Privacy Policy

BarMatch LLC ("BarMatch," "we," "us," or "our") provides a mobile and web platform that helps people 21+ discover local venues, meet other patrons in real time, and transact directly with participating venues. This Privacy Policy describes how we collect, use, share, and protect personal information when you use the BarMatch mobile app, the BarMatch website at barmatch.com, the venue-owner dashboard, the brand-advertiser dashboard, and related services (collectively, the "Service").

By using BarMatch, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Who this policy applies to

This Privacy Policy applies to four audiences:

• Consumer users — adults 21+ who download the BarMatch mobile app to find venues, match with people, and transact.
• Venue owners and staff — businesses that claim their venue listing and use the BarMatch venue-owner dashboard at barmatch.com/venue-owner to manage deals, events, VIP offers, drink menus, advertising, and other tools.
• Brand advertisers — beverage brands and other third parties that advertise on BarMatch and use the brand-advertiser dashboard at barmatch.com/brand.
• Website visitors — anyone who browses barmatch.com without an account.

Sections below indicate which audience they apply to when the practices differ.

2. Information we collect

2.1 Information you provide when you sign up

To create a consumer account, we collect:

• Authentication identifier — an Apple ID or Google account, used to sign you in. We do not see or store your Apple/Google password.
• Phone number — verified via SMS through Twilio. We store the number in standardized international format (E.164). Phone numbers enable friend discovery, contact-import matching, and protection against bot signups.
• Self-attested identity information at signup: first name, last name, date of birth, and gender. You confirm this information is accurate before completing signup. We use it to enforce the 21+ eligibility requirement and personalize matches.
• Profile photos — at least one is required; you may upload up to five. Photos are scanned for safety using automated content moderation (no explicit content) before they go live. For verified users, each photo is also face-matched against the numeric face-geometry vector derived from your verification selfie (see Section 10); a photo that does not match the verified person is hidden from public view — retained privately, not deleted — until you replace it with a matching photo. At least one matching, publicly visible photo is required to appear in the Match Game.
• Match preferences and personal tags — preferred genders, favorite drink and vibe tags, optional bio (up to 250 characters).

2.2 Information you provide if you verify your identity

Identity verification is required to participate in the Match Game (browsing, liking, and matching with other users) and to send drinks to other users, accept drinks sent to you, and buy event or VIP tickets. Venue discovery, Deals, and Friends features never require verification. Verification is free during the launch period; thereafter it is a one-time $0.99 in-app purchase (never a subscription), the same for every user. The fee goes toward what our identity-verification partner, Persona, charges BarMatch for each check, and is set below that charge. When a fee applies, it is collected only after you consent to biometric processing (see Section 10) and proceed — if you decline consent, you are not charged. Vibe checks (the peer-safety polling feature) do not require verification. When you choose to verify:

• Government-issued ID — captured and processed by our identity-verification partner, Persona Identities, Inc. ("Persona"). Persona collects a photo of your ID and a live selfie, performs verification, and returns to us your legal name, date of birth, gender as printed on the ID, and a record of the verification result.
• We receive and store the verified name, date of birth, and gender. We also store the Persona inquiry ID for audit purposes.
• We do not store your government ID image or your verification selfie. Persona retains those materials in accordance with their data processing agreement and privacy policy (available at withpersona.com/legal/privacy-policy).
• With your prior written consent — obtained in-app before verification completes and before any payment — we derive a numeric face-geometry vector from your verification selfie via AWS Rekognition and retain only that mathematical vector, never the selfie image, for the two purposes described in Section 10 (confirming your profile photos depict you, and detecting duplicate accounts).

2.3 Information collected automatically

• Location information — when you ask the app to check you in at a venue, we use your device's GPS to verify you are physically at that venue. Location is collected only at check-in time and during the active check-in window (default four hours). We do not run background location.
• Device and connection information — device model, operating system, app version, IP address, and approximate network location. We use this for fraud detection, analytics, debugging, and abuse prevention.
• Usage information — features you use, screens you view, taps you make, and the timestamps of those events. We use this to improve the Service and measure feature performance.

2.4 Information generated through use

• Check-ins — venue, start time, and expiry time for each check-in. Check-ins are visible to other users at the same venue under the rules of your selected privacy mode (see Section 3.4 below).
• Matches and messages — when two people Like each other on our Match Game, a chat thread opens. We store the match record, the messages exchanged, message timestamps, and any voice notes or images sent. Messages are retained for 60 days from the match's creation, then automatically purged.
• Vibe checks (peer-safety polling) — when you fire a vibe check about another user (the "subject"), we share the subject's profile with the friends you select so those friends can vote on their impression of the subject. What we share: the subject's public profile fields (name as "First L.", age, profile photos, bio, vibe and drink tags, verified-badge status) and the context in which you fired the poll (e.g., "pre-meeting" or "you matched"). We do not share the subject's contact information, exact location, message history, or unrelated activity. We store the poll, the verdict counts, and which friends voted what way. Poll results are visible to the requester and the friends invited to vote. A vibe check can only be about someone you could meet: a current Match Game candidate checked in near you, someone whose drink offer to you is still open, or a person you matched with. The friends you ask can see the subject's profile only while the poll runs. The subject is not notified that a vibe check took place.
• Pre-drink and post-match profile share to friends. When a user is considering sending you a drink (Buy-a-Drink flow), or has just matched with you (Match Game flow), that user may share your profile with their friends through a vibe check before deciding whether to proceed. The shared profile consists only of the public profile fields described in the preceding paragraph. We share this data on the basis of your decision to make your profile visible in the relevant flow (Match Game requires Public visibility; drink-acceptance is a decision you make when the offer is presented). You may adjust your privacy settings at any time to limit who can consider you in these flows; see Section 5.
• Drink offers, ticket purchases, VIP services, deals, and venue invites — we store records of each transaction or social action you take in the app, including counterparties, amounts, venue, and timestamp.
• Friendships and pending requests — records of who you are friends with, who you have invited or blocked, and the per-friend manage-blacklist toggles you set.
• Reviews and ratings — venue reviews you submit, tied to a verified check-in.
• Advertising interactions — when an ad is shown to you or you tap one, we record which campaign it was, which placement it appeared in, when, and what it cost the advertiser. These records are tied to your account so we can limit how often you see the same campaign, bill advertisers correctly, and detect click fraud. See Section 3.6 for how they are used and Section 4.3 for what advertisers are and are not told.

2.5 Contacts (with your permission)

If you grant the app permission to access your device contacts, we collect the phone numbers and names from your contacts and send them to our server as one-way SHA-256 hashes. We use the hashes to match you with BarMatch users you already know. We do not transmit your contacts' raw names or numbers to our server, and we do not share your contact list with other users.

2.6 Payment information

For payments processed in the BarMatch app:

• In-app purchases (chat refreshments, BarMatch+ subscription, identity verification) — processed by Apple App Store on iOS and Google Play Store on Android. We see only the receipt and transaction identifier, not your payment card.
• Card-on-file purchases (drinks, event tickets, VIP services) — your payment card is collected and stored by Stripe, Inc. ("Stripe"), our PCI-compliant payment processor. We receive only a tokenized reference and the last four digits of your card.
• Refund and dispute records — when refunds are issued, we keep a record of the transaction details and reason for our financial records.

2.7 Venue-owner information

If you operate a venue on the BarMatch platform, we collect:

• Business contact information — your legal business name, business address, business phone, and an authorized representative's contact email.
• Ownership verification documentation — when you claim a venue, we may ask for documentation that proves you are authorized to operate it (e.g., a copy of your liquor license or business license, the venue's tax ID).
• Payout banking information — bank account or debit-card information you provide to Stripe Connect for receiving drink-purchase, ticket, and VIP payouts. Stripe collects and stores this; we receive only a reference identifier and payout status.
• POS integration credentials — when you connect your point-of-sale system (currently Square), we receive an encrypted OAuth token allowing us to read your menu and write orders. The token is encrypted at rest with AES-256-GCM.
• Venue content — photos, menus, drink prices, hours, deals, events, VIP offers, ad campaign creative, and other materials you upload or configure.
• Employee and staff information — names and emails of staff you invite to access your venue-owner dashboard (limited employees see only the surfaces you grant).
• Tax-related information — when required for 1099 reporting or VAT/sales tax handling through Stripe Tax.

2.8 Information from third parties

We may receive information from:

• Apple and Google — your basic name and email when you sign in with Apple or Google. Apple offers a "Hide My Email" relay option which forwards messages to your real email without disclosing it; if you choose Hide My Email, the relay address is what we have on file.
• Other users — if another user invites you to BarMatch using their contacts, your phone number hash may identify you to that user once you sign up so they can send a friend request.
• Public business databases — when verifying venue claims, we may consult public data sources (state liquor control records, business directories) to confirm ownership.
• Fraud and abuse prevention services — Twilio provides line-type information so we can decline VoIP / burner numbers during phone verification.

2.9 Brand-advertiser information

If you advertise on BarMatch as a beverage brand or other third party, we collect:

• Business contact information — the brand's legal name, business address, and the names and email addresses of the individuals you authorize to use the brand-advertiser dashboard.
• Campaign and creative content — the campaign settings, budgets, targeting parameters, images, and copy you upload or configure.
• Account and billing records — the contracted advertising credit we issue to you and the spend drawn against it. Brand advertising is funded by contracted credit rather than a card on file, so we do not collect brand payment-card details.

We do not collect personal information about a brand's own customers. Brand advertisers do not upload customer lists, audience segments, or any other personal data to BarMatch, and there is no mechanism for them to do so.

3. How we use information

3.1 To provide the Service

We use information to:

• Create and maintain your account, including enforcing the 21+ eligibility requirement at signup and on every drink purchase.
• Match you with other users on the Match Game, surface friends you may know, and enable the social features of the app.
• Verify you are physically at a venue when you check in.
• Process payments and deliver the things you purchase (drinks, tickets, VIP services, deals).
• Send transactional messages (SMS verification codes, payment receipts, drink redemption notifications, friend request notifications) via Twilio, Apple Push Notification service, and Firebase Cloud Messaging.
• Enable venue-owner dashboard functionality.

3.2 To improve and personalize the Service

• Recommend venues, deals, events, and matches based on your location, check-in history, and preferences.
• Measure feature performance, fix bugs, develop new features, and conduct internal research.
• Send you in-app notifications about activity that relates to you (matches, messages, friend requests, drink offers, etc.) based on the per-category notification toggles you set.

3.3 To enforce safety and trust

• Detect and block fraud, abuse, and violations of our Terms of Service or Community Guidelines.
• Investigate user reports (harassment, fake accounts, illegal content). Each report is reviewed by trained employees; serious violations result in account suspension or termination, with escalation ladder per our published policy (2 weeks → 3 months → indefinite within a rolling 12-month window).
• Apply rate limits, IP-based throttling, and bot detection.
• Screen every image uploaded to the Service — profile photos, advertising creative, and venue and brand assets — against the known child-sexual-abuse-material (CSAM) hash set maintained by the National Center for Missing & Exploited Children (NCMEC) and its partners, using Microsoft's PhotoDNA Cloud Service. A match triggers immediate removal, preservation, and reporting as described in Section 4.5. Profile photos and advertising creative are additionally screened for explicit content.
• Refuse drink purchases when staff at the venue flag a recipient as too intoxicated to receive additional drinks for the night (the "intoxication flag" expires the next operational morning).

3.4 With your privacy mode

BarMatch supports three privacy modes for consumer accounts: public, friends-only, and incognito. Your privacy mode controls whether other patrons at a venue can see you in their Match Game, whether your check-in is visible to friends in the Friend Map, and whether the Patron Strip on the venue details page shows your photo. Per-friend overrides let you hide your location from specific friends or block specific friends from sending drink offers or vibe checks. We follow the privacy choices you make.

3.5 To comply with legal obligations

• Meet tax, accounting, and financial-record retention requirements.
• Respond to lawful subpoenas, warrants, and court orders submitted via barmatch.com/legal/data-request.
• Cooperate with law enforcement when required by law to do so.
• Protect the rights, property, and safety of BarMatch, our users, venue partners, and the public.

3.6 To select and measure advertising

The Service carries advertising from venues and from third-party brands. Ads are chosen on our own servers, from campaigns bought directly from us. The BarMatch app contains no third-party advertising or tracking SDK.

We may select an ad to show you on the basis of:

• Your age and gender, as held on your account.
• Your approximate location at the time, to match campaigns that set a distance limit from the advertising venue.
• The venue you are currently checked in at, and that venue's characteristics (its vibe categories, games, and food offerings).
• What you are browsing at that moment — for example the vibe, music, or category surface you have open.
• Whether you have previously checked in at a specific venue an advertiser has named, within the last 30 days.
• How recently and how often you have already been shown that campaign, so we can limit repetition.

We do not select ads on the basis of your matches, likes, chat messages, voice notes, vibe checks, friend graph, contact list, purchases, profile photos, or biometric data. We do not use information collected about you on other companies' apps or websites, and we do not buy targeting data about you from anyone.

We also use advertising interaction records to measure campaigns: to bill advertisers, to enforce frequency and billing caps, to detect click fraud, and to calculate — on our servers — how many people took an action such as a check-in, purchase, redemption, or save after seeing or tapping an ad. Only aggregate results of that calculation are reported to the advertiser; see Section 4.3.

Every ad is labeled as paid and carries a "Why this ad?" control explaining in plain language why you are seeing it. Advertising cannot be switched off, and a BarMatch+ subscription does not remove it.

4. How we share information

4.1 With other users (per your privacy mode)

Subject to your privacy settings, certain information is visible to other users:

• Match Game candidates see your first name and last initial only, your age, your primary profile photo, your vibe and drink tags, and signals of past co-presence at venues (badges like "crossed paths," "same vibe").
• Mutual matches see your full Match Game profile including additional photos and bio.
• Accepted friends see your full last name (you accepted them; they know you), your full profile, and your live location if you have not turned location-sharing off for them.
• Pending friend request senders/recipients see enough identity information to recognize you (name + photo) so the pending request decision is informed.

We never share with other users your phone number, email address, date of birth, or precise GPS coordinates. We never share who has blocked you.

4.2 With venue owners

Venue owners see aggregate, non-identifiable information, plus what they need when you buy or redeem something at their venue:

• Aggregate check-in counts and patron demographics (counts by gender, age bucket, vibe tag).
• Aggregate match counts attributed to their venue.
• Aggregate advertising delivery and outcomes for campaigns they run — see Section 4.3.
• When you buy or redeem something at a venue (a drink, an event or VIP ticket, or a deal), the venue receives the information needed to fulfill it: your first name and last initial, the item, the quantity or party size, a redemption code, and the time window.
• Your photo on the venue's scanner. When venue staff scan a code you are redeeming, the venue's scanner shows your main profile photo with your first name and last initial, so staff can confirm that the person redeeming is the person the code belongs to. This applies to an event or VIP ticket you hold, a drink someone buys you (shown with the first name of the member who bought it), and a deal, whatever your privacy mode. The photo appears only when the code can be used, never on a refused scan, and it is not part of the scanner's list of recent scans.
• Venue staff confirm redemptions on the venue's door scanner, a per-venue link opened on a staff device and unlocked with each staff member's own numeric code. For drinks, staff record the redemption status (delivered, refused for stated reasons, intoxication flag). For event and VIP tickets, staff scan your redemption code at the door to mark the ticket used and admit your party. In every case, staff see only the details above and your main profile photo; they do not see your last name, your contact details or the rest of your profile.

4.3 With advertisers

Advertisers — both venues advertising their own venue and third-party brands — receive reporting about how their campaigns performed. That reporting is aggregate only:

• Counts of impressions and clicks, and the amount spent.
• Counts of actions — check-ins, purchases, redemptions, and saves — that occurred at the advertising venue after someone was shown or tapped that campaign, within a short attribution window. These are totals per campaign and per day.
• For venue owners, the same aggregate audience information they already receive about their venue (counts by gender, age bucket, and vibe tag).

Advertisers are not told which individual people saw, tapped, or converted on an ad. They do not receive your name, photo, account identifier, contact details, location, or any other personal information, and they have no ability to retarget, re-identify, or contact you as a result of your interaction with an ad. The calculation that links an ad interaction to a later action happens on our servers and only its totals are released.

Where a venue's advertising is displayed on another venue's page, the venue whose page it appeared on receives no information about it beyond the fact that third-party advertising may appear there.

We do not sell personal information to advertisers, and we do not share personal information with advertisers, ad networks, data brokers, or measurement vendors for their own purposes.

4.4 With service providers

We share information with vendors who help us operate the Service. They are contractually obligated to use the information only to provide their service to us. Key providers include:

• Supabase, Inc. — our hosted database and authentication infrastructure.
• Persona Identities, Inc. — identity verification (ID images, selfie, verification result). Persona's own privacy policy applies to data they collect.
• Amazon Web Services, Inc. ("AWS"). AWS Rekognition performs (a) explicit-content moderation on profile photo uploads and advertising creative and (b) face-geometry comparison between verified users' uploaded photos and their Persona-verified ID face geometry. AWS acts as a service provider on BarMatch's behalf for these operations. AWS's practices, including data handling and security certifications, are described at aws.amazon.com/rekognition. The face-geometry vector for verified users is stored in an AWS-managed Rekognition Face Collection per our BIPA Notice.
• Microsoft Corporation (PhotoDNA Cloud Service). Screens every image uploaded to the Service against the known child-sexual-abuse-material (CSAM) hash set, which incorporates NCMEC's hash list, to detect and block such material. Microsoft acts as a service provider on BarMatch's behalf; a positive match triggers automated removal, preservation, and reporting as described in Section 4.5.
• Stripe, Inc. — payment processing for card-on-file purchases (drinks, tickets, VIP) and Stripe Connect payouts to venue owners. Stripe's own privacy policy applies to data they collect.
• Twilio Inc. — SMS verification at signup and SMS-based friend invites. Twilio sees your phone number to deliver messages.
• Resend Communications, Inc. — transactional and marketing email delivery. Resend sees your email address only.
• RevenueCat, Inc. — App Store / Play Store in-app purchase orchestration and entitlement tracking.
• Square, Inc. — venue point-of-sale integration if your venue connects Square as their POS.
• Apple Inc. and Google LLC — sign-in, in-app purchases via Apple App Store and Google Play Store, push notifications via APNs and Firebase Cloud Messaging, and pass delivery to Apple Wallet and Google Wallet.
• Cloudflare, Inc. — bot-protection via Turnstile on the law-enforcement data-request webform.
• Vercel Inc. — hosting of the barmatch.com marketing site, venue-owner dashboard, and admin CMS.
• Cloudflare R2 (or Supabase Storage) — storage for venue map tiles (PMTiles) used by the in-app map.
• Google Cloud Platform — Safe Browsing URL scanning for venue-owner-pasted menu links.
• Sentry and PostHog — error monitoring and product analytics. They receive event and device data and, for signed-in members, an account identifier, and use it only to provide those services to us. PostHog uses the IP address to estimate an approximate location (city level) and does not store the address.

The list above reflects providers currently in use or planned to be in use at launch. We will update this list when material additions or removals occur.

4.5 With law enforcement and in legal processes

We disclose information to law enforcement and government authorities only in response to:

• Valid subpoenas, warrants, court orders, or other lawful legal process, submitted through our webform at barmatch.com/legal/data-request .
• Emergency requests from law enforcement involving imminent danger to life, with documentation that we may verify.
• Disclosures required by our legal counsel to defend BarMatch or enforce our Terms of Service.

Proactive child-safety reporting. Separately from the disclosures above, and as required by U.S. federal law (18 U.S.C. § 2258A), when we detect or otherwise become aware of apparent child sexual abuse material on the Service, we report it to the National Center for Missing & Exploited Children (NCMEC) through its CyberTipline and cooperate with law enforcement. Such a report may include the content itself, your account identifiers (such as name, email address, and phone number), the source IP address associated with the content, and related information. We preserve the relevant content and account data for as long as required by law, including where you have requested deletion of your account.

We publish transparency reports periodically describing the volume and type of law-enforcement requests received and our response rate.

4.6 In connection with a business transaction

If BarMatch or substantially all of its assets are acquired, merged, or otherwise transferred, your information may be transferred to the acquiring entity. We will notify you of any such transfer and your options before the transfer takes effect.

4.7 With your consent

We share information for any other purpose with your explicit consent at the time of sharing.

5. Your rights and choices

5.1 Access and correction

You may access most of your information directly in the app under Account → Manage Profile and Account → Privacy. To request a copy of all data we hold about you, email privacy@barmatch.com. We will respond within 30 days.

Persona-verified identity fields (first name, last name, date of birth, gender) are write-once after identity verification — editing requires re-verification through Persona or contact with support.

5.2 Deletion

You may delete your account at any time from Account → Delete Account. After you submit a deletion request:

• Your account leaves other users' view at once: your profile is hidden, any live check-in, open matches, invites and drink offers end, and you are signed out on every device.
• For 60 days you can keep your account by signing back in and choosing Keep my account.
• After 60 days your account is closed: your photos, profile details, matches, messages, vibe checks, friend graph, saved items and sign-in are removed. The same phone number, Apple or Google account can later sign up only as a new account.
• We keep a limited record for disputes, claims and legal requests: your legal name, date of birth, email and phone number (held separately and available only to authorized BarMatch staff), your purchases and other transactions, your check-ins, support tickets and reports. Venues see these records without your name. This record is kept for 3 years after the account closes; after that your identity is deleted and only anonymous purchase amounts are kept, until 7 years after closing, for tax and accounting. Reports other members made about the account are kept after that, for the safety of our members, and if the account was banned or permanently suspended we also keep the legal name and birthdate from its ID check, only to stop the same person from opening a new account.
• Reviews you wrote stay on the venue's page, shown as "A guest" without your name or photo.
• Records of the terms you accepted and of any biometric consent are kept for 3 years after the account closes (see the BIPA Notice).
• Information in legal-hold status (e.g., subject to a law-enforcement preservation order or active investigation) is retained until the hold is released.

5.3 Communication preferences

• You may turn off any push notification category in Account → Notifications.
• You may unsubscribe from marketing emails using the link in any marketing email or the List-Unsubscribe header.
• Transactional messages (SMS verification, payment receipts, drink redemption confirmations) cannot be turned off while you have an active account.

5.4 Permissions on your device

You may revoke contact, location, camera, and notification permissions at any time through your device's system Settings. Revoking certain permissions may disable corresponding features (e.g., revoking location prevents check-in).

5.5 Data portability

Upon request, we will provide your information in a structured, commonly used, machine-readable format (typically JSON). Email privacy@barmatch.com.

5.6 California residents

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide you additional rights, including:

• The right to know what personal information we collect, use, disclose, or sell about you.
• The right to delete personal information we collect from you.
• The right to correct inaccurate personal information.
• The right to limit our use of your sensitive personal information (we currently use sensitive personal information only for the purposes disclosed in this Policy).
• The right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. We do not sell your personal information and we do not share it for cross-context behavioral advertising.
• The right to be free from discrimination for exercising these rights.

Advertising and the opt-out right. BarMatch shows advertising, but it is first-party advertising: ads are selected on our own servers using only information you gave us or generated inside BarMatch, and are sold directly by us. We do not use information about your activity on other businesses' websites, apps, or services to select ads, we do not disclose your personal information to advertisers or ad networks for their own use, and the app contains no third-party advertising or tracking SDK. We therefore do not "sell" or "share" personal information for cross-context behavioral advertising as those terms are defined under California law, and there is nothing to opt out of. If that ever changes, we will update this Policy and provide the required opt-out mechanism before the change takes effect. Section 3.6 describes exactly what is used to select an ad.

To exercise these rights, email privacy@barmatch.com with the subject line "California Privacy Rights Request." We may need to verify your identity before responding.

5.7 Authorized agent requests

You may designate an authorized agent to make a privacy request on your behalf. The agent must provide signed authorization, and we may also verify your identity directly.

6. Data retention

Specific retention periods are listed below. Retention may be extended where legally required.

• Account profile and credentials — kept while the account is active; 60 days after a deletion request the profile details, photos and sign-in are removed (see Section 5.2).
• Matches and chat messages — 60 days from match creation, then automatically purged.
• Vibe checks — retained until purged with the associated chat record at 60 days.
• Drink offers, ticket purchases, and other transactions — kept linked to your account for 3 years after it closes, for disputes and claims; after that only anonymous amounts are kept, until 7 years after closing, for tax and accounting.
• Payment records held by Stripe — governed by Stripe's retention policies.
• Identity verification result records — retained while the account is active and for any legally required period afterward.
• Check-ins and venue analytics — individual check-in records are kept while your account is open and for 3 years after it closes (venues then see them without your name); aggregated counts are retained indefinitely in anonymized form.
• Push notification records — the text of a push we sent you, which for a chat is a preview of the message, is deleted 30 days after it was sent.
• Advertising interaction records — the individual records of ads shown to you and ads you tapped are kept for 90 days, then automatically and permanently deleted. Aggregated campaign totals (impressions, clicks, spend, and attributed action counts), which do not identify you, are retained indefinitely for billing and financial records.
• Audit log entries — kept indefinitely for security investigation. Audit-log entries include only event metadata (who did what when), not message bodies or photo content.
• Backups and disaster-recovery copies — backup retention follows our infrastructure provider's policy and may temporarily extend deletion timelines by up to 90 days.

7. Children's privacy

BarMatch is intended only for users 21 years of age or older. We do not knowingly collect personal information from anyone under 21. We enforce the age requirement at signup (self-attested date-of-birth check, hardened by Persona identity verification and a database constraint), at every drink purchase (staff PIN confirmation), and at content moderation. If we learn that we have collected personal information from someone under 21, we will delete that information promptly. If you believe we may have collected information from a person under 21, please contact us at privacy@barmatch.com.

8. Security

We use industry-standard administrative, technical, and physical safeguards to protect personal information against unauthorized access, alteration, disclosure, and destruction. These include:

• Encryption in transit (TLS 1.2 or higher) for all client-server communication.
• Encryption at rest for payment-related and POS credentials (AES-256-GCM).
• Server-side input validation and parameterized queries to prevent injection attacks.
• Row-level security in our database so each authenticated user can only access rows they are entitled to.
• Rate limits, bot protection, and abuse detection on authentication, friend-invite, and payment surfaces.
• Screen-protection on financial and personal screens (Android FLAG_SECURE; iOS secure-text-entry behavior on protected surfaces) to discourage screenshot leakage.
• Background-process integrity checks for content moderation and fraud detection.
• Audit logging of administrative actions.

No internet-transmitted information can be guaranteed to be 100 percent secure. If a breach of personal information occurs that is reasonably likely to result in identity theft, fraud, or other material harm, we will notify affected users and applicable authorities as required by law.

9. International users

BarMatch is initially launched only to users physically located in the United States. If you access BarMatch from outside the United States, your information is transferred to, stored in, and processed in the United States. By using BarMatch from outside the United States, you consent to that transfer and processing.

We do not currently offer the Service to users in the European Economic Area, the United Kingdom, Switzerland, or other non-United States jurisdictions. We may expand to additional jurisdictions in the future and will update this Policy with the applicable terms before doing so.

10. Illinois Biometric Information Privacy Act (BIPA) compliance

This Section applies to BarMatch users in Illinois and explains how we handle biometric identifiers and biometric information (collectively, "biometric data") under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. ("BIPA"). For the public retention and destruction schedule required by 740 ILCS 14/15(a), see our standalone BIPA Notice, which is incorporated by reference into this Policy.

10.1 Biometric data BarMatch causes to be collected

BarMatch itself does not collect, scan, or store biometric identifiers directly. Two BarMatch features cause biometric data to be processed through service providers; both require your explicit opt-in:

• Identity verification. When you verify your identity (required to participate in the Match Game; free during the launch period, thereafter a $0.99 one-time purchase, never a subscription, that goes toward Persona's charge for each check), our identity-verification partner Persona Identities, Inc. ("Persona") collects a photograph of your government-issued ID, a live selfie, and derives a face geometry from those images to confirm the photo on the ID matches the selfie. Persona is the data controller and retention party for that biometric data; BarMatch receives only the verification result, your legal name, date of birth, gender, and a Persona inquiry ID for audit purposes. BarMatch does not store the ID image or the selfie image; the only biometric-derived data BarMatch retains is the numeric face-geometry vector described in the next bullet, and that vector is created only with your prior written consent.
• Face-geometry vector and profile photo face-match (verified users only). With your prior written consent — obtained in-app before verification completes and before any payment — BarMatch briefly processes your verification selfie once to derive a numeric face-geometry vector; the selfie image itself is then discarded and is not stored by BarMatch — only the mathematical vector is retained, in an AWS-managed Rekognition Face Collection associated with your account. The vector is used strictly for two purposes: (a) confirming that photos you upload to your BarMatch profile actually depict you (each photo is compared, using face geometry, against your stored vector at upload time), and (b) detecting duplicate accounts. This processing is performed by Amazon Web Services, Inc.'s Rekognition service ("AWS Rekognition"), acting as a service provider on BarMatch's behalf. A photo whose face geometry does not match is hidden from public view — retained privately in your account, not deleted — until you replace it with a matching photo; there is no self-serve override, though you may contact support to request manual human review. At least one matching, publicly visible photo is required to appear in the Match Game. Unverified users do not have face-geometry vectors stored and do not undergo this biometric comparison. Profile photos uploaded by unverified users are subject only to (a) explicit-content moderation (which does not derive biometric data) and (b) perceptual-hash duplicate detection (which compares photos against existing platform photos for re-use, also non-biometric).

10.2 Written informed consent

BarMatch obtains your written, informed consent before any biometric data is collected through our Services, as follows:

• For identity verification: by tapping the "Verify Now" button on the Verify Your ID screen, you agree to Persona's biometric collection and processing of your ID image, selfie, and resulting face geometry, and you authorize Persona to return the verification result to BarMatch.
• For BarMatch's face-geometry vector and profile photo face-match: before the vector is created — before verification completes and before any verification fee is charged — you are shown an in-app BIPA consent screen describing what is collected (a numeric face-geometry vector derived from your verification selfie; the selfie image itself is not retained by BarMatch), the purposes (confirming your profile photos depict you, and detecting duplicate accounts), the retention and destruction schedule, and your right to decline. You must affirmatively tap "I Consent" to proceed; the vector is created only after that affirmative act. If you decline, no biometric data is created, no verification fee is charged, and you do not complete verification or join the Match Game — venue discovery, Deals, and Friends features remain fully available. You may withdraw consent at any time in the app under Account → Privacy; withdrawal permanently deletes the vector (see Section 10.3).

10.3 Retention and destruction schedule

In compliance with 740 ILCS 14/15(a), we maintain the following public retention and destruction schedule for biometric data processed through our Services:

• Persona-held biometric data (ID image, selfie, face geometry). Persona retains this data according to their data processing agreement and applicable law. Their public retention schedule is available at withpersona.com/legal/privacy-policy. BarMatch does not control Persona's retention period independently.
• BarMatch-held biometric-derived data (verified users only). The face-geometry vector derived from your verification selfie is stored in an AWS Rekognition Face Collection. It is retained until the earliest of: (a) your withdrawal of biometric consent (in the app under Account → Privacy, or by request to privacy@barmatch.com); (b) thirty (30) days after your account is closed; or (c) three (3) consecutive years of dormancy (no app login). At the earliest of these triggers, the vector is permanently and irreversibly deleted. If dormancy fires, you will be prompted to re-consent at next login if you wish to continue participating in the Match Game.

See the standalone BIPA Notice for the full retention + destruction schedule, including destruction triggered on user request and on expiration of the business need.

10.4 Disclosure, sale, and dissemination

In compliance with 740 ILCS 14/15(d), BarMatch does not sell, lease, trade, or otherwise profit from your biometric data, and does not disclose, redisclose, or otherwise disseminate your biometric data except:

• To the service providers (Persona and Amazon Web Services) collecting and processing the biometric data on your behalf and BarMatch's behalf for the purposes described in Section 10.1;
• To comply with a valid warrant, subpoena, or court order issued by a court of competent jurisdiction; or
• As required by federal, state, or local law or municipal ordinance.

10.5 Standard of care

In compliance with 740 ILCS 14/15(e), BarMatch and its service providers store, transmit, and protect from disclosure all biometric data using the reasonable standard of care within our industry, and in a manner that is the same as or more protective than the manner in which we store, transmit, and protect other confidential and sensitive information.

10.6 Your BIPA rights

Illinois residents may at any time:

• Request information about biometric data we cause to be collected from you, the purpose of collection, and our retention schedule.
• Withdraw consent to biometric processing at any time, in the app under Account → Privacy or by emailing privacy@barmatch.com. On withdrawal, your face-geometry vector is permanently deleted; you will no longer be able to participate in the Match Game unless you later re-verify and re-consent, but your account and your access to venue discovery, Deals, and Friends features are unaffected.
• Request immediate destruction of biometric-derived data we hold about you. We will honor this request within thirty (30) days for data we directly control. For data held by Persona, we will forward the request and identify Persona's contact for direct follow-up.

Send BIPA requests to privacy@barmatch.com with "Illinois BIPA request" in the subject line.

11. Changes to this Privacy Policy

We may update this Policy from time to time. When we make material changes, we will notify you through the app, by email, or by an in-app banner before the change takes effect, and we will revise the "Last updated" date at the top of this document. Continued use of the Service after a change indicates your acceptance of the updated Policy.

12. Contact us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Mail: BarMatch LLC

980 N MICHIGAN AVE STE 1090 # 943505, CHICAGO, IL 606110000

Or electronically:
privacy@barmatch.com

We will respond to verifiable consumer requests within 30 days, or within 45 days where additional time is required and permitted by law.