Hotpot — AI & Matching-Model Transparency Notice

Last updated: 2026-10-26 · Effective date: 2026-10-26

Version: ai-notice-2026-10-20.6.

This notice explains, in plain language, how Hotpot uses artificial intelligence (AI) and how your own choices control it. It sits alongside the Privacy Policy. It should be read together with the Privacy Policy, the Terms of Service, and the Community & Safety Guidelines.

Who we are and who the data controller is: the full statement is in the Privacy Policy, section 1 (Who we are).

Contents

1. Purpose of this notice
2. Our principles for using AI
3. Where we use AI today
4. Which providers process your data, and what they receive
5. Automated decisions today, and your right to contest them
6. Matching-model training (planned — not live yet)
7. Profiling to choose who you browse
8. What we do not do with AI
9. Your choices and controls
10. How to contact us
11. Related documents

1. Purpose of this notice

Hotpot is a voice-first dating app: you hear people before you see them. Because voice is at the centre of the product, AI is too. Some of what AI touches is sensitive: what you tell us about who you are looking for can reveal your sexual orientation.

2. Our principles for using AI

• The two short descriptions that help choose who you browse are not shown to anyone, you included (section 7).
• How your voice, your transcripts and what you tell us about who you are seeking are treated as special-category data, the consent that covers them, how it is withdrawn and what withdrawal does: the full statement is in the Privacy Policy, section 5 (Voice and special-category data). The separate consent that gates matching-model training, what withdrawing it does, and what a withdrawal cannot undo: the full statement is in the Privacy Policy, section 7 (Matching-model training).

3. Where we use AI today

Why we use each kind of data and the lawful basis for each use, including which uses rest on your consent, which rest on the contract, and which cannot be switched off: the full statement is in the Privacy Policy, section 4 (How and why we use your data). How your voice, your transcripts and what you tell us about who you are seeking are treated as special-category data, the consent that covers them, how it is withdrawn and what withdrawal does: the full statement is in the Privacy Policy, section 5 (Voice and special-category data).

3.1 Turning your voice into text (transcription / speech-to-text)

When you record — during onboarding, when answering a prompt, or when you send a spoken "like" — we convert the audio to text so the app can work with it (for example, to understand your onboarding, generate prompts, or run safety checks).

Before any of that, one check on the recording itself. Every recording a stranger could hear, a sign-up recording, a prompt answer and the voice note sent with a like, is checked first for whether anything was recorded at all. The check measures level and nothing else: a recording with nothing on it, or too quiet to make out, is refused, and so is a file that cannot be read as a recording or one far longer than the screen it came from could have made. No words from a refused recording are read or passed to any check below. If the check itself cannot run, a prompt answer or a like voice note carries on, and the loudness check is tried again later; if it then finds nothing on the recording, or too little to make out, the recording is refused and you are asked to record again. A sign-up recording carries on while the check is retried behind it.

• How, and it differs by step and by phone: every recording you make for the app, a sign-up answer (on Android), a prompt answer or a voice note sent with a like, is turned into words while you are still speaking: the app sends your voice to our server as you record, our server passes it on to Speechmatics' live service, which sends the words back as it hears them. The words are read only once the loudness check above has passed. During onboarding, an iPhone does not take the live path: it works the words out on the phone itself, using Apple's on-device speech recognition; nothing is sent to Apple for that step, and where the phone produced no words the recording goes to Microsoft's model through Vercel's gateway. A recording the live path could not finish is sent through Vercel's gateway to Microsoft's speech-to-text model. If neither can be reached, a prompt answer or a like voice note waits, heard by no one, until it has been turned into text and checked, and a sign-up recording is not accepted, and the app tells you it did not send. Who each provider is and what it receives is in the Privacy Policy, section 8 (Who we share your data with). Where your data leaves the UK, the safeguards we rely on: the full statement is in the Privacy Policy, section 9 (International data transfers).

3.2 Understanding your onboarding

When you first set up Hotpot, you record short spoken answers (an introduction, who you are, who you are looking for, the ages you are hoping for, and what else matters to you). A large-language-model reads the transcripts of those answers and produces a first-draft understanding — for example, your gender and who you are seeking — plus short "reflection" cards that mirror back what you said.

• Data involved: onboarding transcripts, and the inferred signals drawn from them. If your onboarding contains sexually-explicit content, we hold only a flag that it did, which concerns your sex life and is sensitive (special-category data).

3.3 Personalised voice-prompt generation

To keep the conversation going, Hotpot generates spoken prompts tailored to what you have already shared, so you are asked about closer, more specific things rather than the same generic questions everyone gets.

3.4 Content-safety classification and crisis support

AI checks recordings for graphic sexual content, for insults and threats, and for phone numbers, email addresses, handles or any other way of reaching you off Hotpot, before an answer is shown publicly. The first two are Community & Safety Guidelines rules, and section 4.4 of those Guidelines sets out where the line on sexual content falls for an answer, a like's voice note, a recording you make while setting up and your photo. The third is ours, and it is there so you do not hand a direct line to yourself to strangers you have not matched with. A clear case of any of the three refuses an answer; a voice note sent with a like is refused only for the first two. The check can also be unsure whether a recording carries an insult or a threat, or a way of reaching you. A doubtful case is not refused: it waits for a person to listen (section 3.4.1), except that a doubtful way of reaching you in a voice note sent with a like is not held and is delivered. The check also listens for four things it never refuses, each of which waits for a person instead: a speaker who says they are under 18, an adult who says they want someone under 18, drug dealing, and asking for money.

• What it does: if the check refuses an answer we cannot take it: it goes on no profile, no other member ever hears it, we tell you plainly that this one cannot be shared, and you record another. This is the same whether the answer was going to be public or kept for your matches. Separately, a copy of every answer and every like voice note the check refuses is kept for our own team: the recording, the text the check read from it, and why it was refused. It reaches no member and holds nothing of yours back, and it is deleted twelve months after the refusal, or sooner where the Privacy Policy, section 10 (How long we keep your data) says so. Where no approved answer of yours stands for that prompt, the card that tells you stays on screen until you record another or close the app, and nothing else in the app, Matches, any open chat, settings, and block and report included, is reachable behind it. That card is a decision made automatically, and section 5 says how to ask a person to look at it. Where the check cannot run, your answer is not published unchecked: it waits, and it is shown publicly only once the check has run. While it waits, the card you are shown says that nobody else can hear it until the check finishes, that you can carry on, and that you will be told there when it is done. What happens to a recording that waits for a person, for a sign of self-harm or for any of the reasons above, and what that means for who can see you, is in section 3.4.1.
• What is checked for signs of struggling: the recordings you make when setting up, your answers to prompts, and the voice note you send with a like are each checked for signs that you may be struggling. When you report a member, or a member reports you, the person reviewing that report can hear the voice messages and like voice notes the two of you exchanged in the window before the report set out in the Privacy Policy, section 10 (How long we keep your data), and nothing else from that chat or from any other. Where the check faults the voice note you are sending with a like, that note is not sent and you are told so; how to put that decision to a person is in section 5. Where a refused note also suggests you may be at risk of harming yourself, or that you are under 18, or that you want someone under 18, its recording is kept for the person who reviews such recordings, that like waits for them, and the note is never delivered, whatever they decide. Where the check finds in your note one of the reasons above that waits for a person, the note is sent but the person you sent it to cannot hear it until someone on our team has listened.
• When the card is shown: where the check finds something, a calm card can offer ways to reach support. In the United Kingdom, the support the card offers is Samaritans, free on 116 123 at any time, and Shout, by texting SHOUT to 85258. Hotpot is not an emergency service: if you or someone else is in immediate danger, contact your local emergency services (999 in the UK), and what else to do in an emergency is as set out in the Community & Safety Guidelines on hotpot.dating, section 9 (In an emergency).
• How your voice, your transcripts and what you tell us about who you are seeking are treated as special-category data, the consent that covers them, how it is withdrawn and what withdrawal does: the full statement is in the Privacy Policy, section 5 (Voice and special-category data).

3.4.1 A recording that waits for a person

If the check hears something that suggests you may be at risk of harming yourself, or hears one of the reasons in section 3.4 that wait for a person (you saying you are under 18, you saying you want someone under 18, drug dealing, asking for money, or a doubtful insult, threat or way of reaching you), the recording that raised it waits for a named person on our team to listen to it before other members can hear it. The automatic check decides nothing on its own beyond making other members wait: clearing a recording, asking you for another one, or closing an account, is a person's decision. The wait is temporary: it lasts only until a person has listened. While it lasts it changes nothing about your account or about what you can do in the app, nothing you said is refused or removed by it, the people you have matched with keep their conversations with you, and a like somebody sends you, or a match that would form, waits rather than being lost. The wait ends when a person has listened to every recording of yours that is waiting and cleared them. Where the check could not run on a recording you made when setting up and a later attempt hears the sign, the same wait begins from that moment, exactly as if it had been heard at once.

• What waits, and what does not. Of the reasons that make a recording wait, a recording you make when setting up waits only for the sign of self-harm and for the two that name someone under 18; where one of those two is heard, the reflection card for that step is not shown to you. If it was one of your sign-up recordings or one of your public answers, you are not shown to members you have not matched with while it waits, and a like that someone sends you in the meantime waits with it: it is not on your Listening tab and your phone stays quiet, and it reaches you, with its line, the moment a person clears the recording. The same is true the other way round: a like you send to somebody who is waiting for a person, and a match that would form on it, can wait as well, and you are not told which. If it was the voice note you sent with a like, only that like waits, and nothing else about you changes unless the person who listens closes your account, which they can do for every reason except the sign of self-harm.
• Who is told. No other member is told that a recording of yours is waiting. Where one of your answers for a prompt, or the voice note you sent with a like, waits for one of the reasons in section 3.4 that wait for a person, you are told, without the reason, that it is waiting for a person and that nobody else can hear it until a person has listened. You are not told where the sign of self-harm is what first made you wait, where a note also carries that sign, where the recording is one you made while setting up, or where it is a refused recording kept for the reviewer. If you were already waiting because of one of your answers, for one of the other reasons, when the sign of self-harm was heard, the card that says your answer is waiting stays. The support card is not a judgement on your recording. A recording is never refused by the automatic check because it raised this signal or any other reason that waits for a person. A person who listens may decide the recording should not stand and ask you for another one; that answer is open on an answer you recorded for one of the prompts and on the voice note you sent with a like, never on a recording you made while setting up, and never where the recording waits because you said you are under 18 or that you want someone under 18. What you then see is the ordinary card any refused recording gets, with no reason on it and nothing to say a person was involved.
• What the person can do. Clear it, which lifts the hold and puts everything back as it was; ask you to record another one instead, which means the recording does not go on your profile or reach the person you sent it to and you are offered a fresh take; or close the account. Where the answer a person sends back was your only answer for that prompt, you meet the ordinary refused card, and it stays until you record a new one. Where it is the voice note you sent with a like, that note never reaches the person you sent it to, a match that would have formed on it does not form, and you later meet a card with no reason on it inviting you to record another.

3.5 Checking your profile photo

An AI checker looks at a profile photo before any other member can see it, and it can do one of three things: clear it, refuse it, or hold it for a person to look at. You are shown the outcome for the photo you just sent.

• What it does: it reports what is visible (a face, nudity, a weapon, gore, a possible hate symbol, illegal drugs, whether anyone in the frame may be under 18). A separate set of written rules turns that report into the outcome; the model does not decide the rules. On sexual content those rules refuse a photo where swimwear or underwear is the outermost garment on any part of the body, and anything more revealing, the line the Community & Safety Guidelines on hotpot.dating set out in section 4.4 (Sexual content, explicit audio, and nudity). If it cannot answer at all, the photo is not refused: it is kept where nobody can see it and the check is tried again. Where a later attempt does answer, the photo is cleared, refused or held for a person exactly as it would have been the first time; a refusal is shown to you, and a photo the later attempt clears simply goes live. Where no attempt ever answers, the photo waits for a person, and nothing about it is decided until one has looked.
• While it waits: if your first photo is still waiting, you are not in anyone's feed until it clears; if you are replacing a photo that already cleared, you stay, on the cleared one. Either way you can browse, listen and send likes the whole time, and nothing you sent is lost.
• If your photo is refused for a hate symbol, a weapon, gore, someone who may be under 18, nudity in a picture shown in your photo, or writing in it, you can ask for a person to look. That is the route by which an ordinary photograph wrongly refused gets put right, and we would rather you used it than assumed the answer was final. Take that offer and the photo goes to a person instead of the refusal standing. Where the offer is not there, the refusal stands and the photo is deleted, whether our check answered straight away or later. If your first photo is refused, you are not in anyone's feed until another photo clears. Whatever the reason for a refusal, you can still ask us to look at the decision again; section 5 (Automated decisions today, and your right to contest them) says how.
• Where a person in an ordinary photo may be under 18, the photo is refused. Your account is not put on hold, it stays open, and you can send a different photo; your own age was checked at the last step of setting up (Terms of Service, section 3.2).
• The record kept of each photo decision, and the log kept when a person opens your photo: the full statement is in the Privacy Policy, section 6.1 (Your profile photo: the automatic check and human review).

3.6 Choosing who you browse

A large-language-model writes two short descriptions from what you said while setting up, and a second model turns them into numbers that help choose who you browse each day. How it works: section 7 (Profiling to choose who you browse).

4. Which providers process your data, and what they receive

Every company that processes your data for us, what each receives, how they are bound, and when we disclose data to the authorities or to a successor: the full statement is in the Privacy Policy, section 8 (Who we share your data with).

International transfers

Where your data leaves the UK, the safeguards we rely on: the full statement is in the Privacy Policy, section 9 (International data transfers).

5. Automated decisions today, and your right to contest them

• Who you browse is chosen automatically. A filter on gender and age decides who can be among the people you browse, and each day's people are chosen from them partly at random and partly by the profiling set out in section 7. It closes or penalises no account, and it is not one of the decisions you can contest below.
• Content-safety classification can refuse a public answer. This is automated; what it screens and what it can refuse, including the voice note you send with a like, are in section 3.4. What waits when a recording raises the self-harm signal or any other reason that waits for a person, including who can see you while it does, is in section 3.4.1. If a public answer of yours is refused, or a voice note you sent with a like is refused, and you disagree, you can ask us to review it, as set out below.
• A wait for a person. Its start is automatic, whatever raised it, and nothing else about it is: it holds what you sent, and who can see you, until a person has listened; it never refuses or removes anything, and a person ends it. Closing an account is never automatic: only the person who listens can decide it (section 3.4.1).
• The photo check can clear or refuse your profile photo, or hold it for a person. Clearing and refusing are automated, by written rules over what the checker reports; what it looks for, who sees a photo while it waits, and when you can ask for a person to look are in section 3.5. Whatever the reason for a refusal, you can ask us to look at the decision again, as set out below.
• The age check can keep Hotpot closed for your account. At the last step of setting up, VerifyMy decides by software, for us as our processor, whether you are 18 or over: from your email address, or on its page from an estimate of your age from your face or from an identity document matched to your face. An estimate can be wrong, and an adult can be judged under 18. Our rule on the result is automatic too: if the check does not pass, Hotpot does not open for that account, and an account left there is deleted after three months. If you disagree, you can, while the check is still open on VerifyMy's page, choose the identity-document check instead of the estimate; contact VerifyMy's support at support@verifymy.io and use the rights in section 10 of VerifyMy's age assurance privacy policy (verifymy.io/age-assurance/age-assurance-privacy-policy); or write to us as set out below, and a person at Hotpot handles it and passes it to VerifyMy's support. We cannot change VerifyMy's result. Who decides what, and what is read, kept and deleted, are in the Privacy Policy, sections 3, 5 and 10.

Your right to contest. Your data-protection rights, how to exercise them, and how to complain to us or to the Information Commissioner’s Office: the full statement is in the Privacy Policy, section 11 (Your rights), under "Your other rights". To do that, email contact@hotpot.dating and tell us what decision you want reviewed, or ask us to look at a recording of yours that may be waiting for a person. We will route it to a person. For the age check, a person at Hotpot passes your request to VerifyMy's support; VerifyMy's own route is in its entry above.

6. Matching-model training (planned — not live yet)

This is not live yet.

What data would be used. Training could draw on your voice recordings, their transcripts, your stated preferences (such as who you are seeking and your preferred partner age range), and your behaviour on the app (for example, what you listened to and for how long, and who you liked).

Why. To improve the quality of matches — the core promise of a dating app — by learning what tends to lead to mutual, lasting connections rather than one-sided interest.

It needs your separate, explicit, opt-in permission. The separate consent that gates matching-model training, what withdrawing it does, and what a withdrawal cannot undo: the full statement is in the Privacy Policy, section 7 (Matching-model training).

Every company that processes your data for us, what each receives, how they are bound, and when we disclose data to the authorities or to a successor: the full statement is in the Privacy Policy, section 8 (Who we share your data with).

7. Profiling to choose who you browse

After the filter on gender and age (section 5), the people you browse each day are chosen in part by profiling. A large-language-model reads what you said in your sign-up recordings, never the recordings themselves, and writes two short descriptions: one of you, and one of who you hope to meet. A second model turns each description into numbers. People whose descriptions fit yours well both ways, what they are like against who you hope to meet and what you are like against who they hope to meet, are more likely to be among the people you browse, and you among theirs; some of each day's people are chosen at random.

No member sees the descriptions, and they are used for nothing else. They are written again when you record again, and deleted with your account. Why we do this and its lawful basis: the Privacy Policy, section 4. Which companies run the two models and what they receive: the Privacy Policy, sections 8 and 9. How long the descriptions are kept: the Privacy Policy, section 10.

8. What we do not do with AI

• Every company that processes your data for us, what each receives, how they are bound, and when we disclose data to the authorities or to a successor: the full statement is in the Privacy Policy, section 8 (Who we share your data with).
• What data we collect, including the recordings, the transcripts, the device token, and the record kept of each consent: the full statement is in the Privacy Policy, section 3 (What data we collect).
• How Hotpot works: the recordings, the spoken like, the match, the six-match cap and when your photo is shown: the full statement is in the Terms of Service, section 5 (How Hotpot works).

9. Your choices and controls

Your data-protection rights, how to exercise them, and how to complain to us or to the Information Commissioner’s Office: the full statement is in the Privacy Policy, section 11 (Your rights), under "Your other rights".

• Withdrawing your consent to core voice processing. How your voice, your transcripts and what you tell us about who you are seeking are treated as special-category data, the consent that covers them, how it is withdrawn and what withdrawal does: the full statement is in the Privacy Policy, section 5 (Voice and special-category data).
• Consent to matching-model training. The separate consent that gates matching-model training, what withdrawing it does, and what a withdrawal cannot undo: the full statement is in the Privacy Policy, section 7 (Matching-model training).
• How long each kind of data is kept, what account deletion removes and what survives it: the full statement is in the Privacy Policy, section 10 (How long we keep your data). The record kept of each photo decision, and the log kept when a person opens your photo: the full statement is in the Privacy Policy, section 6.1 (Your profile photo: the automatic check and human review).
• Objecting to legitimate-interests processing. Your right to object and the processing it reaches: the full statement is in the Privacy Policy, section 11 (Your rights), under "Your right to object".

10. How to contact us

How to contact us: the full statement is in the Privacy Policy, section 16 (How to contact us). Who we are and who the data controller is: the full statement is in the Privacy Policy, section 1 (Who we are). Your data-protection rights, how to exercise them, and how to complain to us or to the Information Commissioner’s Office: the full statement is in the Privacy Policy, section 11 (Your rights), under "Your other rights".

The law that governs these documents and where disputes are heard: the full statement is in the Terms of Service, section 15 (Governing law and jurisdiction).

11. Related documents

This notice is part of a set. Read it together with:

• the Privacy Policy — the full account of what personal data we process, why, the lawful bases, the complete sub-processor table, international-transfer mechanisms, and retention. The Privacy Policy points to this AI & Matching-Model Transparency Notice for the detail on AI and matching. How we use storage-and-access technologies (cookies, SDKs) under PECR: the full statement is in the Privacy Policy, section 14 (Cookies and similar technologies).
• the Terms of Service — the agreement for using Hotpot. The Terms incorporate the Community & Safety Guidelines.
• the Community & Safety Guidelines — what is and is not allowed, and how the safety features described in this notice’s section 3.4 apply.

How long each kind of data is kept, what account deletion removes and what survives it: the full statement is in the Privacy Policy, section 10 (How long we keep your data). Account deletion is also self-service in the app.