Privacy Policy

1. Information We Collect

When you use Altar & Heir, we collect the following categories of personal data:

Account information

Your full name, email address, and password (stored as a secure hash) when you register.

Profile information

Details you provide to build your dating profile, including your display name, age, gender, location (county or city), denomination, church attendance, biography, and what you are looking for in a partner.

Profile photographs

Images you upload to your profile. These are stored securely and displayed only to other registered members.

Identity verification data

If you choose to verify your identity, Stripe Identity processes a government-issued photo ID and a biometric selfie on our behalf. We receive only the verification outcome (verified, requires input, or cancelled) and a session reference. We do not store copies of your identity documents or biometric data on our servers.

Payment information

If you subscribe to Altar & Heir Premium, Stripe processes your payment card details directly. We receive only a tokenised customer reference and subscription status; we never see or store your full card number.

Messages

The content of messages you send to other members through our in-app messaging system.

Usage data

Technical information collected automatically, including your IP address, browser type and version, device type, pages visited, and timestamps of activity. This is used for security, fraud prevention, and service improvement.

Cookies and session data

We use strictly necessary session cookies to keep you logged in. We do not use advertising or tracking cookies.

2. How We Use Your Information

We use the personal data we collect for the following purposes:

• To create and manage your account and authenticate your identity when you sign in.
• To display your profile to other members and facilitate connections between members who share compatible faith values.
• To process identity verification through Stripe Identity and update your profile's verified status accordingly.
• To process premium subscription payments and manage your billing relationship through Stripe.
• To deliver in-app messages between members.
• To send you transactional emails, including account confirmation, verification outcome notifications, and subscription receipts.
• To notify our administrative team of new member registrations and verification events for safeguarding and compliance purposes.
• To detect, investigate, and prevent fraudulent activity, abuse, or violations of our Community Guidelines.
• To comply with our legal obligations under UK and EU law.

3. Legal Basis for Processing (UK & EU GDPR)

We process your personal data on the following legal bases under the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU General Data Protection Regulation (EU GDPR):

Contract (Article 6(1)(b))

Processing your account information, profile data, messages, and payment details is necessary to perform the contract we have with you — namely, providing the Altar & Heir service.

Legitimate interests (Article 6(1)(f))

We process usage data and technical logs to maintain the security and integrity of our platform, prevent fraud, and improve our service. Our legitimate interests do not override your rights and freedoms.

Legal obligation (Article 6(1)(c))

We may process or retain certain data where required to comply with applicable law, including financial record-keeping obligations and responses to lawful requests from regulatory authorities.

Explicit consent (Article 9(2)(a))

Your dating profile contains special category data — specifically, information about your religious beliefs. We process this data only on the basis of your explicit consent, given when you create your profile. You may withdraw this consent at any time by deleting your profile, though this will mean we can no longer provide the service to you.

4. Data Retention

We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by law.

Active accounts

We retain your account and profile data for as long as your account remains active.

Deleted accounts

When you delete your account, we will remove your profile, photographs, and messages within 30 days. Certain records — such as transaction logs and identity verification outcomes — may be retained for up to 7 years to comply with financial and legal obligations.

Identity verification records

We retain only the verification outcome and Stripe session reference. Stripe's own retention of identity documents is governed by Stripe's Privacy Policy.

Payment records

Billing and subscription records are retained for 7 years in accordance with UK financial record-keeping requirements.

Technical logs

Server and security logs are retained for up to 90 days.

5. Your Rights

Under UK GDPR and EU GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 11.

Right of access

You have the right to request a copy of the personal data we hold about you.

Right to rectification

You have the right to ask us to correct inaccurate or incomplete personal data.

Right to erasure

You have the right to request that we delete your personal data, subject to certain legal exceptions.

Right to restriction of processing

You have the right to ask us to restrict the processing of your data in certain circumstances, for example while a dispute is being resolved.

Right to data portability

Where processing is based on your consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to object

You have the right to object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent

Where processing is based on your consent (including the processing of your religious beliefs as special category data), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or with your local Data Protection Authority if you are based in the EU or EEA. See Section 11 for details.

6. Third-Party Processors

We share your personal data with the following third-party processors, each of whom processes data strictly on our behalf and under a data processing agreement:

Stripe, Inc.

Stripe processes payment card data for premium subscriptions and performs identity verification via Stripe Identity. Stripe is certified to PCI DSS Level 1 and acts as a data processor for payment data and a data controller for identity verification data. Stripe's Privacy Policy is available at stripe.com/gb/privacy.

BetterAuth

BetterAuth provides our authentication infrastructure, managing secure session tokens and credential storage. All authentication data is stored within our own database; BetterAuth does not operate a separate data store for Altar & Heir user credentials.

GoDaddy (Airo email gateway)

Transactional emails — including verification outcome notifications and administrative alerts — are delivered via the Airo platform email gateway, operated by GoDaddy. Email content is transmitted to GoDaddy's infrastructure solely for the purpose of delivery and is not used for any other purpose.

Hosting infrastructure

Our platform is hosted on GoDaddy's Airo infrastructure. All data is stored and processed within the European Economic Area or the United Kingdom.

7. International Data Transfers

Altar & Heir Ltd is incorporated in England and Wales. We primarily store and process your data within the United Kingdom and the European Economic Area.

Stripe, Inc. is headquartered in the United States. Transfers of personal data to Stripe are governed by Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Agreement (IDTA), ensuring an equivalent level of protection to that provided under UK GDPR and EU GDPR.

We do not transfer your personal data to any other countries outside the UK or EEA, except where required by law or where you have explicitly consented.

8. Children's Privacy

Altar & Heir is intended solely for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.

During registration, users are required to confirm that they are aged 18 or over. Identity verification via Stripe Identity provides an additional safeguard by confirming the age of members who choose to verify.

If you believe that a person under the age of 18 has created an account on our platform, please contact us immediately at [email protected]. We will investigate and, where confirmed, delete the account and all associated data without delay.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the 'Last updated' date at the top of this page and, where appropriate, notify you by email or by displaying a prominent notice within the platform.

We encourage you to review this Privacy Policy periodically. Your continued use of Altar & Heir following the posting of changes constitutes your acceptance of those changes, to the extent permitted by applicable law.

If we intend to process your personal data in a materially different way from that described at the time of collection — in particular, any change to how we process special category data such as your religious beliefs — we will seek your explicit consent before doing so.

10. EU Representative

If you are located in the European Union or European Economic Area, Altar & Heir Ltd has appointed an EU Representative to act on its behalf for the purposes of the EU General Data Protection Regulation (EU GDPR). Our EU Representative is:

EU Support Email: [email protected]

Website: eubusinesspartners.com

EU residents may contact our EU Representative directly with any queries or complaints relating to the processing of their personal data. Our EU Representative will liaise with us on your behalf and respond to your enquiry in a timely manner.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way in which Altar & Heir Ltd processes your personal data, please contact our Data Protection team using the details below:

Data Protection Email: [email protected]

We aim to respond to all data protection enquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

• UK residents: UK residents: the Information Commissioner's Office (ICO) — ico.org.uk
• EU/EEA residents: EU/EEA residents: your local Data Protection Authority (DPA) in your country of residence.