← Back to home

Effective: 8 October 2026 · version v2026-10-08

Aperko — Guidelines for Law Enforcement

1. Introduction and scope

These guidelines describe how Skyward Capital s. r. o. (the “operator”), operator of the Aperko service, handles requests from law enforcement and other competent authorities for user data. We disclose personal data exclusively on a valid legal basis and in compliance with Regulation (EU) 2016/679 (GDPR) and other applicable law.

2. Operator and contact details

Skyward Capital s. r. o., Company ID (IČO) 52214923, registered office at Segnerova 719/4, 841 04 Bratislava, Slovak Republic.

Law enforcement contact: info@aperko.com (or in writing to the operator's registered office).

We disclose users' personal data only upon a valid, properly served request supported by appropriate legal process (e.g. a court order or an official request under applicable criminal procedure law). Without valid legal process we do not disclose data — except for emergency requests under section 6 of these guidelines.

4. Requests from foreign authorities

Requests from authorities of other states are handled through mutual legal assistance (MLAT), a European Investigation Order, or via the competent authority of the Czech Republic or the Slovak Republic — not by direct disclosure to the foreign authority.

5. What a request must contain

Submit requests in writing, on official letterhead and signed by an authorized officer. A request must include:

  • the legal basis on which the request relies;
  • specific account identifiers (e.g. phone number, account ID);
  • the scope and time period of the data sought;
  • the name, unit and contact details of the requesting officer.

Requests that do not meet these requirements may be returned for completion.

6. Emergency requests

Where there is an imminent risk of death or serious physical harm, we may, to the extent permitted by law, disclose the necessary data without a court order. Mark emergency requests “EMERGENCY” and send them to info@aperko.com together with a description of the threat, the persons concerned and the data requested. Each emergency request is assessed individually.

7. Data preservation

Upon a valid request from a competent authority, we may preserve the content of a specified connection (questions, video replies, coordination messages and venue photos) for a reasonable period pending service of the appropriate legal process. Preservation does not constitute disclosure. Preservation under such a request takes precedence over any deletion of that content that would otherwise occur (on expiry of a retention period, on closure of the account or upon withdrawal of consent), and also covers verification data still held by our processor Didit at the time the request is received. We are unable to place other data (profile, selfie, record after account deletion) on hold; they are deleted in accordance with Section 11 and cannot be disclosed once deleted. A hold on connection content is marked in the application with the authority and case number and recorded in the audit log (who, when, on what grounds); data that have already been deleted cannot be placed on hold.

8. Data we may hold

Depending on the specific account, we may hold:

  • registration data: e-mail address, phone number, name/nickname, age, neighborhood, profile details, photos;
  • verification data: the verification result ("verified" flag, result of the comparison of the selfie with the profile photo, and age estimate) and the selfie — the selfie only where the user has consented to face verification and has not withdrawn that consent;
  • connection and meeting records;
  • connection content: questions, video replies, coordination messages and venue photo — only for as long as they exist (see Section 11);
  • record after account deletion: a hash of the phone number, the original account ID, the date of deletion and an incident flag with a brief description;
  • safety records (e.g. reports, blocks, SOS activations and check-ins);
  • transaction and payment records (payments are processed by Stripe);
  • consent records.

9. Data we do NOT hold

  • We do not store identity documents — we keep only a “verified” flag, the user's age and the verification selfie (see Section 8); identity verification is performed by an external processor (Didit). An identity document is required only exceptionally (where the estimated age is below 21) and is processed exclusively by Didit, which deletes verification data after 1 month; we retain neither an image of the document nor any data from it. A request served before this period expires may, however, also cover verification data, including any document, still held by Didit as our processor. We do not retain biometric templates (mathematical representations of the face) and we do not search for persons by facial likeness.
  • We do not operate user-to-user chat. The only content of communications consists of questions and short video replies in a meeting request and coordination messages on the day of the meeting (mostly predefined messages, a short description and a venue photo); once the periods under Section 11 have expired, we cannot disclose them.
  • Phone numbers are never shared between users.

10. User notice

We may notify the affected user of a request unless prohibited by law or by a valid request of a competent authority, or where notification would jeopardize an ongoing investigation or the safety of any person.

11. Retention and GDPR

Inactive profiles are generally deleted after approximately 6 months, incomplete registrations after 30 or 60 days respectively; the verification selfie is retained until the account is closed or the user withdraws consent, whichever occurs first; connection content (videos, questions, coordination messages and venue photos) is deleted within 24 hours after the connection ends, after 30 days in the event of a report or no-show, upon closure of an open safety flag, but in any case no later than 12 months after the connection ends, except for content preserved under Section 7; the record after account deletion is deleted after 90 days, or after 12 months in the event of an incident; data deleted before a request is served is no longer available. Disclosures comply with the GDPR, in particular Art. 6(1)(c) and (d), subject to the restrictions under Art. 23.

12. No informal disclosure

Other than emergency requests under section 6 of these guidelines, we do not disclose any user data informally, by telephone, or without valid legal process.

← Back to home