Privacy Policy

Our primary standard is UK GDPR. Protections for other jurisdictions are layered on top. Barota Ltd is the data controller.

1. Data we collect and why

• Account data (phone, name, username, date of birth, photo, bio, location, email, device fingerprint, IP, declaration): legal basis is contract performance and legal obligation.
• Content data (posts, photos, videos, messages, listings): contract performance.
• Transaction data (records stored by Barota; card details are processed by Stripe only): contract performance and legal obligation.
• Communications data (messages stored, not read except for safety or legal reasons): contract performance.
• Usage data (pages, features, searches, device info, IP-derived location): legitimate interests.
• Location data (IP-derived approximate location, never precise GPS without consent): legitimate interests and consent.
• Special category data (dating and matrimonial profiles may contain sexual orientation, religion or ethnicity): explicit consent, visible only to the relevant section, never used for advertising.
• Age-assurance data (the result of an age-estimation or identity-verification check from our verification partners, and, where an account is removed for being under 18, a one-way hash of the identity document used): legal basis is legal obligation and legitimate interests in keeping under-18s off an adults-only platform. We do not retain the underlying facial image or document number; those are processed by our verification partner.
• Identity-check data (every member completes an identity check at sign-up through Stripe Identity: we keep the result, your date of birth as it appears on the document, the country that issued the document, and a keyed one-way reference that ties the document to your account; we check the issuing country against UK, EU and US sanctions lists and keep only the country code if it matches): legal basis is legal obligation and legitimate interests in one real, adult person per account.
• Verification records and documents (if you ask Barota to check a business registration, a professional credential or a Hub's authority: the details you give, the document you upload, and the Verification team's decision and its reason; for a work-email proof we keep only the email domain, never the address): legal basis is contract performance. Documents are stored privately. Only you and Barota's Verification team can open one, and every time the team opens a document it is logged. A document is never shown publicly; the public sees only the badge.

2. Data sharing

We share data only with service providers who help us run Barota: Stripe (payments and identity verification), Yoti (age estimation), Twilio (SMS), Resend (email), Supabase (hosting) and Vercel (deployment, and the approximate location, country and city, that it derives from your IP address; to recognise a VPN or data-centre connection we check that address against a public list held on Barota’s own systems, and it is not sent to anyone else); and with law enforcement under valid legal process only. Your data is never sold. Ever.

3. International transfers

Data may be processed outside the UK by our service providers (Stripe US, Twilio US, Resend US). These transfers are protected by Standard Contractual Clauses and UK adequacy decisions.

4. Retention

Active account data is retained while your account is active. Deleted account data is purged within 30 days, except financial records (kept 7 years per HMRC requirements) and data under legal hold. A sign-up that does not complete the identity check within 3 days of the account being created is deleted. A verification document is kept while its check is active, and deleted 30 days after the check is withdrawn, lapses or is refused. The record that the check happened, and its outcome, is kept.

Where Barota reports suspected child sexual abuse material to an authority, the case record (the decisions, the reasons, who reviewed it, the authority's reference and a fingerprint of the file, never the material itself) is kept for 6 years after the case closes. Where reviewers find it was not abuse material, the record is deleted 1 year after the case closes. The material itself is removed from view at once. It is kept only where the law requires it to be preserved (for example, one year from a report in the United States), in sealed storage that no member or reviewer can open, released only to the authority or to police under valid legal process, and then deleted.

5. Your rights under UK GDPR

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. We respond within 30 days. Contact privacy@barota.co.

6. Rights in other jurisdictions

• EU GDPR: the same rights as UK GDPR for EU residents.
• CCPA (California): right to know, right to delete, right to opt out of sale (Barota does not sell data), and right to non-discrimination. Contact privacy@barota.co.
• Australia Privacy Act 1988: access and correction rights; complaints via privacy@barota.co then the Australian Information Commissioner if unresolved.
• India DPDPA 2023: access, correction, erasure and grievance redressal. Point of contact for Indian users: privacy@barota.co. Response within 30 days.
• Pakistan PECA 2016: complaint process via privacy@barota.co. Barota cooperates with the Pakistan FIA when presented with valid legal process.

7. Children

Barota is for adults aged 18 and over; we do not permit under-18 accounts. We operate age-assurance measures and may verify age using an age-estimation check or an identity document handled by our verification partners. Where we remove an account for being under 18, we retain only a one-way hash of the identity document to prevent immediate re-registration, and that record lifts on the person's eighteenth birthday.

8. Complaints

UK users can complain to the ICO at ico.org.uk. EU users can complain to their national supervisory authority. Australian users can complain to the OAIC. Indian users can complain to the Data Protection Board of India when operational.

9. Contact

privacy@barota.co