your bookings and your feedback.

What it does not reach:

• Your payment and refund records at Stripe, which we must keep for accounting.
• Your email subscriber record at Kit, and any signup you made on this website (section 17).
• Some anonymous internal counters that no longer point at you.

One thing you should know about the other person. If you were introduced to someone and went on a date, the record of that date belongs to both of your histories. Deleting your account removes it — which means the other person also loses that part of their own history. We think your right to erasure should win, but you should know that that is the trade.

14. Do you have to give us all this?

To be matched at all we need your age, gender, height, location and photos, and we need you to talk to Sarah — that conversation is the entire product. Without them we cannot provide the service.

Your religion is never asked for. If your conversation gives us nothing about faith, we record nothing, and faith simply counts for very little in your matching. Nothing breaks.

Your bio is optional. Notifications are optional.

15. Under 18s

Sarah is for adults. You must be 18 or over. If we find an account belonging to someone under 18, we delete it and everything attached to it immediately.

16. Security

Photos and selfies are stored as private objects and served only through a signed, expiring link. Passwords don’t exist — you sign in with Apple. Access to the review panel is restricted to named team members.

We’re a small team. We are not going to tell you our systems are impenetrable.

17. This website

withsarah.app is a static site with no login and no account.

What the form collects. If you ask us to open in your city, we store your email address, the city you asked for, your age, your gender, the language you were reading in, and the referral code you arrived with (if any). If your city isn’t on our list and you type it in, we store that text too, and nobody sees it but us — it never appears on the public board.

What we do with it. We count the cities to decide where to open next, and we pass your email, language, city and referral source — not your age, not your gender — to Kit, the American company that sends our email, so that we can write to you when your city opens. Submitting the form is how you consent to that; it is the only reason the form exists.

The public city board shows ranks always, and numbers only for cities past 1,000 requests. It is built from counts. It never shows an email address, an age or a gender, and it never shows an individual.

Cookies and third parties. We set no advertising cookies and we run no analytics that profile you. [COOKIE POSITION — this page currently loads a music player from Spotify, which can set third-party storage in your browser before you have been asked. That must be gated behind a consent choice or replaced with a self-hosted audio file before publication, and this paragraph must then describe what actually happens.]

18. Adding a friend by their number

The friends side of Sarah works on phone numbers. This section is about what that means for the number you type in — including when it turns out to belong to nobody.

18a. We never see your address book

There is no contacts permission and no contact upload. The app does not contain the code to read your address book at all. You type one number at a time, and that is the only number we receive.

18b. What we store, and what we don’t

We do not store the number. What we store is a keyed hash of it — a fixed-length string produced by running the number through a one-way function together with a secret only we hold — and a masked version for your own list, so you can tell which of your contacts a pending request was for. That looks like «+34•••••78».

18c. When the number belongs to somebody who is not on Sarah

A row is still written. That is not an accident — see 19a for why the alternative would tell you whether they have an account.

We never contact them. No text message, no email, no call. There is no route in our code that sends anything to a number that has no account. The invite link is handed back to you, in the app, and if they hear about Sarah at all it is because you sent it to them yourself.

Our lawful basis is legitimate interests (Art. 6(1)(f) GDPR), and here is the balancing we did rather than a citation on its own. On our side: you asked for this, it is one number, it is used for one purpose, and a service where you add a friend by their number cannot work without it. On theirs: they did not ask, and that matters. So the processing is kept as small as it can be — the number is hashed on arrival and never stored, it is never used for marketing, never enriched, never sold, never used to build a profile of them, and never used to work out who else might know them. If they never join, it is deleted after 90 days.

Because we hold no way to reach them, we cannot send them the notice Art. 14 would otherwise require, and we rely on Art. 14(5)(b) — this section is that notice. If you believe your number is in here and you want it out, write to privacy@withsarah.app and we will remove it. You do not need an account to ask, and we will not ask you to make one.

19. Requests, and what we refuse to tell people

19a. We never say whether you are on Sarah

Somebody who has your number can send you a friend request. Whatever happens next, the screen they see is the same: “Request sent”, with the option to send you an invite link.

It is the same screen whether you have an account, whether you have never heard of Sarah, whether you have hidden yourself, whether you blocked them, and whether you already said no. It is the same words, the same buttons, and it takes the same amount of time — because a screen that appeared faster for one of those would answer the question just as well as saying it out loud.

This is a deliberate limit on a product we could have made more convenient. Being able to type a number into an app and learn whether that person is on a dating service is a thing we are not willing to build, for people who never agreed to be looked up.

It also means we cannot tell you whether your request reached a real person. Your list says “sent” and keeps saying it. That is not us being coy with you; it is the only way the guarantee holds for you as well.

19b. Saying no is silent

If you decline a request, the person who sent it is not told. Their list still reads “sent”. They cannot get a second chance by adding you again — we remember the refusal, and that is the one thing about the pair we keep after the request itself is gone.

19c. Hiding yourself

In Privacy there is a switch: Hide me from contact search. Turn it on and somebody who has your number can no longer send you a request. They are not told that either — their screen is the same one everybody gets.

Two honest details. Invite links still work: if you follow a link somebody sent you, that is you choosing, and hiding your number does not undo it. And turning the switch back off does not deliver requests that arrived while it was on — they were never delivered, and handing them over later with old timestamps would leak exactly what the switch is for.

The switch is off by default, which is a choice we are telling you about rather than burying: the friends side is built around being findable by people who already have your number. Every change to it is recorded, in both directions.

20. Rooms, plans and what Sarah does in them

20a. What is stored

• Your messages, as you wrote them, and who is in each room.
• Photos you send, stored with our storage provider. They are checked automatically for explicit content before they reach anybody.
• Plans: the meal, the part of town, the times you said you were free, whether you said you were in, and the name of anybody you added who is not on Sarah.
• Who paid the booking fee, and the Stripe record of that payment.

The people in the room can see all of it. That is what a room is. A group outlives any one member: if you leave, the conversation carries on without you and what you already said stays where you said it.

20b. Nothing you type is sent to an AI model

This is not a promise about the future, it is a description of today. If it ever changes, this section changes first, and you will be told before it does.

20c. What the restaurant is told

When Sarah rings a restaurant for your group, what she gives them is: how many people, what day and time, and one surname to put the booking under. The surname is ours, not yours — it comes from a small fixed list we keep, and the app tells you which one to give at the door. No member’s name is spoken on that call, and the restaurant is never told who is in your group.

The call itself is placed through ElevenLabs, who handle the voice. Section 9 lists them and everyone else who receives anything.

20d. Somebody you added who is not on Sarah

If you add a friend to a plan by typing their name — somebody without an account, so we can count them at the table — we store that name and nothing else. No number, no email, no note. It is attached to that one plan and it goes when you go.

21. If you only came for your friends

You can use Sarah for your friends without using her for dating. It is a real choice, not a trial: you are asked for a first name, a date of birth and a phone number, and that is where the questions stop.

21a. What we do not collect, and do not work out

Section 3 is a long list. For a friends-only account, almost none of it happens. There is:

• No call with Sarah. No microphone audio, no transcript, no recording anywhere.
• No photos and no verification selfie, so no face recognition templates and no attractiveness score. Those do not exist for you.
• No location. We do not ask for it and we do not have it.
• No personality scores, no values scores, no religion, no politics, no embeddings. Nothing in section 3d is computed for you, because the thing that computes it is the call you never had.
• No written assessment of you, seen by us or by anybody else.

The date of birth is used for one thing: checking you are 18. It is the same check the dating side uses, in the same code.

21b. You are not in the matching pool

Not “excluded by a setting” — you cannot be selected. The query that finds people to introduce requires a completed onboarding call, a finished profile analysis and a computed set of scores. A friends-only account has none of the three, so there is no state in which you are considered and rejected. You are not in the room where that happens.

You will also not be nagged about it. We do not send you reminders to finish signing up for something you did not sign up for. The offer sits in three places in the app — your home screen, your dates tab and your profile — and nowhere else.

21c. If you change your mind

Finishing the full flow turns your account into an ordinary one, and from that point everything in section 3 applies to you like anybody else. Nothing in this section is a limit we impose — it is a description of what we have not asked you for yet.

22. Complaints

Talk to us first: privacy@withsarah.app. If we don’t fix it:

• Andmekaitse Inspektsioon — the Estonian Data Protection Inspectorate, our lead supervisory authority. [ANDMEKAITSE INSPEKTSIOON — POSTAL ADDRESS] · www.aki.ee
• Agencia Española de Protección de Datos (AEPD) — if you live in Spain you can complain here instead. C/ Jorge Juan 6, 28001 Madrid · www.aepd.es

You can also go to court.

[DPIA — Article 35 requires a Data Protection Impact Assessment for this processing. State its status here once it has been carried out. Do not publish a claim that one exists until it does.]

23. Changes

If we change something that matters, we will tell you in the app or by email before it takes effect, and you will be asked to agree again where the law requires it. Old versions stay available at [ARCHIVE URL].

This version: 0.1, in force from [EFFECTIVE DATE].