Privacy
EXY Privacy Policy
This policy explains what personal data EXY handles, why it is needed, who receives it, and the choices available to you.
1. Who controls your data
David Shelley, trading as Halo AI Services, is the controller of personal data processed through EXY.
Postal address: 2 Brighton Terrace, Douglas, IM1 4AP, Isle of Man
Privacy and support: support@haloaiservices.com
Telephone: +44 7813 091307
2. Who may use EXY
EXY is only for adults who are at least 18 years old. We do not knowingly allow anyone under 18 to create or use an account. Report a suspected underage account through the app or to support.
3. Data we collect
Account and identity data
- Email address, account identifier, authentication records, name, date of birth, and age eligibility.
- Profile details you choose to provide, including biography, home region, relationship intentions, interests, and profile prompts.
- Photos and, where you choose to use those features, audio or video content.
Matching preferences and special-category data
Dating preferences and profile information can reveal sensitive or special-category personal data, including sexual orientation, gender identity, relationship preferences, and information that may reveal beliefs, health, ethnicity, or other highly personal characteristics.
EXY asks for separate, explicit consent before using special-category data for matching. You can withhold or withdraw that consent by contacting support. Withdrawing consent does not affect earlier lawful processing, but EXY cannot continue sensitive-data matching without it.
Private availability
You may provide availability windows for a possible date. EXY stores that availability privately and uses it to find an overlap. Another member does not see your full schedule. An exact mutual window is shown only after both people accept the introduction.
Messages, safety, and service activity
- Messages, reactions, introduction decisions, and date check-ins or feedback you submit.
- Reports, blocks, safety information, support messages, and evidence you provide for review.
- Device identifiers, push-notification tokens, app version, request logs, crash or error details, and product interactions needed to run, protect, and improve EXY.
- Coarse or manually selected home-region information. EXY does not need your precise GPS location for the current matching flow.
4. Why we use data
| Purpose | Data | Basis |
|---|---|---|
| Create and secure your account | Account, identity, device, and security records | Contract; legitimate interests in authentication, fraud prevention, and service security |
| Provide reciprocal introductions | Profile, requirements, home region, and private availability | Contract; explicit consent for special-category data |
| Enable communication and notifications | Messages, account identifiers, device token, and notification settings | Contract; consent where device permission is required |
| Keep members and EXY safe | Reports, blocks, content, technical logs, and account activity | Legitimate interests; legal obligations; protection of vital interests where applicable |
| Answer requests and enforce rights | Support correspondence, identity checks, and request records | Contract; legal obligation; legitimate interests in documenting resolution |
5. Matching logic and automated processing
EXY checks reciprocal eligibility using both members' stated age range, gender and relationship preferences, home-region constraints, account readiness, safety exclusions, and overlapping availability. It then issues a limited set of introductions.
EXY does not use payment, engagement, activity, popularity, date outcome, or protected-characteristic scores to rank members. Exact availability remains private until mutual acceptance. The current matching process does not make a decision that produces legal or similarly significant effects about you.
6. Who receives data
- Other members: profile information and content you choose to share, messages you send, and an exact mutual availability window only after both people accept.
- Supabase: cloud database, authentication, storage, and server functions used to operate EXY.
- Apple: app distribution, device notification delivery, and Apple-managed account or purchase services where used.
- Professional advisers, authorities, or emergency services: only where reasonably necessary to comply with law, establish or defend claims, prevent harm, or protect rights and safety.
We do not sell personal data. EXY has no third-party advertising network and does not use personal data to track you across other companies' apps or websites.
7. International processing
Service providers may process data outside the Isle of Man. Where a transfer requires protection, we use contractual and organisational safeguards appropriate to the destination, provider, and data involved.
8. Retention and deletion
We keep personal data only for as long as it is needed for the purpose described above. The period depends on account status, the feature used, active safety or support work, security needs, legal duties, dispute limitation periods, and whether the record can be safely anonymised.
You can permanently delete your account in EXY from Settings, then Danger Zone, then Delete Account. Deletion removes the account and associated service data. Narrow safety-report records and moderation text may be moved to a restricted store for fraud prevention, a live safety investigation, or the establishment or defence of claims. They are normally deleted within 24 months after account deletion; a documented legal obligation or legal hold may require longer, and the record is removed when that exception ends.
A pseudonymous deletion receipt, without the account identifier or email address, is kept for 90 days to confirm completion and investigate a failed deletion.
The live media object is removed during deletion. A copy already held in a device or content-delivery cache may remain retrievable until that cache expires. Storage-provider invalidation can take up to 60 seconds, while an older device cache may use the previous one-hour default.
See the account deletion guide for the complete route and locked-out support option.
9. Security
EXY uses access controls, authenticated requests, row-level data restrictions, transport encryption, server-side separation of private matching data, and operational logging intended to protect personal data. No online service can guarantee absolute security. Contact support if you believe your account or data has been compromised.
10. Your rights
Depending on the circumstances, Isle of Man data-protection law gives you rights to:
- access your personal data and receive information about its use;
- correct inaccurate or incomplete data;
- request deletion or restriction;
- object to processing based on legitimate interests;
- receive portable data you provided when the legal conditions apply;
- withdraw consent at any time; and
- complain to the Isle of Man Information Commissioner.
Send a request to support@haloaiservices.com. We may ask for proportionate information to confirm your identity and protect the account.
11. Changes to this policy
We will publish material changes here with a new effective date. Where law or the nature of a change requires it, EXY will provide an in-app notice or request fresh consent before the new processing begins. Continuing to use EXY is not treated as consent where explicit consent is required.
12. Contact and complaints
Contact EXY first using the details in section 1 so we can investigate. You may also complain to the Isle of Man Information Commissioner.