Effective: 8 October 2026 · version v2026-10-08

Privacy Policy — Aperko

Controller (within the meaning of Article 4(7) GDPR)

• Company name: Skyward Capital s. r. o.
• Registered office: Segnerova 719/4, 841 04 Bratislava – Karlova Ves, Slovak Republic; Company ID (IČO): 52 214 923
• Registration: Commercial Register of the Bratislava III City Court (formerly Bratislava I District Court), Section: Sro, File No. 135081/B
• Data protection contact: info@aperko.com
• Data Protection Officer (DPO): not appointed

1. Introduction and Scope

1.1 This Policy explains what personal data we process when providing the Aperko dating service (the "Service"), for what purposes, on what legal basis, to whom we disclose it and what rights you have. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. of the Slovak Republic on Personal Data Protection.

1.2 The Service is intended exclusively for persons over 18 years of age.

2. What Personal Data We Process

2.1 Registration and profile data: e-mail address, phone number, first name, year of birth, profile photographs, neighbourhood (geolocation only at the level of a city district/neighbourhood) and voluntary data (for example height, body type).

2.2 Profile answers (questionnaire): answers you provide voluntarily for the purpose of better matching.

2.3 Age and identity verification data: the result of the verification ("verified"), age, the selfie and the biometric data derived from it during face comparison and age estimation (Sections 3.3 to 3.6). We do not store identity documents — verification for all users takes place asynchronously via the provider Didit; an identity document is required only exceptionally, where the estimated age is below 21, and is processed exclusively by Didit. In the case of alternative verification by video call (Section 3.6), the video call is not recorded and we retain only the result of the verification, which is recorded manually by the operator.

2.4 Service usage data: the days on which you are available and the selected city, selections, agreed meetings, Credit spending and balance, reports and blocks, technical and log data (for example login time).

2.5 Payment data: data on payments and tax documents. Payment card data is processed exclusively by the payment service provider (Stripe); we do not store it.

2.6 Data from cookies and similar technologies: online identifiers (cookies _fbp, _fbc), IP address, browser and device data, pages visited and events — to the extent and under the conditions set out in Section 7.

2.7 Registration source data: the parameters of the advertising campaign (UTM — source, medium, campaign, ad set, creative) through which you reached the Application, assigned to your account when it is created. They contain no cookie data, are not sent to third parties and are not used for profiling.

2.8 Connection content when arranging and coordinating a meeting: the questions and short videos you record as a reply in a Meeting Request (a recording of your face and voice), coordination messages on the day of the meeting (predefined messages and a short description by which the counterparty will recognise you) and a photo of the place where you are sitting, including time data (sending, first playback).

2.9 Record after account deletion: a hash of the phone number, the original account ID, the date of deletion, the reason for leaving if you provided one, and a safety-incident flag with a brief description (Section 9.10).

2.10 Safety link and SOS function: the name and phone number of a trusted person that a woman saves in her account; data on SOS activation and check-in (time, the connection and meeting to which they relate, and a record of handling by the operator). We do not process device location.

3. Special Category Data and Explicit Consent

3.1 Given the nature of a dating service, certain data (for example selection preferences, certain profile answers, photographs or videos) may reveal data concerning sex life or sexual orientation, which constitute special category data under Article 9 GDPR.

3.2 We process such data exclusively on the basis of your explicit consent under Article 9(2)(a) GDPR, which you give by a separate, active act in the Application. You may withdraw your consent at any time as easily as you gave it (in your account settings or at info@aperko.com); withdrawal does not affect the lawfulness of processing before the withdrawal. Without this consent, the relevant functions of the Service cannot be provided.

3.3 Biometric data — face verification and age estimation. We process profile photographs as ordinary personal data. During account verification, however, we compare your selfie with your profile photo (1:1 face comparison) to verify that the person in the profile photo is you, and we estimate your age from the selfie. For this purpose, facial characteristics are evaluated from the selfie by specific technical processing; these are biometric data within the meaning of Art. 4(14) and Art. 9 GDPR. We carry out this processing solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give by a separate active step during registration. We do not use biometric data to search for persons in a database (1:N identification), for tracking or for any other purpose.

3.4 Verification process and identity document. Face comparison and age estimation are carried out for us, as processor, by Didit Identity Spain, S.L., Barcelona, Spain ("Didit"). If the estimated age is below 21, we will ask you to complete an additional verification with an identity document. The document is processed exclusively by Didit; we receive from Didit only the verification result and age — we store neither an image of the document nor any data from it. Didit retains the selfie, verification results and any document for 1 month after verification and then deletes them. Didit may not use these data to train its models; it may process them for its own purposes only to the extent necessary to secure its service, prevent abuse and comply with legal obligations, for which it acts as an independent controller.

3.5 Who can access the selfie, where it is stored and when it is deleted. We store the selfie in our database with the provider Supabase, hosted in the EU. Authorised staff of the Operator can access it in the administration interface for the entire lifetime of the account, for the purpose of manual review of verification and investigation of reports of fake profiles. The selfie is never shown to other Users. We retain the selfie for manual review, for checking the match when profile photographs are changed and for investigating reports of fake profiles, until the account is closed (including deletion of an inactive profile under Section 9.2); the selfie is deleted together with the account. Face verification is a condition of using the Service. You may withdraw your consent under Section 3.3 at any time by e-mail to info@aperko.com; we will handle the withdrawal as closure of the account and delete the selfie without undue delay when handling it (subject to Section 9.8).

3.6 Voluntary consent and alternative verification. Giving consent under Section 3.3 is voluntary. If you do not wish to give it, write to us at info@aperko.com — we will verify your age and identity by an alternative method, a short video call with an operator of the Operator. Didit is not used in this process, you do not present an identity document and no face comparison or other processing of biometric data takes place; the operator records the result of the verification manually. Alternative verification may take longer. Withdrawal of consent is governed by Section 3.5.

3.7 Videos are not biometric data. We only store the videos in Meeting Requests and play them to the other party; we do not apply face comparison, voice recognition, speech transcription or automated moderation to them. They are therefore not biometric data. If special-category data could be inferred from a video, the consent under Section 3.2 applies to it.

4. Purposes and Legal Bases of Processing

4.1 Overview of processing purposes, data categories and legal bases:

5. Age Verification

5.1 We process the data necessary to verify that you are at least 18 years old. If the verification does not prove an age of 18+, we will not activate the account and will delete the provided data without delay. If we subsequently discover that a user is not 18, we will terminate the account and delete the data.

6. Recipients and Processors

6.1 We disclose personal data only to the necessary extent to the following providers, who act for us as processors (or, in the cases indicated, as independent or joint controllers) on the basis of contracts under Article 28 or Article 26 GDPR:

6.2 We may also disclose data to the competent authorities where required by law.

6.3 We do not sell personal data and do not share it with other Users beyond what is necessary to facilitate a connection (for example, displaying a profile to the counterparty within the Service and making your questions, videos, coordination messages and venue photo available exclusively to the other party to the connection).

6.4 Access by our staff. For as long as they exist, videos, questions, coordination messages and venue photos can also be accessed by authorised staff of the Operator in the administration interface, for the purpose of user support and the handling of disputes and reports. We do not download these data or provide them to third parties, except in the cases under Section 6.2.

6.5 Safety link and SOS. A woman may save a trusted person (name and phone number) in her account and send them a safety link from her own phone for an Agreed Meeting; we do not send anything to the trusted person. On the day of the meeting the woman may activate SOS, and 60 minutes after the start of the meeting we ask her for a confirmation (check-in). Upon activation of SOS, or if she does not confirm the check-in, we alert the operator and the safety link displays the man's first name and profile photographs and the venue (name of the establishment) and time of the meeting. If you are a man, your first name and profile photographs may in such a case be seen by the trusted person of the woman you are meeting. We do not send anything to the counterparty and we do not call the 112 emergency line. If you save a trusted person's details, please inform them.

7. Cookies and Similar Technologies

7.1 The Application uses cookies and similar technologies ("cookies"). We use essential (technical) cookies to ensure the functioning and security of the Application (for example login and session persistence); these do not require consent (Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications) and the legal basis of the related processing is our legitimate interest in the proper functioning of the Service (Art. 6(1)(f) GDPR).

7.2 Marketing cookies (Meta Pixel). To measure and optimise advertising we use the Meta Pixel tool of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). Meta Pixel stores the cookies _fbp and _fbc on your device (validity generally 90 days) and sends Meta data about your visit (in particular IP address, browser and device data, the page visited and the event performed).

7.3 Legal basis and consent. We use marketing cookies exclusively on the basis of your prior consent (Section 109(8) of Act No. 452/2021 Coll. and Art. 6(1)(a) GDPR), which you give by an active action in the cookie banner. Without consent, Meta Pixel does not load at all and no data is sent to Meta. You may withdraw or change your consent at any time as easily as you gave it, in "Cookie settings" in the Application; withdrawal does not affect the lawfulness of processing before the withdrawal.

7.4 Joint controllership. For the collection and transmission of data through Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR; the essential parts of the joint controller arrangement are available in Meta's "Controller Addendum". Meta is responsible as an independent controller for subsequent processing for its own purposes; further information is available at https://www.facebook.com/privacy/policy.

7.5 Scope of deployment. We use Meta Pixel only on the public (marketing) pages of the Application (page view event); we do not send a registration-completed event to Meta; we do not use advanced matching (e.g. e-mail or phone number) or automatic events, and Meta Pixel is not loaded in the logged-in part of the Application. We do not send Meta any data about the use of dating features (selections, meetings, profile answers) or any other data that could reveal special-category data under Art. 9 GDPR.

8. Transfers to Third Countries

8.1 Some providers (for example Vercel, Stripe, Meta — including WhatsApp Cloud API and Meta Pixel) may process data also outside the European Economic Area. In such cases, the transfer is safeguarded by appropriate guarantees under Article 46 GDPR — in particular certification under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses together with a transfer impact assessment. Didit processes data in the EU by default; the same safeguards apply to any access by its parent company Didit Identity, Inc. (USA) or its subcontractors outside the EEA. Further information is available on request at info@aperko.com.

9. Retention Periods

9.1 Active account: we retain data for the duration of the account.

9.2 Inactive accounts are retained for 6 months from the last login; thereafter we delete or anonymise them. Snoozing an account is not considered inactivity. We do not delete accounts with unspent Credits for inactivity or for an incomplete registration (Article 4.3 of the Terms). Incomplete registrations: if you entered only a phone number and did not create a profile, we delete the data after 30 days; if you created a profile but did not complete verification or your verification was declined, we delete the data after 60 days and notify you 7 days in advance via WhatsApp. If you log in after the notification, we extend the period once by 30 days, again with a notification 7 days in advance. We delete the account of a person under 18 without notice no later than 24 hours after their age is discovered; the periods and the rule on unspent Credits under this Section do not apply to it, and we refund the monetary value of any unspent Credits (Section 5.1).

9.3 Deletion on request is carried out within 30 days.

9.4 Tax and accounting documents are retained for the period required by law (generally 10 years) on the basis of a legal obligation, including after account cancellation; during this period we process only the data necessary to fulfil this obligation.

9.5 Data processed on the basis of consent is retained until its withdrawal, unless another legal basis provides otherwise.

9.6 Cookies are retained for the period set out in Section 7 (essential cookies generally for the session; cookies _fbp and _fbc generally 90 days).

9.7 Selfie and face verification data: we retain the selfie until the account is closed or until you withdraw your consent under Section 3.3, whichever occurs first (Section 3.5). We retain the result of the face comparison and age estimation as part of the verification result; neither we nor Didit retain biometric templates (mathematical representations of the face). Didit retains verification data, including any document, for 1 month (Section 3.4).

9.8 Preservation at the request of authorities. Where a public authority asks us, by a valid request, to preserve data, we will retain the content of the connection concerned (Section 9.9) even after the periods under this Section have expired, after your erasure request or after you withdraw consent, for as long as necessary (Art. 17(3)(b) GDPR); we proceed in the same way with data that Didit still holds at the time the request is received (Section 3.4). Other data (profile, selfie, record after account deletion) are deleted in accordance with this Section and cannot be provided once deleted.

9.9 Connection content. We delete the videos of both parties, the question, coordination messages (including the description by which the counterparty recognises you) and venue photos under a single rule:

• if there is no report or dispute relating to the connection, within 24 hours after the connection ends;
• if the connection was reported, either party reported a no-show or the connection is in a no-show state, 30 days after the connection ends;
• if there is an open safety flag relating to the connection, after it is closed;
• in any case no later than 12 months after the connection ends.

A connection ends when it is cancelled or the Meeting Request lapses; if the meeting took place, upon the last rating of the meeting, and if nobody rates it, upon automatic closure of the connection at 04:30 the following day. The periods under this Section, including the 12-month cap, do not apply to content we have preserved at the request of an authority under Section 9.8; such content is deleted once the preservation ends.

9.10 Record after account deletion: after an account is deleted, we retain for 90 days a limited record under Section 2.9 so that we can recognise re-registration of a deleted account (in particular after a sanction) and protect the safety of users. If the account was involved in a safety incident (a report, a sanction or use of the SOS function), we retain the record and the photographs for 12 months to investigate the incident and to establish or defend legal claims.

9.11 Safety link and SOS: we retain the trusted person's details until you delete them, at the latest until the account is closed. The SOS and check-in record forms part of the connection record and is deleted together with it, at the latest when the account of either party is closed; if the account was involved in a safety incident, Section 9.10 applies.

10. Your Rights

10.1 As a data subject, you have the right under Articles 15 to 22 GDPR to access your data and obtain a copy of the processed data; to rectification of inaccurate data; to erasure ("right to be forgotten") under the conditions of the GDPR; to restriction of processing; to portability of data processed on the basis of a contract or consent; to object to processing based on legitimate interest; and to withdraw consent at any time (including the consents under Section 3 — to the processing of data concerning sex life or sexual orientation and to the processing of biometric data; withdrawal of consent to the processing of biometric data means closure of the account, Section 3.5). You may also withdraw your consent to marketing cookies directly in "Cookie settings" in the Application (Section 7).

10.2 You may exercise your rights at info@aperko.com. We will handle your request generally within one month.

10.3 You have the right to lodge a complaint with a supervisory authority. The Controller's supervisory authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava, Slovak Republic (www.dataprotection.gov.sk). Users from other states may also contact the supervisory authority of their habitual residence or place of work (for example, in the Czech Republic, the Office for Personal Data Protection, www.uoou.cz).

11. Automated Processing and Matching

11.1 For the purpose of facilitation, we use a matching algorithm that suggests suitable connections based on profile data, preferences and neighbourhood. This processing does not lead to decisions with legal or similarly significant effects under Article 22 GDPR — it serves exclusively to display suggestions within the Service; the final decision about a meeting is always yours.

11.2 Face comparison and age estimation (Section 3.3) are automated. Where their result would lead to the account not being activated, this is not decided solely by an automated process — the case is reviewed by a member of our team, or we offer you alternative verification under Section 3.6. You have the right to express your point of view and to contest the verification result at info@aperko.com.

11.3 In the free text of questions and coordination messages we automatically detect contact details; we reject such text, do not store it and flag the account for review. The flag itself does not result in any restriction; any measure is always decided by our staff, not by an automated process.

12. Data Protection Officer (DPO) and Impact Assessment

12.1 Given the processing of special category data (including biometric data), we have carried out (and continuously update) a data protection impact assessment (DPIA) under Article 35 GDPR. If a data protection officer is appointed, their contact is stated above; if not appointed, we continuously assess the need for such an appointment according to the scope of processing (Article 37 GDPR).

13. Security

13.1 We have adopted appropriate technical and organisational measures to protect data under Article 32 GDPR (in particular encrypted transmission, access management and minimisation of stored data — for example, geolocation only at neighbourhood level, no storage of identity documents or payment cards).

13.2 In the event of a data breach posing a risk to your rights, we proceed in accordance with Articles 33 and 34 GDPR (notification to the supervisory authority within 72 hours and, in the case of high risk, also to you).

14. Changes to This Policy

14.1 We may update this Policy. We will inform you of material changes in advance (by e-mail or in the Application). The current version is always available in the Application with its effective date.

14.2 This Policy is drawn up in the Slovak language and may be translated into other languages (in particular English and Czech). In the event of a discrepancy between the language versions, the Slovak version prevails; translations are for information purposes only.

15. Contact

For personal data protection matters, contact us at info@aperko.com.