Privacy Policy

Last updated: 27.10.2026

1. Controller

Elias Saleh, Schulze-Boysen-Straße 37, 10365 Berlin, kontakt@conversionsmax.de. For questions about data protection you can reach us at kontakt@conversionsmax.de.

2. What data we process

• Account data: email address and password (stored encrypted). If you sign in with Google or Apple, we receive your email address and, where applicable, your name from them.
• Profile data: the photos you upload, the bio and prompt texts of your dating profile, as well as your display name and avatar.
• Usage data: analyses/reports, ratings (votes) you cast, karma, credits and purchases.
• Payment data: payments are processed exclusively by our payment provider Stripe. We only receive purchase details (e.g. pack, amount, time), not full card or account details.
• Technical data: when you visit the website, our hosting provider processes technically necessary data such as IP address, time and requested page (server logs).

3. Purposes and legal bases

• Providing your account, the AI analysis, expert reviews and purchases to perform the user agreement (Art. 6(1)(b) GDPR).
• Participation in community voting based on your consent (Art. 6(1)(a) GDPR), which you give by sharing your photos and can withdraw at any time (see section 4).
• Audience and usage analytics as well as security and stability of the website based on our legitimate interest in a working and improving service (Art. 6(1)(f) GDPR).
• Compliance with statutory retention obligations, e.g. for purchase records (Art. 6(1)(c) GDPR).

4. Who sees your photos

• Community voting: only if you actively share your photos for voting are they shown to other signed-in users — without your name, email address or profile. You can stop sharing at any time in your profile; the photos are then no longer shown to anyone.
• Expert review: only if you request a personal review does the reviewer see your profile (photos, bio, prompts) in order to give you feedback.
• AI analysis: photos and texts are transmitted to our AI provider (see section 5).

5. Service providers and recipients

We use the following providers, who process data on our behalf:

• Supabase (Supabase Inc.) — database, sign-in and photo storage; servers located in Frankfurt am Main.
• Vercel (Vercel Inc., USA) — hosting and delivery of the website and apps, including server logs.
• Stripe (Stripe Payments Europe Ltd., Ireland) — payment processing.
• Anthropic (Anthropic Ireland, Limited; processing also in the USA) — AI analysis: to create your report, your photos (downscaled) as well as bio and prompts are transmitted to and processed by Anthropic. Under Anthropic's terms, data sent via the API is not used to train AI models by default.
• PostHog (PostHog Inc., EU cloud in Frankfurt) — audience and usage analytics without cookies and with truncated IP address. If you are signed in, usage events are linked pseudonymously via an internal user ID, not via your name or email address.
• Brevo (Sendinblue SAS, France) — sending system emails such as the confirmation of your email address or resetting your password. Brevo technically records whether an email was opened and whether a link in it was clicked (links run through a Brevo redirect). We only use this to make sure emails are delivered (Art. 6(1)(f) GDPR). If you don't load images in your email app, opens are not recorded.
• Google (Google Ireland Ltd.) and Apple (Apple Distribution International Ltd.) — only if you sign in with these services.

6. Transfers to third countries

Some providers are based in the USA or may process data there. Such transfers are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on EU standard contractual clauses (Art. 46 GDPR).

7. Retention

We store your data for as long as your account exists. You can delete photos and your account yourself at any time; the related data is then deleted unless statutory retention obligations (e.g. for purchase records) apply.

8. Cookies and local storage

We only use technically necessary cookies or local storage for sign-in (session), your language choice and display (light/dark). These are required for operation and do not require consent. There are no advertising or tracking cookies and no third-party advertising.

9. No automated decision-making

The AI analysis provides assessments and recommendations about your profile. It does not make decisions that produce legal effects concerning you (Art. 22 GDPR).

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw any consent at any time with effect for the future. Please contact kontakt@conversionsmax.de. You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information.

11. Minimum age

RateMyMatch is intended exclusively for people aged 18 and over.