Hotpot Privacy Policy

Last updated: 2026-10-30

Version: privacy-2026-10-20.22.

At a glance

• What we collect: your phone number, date of birth, email address, name, gender and who you are interested in to open an account and finish setting up, then what you choose to record, the transcripts made from it, your photo, and the safety and consent records the app keeps. The last step of setting up is an age check run for us by VerifyMy, which can read your face. The full list is section 3.
• What is on your phone: the sign-in token and the other items listed in section 14.4. Nothing for advertising or analytics. Section 14.4 and 14.7.
• How long we keep it: while your account is open. Deleting your account closes it at once and deletes everything in it fourteen days later, and you can ask us to recover it inside those fourteen days; three months of never finishing setting up deletes it automatically, a year of not using Hotpot makes it eligible for deletion by our team, and a short list of records survives deletion. Section 10.
• Your rights: to object, to see, correct or delete your data, and to withdraw a consent, from the Privacy screen in the app or by writing to contact@hotpot.dating. Section 11.
• Who to contact: contact@hotpot.dating, or the ICO if you are unhappy. Section 16.

Table of contents

1. Who we are
2. What this policy covers
3. What data we collect
4. How and why we use your data
5. Voice and special-category data
6. AI and automated processing
   • 6.1 Your profile photo: the automatic check and human review
   • 6.2 A recording that waits for a person
   • 6.3 If someone in a photo may be under 18
   • 6.4 Reporting child sexual abuse material
7. Matching-model training
8. Who we share your data with
9. International data transfers
10. How long we keep your data
11. Your rights
12. Children
13. How we keep your data secure
14. Cookies and similar technologies

• 14.1 What this section covers
• 14.2 What storage and access technologies are
• 14.3 The rule we follow: PECR first, then the UK GDPR
• 14.4 Strictly necessary technologies
• 14.5 First-party analytics
• 14.6 Non-essential and third-party technologies
• 14.7 The Hotpot app today
• 14.8 How to control or withdraw

1. Changes to this policy
2. How to contact us
3. Effective date

1. Who we are

Hotpot, at hotpot.dating, is operated by Hotpot Technologies Ltd. How Hotpot works is described in the Terms of Service, section 5 (How Hotpot works).

The controller of your personal data is Hotpot Technologies Ltd ("Hotpot", "we", "us", "our"), a company incorporated in England & Wales.

2. What this policy covers

This policy sits alongside three other Hotpot documents, which it refers to where relevant:

• the Terms of Service on hotpot.dating, which govern your use of the app (and which incorporate the Community & Safety Guidelines);
• the Community & Safety Guidelines on hotpot.dating, which explain what is and is not allowed and how safety tools such as reporting and blocking work; and
• the AI & Matching-Model Transparency Notice on hotpot.dating, which explains in plain language how our AI features and matching work, including how the people you browse each day are chosen. Where this policy summarises AI and matching, that notice gives the detail.

What is stored on your device, in the app and on the hotpot.dating website, and how cookies and similar technologies are governed and controlled, is section 14 of this policy.

3. What data we collect

The table below lists the categories of personal data we collect and use. Some of it is special category data — a legally sensitive class that includes data revealing racial or ethnic origin, data concerning health, and data concerning a person's sex life or sexual orientation.

To open an account and finish setting up you have to give us the things below. Your phone number, which signs you in. Your date of birth, which checks you are 18 or over. Your email address, verified by a code sent to it, which is kept on your account and, if you joined the waiting list on our website under it, is what marks that row as joined once your sign-up passes the London check (section 10). Your name, which the members who hear you see. Your gender, one of three choices, and who you are interested in, one or more of three, without which we cannot introduce anyone to anyone; section 5 says how those two sit under the consent you give before your first recording. If any of them is withheld, setting up stops at that step and Hotpot goes no further. Setting up also needs your phone to be in London when its location is checked, after your email address is verified; "Your location at sign-up" below says what is read, what is kept and what is deleted. When you sign up, our app's server also asks the website's server whether your verified email address is on the waiting list. While sign-up is open only to people on that list, an address that is not on it ends sign-up at that step, the same way as a London check you did not pass. To finish setting up you also record a short spoken hello, answer the age range you are looking for, add a profile photo and pass the age check described below; everything else in the table above you choose to give: you decide what to record and what to leave out, and section 5 says what happens if you withdraw the consent your recordings rest on.

What we do not collect. We do not track where you are. The one place the app reads your phone's location is the London check at sign-up, described under "Your location at sign-up" below, and nothing else in the app reads it today. A photo file from your phone can carry the place, the device and the time it was taken. The app renders your photo afresh from your crop before it uploads it, so the file it sends carries none of those details from your camera. As a guard for a file that does carry them, every photo is rewritten to remove the metadata blocks where such details are usually written before it is put on your profile; we do not read or use those details, though the check reads the file as uploaded. The smaller copies our server makes of your profile photo are deleted whenever the photo they were made from is deleted. What the app does and does not store on your device, including that it sets no advertising identifier, is in section 14.

Your location at sign-up (the London check). Hotpot is open in London for now, so sign-up is for people who are in Greater London when they sign up. After your email address is verified and before you give your name, the app asks you to allow it to read your phone's location; your tap opens your phone's own permission dialog, which is where you decide. If you allow it, the app asks your phone for its position and sends our server the reading. Our server decides whether the reading is in London; it is not usable when your phone gave no reading or you refused. A reading less precise than five kilometres is judged as if it were accurate to five kilometres; if an approximate reading falls outside London, the app asks once for a precise one. Our server keeps a record of every attempt, with your account: the reading, its radius, whether it was precise or approximate, the verdict, the kind of phone and the time. If you are in London, sign-up carries on and the record stays with your account, deleted with it. If you are not, or the reading could not be used, a card tells you and sign-up ends there: you are signed out, the unfinished account is deleted after three months as section 10 says, and the location reading is deleted sooner, when you answer "Not for me" on the card that follows, or within two days if you leave without answering. That card offers something else: if you tap "Hear from us", your email address, the reading you had just given if there was a usable one, and the version of the sentence you agreed to are kept, outside any account, for our newsletter, to tell you when Hotpot opens where you are and to plan where it opens next; they stay until you unsubscribe or write to us. When a sign-up passes the London check, the app's server also tells the website's server that the address became a member, as a keyed code of the address rather than the address itself; it does this for everyone who passes, whether or not you were ever on the list.

The waiting list on our website is separate from your account. If you gave your email address to the waiting list on hotpot.dating before signing up, that address and what you gave with it sit in a row of their own, outside your account. Section 10 says what that row holds, what happens to it when you delete your account, and how to come off the list.

The age check at the last step of setting up. Verifymy Limited runs the age check for us, as our processor (section 8). Our server first sends VerifyMy your email address and a reference for the check, and VerifyMy tries to confirm from that address that you are 18 or over. If that is not enough, its page opens in the app and you choose how to check there: an estimate of your age from your face, or an identity document matched to your face. Every check that can pass you there reads your face. VerifyMy tells us only whether you passed, which kind of check passed you, and when. If the check does not pass, Hotpot does not open for that account: you can sign out or delete it, and an account left there is deleted after three months, as section 10 says. What VerifyMy keeps, and for how long, is in section 10.

Who decides, and what you can do if you disagree. VerifyMy decides, by software, whether the check shows you are 18 or over. It does this for us, as our processor, so in law the decision is made on our behalf. For the estimate from your face, VerifyMy's software judges your age from the images; an estimate can be wrong, and an adult can be judged under 18. For an identity document, it reads the document and matches the face on it to yours. The rule that Hotpot does not open for an account whose check did not pass is ours. While the check is still open on VerifyMy's page, you can choose the identity-document check instead of the estimate. If you disagree with VerifyMy's result, you can contact VerifyMy's support by email at support@verifymy.io, or by post at VERIFYMY LIMITED, Unit 213 The Frames, 1 Phipp Street, London, England, EC2A 4PS. Section 10 of VerifyMy's age assurance privacy policy, at verifymy.io/age-assurance/age-assurance-privacy-policy, sets out your rights about its automated decisions, including "the right not to be subject to automated decision processing which produces an adverse legal effect or significantly affects you", and how to use those rights. We cannot change VerifyMy's result. If you disagree with it, write to us at contact@hotpot.dating: a person at Hotpot handles your request and passes it to VerifyMy's support, as VerifyMy's policy asks.

Device notification tokens. Where your phone's permission to show notifications from Hotpot stands, the app asks your phone's operating system for a token identifying your device when you sign in and each time the app opens while you are signed in, sends it to us, and we hold it against your account so a notification can reach that device. Your device token is sent to us when you allow notifications, when you turn them on in settings, and whenever your phone issues a new one. Google's notification software inside the app registers your handset with Google when the app starts, whether or not you allow notifications, as section 14.7 says. It is used only to deliver Hotpot's own notifications, never for advertising and never to track you across other apps. We delete it when you sign out on that device, when the notification service tells us Hotpot is no longer on that device, and when your account is deleted. To reach your phone, your device token has to be given to the company that runs the notification service on it, Apple for an iPhone and Google, through its Firebase Cloud Messaging service, for an Android phone, together with the words of the notification, which kind of notification it is, the place in the app a tap on it opens (for a voice message, that conversation, named by the sender's account identifier), and a short name for the line, which lets your phone take the line off its notification list once you have seen in the app what it said and lets a newer line of the same kind replace an older one. One line carries no words at all: when you replace your profile photo, each of your matches' registered phones is sent a silent line, with no sound and nothing shown, carrying only your account identifier, which that match's list already names, and the kind of line, so that the app drops your old photo from that phone; it goes only to the people who are your matches at that moment and only under their Activity switch. We also write down each notification we hand over, the silent lines included: which notification, which of your devices, which service, and what it answered. That record holds the same device token, it is kept whether or not that device is still registered, and it is deleted after thirty days. It exists so we can tell whether a notification actually reached your phone; it is not held on your consent, and we never keep it longer. Section 14.4 says what the app does with these lines on your phone.

Signing in with your phone number goes through our server. When you sign in with your phone number, our server passes your request for a text and the code you type to Auth0, our sign-in provider (section 8), and hands the app the tokens that keep you signed in.

Emails from us. We email you for two things. The first is the sign-in code that checks your email address when you sign up. The second is a research invitation now and then, asking whether you would talk to us about Hotpot: it is plain, it promotes nothing, and every one has a "no more of these" line that stops them. We send you at most one in any 90 days, with no reminder, and we have not sent any yet. Nothing else comes to you by email unless you ask for it: the row for occasional emails about the app, which you can turn off under Privacy in your settings, or the waiting list and "Hear from us" (section 10); and our replies when you write to us. Every email from us names Hotpot and gives an address you can reply to.

The device check at sign-up and sign-in keeps scripts and copied versions of the app from opening accounts or asking for codes.

None of what the device check reads is linked to your account, your phone number or your name. If a phone that had passed before fails the check, our server also notes its key identifier or scrambled number in a count it keeps for ten minutes, as set today, which is how it notices a fault of ours failing genuine phones.

We collect most of this data directly from you (UK GDPR Article 13). Transcripts of your spoken answers to prompts, of the voice note you send with a like, and the AI-inferred signals drawn from any of your recordings are created by our systems from what you gave us, rather than collected directly; the law's transparency rules still apply (UK GDPR Article 14), and this policy is how we meet them.

Some of what we hold about you comes from other members. If another member reports you, we receive the reason they chose, a short note they wrote about you in their own words, and which screen they reported you from. The report also files a copy of what passed between the two of you in the 72 hours before it, or the latest six messages between you, whichever holds more: the voice messages each of you sent the other in your chat, and the voice note each of you sent the other with a like. Both sides are in it, so a member who reports someone files their own side of that exchange too, and nothing either of you exchanged with anyone else is in it. It is kept for 30 days from the report (section 10). If another member blocks you, we hold a record of that block and we do not tell you about it. Where someone gives us credible information about harm you caused away from Hotpot, that information about you reaches us from them and not from you, and we may act on it. How reporting and blocking work is in the Community & Safety Guidelines on hotpot.dating, section 6.1 (Blocking) and section 6.2 (Reporting), and the conduct rule is in section 4 (What is not allowed).

4. How and why we use your data

Two layers for the core service. The heart of Hotpot — capturing, storing and transcribing your voice; the runtime AI that writes your reflection / mirror cards and generates your prompts; matching and browse; likes; and voice chat — rests on two things at once:

• an Article 6 basis of contract (UK GDPR Article 6(1)(b)): this processing is necessary to provide the voice-first service you signed up for; and
• an Article 9 condition of explicit consent (UK GDPR Article 9(2)(a)): a separate explicit-consent step sits on top, a clear, separate in-app opt-in, distinct from accepting the Terms. Section 5 explains it.

The other lawful bases we rely on are:

• The London check (section 3). Reading your phone's location is done by the app on your phone with your permission, and your tap on your phone's own dialog is where you give it. You can withdraw this permission at any time in your phone's settings for Hotpot. Judging the reading on our server and keeping the record of the attempt rest on our legitimate interests (UK GDPR Article 6(1)(f)) in opening Hotpot in one city first and in being able to show that each sign-up was checked. Checking your verified email address against the waiting list when you sign up, refusing sign-up while it is open only to the list, and telling our team when an address that is not on the list signs up, rest on the same legitimate interests, in opening Hotpot first to the people who joined the list and in knowing the same day if anyone else has signed up. Keeping your email address and the reading for our newsletter when you tap "Hear from us" rests on your consent (UK GDPR Article 6(1)(a), with PECR regulation 22 for the emails), and your tap is where you give it; you withdraw it by unsubscribing or writing to us (section 10).

• Consent (UK GDPR Article 6(1)(a)) — used only for things that are not part of the core service and that you can refuse without losing it: matching-model training (see section 7), marketing, and weekly update notifications (at most one notification a week, telling you something is waiting for you to hear; section 3 explains the device token this needs). Matching-model training and marketing sit under Privacy in your account settings; weekly updates are a row of their own among the optional ones on the screen you see before your first recording, off unless you turn it on, there (Accept all on that screen turns it on with the other optional rows) or later under Notifications, which is also where you turn it off. Where such an optional use also involves special category data, we rely on your explicit consent (UK GDPR Article 9(2)(a)). You can withdraw consent at any time (UK GDPR Article 7(3)); see section 11.

• Legal obligation (UK GDPR Article 6(1)(c)) — using your data because the law requires it, for example to respond to a lawful request from an authority.

• Vital interests (UK GDPR Article 6(1)(d)) — using your data to protect someone's life, which we may rely on for the crisis / self-harm signal where a life is at risk.

• Legitimate interests (UK GDPR Article 6(1)(f)). Where a legitimate-interests purpose (such as safety) touches special category data, we pair it with an Article 9(2) condition — for us, Article 9(2)(g) with a condition in Schedule 1 to the Data Protection Act 2018.

The table below maps each purpose to its lawful basis. Where a purpose involves special category data, the Article 9 condition is shown.

Uses we have approved and will introduce

The following use is planned but not built yet. We describe it now so you know what is coming; we will not start it without the lawful basis shown.

Refusing an optional opt-in keeps your full core service. Matching-model training, marketing and weekly update notifications are separate, refusable choices — never bundled into the Terms, into the core explicit consent, or into any content licence. If you refuse them, you keep the full Hotpot service.

5. Voice and special-category data

What your voice can reveal. We treat your recordings and their transcripts as special category data.

Who you are seeking, and sexual orientation. When you tell us who you hope to meet, that answer can reveal your sexual orientation, which is special category data. We use it to match you — a core part of the service — and we rely on your explicit consent to do so. We also count members by gender and who they are interested in, without asking for this consent, to check that the app treats people of every orientation equally (section 4); you can tell us not to count you (section 11).

You can withdraw it from the Privacy screen in the app, which you reach from your account settings once your account is set up. While you are still setting up, the app does not carry a link to that screen. Two things cover that stretch. You can write to us at contact@hotpot.dating at any time, including during setup, and we act on it the same way. The same route is yours if your account has been closed, because the app no longer opens for you. And if you stop part-way through setting up and do not come back, we delete the account and every recording you made automatically after three months. Section 10 sets that out. Withdrawing from that screen deletes your account and your recordings at once, and cannot be undone. Section 10 (Deleting your account) sets out both doors. Withdrawing does not make our earlier use of your data unlawful. Withdrawing this consent ends our ability to provide the core service: we will stop processing your voice data and delete it. See section 11 for how.

Setting up asks you two things that cannot be left out: your gender, one of three choices, and who you are interested in, one or more of three. We cannot introduce anyone to anyone without them. Beyond those two, you choose what to record and what to leave out. You also control, per answer, whether it is shared with everyone or only with the people you match with. Today that choice is offered for one category of answer, the Reflective answers, which are heard only by your matches unless you change it; answers in every other category are heard by any member, because the feed is built from them.

If our safety systems detect that you may need support, we store a content-free flag saying so; section 6.2 sets out what follows.

Your face, at the age check. If your email address does not confirm your age, the check on VerifyMy's page reads your face, and VerifyMy makes a face map from the images (section 3). A face map is biometric data, and we treat it as special category data. We rely on your explicit consent (UK GDPR Article 9(2)(a)), which you give on Hotpot's age-check screen, in the statement above its Continue button, before the check starts; the link beneath that statement opens this section. You can withdraw that consent at any time, and withdrawing does not make what was done before it unlawful: before the check finishes, you withdraw by closing VerifyMy's page; once it has finished, VerifyMy deletes the images and the face map within 24 hours, apart from what it keeps to prevent fraud (section 10). VerifyMy tells us only whether you passed, which kind of check passed you, and when. Every check that can pass you on VerifyMy's page reads your face. If you would rather not have your face read, you can stop there: Hotpot then does not open for the account, and you can sign out or delete it (section 3).

6. AI and automated processing

This section is a summary; the AI & Matching-Model Transparency Notice explains our AI and matching in full, including what each model does, what it receives, and its limits.

• Transcription. Your recordings are transcribed so they can be understood, used to shape your prompts and safety-checked. Every recording you make for the app, a sign-up answer, a profile answer or a voice note sent with a like, is turned into words while you are still speaking: our server passes it on to Speechmatics' live service (section 8), which sends the words back. A voice message in a chat is never turned into text, and a sign-up recording made on an iPhone does not take the live path: the phone itself works the words out with Apple's speech recognition, and where it produced no words the recording goes to Microsoft's model through Vercel's gateway. Where and how is in the AI & Matching-Model Transparency Notice, section 3.1 (Turning your voice into text).
• Onboarding understanding. A model reads your onboarding transcript and drafts what it understood about you; the detail is in the AI & Matching-Model Transparency Notice, section 3.2 (Understanding your onboarding).
• A loudness check, first. Before any of the checks below, every sign-up recording, every answer and every like voice note is checked for whether anything was recorded at all: a recording with nothing on it, or too quiet to make out, or one that cannot be read as a recording or is far longer than its screen could have made, is refused on the spot and you are asked to record again. If that check itself cannot run, an answer or a like voice note carries on, and the loudness check is tried again later; if it then finds nothing on the recording, or too little to make out, the recording is refused and you are asked to record again. A like note that has already made a match by then is left as it is. The detail is in the AI & Matching-Model Transparency Notice, section 3.1 (Turning your voice into text).
• Content-safety classification. An automatic content-safety check hears every public answer and every like voice note before another member can; a public answer or like voice note the check cannot classify waits, and so does a recording that raises one of the reasons in section 6.2. None of these is refused for that reason, and the check closes or suspends no account. An answer the check finds clearly carries sexual content, an insult or threat, or a way of reaching you is refused and you are told it cannot be shared; it goes on no profile and no other member ever hears it. A like voice note the check refuses is not sent, and you are told so. A like voice note held for a person is sent but waits until a person has listened. We keep a copy of every answer and every like voice note the check refuses, for our own team. Only a small, named group on our team can listen to it. The copy is kept for 12 months from the refusal and then deleted, and it goes sooner if your account is deleted (section 10). If the check cannot run, your answer is not published unchecked; it waits until the check has run. Some decisions about whether other members can hear an answer, and the card that stays until you record again where a refused answer was your only one for that prompt, are made automatically, and you can ask us to look at one again by emailing contact@hotpot.dating. How the check works, what it can withhold, what a wait means for who can see you, and how to contest an outcome are in the AI & Matching-Model Transparency Notice, section 3.4 (Content-safety classification and crisis support) and section 5 (Automated decisions today, and your right to contest them).
• Matching. Who you see is decided automatically. A filter on gender and age decides who can be among the people you browse; each day's people are then chosen partly at random and partly by how well two short descriptions written from your sign-up recordings, of you and of who you hope to meet, fit those of the people the filter admits, in both directions. This shapes who you can meet. The AI & Matching-Model Transparency Notice, section 5 (Automated decisions today, and your right to contest them), lists the automated decisions in use and how to contest one.

Automated decisions. What the law gives you where a significant decision about you is made solely by automated means is listed in section 11, under "Rights around automated decisions". The wait for a person (section 6.2), after the self-harm signal or any other reason that holds a recording for a person, begins automatically: it refuses and removes nothing, leaves your account and your existing matches as they are, holds what you sent only until a person has listened, and is ended by that person. Where a sign-up recording or a public answer of yours waits, likes sent to you while it lasts wait until it ends. You can write to us at contact@hotpot.dating at any time to ask whether anything of yours is waiting for a person, to say what you want said about it, and to have it looked at; a person takes it from there. What waits, and what the wait means for who can see you, is described in full in the AI & Matching-Model Transparency Notice, section 3.4.1 (A recording that waits for a person). The age check at the last step of setting up is one such decision; who makes it and what you can do if you disagree are in section 3.

Where the content-safety tool's refusal holds the app until you record again, we treat that as an automated decision you can put to a person (section 5 of the notice).

How the people you browse are chosen. Choosing who you browse from descriptions written from what you said is profiling. A large-language-model writes the two descriptions from the words of your sign-up recordings, never from the recordings themselves, and a second model turns each into numbers. No member sees the descriptions, and they are used only to choose who you browse and whose browse you appear in. How it works is in the AI & Matching-Model Transparency Notice, section 7 (Profiling to choose who you browse); which companies run the two models is in section 8 of this policy.

6.1 Your profile photo: the automatic check and human review

Every profile photo is checked automatically before anyone sees it, and a person looks at any photo the check decides to hold, at any photo no attempt at the check can decide, and at any photo you ask to have looked at. The check can clear a photo, refuse it, or hold it for a person to look at; until your first photo clears that check you do not appear in anyone's feed; and you are told the outcome of a decision about your photo, except where that decision closes your account or belongs to a report we make to the authorities, when nothing is sent to you, where a check that could not answer at first clears the photo later, which simply goes live, and where you have already replaced or taken down the photo being decided, which leaves your profile, your card and your phone as they were. How the check works, what each outcome means, who sees a photo while it waits, and what follows when a photo may show someone under 18 are in the AI & Matching-Model Transparency Notice, section 3.5 (Checking your profile photo). If your photo is refused for one of the reasons that notice names, you can ask for a person to look at it, the photo then waits for them rather than being refused outright, and asking is how a photo refused in error is put right. Whatever the reason for a refusal, you can also ask us to look at the decision again by emailing contact@hotpot.dating.

A record of the decision holds what was decided, the reason family (a short label such as "nudity" or "weapon"), who decided it, when, and a short one-way code computed from the picture. The code cannot be turned back into an image; it exists so we can tell whether the same photo has been sent again. It also holds what the automatic check read in the photo, as a set of short answers.

If a person opens your photo, that is logged.

6.2 A recording that waits for a person

Some of what you record, a sign-up recording, a spoken answer and the voice note you send with a like, is checked automatically for signs that you may be at risk of harming yourself, and for you saying you are under 18 or that you want someone under 18. A spoken answer and a like voice note are also checked for offering or asking for illegal drugs and for asking for money, and the check can be unsure whether one carries an insult or a threat or, on an answer, a way of reaching you. If the check hears any of these, the recording waits for a named member of our team to listen to it before other members can hear it; the support you may be offered is in the AI & Matching-Model Transparency Notice, section 3.4 (Content-safety classification and crisis support).

What waits, what the wait means for who can see you, and what the reviewer may do are in the AI & Matching-Model Transparency Notice, section 3.4.1 (A recording that waits for a person). If the person who listens closes the account, the only thing written is a content-free internal record that the decision was taken: no report package, and none of the keeping that section 6.4 describes. Your next sign-in shows the same closed-account notice as an account closed from the photo review, no reason is given, and nothing about the recording is said to you. No other member is told that a recording of yours is waiting for a person to listen. Where a spoken answer or a like voice note waits for a reason other than signs that you may be at risk of harming yourself, you are told that it is waiting for a person, without the reason; you are not told where those signs are what first made you wait, where a like voice note also carries them, where it is a sign-up recording, or where it is a refused recording kept for the reviewer.

The check and the wait keep the app safe for the people on the other side of a recording. They run on our legitimate interests (UK GDPR Article 6(1)(f)), or on vital interests (Article 6(1)(d)) where a life may be at risk, with the safeguarding condition in paragraph 18 of Schedule 1 to the Data Protection Act 2018.

What we keep afterwards. What is kept afterwards, and for how long, is in section 10. Where a person asks you for another take, what happens to the recording they heard is in section 10 (the retention table).

6.3 If someone in a photo may be under 18

What happens when a reviewer thinks the person in an ordinary photo may be under 18 is in the AI & Matching-Model Transparency Notice, section 3.5 (Checking your profile photo).

This is separate from the 18+ rule for using Hotpot at all, which is in section 12.

6.4 Reporting child sexual abuse material

Where a reviewer believes an image may be an indecent image of a person under 18, the account is closed, and it stays closed unless you ask another person to check the decision to close it (section 11) and that person finds the decision to close it was a mistake; in that case the account is reopened, or, where it has already been deleted, the block on your number is lifted so you can sign up afresh. What follows for an account when a photo is reported as suspected child sexual abuse material is in the Community & Safety Guidelines on hotpot.dating, section 4.5 (Anything involving minors).

What we keep. We keep four things as a report bundle, for the periods in section 10:

1. the image itself;
2. what we submitted;
3. what the judgement rested on;
4. your own data from the two weeks before the image — under regulation 8(2) of the Online Safety (CSEA Content Reporting) Regulations, SI 2026/268, this means files you uploaded, created, shared or received, the information attached to them, your messages and chat logs, and information about connections with other accounts. We read that widely: what you made and received in that fortnight, and the records the app itself made about you in it. The package also carries the details of your account that go with the report, whatever their date: your name, email address, phone number and date of birth, the gender and the people you are looking for that you confirmed, when the account was made and whether it was on hold.

There is one case where deleting your account waits: if the copy of that fortnight of your records has not yet been made into the bundle, your account closes at once, as with any request to delete, but the deletion itself is refused until a person on our team has completed the bundle.

7. Matching-model training

We plan, but have not yet started, using member data to train and improve our matching model. We do not train a matching model today; what it would learn from is in the AI & Matching-Model Transparency Notice, section 6 (Matching-model training). Its purpose would be to improve match quality by learning what leads to mutual, lasting connections.

• Because training is not necessary to provide the service, its Article 6 basis is your consent (UK GDPR Article 6(1)(a)) — not contract — and, for the special category data involved, your explicit consent (UK GDPR Article 9(2)(a)).
• We ask you for it already: it is the Improving matching switch you answered when you signed up, and you can change it at any time in your privacy settings.
• You can withdraw this consent at any time, in the app, and separately from your core consent (UK GDPR Article 7(3)). Withdrawal stops future use of your data for training; it does not affect the lawfulness of use before you withdrew.

8. Who we share your data with

We do not sell your personal data. We share it only with the service providers in the table below, who help us run Hotpot, and only for the purposes in this policy. Not all of them stand in the same place, and this is where each one stands today:

• Under a data processing agreement in force: Amazon Web Services, Anthropic, OpenAI, Twilio and SendGrid, Vercel and Google's notification service, through the terms that came with each account; Speechmatics, Sentry, Auth0 (Okta) and Slack, through agreements we signed; and VerifyMy, through our contract with it. These agreements set out how each provider must protect the personal data they cover and use it only on our instructions. The email carrying your sign-in code is sent through our own SendGrid account, not through Auth0's.
• No such agreement exists: Apple, for notifications to an iPhone and for its check that the app is genuine, and Google Play Integrity work under their own developer terms, which contain no data processing agreement. They are not acting on our written instructions.
• The companies that run the language models: every request to a language model goes first through Vercel's AI Gateway, which handles the request and the answer for us as our processor. Vercel lists some of the companies that run the models, among them Anthropic, OpenAI, Google, Microsoft and Amazon, as its own sub-processors, while its terms also call them third parties whose own terms apply to what is sent to them. Nebius is not on Vercel's list. We have no agreement of our own with any of these companies for requests that go through the gateway.

Other members are recipients too: your recordings are heard by other members inside the app and, where sections 6 and 10 say so, by a person on our team, the people you like and the people you match with hear what you recorded, and what members owe each other about what they hear is in the Community & Safety Guidelines on hotpot.dating, section 5 (Voice-specific norms).

We may also disclose personal data where we are legally required to do so — for example to respond to a valid request from a law-enforcement authority or a court — relying on our legal-obligation basis (UK GDPR Article 6(1)(c)). Where the law requires it, or where we reasonably consider it necessary to protect someone from serious harm, we may report content or conduct to the police or other authorities; when we act without warning and when we report a matter to the authorities is in the Community & Safety Guidelines on hotpot.dating, sections 7 (Reporting, and what happens next) and 8 (Enforcement and appeals). If we ever transfer the business, personal data may pass to a successor, and we will tell you if that happens.

9. International data transfers

Some of our providers are based in the United States: Vercel, Anthropic, OpenAI, Google, Microsoft, Amazon, Twilio, SendGrid, Apple and Slack. Sentry, which receives error data and performance timings, holds them in its European region, in Germany, and its company in the United States can reach them. This means your voice recordings and/or transcripts, your profile photo, or other personal data, may be transferred outside the United Kingdom to those providers. Every recording you make for the app, except a chat message and a sign-up recording made on an iPhone, goes first to Speechmatics, a company in the United Kingdom whose service we have set to process it in its European region (a transfer to the European Economic Area is covered by the United Kingdom's adequacy regulations, which recognise its protection as adequate). A recording that path could not finish goes through Vercel's gateway to Microsoft, both based in the United States, and the gateway is not limited to one region: it may have the work done wherever Microsoft runs the model, including outside the UK. UK regulations allow transfers to United States companies certified under the UK extension of the EU-US Data Privacy Framework. On the United States government's list of those companies, as we read it on 2026-10-27, Vercel, Google, Microsoft, Amazon, Twilio (which includes SendGrid), Slack, Sentry and Okta (Auth0) are certified; Anthropic, OpenAI and Apple are not. For Anthropic and OpenAI we rely on the safeguards below; for Apple, see below. People working for OpenAI's reviewing companies in the Philippines and Canada may read text sent to OpenAI's own service for the safety check; Okta (Auth0) and Speechmatics' United States affiliate may also reach your data from the United States. Speechmatics' agreement with us allows its United States company to help run the service; its data protection officer has told us in writing, on 2026-10-19, that data sent to our European endpoint is processed entirely within the European Economic Area and does not leave it.

Vercel is a gateway rather than a destination: your transcripts, your recordings when the fallback turns them into text, and your profile photo when it is checked, pass through it on the way to whichever company runs the model, and that company may be Anthropic, OpenAI, Google, Microsoft, Amazon or Nebius. Nebius, a company in the Netherlands, is where the gateway runs the model that turns the two short descriptions behind your browse into numbers, and we have set the gateway to send that request to Nebius alone. A transfer to Nebius in the Netherlands is covered by the United Kingdom's adequacy regulations for the European Economic Area. Sentry holds error data and performance timings in its European region, in Germany, which the same regulations cover; its company in the United States can reach that data, and that access is covered by its certification under the UK extension of the EU-US Data Privacy Framework. Apple and Google also receive your device token and the words of each notification (section 8). Google's notification service is covered by Google's certification under the UK extension of the EU-US Data Privacy Framework, and so is Google Workspace, which holds our mailbox and sends the email for the waiting list, for our marketing and for the research invitations we email. Apple is not certified under the Data Privacy Framework. For Apple's notification service we rely on the exception in UK GDPR Article 49(1)(b): sending you a notification you turned on is necessary to perform our contract with you. For Apple's check that the app is genuine, we have not yet put in place a safeguard.

VerifyMy, a company in the United Kingdom, and the companies it uses for the age check may do that work outside the United Kingdom and the European Economic Area. Our contract with VerifyMy allows that only with the safeguards UK law requires, such as UK approval of the country, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Where a recipient is not covered by UK regulations, we rely on appropriate safeguards under UK GDPR Article 46. For OpenAI that is the UK Addendum to the EU Standard Contractual Clauses, which its data processing agreement includes. Anthropic's agreement with us is made by Anthropic Ireland, Limited, a company in the European Economic Area, which the United Kingdom's regulations cover; Anthropic has the work done in the United States under its own arrangements, and its agreement with us includes the UK Addendum where one is needed. UK law also asks us to judge that your data is not materially less protected after such a transfer; for Anthropic and OpenAI that assessment is not yet complete. Apple's check that the app is genuine is the one transfer for which we have no safeguard in place yet.

You can ask us for information about the safeguards we use for a transfer, and how to obtain a copy of them, using the contact details in section 16.

10. How long we keep your data

We keep personal data only for as long as we need it for the purposes in this policy, then delete or aggregate it.

Safety records. A self-harm signal and its decision record are held while your account is active, and the waiting mark is cleared when a reviewer clears it. Moderation records touching special category data are held while your account is active. Safeguarding data is kept only as long as the safeguarding purpose needs it, and is then deleted or de-linked. Retention periods for training data are not yet decided and will be published here before matching-model training launches.

An account nobody has used for a year. Once you have finished setting up, we keep your account for as long as you are using Hotpot. If a year goes by and you have not used it at all, your account becomes eligible for deletion and our team deletes it in full — the account, every recording you have made, your photo, and your side of any match — in the same way as if you had asked us to. Our team runs that deletion.

Using Hotpot means any of these: browsing, listening to someone, liking or skipping someone, matching with someone, sending a chat message, answering one of your questions, changing something on your profile or in your settings, or simply opening the app on a phone you have signed in on. Any one of them starts the year again, so this only reaches an account that has been genuinely untouched for twelve months.

We do not warn you before this happens.

Deleting your account. Account deletion is self-service in the app: you can close your account at any time, without giving a reason. It happens in two steps. At once, your account closes: no other member can see you, nothing you recorded can be played to another member, your matches and conversations stop, and the processing your consents allowed ends. Fourteen days later, everything in the account is deleted, automatically, with no further step from you. The fourteen days are there for someone who deletes their account and thinks better of it. The first item under "What we keep after you delete your account" below says what is kept of your consents.

Recovering your account inside the fourteen days. Write to contact@hotpot.dating from the email address on your account and give the phone number it is registered to; a member of our team restores it. We also keep a record in your account that it was recovered and when, which is deleted with your account, unless the eleventh point below keeps it for 180 days with the other safety records, and our team's alert channel in Slack receives a line naming the account by its identifier, who on our team recovered it and when. That line is kept for twelve months, like the alert about a report or a hold, and then deleted. The fourteen days count from the day you asked to delete, and a request that reaches us after them is refused.

Three cases where the account is deleted at once instead, with no fourteen days and no way to recover it. An account that never finished setting up. An account we closed for a safety finding: you ask by writing to us, as section 11 says, the closure stands, and the Terms of Service, section 13 (Closing your account) carries the contract term; your content is deleted except what we are required or permitted to keep for legal, safety or security reasons. And an account with a child-protection report inside its year, described in section 6.4, where only the report bundle stays; section 6.4 also sets out the one case where that deletion waits. Withdrawing your voice consent from the Privacy screen, described in section 5, also deletes at once and cannot be undone.

When your account is deleted, your data is deleted from our systems, with the exceptions set out in full below, under "What we keep after you delete your account". The deletion includes the recordings we hold a record of: your onboarding takes, your answers, the voice notes you sent with a like, your chat audio, and your photo. They are removed from storage as part of the same deletion. Our storage keeps a recovery copy of each file it removes for 30 days and then erases it, the marker under the file's name going on a later run of the rule (the twelfth point below); apart from that copy, from a copy filed with a report, made about you or by you, which stays to the end of its 30 days (the tenth point below), and from the copies inside a child-protection report package where one was made (the third point below), we keep no separate copy or archive of them. One case is still being closed: where a recording was uploaded but never finished saving, nothing of ours ever named it, so the deletion cannot find it.

If removing an individual stored file does not succeed at that moment, for example because of a temporary fault at our storage provider, the file is not forgotten. The deletion still to be done is recorded in our database as part of the same operation that deletes your account, and an automated job then retries it. The file stays in storage while those attempts continue, and once it is gone its recovery copy stands for 30 days (the twelfth point below).

The record of the outstanding deletion holds the storage location of the file, which for most kinds of file includes your account identifier, and no part of the recording itself; it is deleted as soon as the file is.

What we keep after you delete your account. The things below can survive account deletion, meaning the deletion that runs fourteen days after you ask, the deletion at once in the three cases above, and every other deletion this section describes.

The first is a record that you gave a consent and, if you did, that you withdrew it. We keep it because we may need to show that a consent was properly given and that a withdrawal was honoured, which is what UK GDPR Article 6(1)(f) (legitimate interests), together with Article 9(2)(f), is our basis for.

At the moment your account is deleted, it is reduced to this:

• Who it points at: not you by name, email or account number. Your account identifier is replaced with a one-way code, computed with a key we hold outside the database. Other things on this list keep your old account identifier: for a time, the record of a photo decision, for the rest of its twelve months; a child-protection report record, where one was made; the two safety records, for up to 180 days; an outstanding-deletion record, for the moments it usually lasts; and the recovery copies of your files in our storage, for their 30 days and until the rule then removes them, since the name a file is stored under includes it for most kinds of file; and the markers of those copies' deletion, which keep the names and so the identifier, with no part of any file behind them, until a later run of the rule removes them (the twelfth point); and the access records of your files, for their 90 days, since they hold the names files are stored under (the fourteenth point). While any of them still holds it, we could work out which consent record was yours with the key, and the log of who opened something of yours for review, which holds the same code rather than the identifier, could be tied to it the same way; once all of them have gone, the code cannot be turned back into you.
• How long: 12 months from the day you ask to delete your account or withdraw your consent, after which it is deleted automatically.

If you want a copy of what your consent record says, ask us at contact@hotpot.dating before you delete your account.

The second is the record of a photo decision, described in section 6.1, and only if a decision was made about a photo of yours. It stays for the rest of its 12 months, and the reason is blunt: an account closed for a serious finding must stay closed, and a record that vanished when the account did would let the same account be made again. The one exception is an account we closed for a safety finding that is deleted twelve months after the closure: the records of decisions about its photo are deleted with it then, unless a report under section 6.4 still needs one or one was kept longer with a written reason.

The third is a child-protection report record, described in section 6.4, and only if a report was made. Its two clocks — one year for the four things regulation 8(1)(b) of SI 2026/268 requires, five years for the reference — run from the report and are unaffected by the account being deleted.

The fourth is the log of who opened something of yours for review, described in sections 6.1 and 6.2, and only if a person ever opened one: a photo of yours waiting for a decision, a recording of yours held for a safety review, or the voice note you sent with a like while that like was held. Its twelve months run from the open; a log that disappeared with its subject could not say who looked.

The fifth is a report you filed about another member. It cannot die with your account, because the member it is about is still here and a safety trail about them cannot leave with the person who reported them. Your own identifier is taken off it when your account is deleted, so what stands afterwards says what was reported and about whom, and no longer says who reported it. The words you typed in the report stay in it, with your name off, because they are what the trail is made of. It is kept until the account of the member it is about is deleted, and goes with it; where a copy of your exchange was filed with it, it stays until that copy is deleted at 30 days, if that is later. A report made about YOU is not on this list: it is deleted with your account, because there is nothing left to act on, except the copy of your exchange filed with it, which is the tenth point below.

The sixth is the outstanding-deletion record described above, and only where one exists at all. It is unfinished work rather than something we keep: it names a stored file that still needs removing, it holds nothing from inside that file, and it is deleted as soon as the file is. There is one exception: where the system refuses to delete a file because it is not recognisably one person's own, the record is kept, marked as refused, and waits for a member of our team rather than being removed on a schedule.

The seventh is your place on the waiting list, if you joined it. If you typed your email address into the waiting list on hotpot.dating, we hold that address and what you gave with it (section 3). That row is not part of your account, because you gave it at a different moment for a different thing, so deleting your account leaves it standing. Each email sent to the list carries a one-click unsubscribe link. We have set no automatic deletion for the row. To have it removed altogether, write to us at contact@hotpot.dating.

The eighth is a record that your account was closed for a safety finding, and only then. If we closed your account for a safety finding and it is then deleted, whether because you asked us to or because twelve months have passed since the closure, we keep, for twelve months from the day you asked in the app to delete it where you did, and otherwise from the deletion, a scrambled form of your phone number, the fact that the closure was for a safety finding, and the date. It exists so that a closed account cannot be opened again with the same number the day after it was deleted. Our basis is legitimate interests (UK GDPR Article 6(1)(f)), ours and other members' in keeping people safe.

The ninth is the record that your sign-in still needs removing, and only until it is removed. Your sign-in, which holds the phone number and email address you sign in with, is kept by Auth0 (section 8). When your account is deleted, we ask Auth0 to remove it. It is unfinished work rather than something we keep: the record is deleted as soon as Auth0 confirms the sign-in is gone. If the removal does not succeed, an automatic job tries again, and the record and your sign-in at Auth0 both remain until Auth0 confirms the removal. It is not deleted on any schedule before then.

The tenth is a copy filed with a report, and only if another member reported you, or you reported another member, in the 30 days before. It is kept for 30 days from the report and then deleted, and it stays whole for those 30 days even if either of you deletes an account first, because the point of filing it is that what was sent survives the one person with a reason to delete it; so if you reported someone and then delete your account, your own side of that exchange stays in the copy for the rest of its 30 days. Our basis is legitimate interests (UK GDPR Article 6(1)(f)), ours and other members' in keeping people safe. When the copy is deleted at 30 days, it leaves the storage's recovery copy of itself for 30 days more (the twelfth point), where no member and none of our tools can play it, so what the report held can stand in our storage for about 60 days in all.

The eleventh is two safety records about your account, and only where you deleted your account yourself, which includes withdrawing your voice consent, or we closed it for a safety finding. An account we delete because its sign-up was left unfinished for three months, or because it went unused for a year, keeps neither: both are deleted with it. The first is the self-harm / crisis signal described in section 5: for each time the check heard, in one of your recordings, that you may be at risk of harming yourself, how serious the sign was, whether the app showed you where to find support, the country whose helplines it showed, read from the dialling code of your phone number, and when. The second is the record of each time something you recorded, or your photo, was refused, held for a person to look at, or set aside for a person to look at later; what that person decided, including a decision to close your account; and, if your account was recovered, that it was. We keep both for 180 days from the day you asked in the app to delete your account where you did, and otherwise from the day it is deleted, with your old account identifier on them, so that we can answer a complaint sent to us, or a lawful request, about an account that has been deleted. The first, and any part of the second about a sign that you may be at risk of harming yourself, is information about your health. Our basis is legitimate interests (UK GDPR Article 6(1)(f)): ours, other members' and the authorities' in a complaint about a deleted account, or a lawful request about one, being answerable from a record of what the check heard and what a person decided, rather than from nothing. For the part that is information about your health, the ground is substantial public interest (Article 9(2)(g)), on the safeguarding condition in paragraph 18 of Schedule 1 to the Data Protection Act 2018: the record of a step taken to protect a person at risk, kept so that a lawful request made about that person's safety, or a complaint about what we did for them, can be answered; and Article 9(2)(f) (legal claims) where a complaint or request has become one.

The twelfth is a recovery copy, in our storage, of each recording and photo deleted from it, for 30 days, and the marker of its deletion until the rule's later run. Our storage at Amazon Web Services keeps the version of a file it held when that file is deleted or rewritten, so that a deletion made by mistake, by us or by a fault, can be undone, and a rule on the storage erases that copy after 30 days. A copy can stand past its thirtieth day. It covers every file of yours that leaves our storage, whatever the reason. Wherever this policy says a recording or photo of yours is deleted or removed from our storage, this copy and the marker below follow it, whether or not the sentence says so. Where a photo you added carried location, device or time details and we rewrote it to remove them (section 3), it also holds the file as uploaded: the file you uploaded is deleted once the fresh copy is on your profile, and its versions stand as the recovery copy, so for 30 days our storage holds whatever place that file carried; nothing of ours reads it. It is not shown in the app or on our review page and none of our tools reads or restores it; a person with administrator access to our storage account can read or restore one, which we would do only to undo a deletion made by mistake. Once the copy is erased, the marker of the deletion the storage kept under the file's name stands until a later run of the same rule removes it; for most kinds of file that name includes your account identifier, as the paragraph on outstanding deletions above says, and the marker holds no part of the file. Our basis for the copy is legitimate interests (UK GDPR Article 6(1)(f)), ours and yours in a mistaken deletion being reversible for a short time. For a recording, which is information about you of the kind section 5 describes: where you deleted one recording while your account stands, the consent your recordings rest on still covers the copy.

The thirteenth is an entry in our appeals log, and only if you emailed us an appeal or a complaint. When your account is deleted, the entry loses its link to your account and keeps the rest: which kind of appeal or complaint it was, when it arrived, when it was decided and with what outcome, whether you asked to hear nothing more, and which of our team handled it. It holds no email, no email address, no phone number and nothing you wrote, and it is deleted three years from the day the appeal or complaint reached us. Our basis for keeping it is legal obligation (UK GDPR Article 6(1)(c)): the Online Safety Act 2023 requires us to run a complaints procedure and to keep a record of how we do it. Our basis for using it to measure how long our decisions take and how often an appeal is upheld is legitimate interests (Article 6(1)(f)).

The fourteenth is the access records of your files, each for 90 days. Each record of a recording or photo of yours being fetched from or saved to our storage (section 3) stays until its 90 days end, even after your account is deleted, because a record that went with the account could not show what was read in a break-in. It holds which file, when, the internet address and the device software; for most kinds of file the name of the file includes your account identifier. It holds nothing you said or recorded, and no picture. Our basis is legitimate interests (UK GDPR Article 6(1)(f)): ours and yours in knowing exactly what was read if our storage is broken into.

11. Your rights

Your right to object

You have the right to object to some of the ways we use your data.

What you can object to. Some of what we do is based on our legitimate interests (UK GDPR Article 6(1)(f)), and you have the right to object to any of it, on grounds relating to your particular situation (UK GDPR Article 21(1)). You can object to any use this policy bases on our legitimate interests, including the review of your profile photo and the hold on a recording. Today that means:

• product analytics and service improvement — counting how the app is used, for example what was listened to and for how long (section 4);
• checking that people of every orientation are treated equally: the weekly counts by orientation group (section 4);
• research invitations: the emails asking whether you would talk to us about Hotpot; the "no more of these" line in any invitation stops them too (section 4);
• error and performance monitoring — detecting and fixing faults, and finding where the app or our server is slow (section 4); and
• our safety processing where it rests on legitimate interests — content-safety classification of public answers, the content-free crisis / self-harm signal and the human review it triggers, and safety operations such as handling reports and blocks and applying moderation (section 4).

Where we rely on your consent instead, see the right to withdraw consent below.

How to object. Email us at contact@hotpot.dating and tell us what you want us to stop. There is no setting for this in the app: a person at Hotpot reads your email and replies without undue delay, and in any event within one month of receiving it, saying what we have stopped or, where the law lets us carry on, why. You do not need to use any particular form of words, give a reason beyond your situation, or pay anything. See "How to exercise your rights" below.

Being left out of the weekly counts by orientation group. This counting is not switched on yet (section 14.5). Once it is, you can tell us in writing not to count you; email to contact@hotpot.dating is the simplest way, and any written notice to us counts. You do not need to give a reason. We record your request as soon as we read it, and in any case within seven days of receiving it; every weekly count made after it is recorded leaves you out. A count already made holds nothing that names you, so it stays as it is until its 24 months end. You can change your mind by writing to us again.

You can object to direct marketing at any time, and we will stop. Today our marketing is opt-in consent: you withdraw it in the app, or, for "Hear from us", by unsubscribing or writing to us.

Your other rights

Under the UK GDPR you also have the following rights over your personal data. We will always respond and explain our decision. The two complaint routes are set out at the end of this section.

• Right of access — to get confirmation that we process your data and a copy of it (UK GDPR Article 15).
• Right to rectification — to have inaccurate data corrected and incomplete data completed (UK GDPR Article 16).
• Right to erasure — to have your data deleted in certain circumstances (UK GDPR Article 17).
• Right to restriction — to limit how we use your data in certain circumstances (UK GDPR Article 18).
• Right to data portability — to receive certain data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible (UK GDPR Article 20).
• Right to object — to object to processing based on our legitimate interests, on grounds relating to your situation (UK GDPR Article 21). Set out in full above, under "Your right to object".
• Right to withdraw consent — where we rely on your consent or explicit consent, you can withdraw it at any time. In the app, from the Privacy screen in your account settings (the weekly updates switch is on the Notifications screen there), once your account is set up; while you are still setting up, by writing to us at contact@hotpot.dating (section 5 says what else covers that stretch); and if your account has been closed for a safety finding, the app no longer opens for you, so you write to us at the same address. Withdrawing consent does not affect the lawfulness of what we did before you withdrew.
• Rights around automated decisions — where a significant decision about you is made solely by automated means, you have the safeguards in UK GDPR Articles 22A–22D, including the right to be given information about the decision, to make representations about it, to obtain human intervention, and to contest it (for the age check, see section 3) (UK GDPR Article 22C; see section 6).

How to exercise your rights. Correcting your profile details, withdrawing your consent and deleting your account are done in the app, from your account settings, once your account is set up. While you are still setting up, email us at contact@hotpot.dating and we do it for you; section 5 sets out what else covers that stretch. If your account has been closed for a safety finding, the same: email us, and we withdraw your consent or delete your account for you. You can also write to that address to ask another person to check the decision to close your account; the Community & Safety Guidelines on hotpot.dating, section 8 (Enforcement and appeals), say how. A request for a copy of your data, for us to restrict our use of it, or for it in a portable form is made by email to contact@hotpot.dating; none of these is a setting in the app, and a person at Hotpot carries it out. For the other rights above, email us today at contact@hotpot.dating and tell us which right you want to use. We answer a rights request without undue delay and in any event within one month of receiving it. Using any of these rights is free. The only exceptions are a request that is clearly unfounded or excessive, where the law lets us charge a reasonable fee or decline, and we would have to show why, and further copies of data you have already been sent (UK GDPR Articles 12(5) and 15(3)).

Complaining to us. If you think we have handled your personal data wrongly, you can complain directly to us by email at contact@hotpot.dating, or by post to the address in section 16.

Complaining to the regulator. Complaining to us first is not a precondition, and you can go straight to the regulator if you prefer. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Children

Hotpot is for adults only. You must be 18 or over to use Hotpot. If your date of birth is wrong, you can correct it once yourself in the app; after that, email contact@hotpot.dating and a person at Hotpot corrects it, without undue delay and in any event within one month of receiving your request. How age is checked, and what happens to an account that belongs to someone under 18, is in the Terms of Service, section 3 (Eligibility (18+)).

Photos are a separate question, and they are covered in section 6. Section 6.3 explains what happens when a reviewer thinks someone in an ordinary photo may be under 18, and section 6.4 sets out our duty to report suspected child sexual abuse material and the account closure that follows.

13. How we keep your data secure

We take the security of your data seriously and use appropriate technical and organisational measures. These include:

• Encryption in transit — data moving between the app, our servers, and our providers is encrypted.
• Private storage — your voice recordings and photos are held as private files in our storage, not publicly accessible.
• Access controls — access to personal data is limited to what is needed to run and support the service, and authentication is managed through Auth0.
• Data minimisation by design — for example, the self-harm / crisis signal is stored content-free, and email addresses and phone numbers are removed from the error reports and timings the app sends to our monitoring provider, and from the error data and request details our server sends it.
• Access records: our storage records each time a recording, a photo or a safety copy of our database is fetched or saved (section 3). If a breach happens, these records tell us exactly what was read, so that we can tell you and the Information Commissioner's Office what was taken, and not more.

If a personal data breach puts your rights at risk, we report it to the Information Commissioner's Office without undue delay and, where we can, within 72 hours of becoming aware of it (UK GDPR Article 33). If it is likely to put you at high risk, we tell you directly, by email to the address on your account, without undue delay (UK GDPR Article 34).

14. Cookies and similar technologies

What the app stores on your device today is in 14.7 (The Hotpot app today).

14.1 What this section covers

The rules that govern cookies and similar technologies are PECR, the Privacy and Electronic Communications (EC Directive) Regulations 2003. They govern the Hotpot mobile app itself, not just the hotpot.dating website.

14.2 What storage and access technologies are

They are anything that stores information on your device, or reads information already stored there, including:

• Cookies;
• Software development kits (SDKs);
• Local storage and similar on-device storage;
• Pixels, tags and similar markers; and
• Information your device sends out by itself: for example the device type and network address that reach us when the app reports an error or sends timings of how it performs, such as how long a screen took to appear; what we receive and why is explained in section 3 (What data we collect).

14.3 The rule we follow: PECR first, then the UK GDPR

We ask for your consent only where PECR requires it.

14.4 Strictly necessary technologies

Some storage and access is strictly necessary to provide the service you asked for.

For Hotpot, strictly necessary storage includes:

The app takes every Hotpot line off your phone's notification list when you sign out or your account ends on that phone. Signing out clears everything above except what is needed to finish a recording you already sent (the row "A recording waiting to be sent" and the sign-in entries that address it), the device check, which belongs to the phone rather than to your account, and error reports and timings waiting to be sent, which go when the app can send them. Deleting your account clears those recordings too.

14.5 First-party analytics

In the app, nothing is stored on or read from your device for measurement: the app carries no analytics SDK, writes nothing to your device for measurement, and sends the usage events straight to our own servers, where the counting happens.

We do not use this measurement to profile you for anything, with one exception: choosing whom to invite to talk to us about Hotpot, where it helps us pick members who use Hotpot in different ways and does nothing else (the "Research invitations" row in section 3, What data we collect). We do not use it for advertising. Your right to object and the processing it reaches is explained in section 11 (Your rights), under "Your right to object".

Counts by orientation group. This counting is built but not yet switched on; when it is, this paragraph applies from that day and the "Last updated" date above moves. Once a week we will count how many members of each group there are, to check that people of different sexual orientations are treated equally by the app. Your group is your gender together with the genders you are interested in, as you confirmed them; if you have not confirmed both, you are not counted. We count members others can find, members given fewer than three people to hear on a day, members who formed a match, members whose match turned into a conversation, and members holding six matches. Only the counts are kept, never a list of members, and a count of fewer than 10 members, or from a group with fewer than 50 members others can find that week, is shown without its number. Only Hotpot's founders see the counts. They are kept for 24 months and then deleted, and they are never used to decide anything about you: not who you see, not who sees you, and not anything else about your account. The lawful basis is in section 4. You can tell us in writing not to count you, and how is in section 11, under "Being left out of the weekly counts by orientation group".

14.6 Non-essential and third-party technologies

Marketing. Why we use each kind of data and the lawful basis for each use, including which uses rest on your consent, which rest on the contract, and which cannot be switched off is explained in section 4 (How and why we use your data).

The hotpot.dating website sets none today. The site sets no cookies of any kind, stores nothing in your browser and runs no analytics, so there is no cookie banner and nothing here for you to accept or reject.

14.7 The Hotpot app today

As things stand, the Hotpot mobile app itself sets no advertising identifiers and no third-party advertising or tracking SDKs. What it does store on your device is the strictly necessary list in 14.4, and why its measurement stores nothing on your device is 14.5. The app carries Google's notification software, Firebase Cloud Messaging, on both kinds of phone: when the app starts it registers your handset with Google so that a notification can be addressed to it, whether or not you have allowed notifications, and the token it makes reaches us only as section 3 says.

What data we collect, including the recordings, the transcripts, the device token, and the record kept of each consent is explained in section 3 (What data we collect). How long each kind of data held on Hotpot's servers is kept, what account deletion removes and what survives it is explained in section 10 (How long we keep your data); how long what is stored on your device stays there is set out in 14.4. Your phone's operating system issues a token that identifies your device so notifications can reach it, and the app reads it where your phone has permission to show you notifications; what it is and what we do with it is explained in section 3 (What data we collect).

14.8 How to control or withdraw

• First-party analytics in the app (objecting): as explained in 14.5, the app stores nothing on your device for measurement, so there is nothing here for you to switch off.
• Withdrawing consent: where we relied on your consent for a non-essential technology, you can withdraw it as easily as you gave it. The consents you give inside the app, and how to withdraw those, are explained in section 11 (Your rights), under "Right to withdraw consent".
• Your browser and device: you can manage app storage through your device settings.

Controlling cookies is separate from your wider data-protection rights (such as access and erasure), which section 11 explains.

15. Changes to this policy

When we make a significant change, we will update the "Last updated" date and the version line on this document. Before we use your data for a new purpose, we will tell you, and where a new use needs your consent, we will ask for it in the app before we start that use.

16. How to contact us

For any question about this policy or your personal data, or to exercise your rights, contact:

• Email: contact@hotpot.dating
• Controller: Hotpot Technologies Ltd, Suite RA01, 195-197 Wood Street, London, E17 3NU

17. Effective date

Effective date: 2026-10-26