Privacy Policy

FamLoom ("we," "our," or "us"), the proprietor, operator, and ultimate controller of the FamLoom mobile application (the "Application" or "App"), hereby presents this exhaustive, non-exhaustive, and comprehensive policy. This document delineates the complex, multi-layered mechanisms and protocols governing the acquisition, comprehensive cataloging, methodical utilization, systematic processing, secure maintenance, strategic disclosure, cross-border transfer, and eventual disposition of various categories of data, including Personally Identifiable Information (PII) and Non-Personally Identifiable Information (Non-PII), pertaining to our diverse, globally dispersed user base ("User" or "you") when they access, engage with, or otherwise utilize the full suite of functionalities provided by the Application.

This Policy is formulated to address and mitigate liabilities across numerous global jurisdictions and is subject to the interpretive discretion of FamLoom management. By proceeding with the installation, registration, access, or continued use of the Application, you explicitly affirm that you have received, read, comprehended, and unequivocally consent to be legally bound by all terms, clauses, and conditions articulated herein. Non-acceptance of any single provision mandates immediate cessation of Application usage and formal account termination.

1. ⚙️ Principles of Information Acquisition and Categorical Definition

Our data acquisition strategy is executed with deliberate redundancy to ensure all necessary, potential, and foreseeable data points required for the optimal operation of the family-matching service, community integrity, and long-term business intelligence are captured, analyzed, and retained.

A. Data Furnished Voluntarily by the User (Input Data)

This category includes data you actively and consciously submit during the registration process and continuous use of the service:

• 1.1. Account Creation and Verification Data:
  • Electronic Mail Address (Mandatory): The primary digital identifier for securing the account, facilitating two-factor authentication (if enabled), and processing formal administrative, legal, or policy-related communication.
  • Password Hashing: Your chosen credential for account access is stored exclusively as an irreversible cryptographic hash (salted and peppered).
  • Parent/Guardian Demographic PII: Includes your designated name, optional preferred personal identifiers, and non-precise demographic indicators (e.g., categorical age range, self-identified gender).

• 1.2. Profile Enrichment and Matching Data:
  • Family Unit Categorical PII: Generalized data concerning dependent minors, strictly collected in range or category format (e.g., "Child 1: Girl, 4-6 years old; Child 2: Boy, under 2 years"). We strictly prohibit and do not request specific PII of minors (names, exact birthdates) but reserve the right to process this information if inadvertently or unlawfully submitted by the User.
  • Self-Descriptive Text and Preferences: Any narrative text provided in your profile biography, interest keywords, lifestyle markers, and stated preferences for matching criteria (e.g., preferred activity types, proximity radius settings).

• 1.3. User-Generated and Interactive Content (UGC):
  • Visual and Multimedia Content: Any family photographs, videos, or graphical content uploaded. By uploading, you grant us a perpetual, transferable, sub-licensable, worldwide license to host, store, use, display, reproduce, modify, and distribute such content in the context of the Application and its marketing efforts, subject to applicable law.
  • In-App Communications: The content and metadata of messages exchanged through the FamLoom chat platform, including text, images, and attachments. This communication is actively monitored, processed, and retained for the purposes of content moderation, security auditing, and legal compliance.
  • Activity and Event Logistics: All details pertaining to events organized or attended (location descriptors, scheduled parameters, guest lists, RSVPs).

B. Data Acquired Through Passive Technological Means (Usage & Device Data)

This category includes data automatically collected by our servers, systems, and third-party analytical tools:

• 2.1. Telemetry and Usage Logs: Information pertaining to how you interact with the App, including access times, feature utilization frequency, viewing patterns, crash reports, and the complete navigational path taken within the App ("clickstream data").
• 2.2. Device and Technical Specifications Data:
  • IP Address: Stored for security, fraud prevention, and establishing general geographic location.
  • Unique Device Identifiers (UDIDs): Including, but not limited to, Advertising IDs (IDFA, Google Ad ID), platform type (iOS, Android), operating system version, browser type, and device model.
  • Network Information: Mobile carrier, signal strength, and connection type.
• 2.3. Geo-Spatial Data (Location Services):
  • Approximate Location: Derived from IP address or User-input city/postal code.
  • Precise Geolocation: If the User grants explicit permission through their device settings, we process and retain precise GPS coordinates (longitude and latitude) to facilitate advanced proximity-based matching, event localization, and location-specific feature deployment. This data may be collected even when the App is operating in the background, subject to device permissions.

C. Data Acquired from External and Third-Party Sources

In certain, limited circumstances, we may acquire PII from other sources, including:

• 3.1. Other Users: Data provided by other FamLoom Users about you during misconduct reports, dispute resolution processes, or in the context of event organization.
• 3.2. Fraud Detection Providers: Information supplied by external security and fraud prevention firms to assess the risk associated with a User account.
• 3.3. Payment Processors: While we do not store full payment card details, our payment processing partners may provide us with a tokenized identifier and limited transactional data (e.g., last four digits of the card, expiration date) for billing and compliance purposes.

2. 🎯 Legal Basis and Comprehensive Data Processing Objectives

The lawful basis for processing your data is predicated on a combination of Contractual Necessity (to provide the matching service), Legitimate Interests (security, service improvement, internal analytics), Compliance with Legal Obligations, and, where necessary, your explicit Consent.

A. Core Operational Purposes (Contractual Necessity)

• To execute the User matching algorithm and deliver the primary function of the Application.
• To establish, secure, and maintain your User Account and enable seamless login access.
• To facilitate, transmit, and retain User-to-User communications (chat functionality).
• To process and complete any in-App purchases, subscriptions, or financial transactions.

B. Security, Integrity, and Moderation (Legitimate Interests)

• To perpetually monitor, audit, and analyze User behavior and UGC for the detection, investigation, and prevention of fraudulent activities, spam, unauthorized access, and violations of our Terms of Service.
• To enforce our strict 18+ policy and verify User identity and age where deemed necessary.
• To utilize chat content and activity logs to proactively moderate and swiftly respond to all reports of dangerous, harassing, or illegal content or conduct.

C. Internal Analytics and Optimization (Legitimate Interests)

• To conduct extensive research, complex statistical analysis, proprietary data mining, and machine learning exercises to understand market trends, improve our matching effectiveness, and develop new features and services.
• To personalize your experience, including the delivery of tailored content, localized event suggestions, and dynamically adjusted search results.

D. Targeted Communications and Internal Marketing

• To communicate administrative, account-related, and technical information, including policy changes, service updates, and security alerts.
• To conduct internal direct marketing and promotional activities for FamLoom services and affiliated offerings directly within the Application interface, utilizing your profile data and usage patterns for segmentation. This does not constitute a "sale" of data for cross-context behavioral advertising.

3. 🛡️ Data Disclosure, Sharing, and Third-Party Sub-Processing

We adhere to rigorous standards for the disclosure of PII, only sharing data under specific, contractually protected, or legally mandated circumstances.

A. Sharing with Other Users

Your profile information (name, family categorical data, photos, event details, and approximate location) is shared with other Users of the Application to facilitate the connection service. All Users acknowledge that data shared on the platform is inherently public within the closed FamLoom ecosystem and assume all risk associated with such disclosure.

B. Sharing with Service Providers (Data Processors)

We engage selected third-party processors globally to perform essential business functions on our behalf. These entities are meticulously vetted and are contractually prohibited from utilizing your PII for any purpose other than providing the services explicitly defined by FamLoom. Categories of processors include:

• Data hosting and cloud computing providers (e.g., AWS, Azure).
• Payment processing and billing partners.
• Customer support and communication management platforms.
• Data analytics and business intelligence vendors.
• Security, fraud detection, and legal compliance consultants.

C. Corporate Transactions and Restructuring

In the event that FamLoom is involved in a merger, acquisition, financing, asset sale, liquidation, bankruptcy, or transfer of service to another entity, your PII may be disclosed or transferred as part of that transaction, subject to the successor entity agreeing to comply with the protective provisions of this Privacy Policy or a policy offering substantially similar protections.

D. Mandatory Legal Compliance and Enforcement Disclosure

We will disclose PII where required by a valid and enforceable legal order, governmental mandate, subpoena, or to establish, exercise, or defend our legal rights. This includes, but is not limited to, disclosures necessary to:

• Comply with the laws and binding regulations of any applicable jurisdiction, domestically or internationally.
• Protect the fundamental safety, rights, or property of FamLoom, our Users, or the general public, including urgent disclosures to law enforcement in cases involving alleged child exploitation or imminent bodily harm.

4. 🌍 Global Data Transfer, Retention, and Storage Architecture

FamLoom operates a complex, multi-jurisdictional data infrastructure.

A. Location and Transfer Mechanism

• Primary Processing Venue: All data is primarily transferred to and stored in secure data facilities located in Canada and the United States.
• International Data Transfers (IDTs): For Users domiciled in the EEA/UK, the transfer to Canada is covered by the EU Commission's Adequacy Decision (2002/2/EC). Transfers to the United States and other non-adequate jurisdictions rely upon the implementation of mandatory safeguards, specifically Standard Contractual Clauses (SCCs), or analogous approved mechanisms, accompanied by requisite Transfer Impact Assessments (TIAs) to ensure data remains protected to the European standard.
• Consent to Transfer: By using the App, you explicitly and unambiguously consent to the global transfer, processing, and storage of your PII across all necessary jurisdictions and acknowledge that the laws of the receiving jurisdictions may not offer identical data protection levels as your home country.

B. Data Retention Policy

• Active Account Data: We retain PII for the entire duration that your account is active and operational, as necessary to fulfill the services provided under the Terms of Service.
• Post-Deletion Retention: Upon the formal closure and requested deletion of an account, we retain certain essential PII for a maximum period of up to 180 days for safety, security, anti-fraud, financial auditing, and technical disaster recovery purposes. Aggregated and de-identified data may be retained indefinitely for analytics and service improvement.
• Mandatory Legal Hold: Data subject to a legal request, court order, governmental investigation, or regulatory audit will be retained indefinitely until the specific legal obligation is satisfied and the hold is formally released.

5. 🔒 Security Architecture, Incident Response, and Liability Limitation

We implement commercially reasonable, industry-standard administrative, physical, and technical safeguards (e.g., encryption in transit and at rest, firewalls, access controls) designed to protect your PII against unauthorized access, destruction, or disclosure.

• No Absolute Guarantee: NO method of data transmission over the Internet or electronic storage is 100% secure. While we endeavor to use state-of-the-art protection, we cannot warrant the absolute security of your PII. Your use of the Application and submission of data is undertaken at your sole and complete risk.
• Breach Notification: In the event of a confirmed data security incident affecting PII, we will comply with all mandatory notification obligations under applicable global law (e.g., GDPR, CCPA/CPRA, PIPEDA).
• Indemnification: You agree to indemnify and hold harmless FamLoom against any claims, damages, or liabilities arising from the use of PII that you voluntarily disclose or that is required to be disclosed pursuant to any legal process.

6. ⚖️ Rights and Privileges of Data Subjects (Global Framework)

Depending on your country of residence, you may be entitled to exercise one or more of the following fundamental data privacy rights. To exercise any right, a verified request must be submitted via the contact information in Section 10.

7. 👶 Policy Regarding Minors and Compliance with COPPA/GDPR

The Application is strictly intended for adults aged 18 and over. We do not knowingly collect or solicit PII from children under 18.

• COPPA Compliance (US): We are not directed to and do not knowingly collect PII from children under 13, in line with the Children's Online Privacy Protection Act (COPPA).
• GDPR/UK-GDPR Compliance (EU/UK): Where the processing of a child's PII is illegal, we will immediately remove it. The parental data provided (e.g., "Child 1, age 4-6") is processed based on the parent's consent and our legitimate interest in providing a matching service for families with children.
• Suspension and Reporting: If we suspect an account is held by a minor, we will immediately suspend the account, commence an investigation, and, if confirmed, permanently delete the account and all data, and may report the incident to relevant authorities where legally required.

8. 🍪 Tracking Technologies, Digital Identifiers, and Analytics

We utilize a variety of technologies to collect Usage and Device Data:

• Cookies and Local Storage: Small data files stored on your device that uniquely identify your browser or device for purposes including authentication, maintaining session state, and personalization.
• Web Beacons/Pixels: Tiny graphical images used to track the efficacy of marketing campaigns and measure App usage.
• Analytics: We use third-party tools (e.g., Google Analytics, Firebase) which process technical data to provide us with aggregated, anonymized reports on App usage. You acknowledge the use of these tools and their independent processing activities.

9. 📝 Amendments, Interpretations, and Policy Evolution

This Policy constitutes the entire agreement regarding the data processing practices of FamLoom and supersedes all prior agreements.

• Right to Amend: We reserve the unilateral, non-contestable right to modify, amend, update, or supersede this Privacy Policy at any time and without prior notification, provided such amendment does not violate applicable mandatory law.
• Notification of Material Changes: Any changes deemed "material" by FamLoom's sole discretion will be communicated to Users via email, in-App notification, or prominent posting of the revised Policy at least thirty (30) days prior to the new Effective Date.
• Continuous Acceptance: Your continued access to or utilization of the Application following the official posting of any modification constitutes your irrefutable acceptance of the revised Policy terms. It is your ultimate responsibility to periodically review this document for any and all changes.

10. 📞 Policy Oversight, Formal Inquiry, and Dispute Resolution

All formal inquiries, privacy-related complaints, and requests for the exercise of data subject rights must be directed exclusively through the following official channels: