Draft — not legal advice — version 0.1, 22/09/2026

Kesem — Privacy Policy

This policy explains what personal data Kesem collects, why we collect it, who processes it, how long we keep it, and what rights you have. Biometric data (your face scan) is covered in more detail in the separate Biometric Policy.

PP-1 · Who is responsible for your data

• Controller: Yosef Haim Davidovitz, an individual in Israel, who operates Kesem.
• Postal address: 131 Lachish Boulevard, Kiryat Gat, Southern District 8204857, Israel
• Privacy contact: privacy@kesemdating.com. The operator is the privacy contact. There is no external data protection officer at this time; one will be appointed before Kesem is marketed widely.
• Kesem is not offered in the European Union, Norway, Iceland, Liechtenstein or the United Kingdom. Registration is not possible from the US states of Illinois, Texas and Washington.

PP-2 · What data we collect

We do not collect fingerprints, voice, contacts, your photo library (only the photos you choose), payment details, or advertising IDs. The app has no advertising and no third-party tracking.

PP-3 · Why we use it, and on what legal basis

We apply these legal bases in every country where we operate: as a standard of good practice, and where local law requires a legal basis.

We do not sell your data, share it for advertising, or use it for profiling beyond what this table describes.

PP-4 · Sensitive data

• Biometric data is sensitive data. We collect it only with your explicit consent, and we use it only for the three purposes listed in the Biometric Policy.
• "Looking for" may reveal your sexual orientation, so we treat it as sensitive data. It is used only for matching. It is not sent to usage analytics and not shared with anyone. We process it because you choose to fill it in. You can change it in your profile.
• Your photos may reveal other sensitive details by chance. We use photos only for display, moderation and face matching.

PP-5 · Automated decisions

Some decisions are automated: photo moderation, face-scan results, and actions triggered by risk signals (lower visibility, a new face scan, or a temporary suspension until review). Every automated sanction opens a task for a person to review. A permanent ban is always decided by a person. A match with the banned-faces list never blocks you automatically; a person reviews it. The decision message tells you whether the decision was automated, and you can appeal it (see the Terms, TOS-8 and TOS-9).

PP-6 · Who processes your data (recipients)

We use these service providers ("processors"). They process data only on our instructions, under a data processing agreement.

Our team (the operator and any moderators) sees only what their role needs. For example, only the owner or an administrator may view a scan image, must give a reason, and each view is logged. We disclose data to authorities only when the law requires it, or to protect someone's life or safety. We report child sexual abuse material to the authorities (see the Child Safety Standards).

PP-7 · International transfers

Most data is stored in the EU (Germany and Ireland). Some providers are US companies, or process data outside the EU: Twilio (phone numbers, in the US), Google, Apple and Resend. These transfers are covered by the providers' data processing agreements, including the EU Standard Contractual Clauses and, where relevant, the EU-US Data Privacy Framework. The operator is in Israel. The European Commission has recognised Israel as providing adequate protection.

PP-8 · How long we keep data

PP-9 · Security

Here is how we protect your data. Data is encrypted in transit and at rest. The phone number is encrypted in its column. Scan images are encrypted with a separate key (AWS KMS). Backups are encrypted, and the private key is kept offline. The app cannot read database tables directly. Staff sign in with two-factor authentication. Every staff action is logged. If a security incident puts you at high risk, we will tell you and the competent authority as the law requires.

PP-10 · Your rights and how to use them

You have the right to:

• access your data, and receive a copy: in the app, "Export my data" (a file you can download for 7 days; one export per day);
• correct your data: edit your profile in the app, or write to us (some fields are locked, such as the date of birth);
• delete your account: in the app ("Delete account") or on the web at https://kesemdating.com/account-deletion;
• withdraw biometric consent: Settings → Privacy → "Withdraw face scan consent";
• object to usage analytics: Settings → Privacy → "Share usage data" (turn it off). Nothing else changes in the app, and any events not yet sent are discarded;
• restrict or object to other processing, and port your data, where the law gives you these rights;
• complain to a data protection authority. In Israel, this is the Privacy Protection Authority (https://www.gov.il/he/departments/the_privacy_protection_authority).

For anything else, write to privacy@kesemdating.com or use the in-app support form (category "Privacy and data"). We answer within 30 days. We may ask you to confirm your identity, usually by signing in.

PP-11 · Device identifiers, notifications and analytics

• The device identifiers in PP-2 are used only for security and for "one account per device". They are never used for advertising. We store only hashes.
• Push notifications are sent only if you allow them in your operating system. You can choose which notifications to receive in Settings. Marketing notifications are off by default.
• Usage analytics are sent from our server only (there is no analytics SDK in the app), with a pseudonymous ID. They never include "looking for", messages, photos or biometric data.

PP-12 · Children

Kesem is for adults only (18+). We block registration when the date of birth shows someone under 18, and we keep the block. If you believe a minor is using Kesem, report the profile with the reason "minor", or write to safety@kesemdating.com.

PP-13 · Changes

We will publish any update here with a new version number and date. If a change is material, we will also tell you in the app before it takes effect.

PP-14 · Contact

Privacy: privacy@kesemdating.com · Support: support@kesemdating.com · Post: Yosef Haim Davidovitz, 131 Lachish Boulevard, Kiryat Gat, Southern District 8204857, Israel.

PP-15 · Summary table — for the Google Play Data safety form and Apple App Privacy

Machine-checkable. One row per data type. "Shared" = No in every row, because every recipient is a service provider acting for us, which the store definitions exempt. "Optional" = the member can use Kesem without providing it. The categories in brackets are the store category names.

Store-form answers that follow from this policy: data is encrypted in transit: Yes · users can request deletion: Yes (in the app and on the web) · data sold: No · used for tracking (Apple): No · linked to identity (Apple): Yes for all rows, except crash logs (Not linked).

Sources

No third-party template text was used. The structure follows the official checklists listed below. Policies of other dating apps were not used.

• ICO, "The right to be informed" (checklist of privacy information): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/ (checked 22/09/2026)
• Article 29 WP / EDPB, Guidelines on transparency (WP260 rev.01): https://ec.europa.eu/newsroom/article29/items/622227 (checked 22/09/2026)
• EDPB, Guidelines 05/2020 on consent: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en (checked 22/09/2026)
• Israel Privacy Protection Authority (Amendment 13, DPO guidance of 14/07/2026, stored as legal/sources/ppa-dpo-guidance-2026-07-14.pdf): https://www.gov.il/he/departments/the_privacy_protection_authority (gov.il blocks automated fetching; verify manually)
• Google Play, Data safety section: https://support.google.com/googleplay/android-developer/answer/10787469 (checked 22/09/2026)
• Apple, App Review Guideline 5.1.1(i) and (v): https://developer.apple.com/app-store/review/guidelines/ (checked 22/09/2026); App Privacy details: https://developer.apple.com/app-store/app-privacy-details/
• European Commission adequacy decision for Israel (2011/61/EU): https://eur-lex.europa.eu/eli/dec/2011/61/oj
• Internal: legal/ROPA.md (rows 1–17), legal/VENDORS.md, legal/DEVICE-IDS-ANALYTICS.md, planning/SCHEMA-DRAFT.md §14, DECISIONS T-20, T-27, T-28, T-72, T-79, T-84, T-85, P-1–P-4, P-13, V-13