Privacy Notice

1. Who is responsible for your data

Old Enough is operated by Kay Studios (“Old Enough”, “we”, “us”), which decides how and why your personal data is processed for Old Enough (the “data controller”).

• Address: [To be confirmed: physical address]
• Privacy contact: itskaystudios@gmail.com
• Registration with Ghana's Data Protection Commission: [To be confirmed: Data Protection Commission registration number]

This notice explains what personal data Old Enough processes, why, who it is shared with, how long it is kept and the rights you have. It covers the Old Enough website and app, including Home, HookUp, Stories, Activity and messaging, and Old Enough+.

2. Which laws apply

Old Enough is based in Ghana. Our main data-protection framework is Ghana's Data Protection Act, 2012 (Act 843), which requires personal data to be processed lawfully, reasonably and without infringing your privacy, and gives you rights over your data.

Old Enough is also available to adults in other countries. The law of the country you live in may give you additional or different rights, and Act 843 itself requires personal data that comes from another country to be handled in line with that country's data-protection law. For example, the EU and UK General Data Protection Regulations can apply to a business outside Europe when it offers services to people who are in the EU or UK or monitors their behaviour there. We do not claim that Old Enough automatically meets every country's requirements; if you believe a law of your country applies, contact us and tell us which rights you want to use.

3. The personal data we process

Account and sign-in

• Your email address, used to sign you in with one-time codes and to identify your account.
• One-time sign-in codes (stored only in a protected, non-readable form and valid for 10 minutes) and your signed-in sessions.
• Account status information, such as your plan and any restriction on your account.

Age

• Your date of birth, which you give when you sign up. We use it to confirm you are 18 or older and to show your age (not your date of birth) to other users. If it shows you are under 18, no account is created.
• A record, kept in a cookie in your browser, that you confirmed you are 18 or older when you entered Old Enough.

Your profile

• Your anonymous name and generated avatar settings.
• Your gender, city and country. You type these in yourself; we do not use GPS or your device's location.
• Verification: whether you have asked for, been given or lost a verified badge, any short note you add to your request, and the decision.

HookUp

• Your HookUp preferences: who you would like to meet and what you are looking for, where, and your discovery filters (such as age range, gender and location).
• Your likes and passes, your matches and unmatches, and whether Incognito mode is on.

Stories (Community)

• Stories, story parts and comments you write, and your likes, reposts and quotes.
• Who you follow and who follows you, and who you have muted.

Messages and Activity

• Message requests and your conversations: text messages, images, voice notes and view-once photos, with when they were sent and read.
• While you are using Old Enough, your online status and an approximate “last seen” time.
• Your notifications and notification preferences.

Home

• Which Home videos you have watched and saved.
• If you watch Home videos without signing in, a random visitor identifier stored in a cookie, so that we can count how many free videos that browser has watched (see the Cookie Notice). It is not your name or your IP address and is not used for advertising.

Safety and moderation

• The people you block, and reports you make or that are made about you (reason, optional details and the reported content).
• When a message is reported, a copy of that one message (text, image or voice note) for our safety team.
• Moderation decisions about your account or content, including the reasons, and records of which administrator acted.

Old Enough+ and payments

• Your subscription status and billing period, and a record of each payment (amount, currency, status and date), with the reference numbers Paystack gives us for your customer record, subscription and transactions.
• Payments are made on Paystack's checkout. We share your email address with Paystack for this. We never receive or store your full card or mobile-money details.

Security and technical data

• Your IP address and your account identifier, used to limit how often actions can be repeated and to detect and block abuse, and records of security events such as repeated failed sign-in attempts.
• Cloudflare Turnstile checks that sign-up, sign-in and posting are done by a real person. Cloudflare processes technical information from your browser to do this.
• Our hosting provider processes technical request data, such as IP addresses, to deliver and protect the service.

What we do not collect

• We do not use analytics or advertising trackers, and we do not sell your personal data.
• We do not collect your precise location, your contacts, or identity documents.
• The only emails we currently send are one-time verification codes: to sign up or sign in, and to confirm a request to export your data or delete your account.

4. Sensitive information

Because Old Enough is an adult dating and social service, some of what you tell us — especially your HookUp preferences and your private messages — can reveal information about your sex life or sexual orientation. Act 843 treats information about a person's sexual life as special personal data that may only be processed where it is necessary or with the person's consent.

We only process this information because you choose to use these features and provide it, only to run those features, and you can change your HookUp preferences at any time. How consent for this data is recorded: [To be confirmed: special-data consent approach (under legal review)]

5. What other users can see

• Visible to other users: your anonymous name and avatar, age, gender, city and country, verified badge, your Stories, comments and reposts, your follower and following counts, and an approximate last-seen time (such as “recently” or “this week”).
• Visible to the person concerned: when you follow someone, or like, comment on, repost or quote their Story, they are notified that you did; when you match with or message someone, they see it in HookUp or Activity. A HookUp like is shown to the person you liked if you match, or if they have Old Enough+ (“See Who Liked You”). Full follower and following lists are shown only to their owner.
• Visible only to the people in a conversation: your messages.
• Never shown to other users: your email address, exact date of birth, IP address, blocks you have made, reports, and payment details.
• In HookUp, Incognito mode (Old Enough+) limits who sees you in discovery; blocking hides you from each other.

Our moderation tools do not let staff browse private conversations. A moderator can only see a copy of a specific message after it has been reported, and only while that copy is kept.

6. Why we use your data, and our legal grounds

Act 843 allows personal data to be processed with your consent, or without it where processing is necessary for a contract with you, is required or authorised by law, protects your legitimate interests, or is necessary for the legitimate interests of the controller or a third party. We rely on these grounds as follows:

We do not use your data for direct marketing. Decisions about accounts and reported content are made by people, not solely by automated means. Automated security checks can temporarily block suspicious requests; contact us if you think this has affected you wrongly.

7. Who we share data with

We share personal data only as needed to run Old Enough, with these service providers acting on our behalf:

• Vercel — hosting and running the Old Enough website and app.
• Neon — the PostgreSQL database where account, profile and activity data is stored.
• Cloudflare — private storage for media (message images and voice notes, and Home videos) through Cloudflare R2, and bot protection through Cloudflare Turnstile.
• Paystack — processing Old Enough+ payments.
• Email delivery provider — sending one-time verification codes: [To be confirmed: name of the email delivery provider]

We may also disclose information:

• to law enforcement, courts or regulators where the law requires or allows it, or where there is a serious risk to someone's safety (including suspected exploitation of a child);
• to establish, exercise or defend legal claims;
• to a buyer or successor if Old Enough's business is transferred, in which case this notice will continue to apply to your data: [To be confirmed: business-transfer disclosure approach]

We do not sell personal data. Selling or offering to sell another person's personal data is an offence under Act 843.

8. Processing outside Ghana

Our service providers operate internationally, so your data may be stored or processed in countries other than Ghana and other than the one you live in. We choose providers that apply recognised security practices. Where your data is processed: [To be confirmed: provider processing locations and transfer safeguards]

9. How we protect your data

• All connections to Old Enough are encrypted.
• Sign-in codes expire quickly and are not stored in readable form.
• Private media is kept in private storage and can only be opened by the people in the conversation.
• Moderation tools are limited to authorised administrators, and their actions are recorded.
• We limit repeated actions and use bot protection to reduce abuse.

No system is perfectly secure. If personal data is accessed by someone who is not authorised, we will notify the Data Protection Commission and the people affected where Act 843 requires it, as soon as reasonably practicable.

10. How long we keep data

We keep personal data only as long as we need it for the purposes above, unless the law requires or allows us to keep it longer.

11. Your rights

Under Act 843 you have the right to:

• Access — ask whether we hold personal data about you, get a description of it and of who it has been disclosed to, and get a copy of it in an understandable form (sections 32 and 35).
• Correction and deletion — ask us to correct or delete data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and to delete data we are no longer allowed to keep (section 33).
• Object — object to processing of your personal data, and ask us in writing to stop processing that causes or is likely to cause you unwarranted damage or distress (sections 20 and 39).
• Direct marketing — require us not to use your data for direct marketing (section 40). We do not currently do direct marketing.
• Automated decisions — ask that significant decisions about you are not based solely on automated processing (section 41).
• Complain — ask the Data Protection Commission to assess whether processing of your data complies with Act 843 (section 77), and seek compensation for damage caused by a breach of the Act (section 43).

If you live outside Ghana, the law of your country may give you further rights, which you can also ask us to act on.

12. How to make a privacy request

You can already view and change much of your data yourself: edit your profile, HookUp preferences and notification settings, delete your Stories, and manage blocks and mutes in Settings.

Download a copy of your data: in Settings, under Privacy & data, choose Export My Data. After you confirm a code we email to the address on your account, you receive a file (JSON) containing your account, profile, HookUp preferences, Stories, comments, relationships, the messages you sent, notifications, subscription and payment records, and reports you made. It does not include other people's private information, such as messages they sent you, likes or passes other people gave you, or who blocked, muted or reported you. Up to 3 exports can be made per day.

Delete your account: in Settings, under Privacy & data, choose Delete My Account and confirm a code we email to you. You are signed out immediately and the account can't be used again. Any Old Enough+ renewal is stopped. We then delete your profile (including your anonymous name, date of birth, gender and location), your preferences, verification request, Stories, comments, likes, reposts, follows, mutes, blocks, HookUp likes, passes and matches, message requests, notifications, saved videos and viewing history, and the text and media of messages you sent (the other person's messages stay with them, and a note that a message existed remains in their conversation). Your email address is replaced once billing has been stopped.

What is kept after deletion, and why: reports you made and reports about you, the copy of any reported message (until its 7-day limit), moderation and verification history, and subscription and payment records are kept for safety, fraud prevention, accounting and legal reasons, linked only to an internal account number — not to your email or profile. A Story or comment of yours that is part of a report still under review keeps its text, hidden from everyone, until moderators finish. Security records expire on their normal schedule. How long these records are kept: [To be confirmed: post-deletion retention periods]

Other privacy requests can be sent to itskaystudios@gmail.com.

To protect your account, we will ask you to confirm you control the email address on it before acting on a request, as Act 843 allows. We will not ask for your sign-in code by email or message.

13. Complaints

Please contact us first at itskaystudios@gmail.com so we can try to help. You can also complain to Ghana's Data Protection Commission (dataprotection.org.gh), or to the data-protection authority in the country where you live.

14. Children

Old Enough is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18 we close it. If you think a minor is using Old Enough, report the account with Underage concern.

15. Cookies

Old Enough uses a small number of cookies that are needed for it to work, and no advertising or analytics cookies. See the Cookie Notice.

16. Changes to this notice

We will update this notice when Old Enough or the law changes. The version and date at the top show the current version, and we will tell you in the app about significant changes.