1. Who operates the data
The data controller is ELHAKIM (PTY) LTD, company number 2021/622573/07. Registered office shown in the supplied CIPC company record: 50 Von Brandis Street, Marshalltown, Johannesburg CBD, Gauteng, 2000, South Africa. Privacy and rights requests: privacy@ahdna.co.
Recorded membership-request legal bundle: 2026-08-25-global-launch-v2. See the current processor schedule (2026-09-08-processors-v5) and international transfer notice (2026-08-25-transfers-v3). A membership request is not membership acceptance; the supplied record completes the controller identity and registered-office item, while the remaining operating gates stay independent.
2. Data processed
Accepted membership-request Privacy Notice version: 2026-08-24-v4.
- Membership request: an encrypted email address, a secret-keyed HMAC lookup value, an ISO country-of-residence code, locale, versions of the 18+, privacy and contact-purpose confirmations, consent/status/expiry times, and one-way hashes of withdrawal capabilities. This does not create an account. The request does not collect a name, phone number, precise address, identity document, or raw IP address.
- Account and security: signed runtime identity, a pseudonymous member ID, authorised roles, policy consent versions, and abuse limits.
- Profile and preferences: public alias, stated age, country, language, faith path, family intentions, education, smoking, marriage timing, hard boundaries, and priorities.
- Verification: check kind and state, request/decision/expiry dates, and reason code. External review references are stored only as SHA-256 hashes. The current member screen uploads no identity document.
- Relationships: suggestions, interests, matches, message text and reads, family invitations, and a hashed invitation token. Plain tokens appear once and never return in list responses.
- Community and safety: posts, comments, reports, evidence snapshots, blocks, moderation decisions, and appeals.
- Support and operations: request subject/body/status/replies, idempotency keys, and technical records needed for safety and diagnostics.
3. Purposes
Data supports membership-request review and operates the account, profile, discovery, communication, invitations, and community; applies preferences; prevents duplicate or abusive requests; enables reporting, blocking, moderation, appeals, and support; and fulfils export and deletion. Ahdna does not sell data or use behavioural advertising. The current release has no payments.
4. Hosting, processors, and transfers
The public production path runs on Hostinger with Supabase sign-in and PostgreSQL in the verified primary region eu-west-1 (Ireland). The current OpenAI Sites deployment is an owner-only preview, not the production intake path, and is not authorised to hold production membership data.
The approved request scope is: all countries worldwide. Processor and transfer details are published above under retention policy 2026-08-13-retention-v1.
5. Visibility and retention
A profile enters discovery only after onboarding, discovery opt-in, and an unexpired verified age state. Posts are public under an alias. Messages are shared only between mutually matched members. Family tokens travel in URL fragments, are stored locally for less than the invitation lifetime, and then clear.
A membership request is not visible to members and never enters discovery. A valid withdrawal deletes the encrypted contact record immediately. Detached one-way hashes of its withdrawal capabilities may remain only until their original bounded expiry, without an email or contact record, so a delayed retry cannot recreate the request. A minimal technical audit event without the email or contact record may remain for no more than 365 days. Otherwise, the contact record expires 180 days after the latest request. A “contacted” or “invited” status does not create unlimited retention.
Account deletion removes the profile, preferences, current verification check and consent records, non-shared interests and suggestions, invitations, support records, the account-linked release-interest record, block records created by the deleting member, and every message row and body authored by that member. It does not delete messages authored by the other member. Instead, the shared conversation and match are closed while the counterparty's messages and closed conversation/match metadata remain. Block records created by the other member and verification-attempt records linked to a moderation case or decision also remain. A minimal security tombstone, safety reports, and moderation decisions and audit history remain under restricted controls.
No final period is stated for these retained categories before approval. See the Data Retention Schedule and approval status. Public production launch remains closed until the final schedule is approved for the relevant categories and markets, its effective version is published, and it is connected to deletion, backups and restore, alongside the applicable transfer assessment.
6. Export, deletion, and choices
The Privacy center downloads a JSON export for the stated Ahdna account scope and deletes the Ahdna account after an exact confirmation phrase. The export streams in memory-bounded pages; concurrent changes may reflect nearby moments rather than one transactional snapshot. In the production Android sign-in path, the transaction removes the categories described above and the associated Supabase Auth identity, including active provider sessions; if that complete operation cannot be secured, it fails without committing a partial deletion. The server returns an explicit retained-category list that includes counterparty messages, closed relationship metadata, counterparty-created block records, verification attempts linked to a moderation case or decision, safety and moderation records, and the minimal deletion tombstone.
The membership request is separate from an account; account deletion is not presented as deletion of an anonymously linked request. You can withdraw it with the secret capability returned once to your browser, or through the published privacy channel after appropriate verification. A member may edit the profile, turn off discovery, withdraw an interest, revoke a family invitation, unblock a member, and track a report or appeal. Open a referenced support request for correction, objection, or questions.
7. Age and safety
The service is not for anyone under 18. Suspected under-age use pauses discovery and opens safety review. Never place identity documents, phone numbers, email addresses, or financial details in a profile, message, or report.
8. Abuse verification
Cloudflare Turnstile is used with a valid production key to protect member and reviewer sign-in on the web and Android app. On Android, Ahdna's verification page opens inside a WebView; sign-in protection still operates when membership-request intake is closed. The membership-request form also uses Turnstile when enabled.
Cloudflare may process the network address, User-Agent, TLS fingerprint and other technical signals for human and abuse verification under the Processor Schedule (2026-09-08-processors-v5). Ahdna does not include the email, password, profile or message content in the data it passes to the verification widget. Not storing a raw IP address in the membership-request record or member profile does not mean that authentication, protection and hosting providers do not process technical data.