Privacy Policy

1. Who is responsible for your data

HookupAI is the data controller for personal data processed through HookupAI. Contact us about privacy, or to reach our Data Protection Officer, using the details below.

2. What we collect

• Account data: email, phone number, display name, password hash (managed by our authentication provider), sign-in method, two-factor settings, role.
• Age and identity verification (KYC): date of birth, images of government-issued ID, selfies or liveness images, the verification outcome, reviewer notes and timestamps.
• Profile and content: photos, videos, descriptions, rates, location (town/area you choose to publish), services, reviews and forum posts.
• Communications: messages between users, booking requests, support tickets, reports and content-removal requests.
• AI companion conversations: the messages you send to and receive from AI companions, media requests, and usage counts.
• Payments: wallet ledger, top-ups, subscriptions, payouts, transaction references and the phone number or email used with the payment provider. We do not store full card numbers.
• Technical data: IP address, approximate country (from our hosting provider), device and browser data, security and error logs.

3. Sensitive personal data and explicit consent

Using an adult platform can reveal information about your sex life or sexual orientation, and verification involves biometric-type images (ID photos and selfies). These are sensitive personal data under the Data Protection Act, 2019. We process them only on the basis of your explicit consent, which you give when you register, complete verification, or publish a profile, and where necessary to establish, exercise or defend legal claims or comply with the law (for example age-verification and record-keeping duties).

You can withdraw consent at any time by deleting the relevant content or your account. Withdrawal does not affect processing already carried out, and we may need to keep verification records as explained in section 7.

4. How and why we use data

• To provide the service you request — accounts, listings, messaging, bookings, AI chat, payments (contract).
• To verify that every advertiser and creator is an adult and is who they claim to be, and to prevent the exploitation of minors and non-consenting people (legal obligation, explicit consent, legitimate interests in safety).
• To moderate content, investigate reports and prevent fraud, chargebacks and abuse (legitimate interests, legal obligation).
• To keep accounting and tax records (legal obligation).
• To send service emails and, only if you opt in, notifications (contract, consent).
• To keep the platform secure and fix errors (legitimate interests).

We do not sell personal data, and we do not use your data for third-party advertising.

5. AI chat processing

When you chat with an AI companion, your messages and recent conversation context are sent to our AI providers (OpenRouter and the model providers it routes requests to, and for images and voice, Replicate, ElevenLabs or Speechify) to generate a reply. We configure providers not to use your conversations to train their models where that option is available. Conversations are stored in your account so you can continue them, and may be automatically screened — and in limited cases reviewed by trained staff — to enforce our Acceptable Use Policy (for example to block content involving minors). AI companions are fictional; do not share information in a chat that you would not want processed in this way.

6. Who we share data with

We share personal data only with: other users, to the extent you publish it or send it to them; service providers (sub-processors) acting on our instructions; payment providers to complete transactions; professional advisers; and law-enforcement or regulators where required by law or to protect someone from serious harm (including reports of suspected child sexual abuse material).

Several of these providers store or process data outside Kenya (for example in the European Union or United States). Where we transfer data abroad we rely on the safeguards required by sections 48–50 of the Data Protection Act, 2019, such as contractual protections, or on your consent.

7. How long we keep data

• Age and identity verification records (outcome, date of birth, document type, reviewer and timestamps) for advertisers and creators: 7 years after the account closes or the content is removed, to meet record-keeping and legal-claim obligations. Raw ID and selfie images are deleted after a shorter, configured period once a decision is made, unless they are needed for an open investigation.
• Payment and accounting records: 7 years, as required by Kenyan tax law.
• Account and profile data: for as long as your account is open; deleted or anonymised within 30 days of account deletion, except as listed here.
• Messages and AI chat history: while your account is open, or until you delete them.
• Reports, moderation and content-removal records: up to 7 years, and longer where linked to a law-enforcement matter.
• Security and server logs: typically up to 90 days.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you;
• rectify inaccurate or incomplete data — most of it directly in your settings;
• erasure — delete your account from your account settings, or ask us to delete specific data, subject to the retention duties above;
• data portability — export your data from your account settings;
• object to, or ask us to restrict, processing based on legitimate interests;
• withdraw consent at any time.

Make a request through the contact details in section 1. We will respond within the period required by law (generally 7–14 days for most requests) and may need to verify your identity first.

If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC), Kenya — www.odpc.go.ke. We would appreciate the chance to resolve your concern first.

9. Cookies and local storage

We use essential cookies and device storage needed to run the service, plus two first-party measurement cookies that tell us which link brought you here. Advertising pixels (Meta, TikTok, Snap or Google Ads, where we run campaigns) load only if you choose "Accept marketing" in the cookie banner; they record that you started a chat, completed age verification or made a first purchase, so we can measure our ads. Your choice is kept in the hk_consent cookie for a year; clear it to choose again.

• session — keeps you signed in (HttpOnly, secure).
• csrf_token — protects forms against cross-site request forgery.
• market_v1 — remembers the country market you are browsing.
• age_ok — records that you confirmed you are 18 or older (HttpOnly, signed, 30 days).
• age_ok_ui — a non-identifying companion flag (30 days) that lets public pages know the 18+ confirmation was given, so they can show profile thumbnails.
• geo_country — your country code, used to suggest the site for your region (1 day).
• hk_vid — a random visitor ID (1 year), so a visit that continues in your browser after leaving an app's built-in browser counts as one visit.
• hk_attr — the campaign label of the link you first arrived from, such as "instagram" (HttpOnly, 30 days). It holds no personal data and is copied to your account when you sign in so we can see which channels bring members.
• Theme preference (light/dark) and search preferences, stored on your device.
• Sign-in state kept by our authentication provider in your browser storage.

Our hosting provider's analytics are aggregated and do not use cookies to track you across sites.

10. Security

We use encryption in transit, access controls, private storage for verification documents, audit logging for staff access, rate limiting and optional two-factor authentication. No system is perfectly secure; if we suffer a personal data breach that is likely to put you at risk, we will notify you and the ODPC as the law requires.

11. Children

HookupAI is strictly for adults. We do not knowingly collect data from anyone under 18. If you believe a minor is using the service or appears in any content, report it immediately through our content removal form.

12. Changes

We will post any update here with a new “last updated” date and, for material changes, notify you in the product or by email.