Legal

Privacy Policy

Effective: 2 June 2025 · Last updated: 2 June 2025 · Version 2.0

NDPA / NDPR Compliant

GDPR Compliant

CCPA / CPRA Compliant

AES-256 Encrypted

1. Overview and Scope

This Privacy Policy explains how Forj ("we", "us", or "our") collects, uses, stores, discloses, and safeguards personal information when individuals access or use our dating application, website, and any related features, communications, or services (collectively, the "Service"). This Policy applies to all users of the Service, regardless of profession, background, or location, and governs the processing of personal data in connection with account registration, profile creation, user interactions, and overall platform operations.

We recognize that dating platforms involve the sharing of personal and, in some cases, sensitive information, and that users may have varying expectations regarding privacy, discretion, and confidentiality. Accordingly, we apply appropriate technical, organizational, and administrative safeguards to protect personal data and to ensure that such data is processed in a lawful, fair, and transparent manner. Where personal information qualifies as sensitive under applicable data protection laws, additional protections are applied.

This Privacy Policy describes the categories of personal information we collect, the purposes and legal bases for processing such information, how and when information may be disclosed to third parties, the measures we take to safeguard personal data, and the rights available to users in relation to their information under applicable law. This Policy should be read together with our Terms of Service and any supplemental privacy notices made available through the Service.

By creating an account, accessing, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy. Where required by law, we will obtain your explicit consent before processing certain categories of personal data, and you may withdraw such consent at any time through your account settings or by contacting us.

2. Categories of Personal Data Collected

In order to provide, operate, and improve the Service, Forj collects and processes certain categories of personal information. The nature and extent of the data collected depend on how users interact with the Service, the features they choose to use, and applicable legal requirements. We are committed to collecting only data that is relevant, adequate, and necessary for the purposes described in this Privacy Policy.

2.1 Information Provided Directly by Users

We collect personal information that users voluntarily provide when creating an account, completing a profile, communicating with other users, or contacting us for support. This may include:

Identifying information such as name, username, email address, date of birth, and login credentials
Profile information, including photographs, biographical details, interests, gender identity, and dating preferences
Content generated or shared by users, such as messages, images, or other materials exchanged through the Service
Information submitted for verification purposes, including age or identity confirmation where required
Communications with customer support, feedback, or responses to surveys or promotions

Users are not required to provide all information listed above; however, certain information may be necessary to access specific features of the Service.

2.2 Information Collected Automatically Through Use of the Service

When users access or use the Service, certain information is collected automatically through technical means. This may include:

Device and connection information, such as IP address, device type, operating system, browser type, and language settings
Usage and interaction data, including login activity, session duration, feature usage, matches, and in-app interactions
Log and diagnostic data used to monitor system performance, troubleshoot issues, and enhance security
Approximate location information derived from IP address or device settings (for example, city or region-level location)

We do not collect precise real-time location data unless users expressly enable such functionality within the Service.

2.3 Cookies and Similar Tracking Technologies

Where applicable, we use cookies, software development kits (SDKs), and similar technologies to support core functionality, enhance user experience, and analyse platform performance. These technologies may be used to:

Remember user preferences and settings
Authenticate users and maintain secure sessions
Understand usage patterns and improve features

Users may manage cookie preferences through their device or browser settings, subject to applicable law. See our Cookie Policy for full details.

2.4 Sensitive Personal Data

Certain categories of information processed by the Service may be considered sensitive or special category data under applicable data protection laws. This may include:

Sexual orientation or dating preferences
Profile photographs and videos
Biometric data, where identity or authenticity verification features are enabled

Such information is processed only where necessary for the operation of the Service and, where required by law, only with the user's explicit consent. Users may withdraw consent for the processing of sensitive personal data at any time by contacting us, subject to legal limitations.

2.5 Information from Third Parties

In limited circumstances, we may receive information about users from third-party sources, including:

Authentication or verification providers
Payment processors, in connection with subscriptions or premium features
Service providers assisting with safety, moderation, or fraud prevention

Any such information is processed in accordance with this Privacy Policy and applicable data protection laws.

2.6 Data Minimization and Accuracy

We take reasonable steps to ensure that personal data collected is accurate, up to date, and limited to what is necessary for the purposes for which it is processed. Users may review, update, or correct their personal information at any time through their account settings or by contacting us.

3. Purposes of Processing Personal Data

Forj processes personal data solely for specific, explicit, and legitimate purposes in accordance with applicable data protection laws. We collect and use personal information only to the extent necessary to operate the Service, provide users with a secure and functional dating experience, and meet our legal and regulatory obligations.

3.1 Account Creation and Administration

We process personal data to enable users to register for, access, and manage accounts on the Service. This includes verifying eligibility, authenticating users, maintaining account security, and providing access to features and functionalities associated with user accounts.

3.2 Matching, Communication, and User Interaction

Personal data is processed to facilitate core dating functionalities, including profile discovery, matching, messaging, and other forms of interaction between users. Information such as preferences, interests, and activity data is used to support compatibility assessments and to enable meaningful connections within the platform.

3.3 Personalization and User Experience Enhancement

We process personal data to personalize content, recommendations, and features based on user preferences and usage patterns. This allows us to tailor the Service to individual users, improve relevance, and enhance overall usability, while ensuring that such processing remains proportionate and consistent with user expectations.

3.4 Safety, Security, and Abuse Prevention

We process personal data to maintain the safety and integrity of the Service. This includes detecting, investigating, and preventing fraudulent activity, harassment, misuse, or violations of our Terms of Service. Automated and manual moderation tools may be used to support these objectives, with appropriate safeguards and human oversight.

3.5 Service Improvement and Development

Personal data may be used to analyze usage trends, evaluate performance, and develop new features or improvements to existing functionalities. This processing enables us to troubleshoot issues, conduct research and analytics, and enhance the reliability and efficiency of the Service.

3.6 Communications and Service-Related Notifications

We process personal data to communicate with users regarding account-related matters, service updates, security notifications, policy changes, and customer support responses. Such communications are limited to what is necessary for the operation and administration of the Service.

3.7 Legal, Regulatory, and Compliance Obligations

We process personal data as necessary to comply with applicable laws, regulations, lawful requests from authorities, and to establish, exercise, or defend legal claims. This includes maintaining records required for tax, accounting, or regulatory compliance purposes.

4. Legal Basis for Processing (GDPR — EU & UK Users)

For users located in the European Union and the United Kingdom, Forj processes personal data in accordance with the lawful bases set out in the General Data Protection Regulation (GDPR) and the UK GDPR. We ensure that all processing activities are supported by at least one valid legal basis and that such processing is necessary, proportionate, and consistent with the purposes described in this Privacy Policy.

4.1 Consent

We rely on user consent where required by law, particularly in relation to:

The processing of sensitive or special category personal data, such as dating preferences, sexual orientation, profile photographs, or biometric data
Optional features that are not essential to the operation of the Service
Direct marketing communications, where applicable

Where consent is relied upon, it is obtained in a clear, specific, and informed manner. Users may withdraw consent at any time through their account settings or by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

4.2 Performance of a Contract

We process personal data where such processing is necessary for the performance of a contract between the user and Forj or in order to take steps at the user's request prior to entering into such a contract. This includes processing required to:

Create and manage user accounts
Enable matching, communication, and interactions between users
Provide access to features and functionalities of the Service
Process subscriptions or premium services, where applicable

Without this processing, we would be unable to deliver the core functionality of the Service.

4.3 Legitimate Interests

We process certain personal data on the basis of our legitimate interests, provided that such interests are not overridden by the rights and freedoms of users. Legitimate interests may include:

Ensuring the safety, security, and integrity of the Service
Preventing fraud, abuse, and violations of our Terms of Service
Improving and optimizing platform functionality and performance
Conducting analytics and internal research to enhance user experience

Where we rely on legitimate interests, we conduct a balancing assessment to ensure that processing is fair, reasonable, and aligned with user expectations.

4.4 Legal Obligations

We process personal data where necessary to comply with legal obligations to which we are subject, including:

Compliance with applicable data protection, consumer protection, and online safety laws
Responding to lawful requests from public authorities
Maintaining records required for regulatory, tax, or accounting purposes
Establishing, exercising, or defending legal claims

5. Disclosure of Personal Information

Forj is committed to maintaining user trust and transparency in how personal information is shared. We do not sell personal data and do not disclose personal information to third parties except as described in this Privacy Policy and where such disclosure is necessary, lawful, and as required under any statute or judgment of a court of law.

5.1 Disclosure to Service Providers

We may disclose personal information to trusted third-party service providers who perform services on our behalf and support the operation of the Service. These may include providers of:

Cloud hosting and data storage
Analytics and performance monitoring
Content moderation and trust-and-safety services
Customer support and communication tools
Payment processing (where applicable)

Such service providers are permitted to process personal data only for the purposes of performing services on our behalf and in accordance with our instructions.

5.2 Safety, Security, and Fraud Prevention

We may disclose personal information to safety, security, and fraud-prevention partners where necessary to:

Detect, investigate, and prevent fraudulent or unlawful activity
Enforce our Terms of Service and community standards
Protect the rights, safety, and integrity of users and the platform

Disclosures for these purposes are limited to what is strictly necessary and are subject to appropriate safeguards.

5.3 Legal and Regulatory Disclosures

We may disclose personal information where required to comply with applicable laws, regulations, legal processes, or lawful requests from public authorities, including courts or regulatory agencies. This may include disclosures necessary to:

Respond to subpoenas, court orders, or legal claims
Meet statutory or regulatory reporting obligations
Protect our legal rights or the rights of others

Where permitted by law, we will take reasonable steps to notify users of such disclosures.

5.4 Disclosure with User Consent

We may disclose personal information to third parties where users have provided their explicit and informed consent. Such disclosures may occur, for example, where users choose to integrate third-party services or participate in optional features requiring data sharing. Users may withdraw consent for such disclosures at any time, subject to legal limitations.

5.5 Data Protection Obligations of Third Parties

All third parties that receive personal information are required to:

Process personal data in accordance with applicable data protection laws
Implement appropriate technical and organizational security measures
Maintain confidentiality and restrict access to authorized personnel only

Where required, we enter into data processing agreements to ensure adequate protection of personal information.

6. User Privacy Controls

Forj provides users with meaningful and accessible controls to manage how their personal information is displayed, used, and shared within the Service. These controls are designed to empower users to tailor their privacy settings according to their individual preferences while ensuring a safe and respectful environment for all users.

6.1 Profile Visibility and Discoverability

Users may control the visibility of their profiles and the extent to which they are discoverable by other users. This includes options to:

Limit who can view profile information
Manage discoverability based on preferences or matching criteria
Temporarily hide or deactivate profile visibility without deleting the account

6.2 Interaction and Messaging Controls

Users may determine who is permitted to communicate or interact with them on the Service. These controls may include:

Restricting messaging to matched users
Managing who can initiate contact or send media
Adjusting read receipts or interaction indicators, where available

6.3 Location Visibility

Users may manage how location information is used and displayed within the Service. Location settings are designed to:

Display only approximate location information
Allow users to adjust or disable location-based features
Provide transparency regarding when location data is used

Precise location data is not shared without the user's explicit consent.

6.4 Blocking, Reporting, and Safety Tools

Users may block or report other users at any time. These tools enable users to:

Prevent further interaction with specific users
Report behavior that violates community standards or applicable laws
Support moderation, safety reviews, and enforcement actions

Reports are reviewed in accordance with our safety and moderation procedures.

6.5 Marketing and Notification Preferences

Users may control how and whether they receive communications from us, including:

Email, push, or in-app notifications
Marketing or promotional communications
Personalized content or recommendations, where applicable

Users may update their preferences at any time through account settings.

7. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes outlined in this Policy. Upon account deletion, user profiles and associated data are deleted or anonymized, subject to limited retention required for legal or safety reasons. See Section 16 for our detailed retention schedule.

8. Data Security Measures

We implement commercially appropriate technical and organizational safeguards, including:

Data encryption: All data in transit is encrypted using TLS 1.3. All data at rest is encrypted using AES-256.
Restricted access controls: Access to user data within Forj is restricted to authorised personnel only, on a need-to-know basis.
Secure storage environments: Our infrastructure is protected by Cloudflare (DDoS, WAF) and regular penetration testing.
Ongoing monitoring and risk assessments: Regular security audits and vulnerability assessments are conducted.

Despite these measures, no system can be guaranteed to be completely secure. In the event of a data breach that poses a risk to your rights, we will notify affected users and the Nigeria Data Protection Commission (NDPC) within 72 hours, as required by the NDPA.

10. California Privacy Rights (CCPA / CPRA)

This section applies only to residents of the State of California and is provided in accordance with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

10.1 Categories of Personal Information Collected

California residents have the right to request information regarding the categories of personal information we collect, the sources of such information, the purposes for which it is used, and the categories of third parties with whom it is disclosed.

10.2 Right to Know and Access

You have the right to request access to the specific pieces of personal information we have collected about you during the applicable statutory period, subject to verification of your identity and applicable legal exceptions.

10.3 Right to Delete

You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions permitted by law, such as where retention is necessary to complete a transaction, detect security incidents, comply with legal obligations, or exercise legal rights.

10.4 Right to Correct

You have the right to request correction of inaccurate personal information maintained about you, taking into account the nature of the information and the purposes for which it is processed.

10.5 Right to Opt Out of Sharing for Targeted Advertising

You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising or other targeted advertising purposes. Where applicable, opt-out mechanisms will be made available through the Service or by submitting a request.

10.6 Right to Limit the Use of Sensitive Personal Information

Where we process sensitive personal information as defined under the CPRA, you have the right to request that such information be used only for purposes permitted by law, including those necessary to provide the Service.

10.7 Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising any of your rights under the CCPA or CPRA. We will not deny services, charge different prices, or provide a different level of service solely because you exercised your privacy rights.

10.8 Exercising California Privacy Rights

California residents may submit verifiable consumer requests by contacting us at admin@forj.online. We may require verification of your identity before responding to a request and will respond within the timeframes required by applicable law.

11. International Data Transfers

Personal data collected through the Service may be transferred to, stored in, and processed in countries outside your country of residence, including jurisdictions that may not provide the same level of data protection as your local laws. Such transfers occur for purposes including service delivery, data hosting, customer support, security operations, and technical maintenance.

Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, Forj ensures that appropriate safeguards are implemented in accordance with applicable data protection laws. These safeguards may include:

Reliance on adequacy decisions issued by relevant authorities
The use of Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner's Office
The implementation of supplementary technical and organizational measures designed to protect personal data

We take reasonable steps to ensure that all recipients of personal data, regardless of location, are subject to confidentiality obligations and data protection standards consistent with this Privacy Policy.

By using the Service, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside your country of residence in accordance with the safeguards described above.

12. Age Restriction and Children's Privacy

The Service is intended solely for individuals eighteen (18) years of age or older. We do not permit the use of the Service by minors and do not knowingly collect, solicit, or process personal data relating to individuals under the age of 18.

Reasonable measures are implemented to restrict access by minors, including age-declaration requirements during account registration and monitoring mechanisms designed to identify and remove underage accounts. If we become aware that personal data has been collected from a minor, we will take appropriate steps to promptly delete such information and terminate the associated account. Individuals who provide false age information shall be liable to prosecution in accordance with the extant laws in the jurisdiction of residence.

Parents or legal guardians who believe that a minor has provided personal data through the Service may contact us at admin@forj.online so that appropriate action can be taken without delay. Forj shall be held harmless for any loss resulting from such misrepresentation.

13. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal or regulatory requirements, or the features of the Service. When we make changes, we will revise the "Last Updated" date at the top of this Policy.

Where changes are material and affect how personal data is processed, we will take reasonable steps to notify users in advance through the Service, by email, or by other appropriate means, as required by applicable law. Continued use of the Service after an updated Privacy Policy becomes effective constitutes acknowledgment of the revised terms, except where explicit consent is required.

Users are encouraged to review this Privacy Policy periodically to remain informed about how their personal information is protected.

14. Contact Information and Data Protection Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, you may contact us using the details below:

Email: admin@forj.online

This contact point may be used to:

Submit inquiries regarding data protection practices
Exercise your rights under applicable data protection laws
Request access to, correction of, or deletion of personal data
Raise concerns or complaints related to privacy or data security

Where required by law, Forj has appointed a Data Protection Officer or designated privacy contact responsible for overseeing compliance with applicable data protection regulations. Communications submitted through the contact details above will be handled in a timely and confidential manner in accordance with applicable laws.

15. Nigeria Data Protection Rights (NDPA / NDPR)

This section applies to all users located in the Federal Republic of Nigeria and is provided in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR) issued by the Nigeria Data Protection Commission (NDPC). Forj Technology Ltd is registered with the NDPC as a data controller and has appointed a Data Protection Officer (DPO) in compliance with section 32 of the NDPA. The DPO may be contacted at admin@forj.online.

15.1 Lawful Basis for Processing

Forj processes personal data of Nigerian users on the following lawful bases under the NDPA:

(a) Consent, freely given, specific, informed, and unambiguous, including explicit consent for the processing of sensitive personal data such as dating preferences and biometric data
(b) Performance of a contract to which the data subject is a party, including account registration, matching, and messaging
(c) Compliance with a legal obligation applicable to Forj as a data controller
(d) Legitimate interests pursued by Forj or a third party, provided such interests are not overridden by the rights and freedoms of the data subject

15.2 Rights of Nigerian Data Subjects

Under the NDPA, Nigerian users are entitled to the following rights in relation to their personal data processed by Forj:

Right of Access: You have the right to obtain confirmation of whether your personal data is being processed and, if so, to receive a copy of the data and information about how it is used.
Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data without undue delay.
Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent is withdrawn and no other lawful basis applies, or where the data has been unlawfully processed, subject to applicable legal limitations.
Right to Object: You have the right to object to the processing of your personal data where such processing is based on legitimate interests or is carried out for direct marketing purposes.
Right to Data Portability: You have the right to receive personal data you have provided to Forj in a structured, commonly used, and machine-readable format.

15.3 Exercising Your Rights and Filing Complaints

Requests to exercise any of the rights listed above may be submitted by contacting our Data Protection Officer at admin@forj.online. We will respond within 30 days of receipt of a verifiable request, as required under the NDPA. Where a request cannot be fulfilled within this period, we will notify you and provide a revised timeframe. If you are dissatisfied with our response or believe that your personal data is being processed in violation of applicable law, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.

16. Data Retention Schedule

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with applicable legal obligations, and to resolve disputes or enforce our agreements. The following schedule sets out the specific retention periods applicable to the principal categories of personal data we process. Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.

Category of Personal Data	Retention Period	Basis / Notes
Account and profile data	Duration of account + 30 days post-deletion	Contract performance; 30-day grace period for account recovery
Messages and in-app communications	Duration of account + 30 days post-deletion	Safety investigation and dispute resolution
Payment and transaction records	7 years from transaction date	Nigerian tax and financial records obligations (FIRS requirements)
Safety and abuse reports; moderation records	3 years from report date	Platform safety; legal claims limitation periods
Age and identity verification records	Duration of account + 1 year post-deletion	Online safety compliance; underage account detection
Technical logs and usage data	12 months on a rolling basis	Security monitoring; service improvement
Customer support records	2 years from closure of support ticket	Legitimate interests; quality assurance
Consent records	5 years from withdrawal or account deletion	Regulatory accountability; demonstrating lawfulness of processing

Where personal data is retained beyond account deletion for legal or safety reasons, access to that data is restricted to authorized personnel and the data is not used for any commercial purpose. Users may request information about applicable retention periods by contacting us at admin@forj.online.

17. Data Breach Notification

We maintain incident detection, response, and reporting procedures designed to identify and contain personal data breaches promptly. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of users, we will notify the relevant supervisory authorities and, where required, affected users in accordance with applicable law.

17.1 Regulatory Notification

Where a reportable breach occurs, we will notify the applicable supervisory authority within the timeframes required by law: within 72 hours of becoming aware of the breach under the GDPR and UK GDPR, and as soon as reasonably practicable and not later than 72 hours under the NDPA. Notification to the NDPC will include the nature of the breach, the categories and approximate number of data subjects and personal data records affected, the likely consequences of the breach, and the measures taken or proposed to address it. Where notification cannot be made within the applicable deadline, we will provide information in phases and state the reasons for any delay.

17.2 User Notification

Where a breach is likely to result in a high risk to the rights and freedoms of affected users, we will notify those users directly without undue delay. Such notification will be communicated via the primary email address associated with the user's account or through a prominent in-app notice, and will include, in clear and plain language: a description of the nature of the breach; the name and contact details of our Data Protection Officer; the likely consequences of the breach; and the steps we have taken or propose to take to address the breach and mitigate its effects. Where direct notification would involve disproportionate effort, we may instead publish a public notice in a prominent location on the Service.

17.3 Internal Breach Records

We maintain an internal register of all personal data breaches, including those that do not require external notification, documenting the facts relating to the breach, its effects, and the remedial action taken. This register is maintained for a minimum of five years and is made available to supervisory authorities upon request.

18. Automated Decision-Making and Profiling

Forj uses automated systems to process personal data in connection with core features of the Service. This section explains how those systems work, the safeguards we apply, and the rights available to users in relation to automated processing.

18.1 How We Use Automated Processing

The Service uses automated processing and profiling in the following contexts:

Matching and discovery: Our matching algorithm analyses profile data, stated preferences, interaction history, and compatibility signals to rank and surface potential matches in the discovery feed. The algorithm uses these inputs to generate a compatibility score that determines the order in which profiles are presented to a user. No match is imposed; users retain full control over whether to engage with any suggested profile.
Content moderation: Automated tools are used to detect content or behaviour that may violate our Terms of Service, including abusive messaging, prohibited images, and fraudulent account activity. Automated flags are subject to human review before any enforcement action is taken, such as a warning, suspension, or account termination.
Fraud and safety screening: Automated systems analyse account registration patterns and behavioural signals to detect fake or fraudulent accounts. Where an account is automatically flagged, it is placed under review and a member of our Trust and Safety team makes any final determination on account status.

18.2 Solely Automated Decisions with Legal or Significant Effects

Where automated processing produces a decision that has a legal effect on a user, or similarly significantly affects them — such as a decision to suspend or terminate an account — we ensure that such decisions are not made solely by automated means without human review. Users have the right to: (a) request that the decision be reviewed by a member of our team; (b) express their point of view and contest the decision; and (c) receive an explanation of the logic involved in the automated assessment and its significance. Requests for human review may be submitted to admin@forj.online within 30 days of the relevant decision being communicated to the user.

18.3 Safeguards and Bias Mitigation

We take reasonable technical and organizational measures to minimize inaccuracy and unfair bias in automated systems, including periodic audits of matching and moderation algorithms and ongoing monitoring for discriminatory outcomes. Automated processing does not use special category data, such as sexual orientation or religious beliefs, as a ranking or filtering criterion except where such data has been explicitly provided by the user for the purpose of matching and the user has given explicit consent for its use in this manner.