Privacy policy

Who we are

HeartWise is a business name of Callibers Limited (CRO 814237), Dublin, Ireland. Callibers Limited is the data controller for the personal data described here (in India, the "Data Fiduciary"; in US state law, the "business" or "controller"). You can reach us about privacy at connect@heartwise.club.

HeartWise is open in Ireland, the United Kingdom, every country of the European Union, India and the United States. The same protections in this policy apply to every member, wherever you live. The sections near the end add the rights and contact points that your own country's law gives you: Ireland and the EU, the United Kingdom, India and the United States.

Before we open: waitlists and requests

Until member accounts open, Early Access applications, questionnaire answers, group requests, LAX registrations, contact messages, and testimonials and stories arrive by email at connect@heartwise.club. Nothing is stored on the website. We use these details only to contact you about what you asked for, keep them only until then, and delete them at any time if you ask (consent). During Early Access, a member of our team reads questionnaire answers to suggest introductions; your faith answer is only sent if you give explicit consent. We publish a testimonial or story only with your explicit permission, credited the way you choose, and remove it whenever you ask.

What we collect

Your name, email, date of birth, town, your Facebook or Instagram account (and your LinkedIn link for Career & Business), the relationships you're looking for, questionnaire answers, profile photos, messages, the people you save as favourites or hide, group outings you join, meet-ups you plan (including the name and contact details of the person you choose to tell), and the helpers you add. For LAX, the name and phone number given to us, call times, interests and, if the person being called agrees, the family member who gets a weekly update. Your date of birth and your Facebook, Instagram and LinkedIn accounts are seen only by our verification team, to check you are a real adult. They are never shown to other members.

Why, and our legal basis

Verifying identity and age helps protect members from fake profiles (legitimate interests). Matching, messaging and your plan are how we provide the service you signed up for (contract). We keep a record of every verification decision made by our team (legal obligation and legitimate interests). We ask for your date of birth and a Facebook or Instagram account to confirm that you are a real adult (legitimate interests: keeping members safe from fake profiles and from anyone under 18).

Who we share data with

We never sell your personal data. We share it only with the companies that help us run HeartWise, each under a written data processing agreement that lets them use it only on our instructions, and only as much as their job needs:

• Supabase (database, sign-in and photo storage), on servers in the European Union.
• Hostinger (website hosting, and the email that carries our website forms to our team inbox and our account emails to you).
• Our payment partner, from early 2027, which takes payments on its own secure pages. Card details never reach us.
• A telephone provider for LAX, once calls are switched on, so that calls connect without showing anyone's number.
• The sign-in service you choose, such as Google or LinkedIn, if you sign in with an account you already have. It tells us only your name, email address and whether the email is confirmed.

We also share information when the law requires it, for example with the police or a court where a member's safety is at serious risk or a valid legal order is made, and with professional advisers under a duty of confidence. If HeartWise were ever sold or merged, members would be told before their data moved to a new owner. We publish no member's details and share nothing with advertisers or data brokers.

Your consent at sign-up

When you join, you confirm you are 18 or over and accept our Terms of use and this Privacy policy. Anything more sensitive is asked for separately, with its own box that is never ticked for you: your faith or spiritual belief, and the optional mood check-in. We record when you agreed, and you can withdraw any consent at any time in My profile.

What other members see, and sharing contact details

Other members see your first name, age range, general area and the profile details you choose to show. Your photos stay private: they are shown only to a member you have both accepted in an introduction, or someone you choose to share your profile with. Your date of birth, email address, phone number and social media and LinkedIn accounts are never shown to other members.

Chat with a member first. If you both want to keep in touch outside HeartWise, either of you can use "Ask to share contact details" and choose what to share (for example your phone number or Instagram). The other member must agree and choose what they share back, and then our team reviews the request before anything is shown. Each of you sees only what the other chose, and you can stop sharing at any time. Phone numbers, email addresses and social handles can't be sent in chat, including when written out in words. Our legal basis is performing the service you asked for, your consent to each share, and our legitimate interest in keeping members safe.

We recommend a video call before meeting in person. HeartWise team members, who sign in with their own accounts, check introductions and contact requests for safety. They see the status, how long you have chatted, any reports and warning signs, and notes they write. Everything they do is recorded in an accountability log.

What we don't ask for

We don't ask for your sexual orientation, health conditions, political opinions or ethnicity, and we never use automated face-matching. If HeartWise ever needs information like this, we'll only ask with your explicit consent and after updating this policy.

Sensitive information

Your faith and spiritual belief answers are optional. We only store them with your explicit consent, use them in matching only when both people have agreed, and show your belief only to the people you are introduced to. Withdrawing consent in My profile deletes them straight away. The mood tracker is the only health-related feature: it is off unless you switch it on, it is private to you and never used for matching, and switching it off deletes your moods. Other members never see your statement answers, only an overall match score and the profile details you choose to share, such as your languages, hobbies and free-time favourites.

Photo checks and photo protection

When you choose a profile photo, your own browser checks that it shows a person's face. This part runs entirely on your device and isn't facial recognition. When the photo is uploaded we also make automatic checks to help our team spot fake profiles: we read the file's built-in information for signs that it was made or heavily changed by an image-generating or editing app, and we keep a fingerprint of the file (a short code, not your face) so we can tell if the same photo is used on another account. These checks only add a note for our team; a person looks at every photo, and compares it with the social media account you linked, before an account is approved. Nothing is decided automatically.

When other members view your photos, each one is marked with the viewer's name and the date, right-clicking and saving are blocked, and photos are blurred when the viewer switches away from the page. No website can fully stop screenshots, but the mark makes any copy traceable to the member who took it, and copying or sharing another member's photo breaks our Terms and leads to removal.

ID documents and selfies

HeartWise does not ask for, receive or store ID documents or selfies. Our team confirms you are a real person by looking at your profile photos and the Facebook or Instagram account you link. Please never send ID documents to us by email or chat.

LinkedIn, for Career & Business

If you choose Career & Business connections, we ask for your LinkedIn profile link. A member of our team opens it to check that the name, photo and work match your verified account, and we record the result and who checked it (legitimate interests: keeping professional introductions genuine). If you choose to sign in with LinkedIn, LinkedIn sends us only your name, email and whether your email is confirmed; we never post on your behalf, read your connections or messages, or copy anything else from your profile. Your profile link is shown only to members you're introduced to through Career & Business. Removing Career & Business or deleting your account deletes the link and the check result.

How long we keep things

Accounts that haven't completed verification within 30 days of joining are deleted with their photos. Accounts we couldn't approve are deleted 30 days after the decision. If you don't sign in for 12 months, we let you know, and your account is deleted 30 days later unless you sign in again (accounts on a paid plan are kept while the plan is active). Meet-up plans, including your trusted contact's details, are deleted 30 days after the meet-up. Deleting your account removes your profile, photos, answers, messages, meet-ups and helper links straight away. Our accountability log is kept for two years. Reports, appeals and notices of illegal content are kept for two years after we decide on them. If we suspend an account, we keep a one-way code made from its email address and phone number for three years (see “Keeping HeartWise safe”). We never hold ID documents.

Where your data lives, and transfers

Your data is stored in the European Union and protected by the GDPR, wherever you live. If you live in the UK, India or the USA, this means your data is transferred to the EU:

• UK: the UK recognises the EU as giving adequate protection, and your UK GDPR rights continue to apply.
• India: the DPDP Act allows transfers to the EU, and we protect your data there to the standard that Act requires.
• USA: your data is held in the EU under the GDPR's protections, which are at least as strong as those in US state law.

If a service provider ever needs to reach your data from outside the EU or the UK, we use only approved safeguards, such as an adequacy decision, the EU–US Data Privacy Framework, or standard contractual clauses (with the UK addendum for UK members), and we will update this policy to say so.

Helpers and trusted contacts

A helper you add sees only how your account is coming along (photo, verification, questionnaire). They never see your messages or the people you match with. We never contact your trusted contact or helper ourselves: you send them the details from your own phone or email.

Security

Your data is stored in the EU, in private storage that can't be reached from the internet directly; photos are shown only through short-lived links. Passwords are stored as one-way hashes, or you can sign in with an account you already have. Only a small number of trained team members can see account details, and their actions are logged.

Personal data and payment card policy

Payment cards. HeartWise never sees, receives or stores your card number, expiry date or security code. Payments are taken on the secure, hosted payment pages of our payment partner, which is certified to the Payment Card Industry Data Security Standard (PCI DSS) at its highest level. We only receive a confirmation that a payment was made, the plan and the amount. Never send card details by email, chat or our contact forms; our team will never ask for them.

How we group personal data. We sort what we hold into levels and protect each accordingly:

• Public within HeartWise: first name, photos, age range, town and the profile details you choose to show. Seen by verified members.
• Private: full name, date of birth, email, phone number, social media and LinkedIn accounts, and your answers. Never shown to other members; shared with another member only through an approved contact request.
• Sensitive: optional faith or belief answers, safety reports and ID-check results. Seen only by named team members who need them for a specific task, and every view is logged.
• Payment: card details stay with our payment partner and never reach HeartWise.

How we protect it. We collect only what the service needs; mask private details everywhere they aren't needed; encrypt data in transit and at rest; give team members only the access their role needs, behind their own sign-in; record team actions in an accountability log; and delete data on the schedules described in "How long we keep things". If a breach affecting your personal data ever happens, we will tell the regulators the law requires within their deadlines: the Data Protection Commission (and, for UK members, the ICO) within 72 hours, the Data Protection Board of India within 72 hours for Indian members, and US state authorities where state breach laws require it. We will tell you without undue delay if it puts you at risk, what happened, and what you can do.

Cookies

Under the ePrivacy rules in Ireland and the UK's PECR, we use two strictly necessary cookies, only to keep you signed in: one holds your secure sign-in, the other just tells the site you're signed in. Because we use no analytics, tracking or advertising cookies, we don't need to ask for cookie consent; a short notice tells every visitor this, and your browser remembers when you close it. If you choose text size, contrast or language under "Display & language", that choice is saved in your own browser and never sent to us. No advertising or tracking cookies.

The website can also be installed as an app; it keeps copies of its own pages in your browser so it opens quickly and works offline. These copies contain no personal data. Because we never sell or share your data for advertising, there is nothing to opt out of, but we also honour the Global Privacy Control signal if your browser sends it.

Keeping HeartWise safe: reports, decisions and repeat offenders

When you report a member, or anyone sends us a notice of illegal content, we use what you tell us (and, for a notice, your name and email) to look into it, act on it, and tell you what we decided. The person you report is never told who reported them. Our legal bases are our legitimate interest in keeping members safe, and our legal obligations under the EU Digital Services Act and the UK Online Safety Act. If we refuse or suspend an account, we tell the person what we decided, which rule it is based on, and why, and they can ask a different team member to look again. If we suspend an account, we keep a one-way code (a “hash”) made from its email address and phone number, so the same person can't simply join again. The code can't be turned back into the email or number. We delete it if an appeal succeeds, and otherwise after three years. If several members report the same person, or a report is about threats, someone under 18 or an intimate image, that person is held out of new introductions until a person on our team has looked. This hold is never a ban: only a team member can restrict or suspend an account.

Automated suggestions

Your Compatibility Score is worked out automatically from your answers, to suggest who you might like to meet. The only other automatic step is the short safety hold described above, which pauses new introductions until a person reviews the reports. Neither decides anything with legal or similarly significant effect on you: a person on our team approves, restricts or suspends every account, and you choose who to talk to. You can ask for a person to look again at any decision about your account.

Chat or Talk with LAX: your personal AI companion

LAX tells you it is an AI assistant, not a person, as the EU AI Act requires. It answers from HeartWise's help pages and runs in your own browser: HeartWise doesn't save anything you type or say to it, and it never uses your profile. If you talk to LAX by voice, your browser's own speech feature turns your speech into text and reads answers out loud. In Chrome, Edge and Safari, the browser maker (Google, Microsoft or Apple) may process that audio on its servers under its own privacy terms, so please don't say private details out loud; typing your question avoids this. Typed and spoken chat with LAX is separate from LAX phone calls, which are with real people.

Adults only

HeartWise is only for people aged 18 and over. We ask for your date of birth when you join, and we delete any account we learn belongs to someone under 18.

What we never do

We never sell your personal data and never show advertising based on your answers.

Your rights

Wherever you live, you can see and download everything we hold about you with "Download my data" in My profile, correct it, withdraw any consent, or delete your account at any time. You can also ask us to limit how we use your data, to object to our use of it (for example where we rely on legitimate interests), and to move your data to another service ("Download my data" gives you a copy you can reuse). We never make decisions about you using automated processing alone, and you can always ask for a person to look at any decision.

To make a request, use My profile or email connect@heartwise.club with "Privacy" in the subject. You can ask someone you trust to make a request for you; we will check they have your permission. We confirm it is you before we act, never charge for a reasonable request, and never treat you differently for using your rights. We reply within one month in the EU and the UK (we may extend this by up to two more months for complex requests and will tell you why), within 45 days in the USA, and as quickly as the DPDP Rules require in India. Your country's section below explains where to complain if you're not happy, but we would be glad to hear from you first, so we can put things right.

If you live in Ireland or the European Union

The GDPR and Ireland's Data Protection Act 2018 protect your data. Because Callibers Limited is based in Ireland, the Data Protection Commission (dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2) is our lead supervisory authority, but you can also complain to the data protection authority in the EU country where you live or work, or where you think the law was broken. Under the EU Digital Services Act, our single point of contact for members and authorities is connect@heartwise.club, and you can challenge our decisions about accounts and content as set out in our Terms of use, including through a certified out-of-court dispute settlement body. Cookies follow Ireland's ePrivacy Regulations (S.I. 336/2011).

If you live in the United Kingdom

The UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations (PECR) protect your data, with the same rights described above. If you have a complaint about how we use your data, tell us first at connect@heartwise.club: we acknowledge every complaint within 30 days and tell you what we did about it. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). Under the Online Safety Act 2023, you can report illegal content or complain about how we apply our Terms at the same address.

If you live in India

For members in India we follow India's Digital Personal Data Protection Act, 2023 (DPDP Act) alongside the GDPR. We process your personal data only with your free, specific and informed consent, given by a clear action at sign-up, or for another purpose the Act allows. You can withdraw consent at any time as easily as you gave it, and you can ask us to access, correct, complete, update or erase your data, and to nominate someone to exercise these rights for you if you cannot. Every notice we give you is in clear, plain language, and you can ask us to explain anything in it. Your data is stored in the European Union; we do not store it in India, and the Act allows this transfer. We keep it only as long as needed for the purposes above, and if a personal data breach happens we tell you and the Data Protection Board of India without delay, as the DPDP Rules 2025 require. HeartWise is for people aged 18 and over, so we do not knowingly process the data of children. Grievance Officer. For any privacy complaint or grievance, or a complaint about content or another member under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, write to our Grievance Officer at connect@heartwise.club with "Grievance" in the subject. We acknowledge every complaint within 24 hours and resolve it within 15 days; we remove intimate images shared without consent within 24 hours of a complaint. If we have not resolved a privacy complaint, you may complain to the Data Protection Board of India.

If you live in the United States

We give every member in the USA the same privacy rights, whichever state you live in, including the rights in California's CCPA/CPRA and the privacy laws of Colorado, Connecticut, Virginia, Texas, Oregon and other states.

What we collect, and why (notice at collection). Identifiers (name, email, phone, the sign-in account you use); personal details (date of birth, town, photos); your profile and questionnaire answers; messages and activity on HeartWise; and, only if you choose, sensitive information (your faith or belief, and the private mood check-in). We use them only to verify you are a real adult, suggest introductions and run the service, for as long as described in "How long we keep things".

We do not sell or share your data. We do not sell your personal information, share it for cross-context behavioural or targeted advertising, or use it for profiling that has legal or similarly significant effects. We use no advertising or tracking cookies, and we honour Global Privacy Control signals. Under California's "Shine the Light" law, we don't share personal information with anyone for their direct marketing.

Sensitive and health information. Your faith answers and mood check-ins are collected only with your opt-in consent, used only to provide the feature you switched on, never sold or shared, and deleted when you switch them off. Mood check-ins may count as "consumer health data" under Washington's My Health My Data Act and similar laws in Nevada and Connecticut: we collect them only with your separate consent, never sell them, and you can delete them at any time.

No biometric data. We do not collect fingerprints, face geometry, faceprints or voiceprints. The photo check that looks for a face runs only on your own device and keeps nothing; voice questions to LAX are handled by your browser, not by us.

Your rights. You can ask to know what we hold and how we use it, get a copy, correct it or delete it, and opt out of any sale, sharing or targeted advertising (which we never do). You can use an authorised agent, and we will check they have your permission. Email connect@heartwise.club with "US privacy request" in the subject. We will confirm it is you, reply within 45 days, and never treat you differently for using your rights. If we turn down your request, you can appeal by replying with "Appeal" in the subject; we will answer within 45 days. If you're still not happy, you can contact your state attorney general, or in California the California Privacy Protection Agency (cppa.ca.gov).

Children. HeartWise is for people aged 18 and over. We do not knowingly collect data from anyone under 18, and we delete it straight away if we learn we have. Emails. We send account emails you need, and any other email only with your agreement; each one says who we are and how to stop them.

Contact

Questions about privacy, or a request to see, correct or delete your data? Email connect@heartwise.club with "Privacy" in the subject (in India, "Grievance"; in the USA, "US privacy request"). We reply within the times set out in "Your rights". We will tell you about any important change to this policy before it takes effect, by email and on this page.