Who we are
MayaDating is a brand of Nimzo Holdings Ltd (company number 17453506), a company registered in England and Wales. Nimzo Holdings Ltd ("we", "us") is the data controller for personal information processed through MayaDating. Registered office: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE.
Privacy contact: info@mayadating.com
Information we collect
Account information
- Name and email address
- Password (stored as a secure hash - we do not store plain-text passwords)
- Authentication session data (via NextAuth)
Profile and dating information (collected during onboarding and use)
- Date of birth / age-related information
- Gender
- Location and occupation
- Personality description, strengths, insecurities
- Relationship goals and current relationship status
- Dating experience and communication style
- Dating apps used and coaching goals
- Current dating focus
- Sexual orientation and/or who you are interested in dating (if you choose to provide this - see Special-category information)
Photos and uploads
- Dating profile photos you upload for review
- Screenshots of dating profiles or conversations
- Other images submitted for analysis
Coaching and analysis information
- Messages you send to Maya (AI coach)
- Date debriefs, ratings and reflections
- Notes about people you are dating ("people" records)
- Conversation analyses and profile review results
- Generated insights and coaching memories derived from your use
- Practice conversation messages (simulator)
Third-party information
If you upload screenshots or conversations, those may contain another person's messages, name or image. We process this only to provide the analysis you request.
Waitlist
- Email address
- Whether you opted in to optional marketing emails
- Referral code and referring waitlist signup (if you used a friend's link)
- First-touch marketing UTMs and landing context (if captured)
- Hashed technical signals used to limit referral abuse (not a raw IP address)
Technical information
- IP address and browser/device information (standard server logs)
- Hashed IP stored with consent records for audit
- Authentication and security session cookies
- Usage records for plan limits (e.g. free message counts)
- AI generation metadata (feature, provider, status - not full prompts)
Payment information
If you subscribe, payment card details are processed by our payment provider (Stripe, when configured). We store subscription status, plan type and billing-related identifiers - not full card numbers.
Why we use information
| Purpose | Data involved | Lawful basis (UK GDPR) |
|---|---|---|
| Creating and managing your account | Name, email, password hash, session data | Contract (Art. 6(1)(b)) — to create and run the account you asked for |
| Waitlist and launch emails | Email, referral and signup metadata | Contract / steps prior to contract (Art. 6(1)(b)) for launch and reserved-offer emails you requested by joining |
| Providing profile analysis and coaching | Profile, photos, chats, debriefs, preferences | Contract (Art. 6(1)(b)) |
| Personalising coaching using sensitive dating information | Sexual orientation, interested-in preferences (if provided) | Explicit consent (Art. 9(2)(a)) plus Art. 6(1)(a) |
| Subscriptions and billing | Email, subscription status, Stripe identifiers | Contract (Art. 6(1)(b)); legal obligation for tax records where applicable |
| Security and fraud prevention | Hashed IPs, logs, usage patterns, waitlist abuse signals | Legitimate interests (Art. 6(1)(f)) — keeping the service secure |
| Optional analytics cookies | Device/usage data via Google Analytics, Meta Pixel, and Reddit Pixel if enabled | Consent (Art. 6(1)(a) and PECR) |
| Marketing emails (if you opt in) | Email, marketing consent record | Consent (Art. 6(1)(a) and PECR) |
| Legal and regulatory compliance | As required | Legal obligation (Art. 6(1)(c)) / legitimate interests |
Special-category information
Information about your sexual orientation, and potentially information about your sex life or dating preferences, may constitute special-category personal data under UK GDPR Article 9.
Where we process this information for personalisation, we intend to rely on your explicit consent. We will:
- ask separately from Terms acceptance
- explain what information and purpose the consent covers
- allow you to skip optional fields where the product supports it
- let you withdraw consent from account privacy settings
Withdrawing consent does not affect the lawfulness of processing before withdrawal. After withdrawal, we stop future processing that relies on that consent and clear related profile fields (such as who you are interested in dating).
How we use artificial intelligence
We use AI to analyse information you submit and generate coaching feedback, summaries and suggestions. Depending on configuration, this may include profile text, uploaded images, coach messages, date debriefs and conversation content.
When AI_PROVIDER=gemini is enabled (typical in production), relevant content is sent to Google (Gemini API) for inference. Google's current paid Gemini API customer terms state that prompts and responses are not used to train Google's models. We have not separately contracted a zero-data-retention addendum. We store AI generation metadata (feature, model, status) but not full prompts. When mock mode is used (default without an API key), processing stays on our servers.
AI outputs may be inaccurate. They should not be treated as objective facts about you or anyone else.
See AI & your data.
Automated decision-making
The Service uses AI to generate personalised analysis and suggestions. These outputs do not, by themselves, produce legal or similarly significant effects (such as credit decisions or employment outcomes). You are always responsible for how you act on coaching suggestions.
International transfers
Some providers (including Vercel, Google, Resend, Stripe, Meta and Reddit) may process data in the United States or other countries. Where this occurs we rely on the UK-US data bridge / adequacy where it applies, or on standard contractual clauses / the UK International Data Transfer Agreement or Addendum offered by those providers.
How long we keep information
| Category | Retention |
|---|---|
| Account data | Until you delete your account |
| Waitlist signup | Until you erase it (including when you delete a linked account) or we close the waitlist |
| Coach conversations and memories | Until you delete them or delete your account |
| Uploaded images | Until you delete them or delete your account — files are removed from storage where implemented |
| AI analysis results | Until you delete them or delete your account |
| Consent records | Kept as evidence of consent or withdrawal for the life of the account, then deleted with the account |
| Billing records | Subscription identifiers for as long as the account exists; Stripe may retain payment records for its legal obligations |
| Security logs | Short-lived hosting/provider logs (typically days to weeks) |
| Import sessions (profile/message) | ~1 hour in-memory TTL |
| Waitlist verification tokens | Until used or expired (hours) |
See our Cookie Policy for cookie durations.
Security
We use measures appropriate to the risk, including where implemented:
- HTTPS for data in transit
- Password hashing (bcrypt)
- Authenticated access to app features
- Server-side storage of secrets and API keys
- User-scoped file storage paths
No method of transmission or storage is completely secure. We cannot guarantee absolute security.
Your rights
Under UK GDPR you may have rights to access, rectify, erase, restrict, object, data portability, and withdraw consent where processing is based on consent.
Submit requests via privacy requests or email info@mayadating.com.
Delete data and your account
You can delete specific categories of data and your entire account from account settings where available. Account deletion removes your user record and cascades related database records, and deletes uploaded files from our storage provider where implemented. Linked waitlist signups for that email are also erased.
You can download a machine-readable copy of your account data from account privacy settings, or email info@mayadating.com.
Complaints
Contact us first at info@mayadating.com. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
Children
The Service is not intended for anyone under 18. We do not knowingly collect personal information from children.
Changes
We may update this Notice. The version and effective date at the top will change when we do. Material changes will be communicated where appropriate.