Privacy Policy

1. Who We Are and What This Policy Covers

1.1 This Privacy Policy explains how Club Giraffe Ltd ("Club Giraffe", "we", "us", "our") collects, uses, shares, and protects your personal data when you use our matchmaking service ("Service"), including our WhatsApp conversations with you, the emails we send you, and the introductions we make.

1.2 The Service currently operates in London and New York. Because we operate in both the UK and the US, this Policy has:

• a UK & EU GDPR section (Sections 3, 4 and 8) that applies if you are in the UK or EEA, and
• a US state privacy law section (Section 9) that applies if you are in the United States.

Sections 2, 5, 6, 7, 10 and 11 apply to all members.

1.3 For the UK/EU and the US, Club Giraffe Ltd is the business responsible for your information. Contact details are in Section 11.

1.4 This Policy should be read alongside our Terms & Conditions.

2. What We Collect

2.1 We only ask for the special category / sensitive data described above because it is necessary for the matching judgement we make on your behalf. You can share as much or as little as you're comfortable with, though sharing less may limit how well we can match you.

2.2 We do not knowingly collect special category or sensitive data about anyone other than you (for example, about a partner or ex) beyond what you volunteer in describing your own history and preferences.

2.3 Voice notes. If you send us voice notes, we process the recording and a written transcript of it in the same way as a typed message.

2.4 Referrals. If you put a friend forward, we use their details only to contact them about membership, and we tell them who referred them. If you name someone as your referrer, we may contact them to confirm that they know you. We tell them only that you have applied, and we do not tell the person who referred you anything you share with us.

2.5 Photos. We do not show members' photos to each other. Any photo or ID document you give us is used only to verify your identity.

2.6 LinkedIn. If you give us your LinkedIn profile link, we look at your profile only to confirm your identity and to review your application. We never contact you, or anyone else, through LinkedIn.

2.7 Your application form. While you fill in our application form, your answers are saved in your browser, on your own device, so you do not lose your place if the page reloads. They are not sent to us until you submit the form, and they are deleted from your device when you submit it, or after 24 hours.

3. Our Legal Bases for Processing (UK/EU)

3.1 For identity, contact, verification, practical, consent-record, message, introduction, referral and payment data, we rely on: performance of our contract with you (to run the Service); our legitimate interests (to improve matching quality, keep members safe and keep the Service secure), balanced against your rights; and legal obligation, where applicable (for example, tax records and keeping a record of consent).

3.2 For special category data, we rely on your explicit consent under Article 9(2)(a) UK/EU GDPR. Before your first conversation starts, we ask you on WhatsApp to confirm you are 18 or over and then to agree, by tapping a button, to us collecting and using this information. This is separate from your acceptance of our Terms, and the conversation does not start unless you agree.

3.3 You can withdraw this consent at any time (Section 8). If you do, we stop new processing of that data, but withdrawal does not affect processing already carried out, and may mean we can no longer provide the matching Service to you.

3.4 Your wellbeing. If something you tell us suggests you may be at risk, our system alerts our team straight away and shares support resources with you. Where that involves health information and we cannot ask for your consent first, we rely on protecting your vital interests (Article 9(2)(c)).

4. How We Use AI and Automated Processing

4.1 Your conversations. Your first conversations with us on WhatsApp are with an AI-powered agent that we designed, and we tell you this at the start. It runs on a third-party AI model provided by Anthropic (see Section 5). It uses what you tell us to ask follow-up questions and to draft your written summary. A person on our team reviews your summary before it is sent to you. If you ask to speak to a person at any point, we pass your request to the team.

4.2 Matching. We use an algorithm/AI system to score and shortlist potential matches based on the data in Section 2. A person on our team reviews every shortlist and confirms every introduction before it is put to you. Parts of the shortlisting may become automated over time, but we will keep a human review and sign-off step before you are ever introduced to anyone.

4.3 Because a person always reviews and confirms your introduction before it reaches you, this process does not amount to a decision "based solely on automated processing" producing legal or similarly significant effects under Article 22 UK/EU GDPR. If we ever change that, we will update this Policy first and tell you what that means for you, including your right to request human review of, and to contest, any such decision.

4.4 No AI training. We do not share your conversations with any third party to train their AI models, and our AI provider does not use them to train its models. We may use anonymised information, with your name and anything that could identify you removed, to improve how we match members.

4.5 You can ask us for more information about the logic involved in our matching process, and can object to profiling carried out for matching purposes, by contacting us at hello@clubgiraffe.com (Section 11).

5. Who We Share Your Data With

5.1 Our team. The people on our team who review summaries and confirm introductions see the data needed to do that, under confidentiality obligations and access controls limiting it to what their role requires.

5.2 Members you are introduced to. When we introduce you to another member, we share your name, your phone number (through a WhatsApp group with you both) and a short note about you and why we think you'll get on. We do not share anything else you've told us, and there is no member directory.

5.3 Service providers (processors). We use the providers below to run the Service. They may only use your data to provide their services to us, under a data processing agreement, and never for their own purposes.

5.4 We do not sell your personal data, and we do not share your special category / sensitive data with advertisers or data brokers. The networks our members come through do not receive any of your information.

5.5 Legal disclosures. We may disclose data where required by law, to protect the safety of a member, or to enforce our Terms.

5.6 International transfers. Several of our providers are based in, or store data in, the US. Where we transfer personal data out of the UK or EEA, we use an appropriate safeguard, such as the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or EU Standard Contractual Clauses, to protect it to UK/EU standards.

5.7 Cookies and website analytics. With your permission, we use Google Analytics on this website to understand how many people visit and which pages they look at, so that we can improve it. It sets cookies and sends Google information such as the pages you view, your approximate location and your device and browser type. It is switched off unless you choose Accept on the cookie banner. If you choose Decline, nothing is loaded from Google. You can change your choice at any time by clearing this site's data in your browser, after which the cookie banner will appear again, or by emailing hello@clubgiraffe.com. We do not use advertising cookies, and we do not use analytics on your conversations with us, which take place on WhatsApp. Google acts as our processor for this analytics data.

6. How Long We Keep Your Data

6.1 We keep your data for as long as you are a member, and for 12 months after your membership ends, after which we delete or anonymise it, except where we must keep it longer for legal, accounting, or dispute-resolution reasons.

6.2 Special category / sensitive data is deleted or anonymised on the same schedule, or sooner if you withdraw your consent and ask us to delete it (Section 8). When we have deleted your data, we let you know.

6.3 If you tell us you are under 18, or you decline consent, we stop there and keep only a record of your answer and your phone number, for 12 months, so we do not contact you again by mistake.

6.4 If you stop replying part-way through your first conversations, we may close the conversation after a period of inactivity. Your data is then kept under Section 6.1 unless you ask us to delete it.

7. Keeping Your Data Secure

7.1 Given the sensitivity of what we hold, we apply enhanced safeguards to special category / sensitive data, including anonymising it where we can, and access limited to the people on our team who need it for their role.

7.2 Messages you send us on WhatsApp are processed by Meta, Twilio and our other providers so we can read and reply to them. We use industry-standard technical and organisational measures across the Service and review them regularly.

7.3 If a breach occurs that is likely to risk your rights and freedoms, we will notify the relevant regulator (the ICO, an EU supervisory authority, or an applicable US state authority) within the legally required timeframe, and will notify you directly where the law requires it or the risk to you is high.

8. Your Rights (UK & EU Members)

8.1 Under UK/EU GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten"), subject to legal exceptions
• Restrict or object to our processing, including profiling used in matching
• Port your data to another provider in a structured format
• Withdraw consent at any time for anything we process on that basis, including your special category data (Section 3.2)

8.2 To exercise any of these rights, message us on WhatsApp or email hello@clubgiraffe.com. We will respond within one month, as required by law.

8.3 If you are unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, your local data protection supervisory authority. We'd appreciate the chance to resolve it directly first.

9. Your Rights (US Members)

9.1 Depending on your state of residence (including under the California Consumer Privacy Act/CPRA and comparable laws in other states), you have the right to:

• Know what personal information, including sensitive personal information, we've collected about you
• Delete your personal information, subject to legal exceptions
• Correct inaccurate personal information
• Limit our use of your sensitive personal information (relationship history, dating preferences, and similar data) to what is reasonably necessary to provide the Service
• Opt out of any "sale" or "sharing" of your personal information; we do not sell or share your data as those terms are defined by law
• Not be discriminated against for exercising any of these rights

9.2 To exercise these rights, message us on WhatsApp or email hello@clubgiraffe.com. We will verify your identity before acting on your request and respond within the time required by applicable state law.

9.3 You may also designate an authorized agent to make a request on your behalf, subject to our ability to verify that authorization.

10. Children

10.1 The Service is for adults only. Before your first conversation starts, we ask you to confirm you are 18 or over. If you tell us you are not, we stop there, and we do not knowingly collect personal data from anyone under 18.

10.2 If we learn that we've collected data from someone under 18, we will delete it promptly. If you believe a minor has provided us data, contact us at hello@clubgiraffe.com.

11. Contact Us and Changes to This Policy

11.1 Privacy questions, requests and general contact: hello@clubgiraffe.com. Postal address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Club Giraffe Ltd is registered in England and Wales (company number 17432700) and is registered with the Information Commissioner's Office (ICO), registration number ZC273622.

11.2 If we appoint a Data Protection Officer, their contact details will appear here.

11.3 We may update this Policy as our practices, the Service, or the law changes. We will post the updated Policy at clubgiraffe.com/privacy with a new "last updated" date, and where a change is material, especially anything affecting how we use your special category / sensitive data, we will notify you directly and, where required, ask for fresh consent before it applies to you.

Home page photo by Taylor Cowling on Unsplash.