Privacy Policy

kibaki cover
Last updated: Oct 21, 2026

The following information explains the nature, scope, and purposes of the collection and use of personal data when you use this website and our app, as well as your rights.

I. Controller Responsible for Data Processing

Kibaki GmbH
Jülicher Str. 48
41464 Neuss
Germany

Data Protection Officer: DLC B2P UG (haftungsbeschränkt), Gerhardt-Hauptmann-Str. 49b, 51379 Leverkusen

Contact: datenschutz@kibaki.com

Further details available in the Site Notice (Imprint).

II. Personal Data, Purposes of Processing, and Legal Bases

Personal data means “any information relating to an identified or identifiable natural person.” Processing occurs for:

  • Consent-based purposes (Art. 6(1)(1)(a), Art. 9(2)(a) GDPR)
  • Website and app use (Art. 6(1)(1)(b) GDPR)
  • Legitimate interests in user experience and service promotion (Art. 6(1)(1)(f) GDPR)
  • Service provision and pre-contractual measures (Art. 6(1)(1)(a), Art. 6(1)(1)(b) GDPR)
  • Contract performance (Art. 6(1)(1)(b) GDPR)
  • Legal obligations (Art. 6(1)(1)(c) GDPR)

1. Access Data / Server Log Files

Collected information:

  • Referrer (previously visited website)
  • Requested website or file
  • Browser type and version
  • Operating system
  • Amount of data transferred
  • Device type
  • Time of access
  • IP address in anonymized form

Host: AWS (Amazon Web Services)

Legal basis: Art. 6(1)(1)(f) GDPR (legitimate interest in monitoring and abuse prevention)

Retention: Automatically deleted after 7 days

2. Cookies

Types: Technically necessary cookies and functional cookies

Consent management: consentmanager AB, Haltegelvägen 1b, 72348 Västeras, Sweden

Legal basis: § 25(2)(2) German Telecommunications Digital Services Data Protection Act (TDDDG), Art. 6(1)(1)(f) GDPR for essential cookies; § 25(1) TDDDG, Art. 6(1)(1)(a) GDPR for optional cookies

Note: Consent can be revoked anytime via consent management tool

3. Consent Management with Consentmanager

Provider: consentmanager AB (hosted on own servers)

Data handling: Processing occurs locally on Kibaki’s systems; no direct transmission to consentmanager AB servers

Legal basis: Art. 6(1)(1)(f) GDPR (legitimate interest in consent management), Art. 6(1)(1)(c) GDPR (legal obligation to obtain and demonstrate consent)

4. Contact Via Email or Other Means

Data collected: Name, email address, telephone, message content

Purpose: Handling inquiries and follow-up questions

Legal basis: Art. 6(1)(1)(b) GDPR and/or Art. 6(1)(1)(a) GDPR (consent)

5. Registration

Data collected:

  • Name, email address, telephone number
  • Authentication data
  • Profile information
  • Profile photos
  • Date of birth
  • Selected interests
  • Location data
  • Filter preferences
  • Device identifiers (device token for push notifications)

Special categories: None are collected during registration or in the user profile.

KIBAKI does not collect gender, sexual orientation or sexual preferences, and does not ask which users you wish to be shown. All users are shown to all users.

Biometric data processed during the optional identity verification is dealt with separately in Section 6 below.

Legal basis: Art. 6(1)(1)(b) GDPR

6. Identity Verification

Identity verification is offered during registration and can be completed later at any time. It is optional. Certain functions of the service require a verified profile; these are set out in Section 11.

Self-image verification process: Users imitate a random pose in a photo for upload

Automated check option:

  • Artificial intelligence performs match and authenticity assessment
  • AI can approve or flag for human review; cannot finally reject
  • Biometric data processed for identification and authentication
  • If no match, human review required

The automated check compares the uploaded image with the photographs on the user’s own profile, for the sole purpose of confirming that the person submitting the image is the owner of the profile. No other characteristics are derived from the image. In particular, no inference is made as to gender, age, ethnic origin, health or emotional state. The outcome of the check is a match or no-match result only. The biometric comparison data is not used for any other purpose and is not used anywhere else in the service.

Service provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Amazon Bedrock)

Processing location: European Union – AWS Region eu-central-1 (Frankfurt, Germany)

Third-country transfer: None intended; all data is processed within the EU. Should a transfer to the USA occur (e.g. for technical support), it is covered by the EU-US Data Privacy Framework (adequacy decision), under which AWS is certified.

Legal basis: Art. 6(1)(1)(a) GDPR, Art. 9(2)(a) GDPR, Art. 22(2)(c) GDPR (consent, revocable)

Human review alternative:

You may request that your photo is reviewed by a member of our staff instead of by the automated system. This option is available on the verification screen before the automated check is carried out. If you choose it, no biometric data is processed.

  • Uploaded photos checked by staff to verify match
  • No biometric features extracted

Legal basis for human review: Art. 6(1)(1)(b) GDPR (contract performance), Art. 6(1)(1)(f) GDPR (preventing fraud and abuse)

Photo quality check:

  • Automatic analysis to verify genuine photograph with visible face
  • Detection check only — establishes face presence, not identity
  • No facial feature extraction, no biometric template creation
  • No photo comparison with other images or databases
  • Processing on own infrastructure in European Union

Legal basis for photo quality check: Art. 6(1)(1)(b) GDPR (contract performance), Art. 6(1)(1)(f) GDPR (preventing fake profiles and misuse)

7. Authentication

Login options:

Phone one-time password:

  • 6-digit code sent via SMS
  • Valid for 5 minutes, single use only
  • Service provider: Infobip d.o.o., Istarska 157, 52215 Vodnjan, Croatia

Login via Apple or Google:

Legal basis: Art. 6(1)(1)(b) GDPR (contract performance), Art. 6(1)(1)(f) GDPR (security of verification)

8. Content Safety Checks and Moderation

Purpose: To keep KIBAKI safe for its members, to meet our obligations as a platform, and to prevent violations of our Terms of Use and Community Guidelines.

What is checked: We automatically check content that members post. This includes profile photos, event images, photos sent in chats, and text in profiles, event descriptions, event rules, invitation notes and messages. These checks look for content that is not permitted under our Community Guidelines, such as sexual content, content involving minors, threats, hate speech and scams.

Process: Images are checked automatically; the automated system pre-screens and flags potentially prohibited content, and a member of our staff makes the final decision on removal or blocking. If an automated check blocks something you posted, you can request a human review at support@kibaki.com.

Service provider (images): Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Amazon Bedrock)

Processing location: European Union – AWS Region eu-central-1 (Frankfurt, Germany)

Third-country transfer: None intended; all data is processed within the EU. Should a transfer to the USA occur (e.g. for technical support), it is covered by the EU-US Data Privacy Framework (adequacy decision), under which AWS is certified.

No opt-out: Because these safety checks are necessary to operate the service safely and lawfully, they cannot be switched off.

Legal basis: Art. 6(1)(1)(f) GDPR (legitimate interest in keeping the service safe for its members) and Art. 6(1)(1)(c) GDPR (legal obligations under the Digital Services Act)

9. Location Data

Purpose: Display location-tailored profiles and events

User control: Allow or revoke in mobile app settings or operating system

Service provider for location determination and phone country code prefilling: MaxMind Inc., 51 Pleasant Street #1020, Malden, MA 02148 (Data Privacy Framework certified)

Third-country transfer basis: Adequacy decision
Further information: https://www.maxmind.com/en/privacy-policy

Legal basis: Art. 6(1)(1)(a) GDPR (consent)

10. How People and Events Are Shown

KIBAKI does not match users. There is no matching score, no compatibility rating and no partner suggestion.

The order in which nearby people and events are displayed is determined by:

  • the distance between you and the person or the event
  • the filters you have set yourself
  • whether an event is still upcoming
  • the interests you have selected, where these correspond to an event category

Data processed: location data (for distance), your filter settings, the interests you have selected, and the events you have created or joined.

Legal basis: Art. 6(1)(1)(b) GDPR (contract performance)

11. Invitations, Events and Participation

A verified profile is required in order to appear in the list of people nearby, to join an event, to send an invitation, to propose a plan and to create an event.

Without verification you can browse events and the people nearby, and view their profiles, but you are not shown to other users in the list of people nearby. Managing your profile, deleting your account, reporting another user and contacting support never require verification.

Invitations

Data processed: the sender and the recipient of an invitation; the event or the proposed activity it refers to; the suggested timeframe and the general area; an optional message of up to 140 characters; the status of the invitation (pending, accepted, declined, withdrawn); and the times at which it was sent and answered.

Purposes: enabling users to invite one another to events and to propose meeting in person; applying the limit on the number of invitations a user may send in a given period; and applying the protective rule under which a user who has declined an invitation does not receive further invitations from the same person for a defined period.

Legal basis: Art. 6(1)(1)(b) GDPR (contract performance); Art. 6(1)(1)(f) GDPR (legitimate interest in preventing unwanted contact and misuse of the service)

Events you create

Data processed: the title, description, date, time, place, category and, where applicable, the price of the event, together with your identity as its host, which is visible to other users of the service.

Legal basis: Art. 6(1)(1)(b) GDPR (contract performance)

Event participation

Data processed: the events for which you have indicated that you are attending.

Visibility: your profile appears in the list of attendees of an event you are attending. If you have activated Private Mode, you are included in the number of attendees but are not named to other users; the host of the event can see your participation, and you are informed of this before you join.

Legal basis: Art. 6(1)(1)(b) GDPR (contract performance)

12. Chat Function

A chat is created only after a user has accepted an invitation from another user. It is not possible to send a message to a user who has not accepted an invitation. Each chat is linked to the event or plan the invitation referred to.

Data processed:

  • Message content
  • Voice messages
  • Image messages
  • Send and receive timestamps
  • Read receipts
  • Online status
  • Chat metadata

Encryption: In transit (TLS) and at rest; not end-to-end encrypted to enable content moderation and community safety

Retention: Messages, including voice and image messages, are kept while the chat exists and are deleted or anonymized when you delete your account, as described in Section IV. Where a message or voice message has been reported, it is kept for up to 6 months after the related report is closed so that we can act on it and respond to lawful requests; content relating to child safety is kept for longer where the law requires it.

Legal basis: Art. 6(1)(1)(b) GDPR (contract performance); Art. 6(1)(1)(f) GDPR and Art. 6(1)(1)(c) GDPR for retention of reported content

13. Push Notifications

Purpose: Inform you about invitations you receive, responses to invitations you have sent, changes to events you are attending, and new messages in chats that are already open

Data processed: Device tokens and notification settings

Service provider: Expo (650 Industries, Inc., P.O. Box #205, Burlingame, CA 94011, USA)

Sub-processors:

  • Firebase Cloud Messaging (FCM, Google) for Android
  • Apple Push Notification service (APNs) for iOS

Certification: Expo certified under EU-US Data Privacy Framework

Third-country transfer basis: Adequacy decision

Further information: https://expo.dev/privacy

Legal basis: Art. 6(1)(1)(a) GDPR (consent, revocable anytime)

14. Reporting Function

When you report another member or their content, we process the report together with the content you reported, your account identifier, and the reported member’s account identifier. We use this to investigate and to decide what action to take.

Data processed:

  • Report reason and category
  • The reported content
  • The reported content and users
  • Your account identifier (as the reporting member)

Confidentiality: The member you report is not told who reported them.

Retention: We keep reports and the related evidence for up to 6 months after the report is closed, so that we can recognise repeated behaviour and respond to lawful requests. Reports relating to child safety are kept for longer where the law requires it.

Legal basis: Art. 6(1)(1)(c) GDPR (legal obligation under the Digital Services Act), Art. 6(1)(1)(f) GDPR (legitimate interest in platform security)

15. Children

KIBAKI is for adults only and you must be 18 or over to use it. We do not knowingly process the personal data of anyone under 18.

Every account must state a date of birth at sign-up, and anyone under 18 cannot complete registration. If we learn that an account belongs to someone under 18, we remove the account and delete the data, except where we are required to preserve information in connection with a child safety investigation.

Our full child safety standards are published at kibaki.com/child-safety.

Legal basis: Art. 6(1)(1)(c) GDPR (legal obligation), Art. 6(1)(1)(f) GDPR (legitimate interest in protecting minors)

16. Features and Payment Service Providers

Features: Premium subscriptions (optional)

Data processed: Transaction details and billing data

Payment service providers:

Apple In-App Purchase:

  • Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
  • For EU/EEA users: Apple Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Google Play Billing:

  • Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  • For EU/EEA users: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Data shared with payment providers: Name, payment data, order number, transaction amount, additional provider-dependent information

Responsibility: Payment service providers are responsible controllers for their data processing

Data received by Kibaki: Information for recording, confirming, and executing orders via platform

Retention: Until payment processing complete and statutory retention obligations met (refund processing, receivables management, fraud prevention)

Legal basis: Art. 6(1)(1)(b) GDPR (pre-contractual measure, contract performance), Art. 6(1)(1)(c) GDPR (statutory retention obligations)

17. Other Integration of Third-Party Services and Content

General note: Third-party content/services integration requires providers to perceive users’ IP addresses; providers should use IP addresses solely for content delivery

WordPress Content Management System:

  • Developer: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA
  • Data processing: Locally on own servers; no direct transmission to Automattic Inc. unless required by certain plugins
  • Legal basis: Art. 6(1)(1)(f) GDPR (legitimate interest in efficient content management)

Google Analytics:

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Technologies: Cookies, device fingerprinting
  • IP anonymization: Activated (IP address truncated within EU/EEA before processing)
  • Certification: Data Privacy Framework certified
  • Third-country transfer basis: Adequacy decision
  • Revocation: Via consent management tool
  • Further information: https://policies.google.com/privacy
  • Legal basis: Art. 6(1)(1)(a) GDPR (consent), § 25(1) TDDDG

Google Tag Manager:

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Purpose: Manage website tags via interface
  • Revocation: Via consent management tool
  • Further information: https://policies.google.com/privacy
  • Legal basis: Art. 6(1)(1)(a) GDPR (consent)

Content Delivery Network (CDN):

  • Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
  • Purpose: Faster and more reliable content delivery
  • Data processed: IP address, timestamp, time and date, user agent, visited website, amount of data transferred
  • Third-country transfer basis: EU-US Data Privacy Framework
  • Further information: https://www.cloudflare.com/privacypolicy/
  • Legal basis: Art. 6(1)(1)(f) GDPR (legitimate interest in performant website provision)

Social Media and Other Platforms:

Note: Clicking social media icons leaves website/app; connection established with third-party providers; data may be processed outside European Union

Adjust (Mobile Attribution & Analytics):

  • Provider: Adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany
  • Purpose: Measuring app installs and attributing which campaign or source brought a user to the app
  • Technologies: Device advertising identifier (IDFA / Advertising ID), device information
  • Data processed: Advertising identifier, IP address, device and event data
  • Revocation: Via the app’s tracking consent prompt (ATT) and the consent management tool

Further information:

III. Recipients of Personal Data and Third-Country Transfers

Recipients:

  • Employees and processors (as necessary)
  • Website and hosting provider: Amazon Web Services (AWS) and respective sub-processors
  • Service providers named above under Section II (depending on services used)
  • Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (content delivery network and security)

Disclosure to third parties: Not without express consent unless legally obliged or necessary for contractual performance

Third-country transfer services: Apple, Google, Expo, MaxMind, Amazon Web Services, Cloudflare (see Section II)

Risks: Enforcement of rights may be made more difficult, particularly in the US due to differing data protection standards

Transfer safeguards: EU-US Data Privacy Framework or standard contractual clauses (as described for respective services)

Processor requirements: Only used if European Commission adequacy decision exists (Art. 45 GDPR), appropriate safeguards (Art. 46 GDPR) or standard data protection clauses (Art. 46(2)(c) GDPR) agreed, and/or binding corporate rules (Art. 47 GDPR) exist

IV. Duration of Storage

General rule: Deletion once purpose achieved and legal basis no longer applies; absent retention obligations

Server log files and IP addresses: Automatically deleted after 7 days

Session cookies: Automatically deleted after session end

Cookies with expiry date: Stored on device; user controls usage and deletion

Inquiry data (email, contact form, other means): Processed until inquiry fully completed; deleted if no legal retention obligation exists

Note: Commercial and tax law retention obligations apply — minimum six years (§ 257 HGB) or ten years (§ 147 AO)

Verification data: Deleted after completion unless retention obligation exists

Account deletion: Associated personal data deleted (profile data, location data, preferences, filter settings, device token, invitations sent and received, and records of your participation in events)

When deletion does not apply: When you delete your account we erase your data as described here. We may keep limited information for longer where we are legally required to, or where it relates to an open report about serious harm, including reports concerning child safety, threats or fraud. Information kept for this reason is stored separately, with restricted access, and is used only for that purpose.

Post-deletion processing:

  • Chat messages and interactions: Anonymized; “tombstone entry” (e.g., “deleted user”) retained without personal data; identifying features removed from messages
  • Events you created: if other users are registered as attending, the event remains visible until it has taken place, without your name or profile; it is then deleted
  • Transaction data: Stored per statutory retention obligations (§ 257 HGB, § 147 AO) for six to ten years, then deleted unless another legal basis exists

Legal claims: Data retained insofar as necessary for assertion, exercise, or defense

Annual review: Check whether data can be deleted

V. Provision of Personal Data and Rights of Data Subjects

Legal obligation: Not required to provide personal data; however, provision may be necessary for contract conclusion or service functions

Consequence of non-provision: Contract or function may not be offered

Fully automated decisions: Some decisions on KIBAKI are made automatically — for example, whether a photo passes our identity verification and our content safety checks. For identity verification, the AI can automatically approve or flag for human review, but never automatically rejects. You can ask for a person to review any automated decision that affects you, at support@kibaki.com. Decisions to remove an account for a serious violation are always reviewed by a person before they are final.

Data subject rights: Arise from Art. 15-23, Art. 77 GDPR and §§ 32-37 German Federal Data Protection Act (BDSG)

Rights regarding personal data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)

Right of revocation: If consent given to personal data processing, right to revoke (Art. 7 GDPR) with effect for future; lawfulness of prior processing unaffected

Right to object: (Art. 21 GDPR); see further information under Section VI

Contact: Direct all inquiries, requests, communications to controller (see Section I)

Right to lodge complaint: If processing of personal data violates data protection law, right to complain to competent supervisory authority (Art. 77 GDPR)

Supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, https://www.ldi.nrw.de

VI. Information About the Right to Object Under Art. 21 GDPR

1. Right to object to Art. 6(1)(1)(f) processing:

You have the right to object anytime, on grounds relating to your particular situation, to processing of personal data based on Art. 6(1)(1)(f) GDPR (legitimate interest processing).

Effect of objection: We cease processing unless we demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or processing serves assertion, exercise, or defense of legal claims.

2. Right to object to direct marketing:

If personal data processed for direct marketing, right to object anytime to such processing.

Effect of objection: We cease processing your personal data for marketing purposes.

Objection procedure: In any form; preferably directed to controller (see Section I)