1. Who we are
Carisma is provided by Carisma Dating, Milan, Italy ("Carisma", "we", "us"). We are the controller of your personal data. Contact: [email protected]. Our EU representative is Nader Raslan, Milan, Italy.
2. The data we collect
You give us:
- Account: email address, password (stored only as a hash by our sign-in provider; we never see it), and your phone number if you add one for two-step sign-in.
- Eligibility: your date of birth, to confirm you are 18 or older. Only your age is shown to others.
- Profile: display name, gender (which decides who you see and who sees you), country of residence, languages, interests, bio, optional "More about me" details (such as work, study, family and lifestyle), and 1–5 profile photos.
- Verification selfie, if you choose to verify your profile.
- Messages and media: text, photos, short videos and voice notes you send, and Introductions you write.
- Requests and connections: who you send requests to, accept, decline or block.
- Reports: what you report and any details you add.
- Support messages you send us.
Created when you use Carisma:
- Device push token, if you allow notifications (stored encrypted).
- Purchase status, if you subscribe (from Apple or Google, through RevenueCat — we never receive your card details).
- Security records: sign-in and security events, such as two-step sign-in changes and account deletion.
- Device integrity check: a token from Google Play Integrity or Apple App Attest is checked on each request to block fake apps. It is not stored.
We do not collect: your precise location (Carisma never asks for location access), your contacts, your photo library (you pick individual photos), or advertising identifiers. Carisma has no advertising and no third-party analytics or tracking.
3. Why we use it (and our legal bases)
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, show your profile, deliver requests, connections and messages | Account, profile, messages, connections | Contract |
| Confirm you are an adult | Date of birth | Legal obligation / legitimate interests |
| Information that may reveal sensitive characteristics (for example, sexual orientation through the gender you choose to meet) | Profile | Explicit consent, given at sign-up |
| Keep members safe: check photos, review reports and verification, act on rule breaks | Photos, selfies, reports, messages reported to us | Legitimate interests (safety); legal obligation |
| Secure your account | Phone, security records | Contract; legitimate interests |
| Translate messages you receive (you can turn this off) | Message text | Contract (a feature you use) |
| Process subscriptions | Purchase status | Contract |
| Send notifications you allowed | Push token | Consent |
| Answer support requests | Your messages to us | Contract / legitimate interests |
4. Automated checks
- Photo and video checks. Profile photos, chat photos, chat videos and verification selfies are automatically checked for explicit, violent or misleading content by Google Cloud Vision and Video Intelligence before they are shown. Anything flagged is held for review by our team.
- Photo framing. When you upload a profile photo, face detection runs once to choose where crops of that photo are centred. Only that single point is kept; no face data or template is stored, and nothing is used to identify you. You can move the point yourself.
- No face recognition. We never use face recognition or biometric matching. A person, not a machine, reviews verification selfies.
- No matching algorithm and no profiling for advertising.
5. Who processes your data for us
We do not sell or share your personal data with third parties for their own purposes. These providers process it on our behalf, under contract:
| Provider | What for | Where |
|---|---|---|
| Google (Firebase, Google Cloud) | Sign-in, database, file storage, push notifications, app integrity | EU (europe-west1); sign-in is a global service |
| Google Cloud Vision / Video Intelligence | Automated photo and video checks | EU |
| Google Cloud Translation (and on-device Google ML Kit) | Translating messages you receive | — |
| RevenueCat | Subscription status (using a random ID, not your email) | — |
| Apple and Google | App distribution, payments, push delivery | Their own terms apply |
Other members see only what you put on your profile, the messages you send them, and your verified status. We may disclose data when the law requires it, to protect someone's safety, or to report child sexual abuse material to the relevant authorities.
6. International transfers
Our main systems are in the European Union. Where a provider processes data outside your country, we rely on the European Commission's Standard Contractual Clauses or adequacy decisions.
7. How long we keep data
- While your account exists, we keep your data so the service works.
- Verification selfies are deleted 14 days after you submit them, whatever the outcome.
- Message translations are deleted 30 days after they are made.
- When you delete your account, we delete your profile, photos, voice notes, messages and the conversations they were in, your connections and requests, your date of birth, country history, push registrations and your sign-in. Deletion begins immediately — your profile disappears at once — and completes automatically shortly after.
- We keep, after deletion, only what safety and the law require: reports and moderation records (including reports about you), blocks other members placed, the security log, the record that your deletion happened, and minimal billing records. We keep these for as long as the law requires.
- Backups are overwritten within a limited period.
8. Your choices and rights
- Edit your profile at any time in the app.
- Turn off notifications and message translation in Settings.
- Hide your read receipts in Settings.
- Block or report anyone.
- Delete your account in the app: You → Settings → Delete account. See carismadating.com/delete-account.
Depending on where you live, you can ask to access, correct, delete or receive a copy of your data, object to or restrict some uses, and withdraw consent at any time. Email [email protected]. You can also complain to your data protection authority (Garante per la protezione dei dati personali).
9. Security
Data is encrypted in transit; stored files are private and reachable only through the app's checked requests; push tokens are stored encrypted; two-step sign-in and backup codes are available.
10. Adults only
Carisma is only for people aged 18 or over. We remove accounts belonging to anyone under 18. If you believe a minor is using Carisma, report them in the app or email [email protected].
11. Changes
We will tell you in the app before material changes take effect.
12. Contact
Carisma Dating, Milan, Italy · [email protected]