Privacy Policy

levalock is a dating and friendship app for the Lebanese community. levalock is operated by LUNIO Ltd, a company registered in England and Wales under company number 17267481, with its registered office at 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB. In this policy, "we", "us", and "levalock" refer to LUNIO Ltd, which is the data controller for your personal data under UK GDPR and applicable data protection law.

For any privacy question, complaint, or data-rights request, contact us at contact@levalock.com.

When you create a levalock account and use the service, we collect:

Account & identity data:

• Email address and phone number (for sign-in and account security)
• Profile information you provide: name, date of birth, gender, photos and videos, bio, religion, nationality, lifestyle preferences, prompts, hobbies
• ID document and selfie (for identity and age verification)

Usage data:

• Messages you send to other users
• Likes, matches, blocks, reports, and other in-app activity
• Settings and preferences (language, notifications, visibility)

Location data:

• Approximate location (rounded to ~1 km), used only to compute distance between users
• We never collect or store your precise GPS coordinates

Device & technical data:

• Device type, operating system, app version
• IP address (used for security, fraud prevention, and rough country/region)
• Diagnostic and crash reports (to help us fix bugs)
• Authentication tokens stored on your device

We use your data only to:

• Run the service: show your profile to other users, deliver matches, transmit messages, compute distance
• Verify your age and identity: levalock is an 18+ platform; verification protects all users
• Send important account notifications: verification results, security alerts, policy changes
• Improve the app: fix bugs, investigate crashes, study aggregate usage patterns
• Keep the service safe: investigate reports, detect abuse, prevent fraud and impersonation
• Marketing (only with your consent): we will only send promotional notifications or emails if you have opted in via Profile → Notifications → Promotions & tips

We do NOT sell your data, share it with advertisers, or use it to train AI models.

As a UK-registered company, we process your personal data primarily under the UK GDPR and the UK Data Protection Act 2018. For users in the European Economic Area, we also process data under the EU GDPR. The legal bases we rely on are:

• Performance of a contract — we need your data to provide the service you signed up for
• Legitimate interests — for security, fraud prevention, abuse investigation, and improving the app
• Consent — for marketing communications, age verification (biometric data), and any optional processing where we ask
• Legal obligation — when required to comply with law or respond to lawful requests

You may withdraw consent at any time. Where processing is based on consent, withdrawal does not affect prior lawful processing.

Supervisory authorities: If you're in the UK, your supervisory authority is the Information Commissioner's Office (ICO) ico.org.uk. If you're in the EEA, you can contact your national data protection authority (e.g., CNIL in France, the DPC in Ireland).

Other users can see:

• Your first name, age, photos and videos
• Bio, hobbies, prompts, lifestyle answers, languages, religion, region (only if you chose to share)
• Approximate distance from them
• Verification badge (if you're verified)

Other users CANNOT see:

• Your email address or phone number
• Your exact location or full address
• Your ID document or selfie verification photos
• Income/salary, unless you explicitly chose to show it on your profile
• Your private messages with any other user
• Your last name

Privacy controls available to you:

• Blur mode — your photos appear blurred to other users in Discover; you can selectively unblur for people you've liked or matched with (with levalock+)
• Pause account — your profile is hidden from Discover and you stop receiving new likes and matches until you unpause; existing chats remain
• Block — prevent any specific user from seeing you, contacting you, or appearing in your Discover

We use a small set of trusted infrastructure and service providers (for hosting, email, identity verification, content moderation, billing, and analytics) who process data strictly on our behalf under written data-processing agreements. They handle data only to deliver the service you signed up for.

We do not sell your data and we do not share it with anyone for their own marketing or other purposes, except where required by law (see "Law enforcement requests" below).

If you'd like the current list of named processors for your own records, email contact@levalock.com and we'll send it to you.

You have the following rights over your personal data. To exercise any of them, email contact@levalock.com or use the in-app controls where available. We will respond within 30 days.

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data (edit your profile anytime)
• Right to erasure — delete your account and all associated data from Profile → Delete account
• Right to restrict processing — limit how we use your data while a dispute is being resolved
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — turn off marketing, change notification settings, or revoke verification consent at any time
• Right to lodge a complaint — file a complaint with a data protection authority. UK users can complain to the ICO (ico.org.uk/make-a-complaint). EEA users can complain to their national authority (e.g., CNIL in France)
• Right to block, report, and not be contacted by other users

To verify your age and identity, we ask you to take a live selfie inside the app. Your selfie is processed by Amazon Web Services (AWS) Rekognition, which performs the following automated checks on your behalf:

• Face detection and quality check — confirms a single human face is present, clearly visible, and well-lit
• Age estimation — estimates an age range from your face to confirm you appear to be 18 or over
• Face matching — compares your selfie against the public photos on your profile, to confirm you match the person in your photos
• Duplicate-account prevention — checks whether the same face has already been used to create another levalock account

Biometric template storage. If your verification is approved, AWS Rekognition generates and stores a numerical biometric template (a "face fingerprint") that represents your face. We use this template only to detect duplicate or re-created accounts in the future. We do not use it for advertising, identification, surveillance, or to share with other users.

This is biometric data. Under UK GDPR, EU GDPR Article 9, and US laws including Illinois BIPA, your selfie and the face template generated from it are a special category of personal data. We process them only on the basis of your explicit consent, which you give when you complete verification. You may withdraw consent and request deletion of your biometric template at any time by emailing contact@levalock.com or by deleting your account.

Retention. Your biometric template is retained for as long as your account is active so duplicate detection can keep working. When you delete your account, your biometric template is permanently removed from AWS Rekognition within 30 days. Your original selfie image is not stored long-term — only the numerical template derived from it.

Edge cases that require manual review. A small number of verifications may be reviewed manually by trained levalock staff (e.g. when the automated check is inconclusive). In those cases, your selfie is reviewed privately and is not shown to other users.

We keep your personal data only as long as needed:

• Active accounts: we keep your data for as long as your account is active
• After deletion: when you delete your account, we permanently delete your profile, photos, verification documents, matches, and messages within 30 days
• Logs and security data: retained for up to 90 days for active monitoring, and up to 2 years where required for fraud prevention or legal compliance — with personal identifiers removed where possible
• Records of policy violations: we retain a minimal record (e.g., phone hash, ban reason) to prevent banned users from rejoining, indefinitely
• Legal obligations: we may retain certain data longer when required by law (e.g., financial records for tax)

We use industry-standard measures to protect your data:

• All data in transit is encrypted using HTTPS / TLS
• Photos, ID documents, and selfies are stored in encrypted-at-rest cloud storage
• Passwords are never stored in plain text; sign-in uses one-time codes
• Sensitive fields (phone number, email, verification documents) have strict access controls — only you and authorized levalock admins can access them
• Admin access requires authentication and is logged

No system is 100% secure. We can't promise absolute security, but we work hard to protect your information. If we ever become aware of a security incident affecting your data, we will notify you and the relevant authorities as required by law.

levalock is operated by a UK-registered company. Our service providers (Supabase, Resend, Expo) may store and process your data on servers located in the United Kingdom, the European Union, the United States, or other regions. By using levalock, you understand that your data may be transferred to countries with different data protection laws than your own.

Where we transfer personal data from the UK to a country that does not have a UK adequacy decision, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate supplementary safeguards. For transfers from the EEA, we rely on the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms. You may request a copy of the relevant safeguards by emailing contact@levalock.com.

levalock is strictly for users 18 and older. We do not knowingly collect data from anyone under 18. We use age verification at sign-up and during ID verification to prevent minors from creating accounts. If we discover that a user is under 18, we immediately delete their account and all associated data. If you believe a minor has signed up, please report the profile from the app, or email contact@levalock.com.

We will only send you marketing emails or promotional push notifications (such as offers, levalock+ deals, or tips) if you have explicitly opted in. The Promotions & tips toggle in Profile → Notifications controls this, and it defaults to OFF. You can turn it off again at any time.

Transactional notifications (matches, messages, verification results, important account changes) are part of the service and are not marketing.

This opt-in approach reflects our duties under the UK Privacy and Electronic Communications Regulations (PECR) and, for EEA users, the ePrivacy Directive.

We will disclose your data to law enforcement or other authorities only when required to comply with a valid legal process (such as a court order, subpoena, or formal legal request from a competent authority) or where we have a good-faith belief that disclosure is necessary to prevent imminent harm. Where legally permitted, we will notify the affected user before disclosure.

We may update this policy from time to time. When we do, we'll update the "Last updated" date and, for significant changes, notify you in the app or by email. Continued use of the service after changes take effect means you accept the updated policy.

Privacy questions, complaints, or data rights requests? Email us at contact@levalock.com. We respond to all valid requests within 30 days.