Privacy Policy

Who is responsible for your data?

Biyu (biyu.one and the iOS / Android apps) is published by Asura Studio, SARL (trading as Asura Studios), SIREN 994 847 358, 1 cours du Buisson, 77186 Noisiel, France, the controller of your personal data.

For any question or to exercise your rights: contact@biyu.one.

Biyu is for adults only (18 and over).

The data we process

• Account: email address, password (stored encrypted), username, date of birth; your Google, Apple or Facebook identifier if you sign up with these services.
• Profile: gender and gender sought, city and approximate location (for distance), height, description, photos, interests, qualities and flaws, habits, languages, dating goal, answers to profile prompts.
• Profile verification (optional): a selfie taken in the app, automatically compared with your profile photo.
• Activity: messages, likes, matches, profile visits, blocks and reports.
• Premium subscription: status, plan, start and end dates. Payments are handled by Apple, Google (or Stripe for former web subscriptions): we never receive your card details.
• Technical data: IP address and connection logs, device type and OS, app version, push notification token, crash reports.
• Audience and ad measurement (only with your consent): pages and screens viewed, journey steps (sign-up, first like…), the device advertising identifier if you allow it.

Sensitive data

Biyu is a dating service: some information in your profile is sensitive data under Article 9 GDPR. The gender you are looking for reveals your sexual orientation, and your profile shows your childfree life choice, which relates to your private and intimate life. Simply being on a dating service also says something about you.

We only process it with your explicit consent, asked separately at sign-up, and only to suggest compatible profiles and show you to relevant members. This data is never sold, never shared with advertisers and never used to target ads.

The verification selfie is only used to compare your face with your profile photo (AWS Rekognition, Ireland region); it is deleted with your account.

You can withdraw your consent at any time by deleting your account (My account > Delete my account): your data is then erased.

Why, and on what legal basis

• Providing the service (account, profile, suggestions, messaging, notifications): performance of the contract (terms of use), and explicit consent for sensitive data.
• Premium subscription: performance of the contract; keeping proof of payment: legal obligation.
• Safety and moderation (reports, bans, fraud and fake profile prevention, anti-bot protection at sign-up): legitimate interest in protecting members.
• Automated profile moderation: your photos and the public information of your profile (username, description, answers, gender, age, city) are analysed by an artificial intelligence tool, at sign-up, on every change and regularly, to detect fake profiles, nudity, personal contact details and photos that do not show you. Your email, exact location, messages and payments are never sent. A profile found doubtful may have its visibility limited while a person from our team checks it; no deletion or ban is decided without human review. Basis: legitimate interest in protecting members. You can contest a decision at contact@biyu.one.
• Profile verification: your consent (optional).
• Crash reports: legitimate interest in fixing bugs (no identifying personal data, screens masked).
• Information emails and newsletter: your consent, withdrawable in one click in every email or in your notification settings.
• Audience measurement (Google Analytics) and ad measurement (Meta): your consent, asked separately and withdrawable at any time.
• Internal statistics (number of sign-ups, active users, account deletions): legitimate interest, aggregated and anonymous.

Who receives your data (processors)

Other members only see what you publish on your profile. We use the following providers, acting on our instructions:

• OVHcloud (France): server and database hosting.
• Google Cloud Storage (Google): storage of photos, verification selfies and backups.
• Mailjet (France): sending emails.
• Amazon Web Services – Rekognition (Ireland): verification selfie comparison.
• Anthropic (United States, Claude API): automated profile moderation (photos and public profile information). The data is not used to train its models and is kept by Anthropic only as long as needed, 30 days at most.
• Expo (United States): delivering push notifications.
• RevenueCat (United States), Apple, Google, Stripe: subscriptions and payments.
• Sentry: app crash reports.
• Google Maps Platform: city suggestions while typing.
• Cloudflare Turnstile: anti-bot protection of the web sign-up form.
• Google Analytics / Firebase and Meta (Facebook, Instagram): only if you accept, for audience and ad measurement.
• Google, Apple, Facebook: if you choose to log in with these services.

We never sell your data.

Transfers outside the European Union

Some providers (Google, Meta, Anthropic, Expo, RevenueCat, Sentry, Apple, Stripe) are based in the United States or may access data from there. These transfers rely on the EU–US Data Privacy Framework when the provider is certified, or on the European Commission's standard contractual clauses.

Cookies and trackers

Website. On your first visit, a banner lets you accept all, refuse all or choose per purpose. No tracker requiring consent is set before you choose. You can change your choice at any time with the "Manage cookies" link at the bottom of every page; withdrawing deletes the related cookies.

• Session and login (session cookie, "remember me"): required for the site to work, 1 year maximum, no consent needed.
• biyu_consent: stores your choice, 6 months, no consent needed.
• Google Analytics (_ga, _ga_*): audience measurement, 13 months, with consent.
• Meta Pixel (_fbp, _fbc): measuring how well our ads work, 90 days, with consent.
• Local storage: remembers that you closed the "Get the app" bar, 30 days.

Apps. A dialog lets you refuse, accept audience measurement only, or accept all. Nothing is collected before you answer. Audience measurement uses Google Analytics for Firebase; ad measurement uses the Meta SDK and, on iPhone, the tracking permission (ATT) asked by iOS. You can change your mind in My account.

How long we keep it

• Account, profile, photos, messages: as long as your account exists. When you delete your account, they are erased immediately and permanently (photos and selfie included).
• Inactive accounts: deleted, with all their data, after 3 years without any login. We let you know by email 30 days before; just log in again to keep your account.
• Database backups: 30 days.
• Server technical logs: 14 days.
• Banned accounts: to prevent re-registration (legitimate interest in member safety), we keep the username and an irreversible fingerprint of the email address (never the address itself), for 3 years after the ban.
• Automated moderation results (score and short reasons, no copy of your photos or texts): as long as your account exists; when it is deleted, they are detached from your account and only used to measure how reliable the tool is.
• Reports: kept for 1 year after they have been handled, even if one of the accounts concerned has been deleted, then erased.
• Premium subscription: history kept as proof of payment; the App Store or Google Play transaction id is erased 6 years after the transaction.
• Undelivered emails (technical sending error): 30 days.
• Login sessions: 30 days at most, erased as soon as they expire.
• Statistics: aggregated and anonymous only (e.g. "one account deletion that day"), not linked to you.
• Audience measurement: 14 months maximum in Google Analytics.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, to withdraw your consent at any time, and to set instructions for your data after your death.

• Edit your profile, notifications and tracker choices: from your account.
• Delete your account and all your data: My account > Delete my account, in the app or on the website.
• Any other request: contact@biyu.one. We reply within one month and may ask you to prove your identity if in doubt.

If you believe your rights are not respected, you can lodge a complaint with the CNIL.

Security

Encrypted connections (HTTPS), passwords stored encrypted, access to data limited to people who need it, regular backups. No system is infallible: please report any issue to contact@biyu.one.