Last updated: September 15, 2026
VyByN LLC ("VyByN", "we", "us", or "our") operates the VyByN mobile application and website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.
We collect information you provide directly, including:
We automatically collect device information, usage data, approximate location, and analytics through standard technologies.
We use your information to:
VyByN uses an AI service provider to support several features. This section explains exactly what is sent, why, and what your rights are.
Our provider. All AI processing described here is carried out by OpenAI OpCo LLC, acting as our processor under a Data Processing Agreement executed on 10 August 2026. OpenAI does not decide how your data is used; it processes it only to return a result to us. Transfers outside the EEA and the UK are covered by Standard Contractual Clauses.
This data is not anonymised. It is your personal data, and your rights under this notice apply to all of it.
| Feature | What is sent to OpenAI | Why |
|---|---|---|
| Compatibility (VybCheck) | Both users' interests, values and relationship goals | To generate a compatibility analysis and questions for a match |
| Conversation starters | Both users' first names, interests and profile content | To suggest opening messages for a new match |
| Review moderation | The text of a review you write about another user | To screen reviews for abusive or policy-violating content before publication |
| Dispute assistance | Statements and case details from a dispute; for rating disputes, evidence images you upload | To produce a structured first-pass analysis for a human reviewer |
| Safety screening of messages | Message content, where an account is being investigated | To detect fraud and romance-scam patterns |
What is never sent to OpenAI: your government ID or images of it, your verification selfie or video, your face geometry, your payment details, your precise location, or your journal entries.
Our lawful basis is our legitimate interests under Article 6(1)(f) — operating a functional and safe dating platform. You have the right to object at any time under Article 21, and where you object we will stop this processing for you. Everything else in VyByN continues to work. To object, use the AI processing control in the app under Settings › Privacy & Data, or contact us at privacy@vybyn.app.
No automated decision has a legal or similarly significant effect on you. AI output is a suggestion or a first-pass analysis. Disputes are decided by a person, flagged reviews are reviewed by a person, and no account is suspended by an automated AI decision alone.
Retention at OpenAI. Under OpenAI's published policy for business API accounts, data sent through its API is retained for up to 30 days for safety and abuse monitoring and then removed, unless OpenAI is legally required to keep it for longer. This 30-day period is set by OpenAI's published policy and is not a term of our Data Processing Agreement, which means OpenAI can change it. We monitor that policy and will update this notice before any change takes effect. We do not currently hold a zero-retention arrangement with OpenAI and we are seeking one.
Training. OpenAI's published policy is that data submitted through its API is not used to train or improve its models. As with retention, this is OpenAI's policy rather than a term of our agreement.
OpenAI's own sub-processors. OpenAI may engage sub-processors, which include cloud infrastructure and hosting providers, under the general authorisation in our Data Processing Agreement. Each is bound to comparable data protection obligations.
We do not sell your personal information. We may share data with:
Each of these acts only on our instructions, and none of them sells your data.
| Processor | What they handle |
|---|---|
| Amazon Web Services | Hosting, databases, photo and video storage, email delivery |
| Amazon Rekognition (AWS) | Screening uploaded photos for explicit content. Face Liveness checks and face comparison during identity verification, only if you choose to verify and give separate biometric consent |
| Stripe | Payments, payouts and government-ID verification. Stripe holds the ID document image; we never receive it |
| OpenAI OpCo LLC | The AI features in section 3 |
| Agora | Real-time voice and video calling. Call media is not recorded or stored by us |
| Twilio | SMS delivery for phone verification and alerts |
| Google (Firebase) | Push notifications, and sign-in if you use Google sign-in |
| Apple | Sign in with Apple and in-app purchases, if you use them |
We collect the categories of personal information listed in section 1, for the business purposes described in this notice. AI processing by OpenAI is a disclosure to a service provider for a business purpose. It is not a sale, and it is not sharing for cross-context behavioural advertising. We do not sell or share your personal information as those terms are defined by the CCPA.
We implement industry-standard security measures including encryption in transit (TLS), encrypted storage for sensitive data, two-factor authentication for admin access, and regular security audits.
Before you can add money, contribute to a date fund, or receive money from another member for the first time, we require you to verify your identity against a government-issued document. This is required, not optional, and it happens once — after that, later payments and withdrawals go through without repeating it. Everything else in VyByN works without it: matching, messaging, calls, groups and events are all unaffected.
What is not covered by this requirement. Subscription purchases made through the Apple App Store or Google Play are not gated on verification. Those purchases are processed entirely on the app store’s systems and we only learn of them after you have already been charged, so there is no point at which we could interpose a check. They also create no balance you can withdraw, so the record-keeping reason below does not apply to them.
What happens. You photograph a passport, driving licence or ID card. The image goes to Stripe Identity, who confirm the document is genuine and read your legal name and date of birth from it. The document must be photographed live rather than uploaded from your camera roll.
What we keep. VyByN never receives or stores the image of your document — Stripe holds that as our processor. We keep the result: your legal name as printed on the document, the document type, the issuing country, and whether the check passed or failed. We do not ask Stripe for your date of birth, a national ID or a social security number.
This step takes no face measurements. It reads a document. It is separate from the optional identity verification check described in section 7, which does analyse facial geometry and which asks for your explicit agreement first.
Why we require it. Members of this app arrange to meet each other in person, and the date-fund feature is how many of those meetings get arranged — so confirming that an adult is who they say they are protects the person they are meeting. Tax law separately requires our financial records to be attributable to a verified legal name rather than one somebody typed in. And it confirms you are over 18 before we help arrange an in-person meeting.
Our legal basis is legitimate interests — Article 6(1)(f) of the GDPR. We are not relying on your consent, and we say so plainly because it changes what rights you have: there is no agreement here for you to withdraw, but you do have the right to object, described below.
How long we keep it. Your verified name is kept on payment records for 7 years from the end of the tax year the payment falls in, under the tax obligation described in section 8. The verification record itself is removed when your account is erased — the same either way, whether you close your account yourself or we ban it — and we instruct Stripe to delete the document image they hold. A record may persist in a backup for up to 8 days after erasure.
Stripe’s own role. Stripe acts as our processor for this check, and separately as an independent controller of some of that data for their own fraud-prevention and legal purposes. You therefore have rights against Stripe directly as well as against us, and you may contact them about that data without going through VyByN.
Your right to object. Because we rely on legitimate interests, you may object to this processing under Article 21 of the GDPR. Email privacy@vybyn.app and tell us what it is about your particular situation that makes this a problem for you. You do not need to use any particular wording, or mention Article 21 at all. We will assess your objection individually — not against a policy of refusing them — and reply within one calendar month of receiving it. If the case is complex we may extend that by up to two further months, and we will tell you within the first month if we do. If we refuse, we will tell you the grounds we relied on and how to complain to a supervisory authority or seek a judicial remedy. You keep every non-financial part of VyByN either way; what you cannot do without verification is add money or receive it from another member.
VyByN offers an optional identity verification step. If you use it, your phone streams a short live video of your face directly to Amazon Web Services, which runs its Rekognition Face Liveness check on it. Our servers never receive that video. AWS returns a liveness result and one reference frame, and we compare the geometry of your face in that frame against your profile photo, in memory, to check they are the same person. That analysis is biometric data about you.
It is optional in the real sense: nothing in the app is withheld from you for declining, and it is never a condition of adding money, splitting a date, or withdrawing your balance. We ask for your explicit agreement before the camera opens, and you can withdraw that agreement at any time — which deletes the scores immediately, on the same scope as the one-year sweep described below.
We do not store the video and we do not store the reference frame. The video never reaches our servers, and the frame is used for the comparison in memory and then discarded. What we keep is the result: the liveness confidence score, the similarity score, the outcome, the stage and reason text if it failed, the AWS session reference and the timestamps. The scores are permanently deleted after 1 year, automatically, and immediately if you withdraw consent. The outcome record is not on that clock, and it outlives the year, a withdrawal of consent and the erasure of your account — but it holds no measurement of your face. Where an attempt failed on face match, the reason text says so in fixed words; it does not record the match percentage. Our biometric policy explains this in full. We never sell, lease or trade biometric data.
Our full written retention and destruction policy is published at vybyn.app/biometric-policy.html.
We retain your data for as long as your account is active. You may request a copy of your data, or delete your account, at any time in the app under Settings → Privacy & Data, or by contacting us at privacy@vybyn.app.
When you delete your account you choose one of two options:
Under either option, a small number of records are retained where the law requires it or where another person has a legitimate interest in them. What happens to your identity differs by record type, so we set each one out separately below.
Records we keep in your name. Payment and transaction records are retained for 7 years from the end of the tax year in which the transaction occurred, to meet tax and financial record-keeping obligations. These records keep the name from your identity verification and your payment identifiers. A financial record that cannot be attributed to a person does not satisfy the obligation it is kept for, so removing your name from these would defeat the reason we are required to hold them. Your government-ID verification record itself is not among these: it is deleted when your account is erased, whatever the reason your account ended. That is a different record from the face-verification attempt described in section 7, which is not deleted on erasure — it is kept, without your name attached, as the record that a check took place.
Records we strip your identity from. For the remaining retained records we remove your name and the link to your account. We do not treat these records as anonymous: they may still be connected to you by someone who already knows about the interaction, so we continue to treat them as your personal data and this policy continues to apply to them.
Backups. Our live systems and our backups are erased on different schedules. A record may persist in a backup for up to 8 days after it is erased from our live systems, after which the backup containing it is destroyed.
Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data. You may also opt out of certain data processing activities. To exercise these rights, contact privacy@vybyn.app.
VyByN is not intended for users under the age of 18. We do not knowingly collect information from anyone under 18. If we learn we have collected data from a minor, we will promptly delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email.
If you have questions about this Privacy Policy, please contact us:
VyByN LLC
254 Chapman Rd, Ste 208 #25531
Newark, Delaware 19702
Email: privacy@vybyn.app