DCZ Media Holdings LLC ("DCZ", "we", "our", "us") operates DesiCouplesZ at desicouplesz.app and desicouplesz.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our platform.
By creating an account or using DCZ, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our platform.
1. Information We Collect
1.1 Account Information
When you register, we collect your email address, date of birth (to verify you are 18+), display name, and password (stored as a bcrypt hash — never plaintext). Your email address is verified by a one-time code before your account is created.
Mobile number — optional. You are not required to provide a mobile number to register or to sign in. If you choose to add one, we use it solely to verify that the number is yours, to give you a second way to recover your account, and to display a verification badge on your profile. We do not use it for marketing, we do not disclose it to other members, and you may sign in with your email address or display name alone.
1.2 Profile Information
Information you choose to add to your profile: photos, bio, location (city-level only), relationship status, heritage, and preferences.
1.3 Age & Identity Verification
Age is declared by you at registration. DCZ may additionally require age estimation performed by a third-party processor engaged under a written data-processing agreement, by means of facial age estimation from a selfie image. No identity document is requested at any point. Such providers process the image under their own privacy policies and as our processors. We receive only a verification outcome and a reference identifier; we do not receive or retain the image, any biometric template, or any identity document.
Genuine Member Verification. Separately from age verification, DCZ may require verification of any account as a condition of continued access to any feature, and determines, at its discretion and by reference to objective indicators of risk to the integrity or safety of the Platform, which accounts are required to complete it and when. Verification is conducted by means of a short recorded video session initiated from within the Platform, assessed with the assistance of automated tools and reviewed by authorised personnel before a determination is made. The resulting recording is held in private storage, is not published or made available to other members, and is retained for the period stated in §5. DCZ does not disclose the criteria, methods or tooling applied, disclosure of which would prejudice their effectiveness.
For 18 U.S.C. § 2257 purposes, DCZ maintains platform records in a separate database accessible only to the designated records custodian. Those records identify the uploading account, the item uploaded, the date and time of upload, any age-confirmation reference, and the applicable retention date. They do not contain identity documents, and DCZ does not request or hold one.
1.4 Device, Technical & Usage Data
We automatically collect the following. This list is exhaustive as regards device and technical data and corresponds to the disclosures we make to the Apple App Store and Google Play:
- IP address, including the country and city derived from it. Used for security, fraud prevention, service delivery and compliance with legal obligations.
- Device type, browser user-agent and platform (web, iOS or Android). Used to deliver the service and to apply the content rules that differ between our website and our mobile applications.
- Push notification token — a device identifier issued by Apple or Google, collected only if you enable notifications and used only to deliver them. Deleted when you disable notifications or delete your account. We do not collect advertising identifiers (IDFA or AAID) and we do not track you across other applications or websites.
- Sign-in and session records — sign-in times, last endpoint accessed, and the device and network details above, retained as a security log.
- Precise location— collected only with your device's permission, optional, and withdrawable at any time in your device settings. See §8 of the Terms.
- Interaction data — pages and profiles viewed, searches and in-product actions.
We do not sell this data and do not share it with data brokers or advertising networks. Sharing is limited to the recipients listed at §4.
1.5 Communications
Messages sent between members are stored encrypted. We may access them only when required by law or to investigate abuse reports.
2. How We Use Your Information
- To operate and improve the platform
- To verify your age and identity
- To process payments through third-party payment processors and app-store billing systems
- To send service communications (account updates, security alerts)
- To detect and prevent fraud, abuse, and CSAM
- To comply with legal obligations (18 U.S.C. § 2257, NCMEC reporting)
- To enforce our Terms of Service
3. Content Moderation, CSAM & Communications Monitoring
Media uploaded to a profile, gallery or album is subject to automated screening and to review by a person before it becomes visible to any other member. Live video sessions are not pre-reviewed. Automated screening runs on DCZ's own infrastructure; media is not sent to a third-party screening service. Where material appearing to constitute child sexual abuse material (CSAM) is identified, whether by screening, by review or by report, it is removed, the account is permanently terminated, and the matter is reported to the National Center for Missing & Exploited Children (NCMEC) CyberTipline in accordance with 18 U.S.C. § 2258A. We do not inform the uploader of the specific reason for removal. DCZ does not disclose the tools or criteria applied in screening, disclosure of which would prejudice their effectiveness, and nothing in this section constitutes a warranty that every item of unlawful material will be detected.
Automated classification and human adjudication. Visual material is subjected to automated classification directed to sexually explicit conduct within the meaning of 18 U.S.C. § 2256(2) and to indicia of minority within the meaning of 18 U.S.C. § 2256(1); textual material is classified for prohibited expression, threats and off-Platform solicitation. Classifier output may cause material to be withheld or escalated, but no measure is imposed by automated means alone, all enforcement determinations being made by a natural person exercising independent judgement. Accordingly you are not subject to a decision based solely on automated processing within the meaning of Article 22 of Regulation (EU) 2016/679 and of the United Kingdom General Data Protection Regulation, and the safeguards at Article 22(3) are not engaged in respect of content moderation. See §4A.3 of the Terms of Service.
Account-level compliance audit; lawful bases.The Compliance & Security Team is authorised to audit an account in its entirety, comprising profile data, public and non-public media, albums and access grants, account, session and transaction records, and conduct directed toward other recipients of the service. Material designated private, restricted or view-limited is not removed from scope. Processing for this purpose is undertaken in reliance upon Article 6(1)(f) of Regulation (EU) 2016/679 (legitimate interests in the prevention and detection of unlawful acts and in the security of the service, as recognised at Recital 47 and Recital 49), and upon Article 6(1)(c) in so far as the processing is necessary for compliance with the obligations arising under 18 U.S.C. § 2258A, 18 U.S.C. § 2257 and 28 C.F.R. Part 75, the Online Safety Act 2023, and Regulation (EU) 2022/2065. In so far as the processing concerns data within Article 9(1), it is undertaken in reliance upon Article 9(2)(g) (substantial public interest), the condition at paragraph 10 of Part 2 of Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts) and, where the conduct concerns a child or an individual at risk, paragraph 18 of that Part, subject in each case to the Appropriate Policy Document maintained under paragraph 5 of Part 4 of that Schedule. Audit is not notified in advance, notification being incompatible with the purpose of the measure within the meaning of Article 14(5)(b).
3.1 Recording and review of interactive communications
All interactive video sessions — one-to-one calls, group rooms, livestreams and verification sessions — are recorded automatically. Recordings are reviewed only to detect, prevent and investigate unlawful conduct, to investigate reports, and to respond to valid legal process. They are not used for marketing, profiling, advertising or model training, are not disclosed to other members, and are not made public.
Lawful basis. For members in the UK and EU, processing is carried out in reliance on Article 6(1)(f) (legitimate interests in the prevention and detection of unlawful acts and the protection of members) and, where it concerns data within Article 9(1), on Article 9(2)(g) (substantial public interest), as further specified in Schedule 1, Part 2, paragraphs 10, 11 and 18 of the Data Protection Act 2018. An appropriate policy document is maintained as required by that Schedule. In the United States, recording is undertaken with the consent of every participant, given in advance under the Terms, which satisfies the all-party consent requirements of those states that impose them.
Safeguards and access. Recordings are encrypted at rest, held in private storage that is not publicly reachable, and retrievable only by server-issued credentials. Access is confined to authorised personnel discharging a documented compliance function, is authenticated, and is logged. Content is not indexed for search, is not used to build profiles, and is not transferred to any advertising or analytics recipient.
Retention.Retention periods are set out at § 5 and are enforced by automated deletion, save where material is subject to a legal hold, an active investigation, or a mandatory retention obligation.
Impact assessment. A data protection impact assessment has been carried out in respect of this processing in accordance with Article 35, is kept under review, and is revisited on any material change to the nature, scope, context or purposes of the processing.
Your rights.Your rights in respect of recordings, and how to exercise them, are set out at § 6. Objecting to this processing means you cannot use interactive video features, as the processing is inseparable from them.
4. Sharing Your Information
We do not sell your personal data. We share information only with:
- Service providers (processors) — we use only the following, each bound to process data on our instructions:
- Infrastructure and hosting providers — server hosting and encrypted media storage
- Network security providers — content delivery, denial-of-service mitigation and automated-traffic detection
- Communications providers — transactional email and SMS one-time passcodes
- Real-time media providers — video calls, group rooms, livestreams and verification sessions
- Age-estimation providers — where age estimation is used (§ 1.3)
- Geolocation providers — approximate city-level lookup of your IP address for the review team
- Payment processors and app-store billing systems
- Law enforcement — when required by valid legal process
- NCMEC — CSAM reports as required by law
- Business transfers — in the event of a merger or acquisition, subject to the same privacy protections
5. Data Retention
- Active account data: retained while your account is active
- Verification recordings (the Genuine Member Verification session): retained for 90 days from recording, then automatically deleted, save where subject to a legal hold, an active investigation, a report, or a mandatory retention obligation, in which case the recording is retained for as long as that purpose requires and then deleted. Processed on the basis of your consent, given on the verification screen, to confirm your account is operated by a real adult and to check the recording for illegal or unlawful content. Never shown to other members, never made public, and never used for marketing or training. You may withdraw consent and request deletion at any time (see §6.4) — doing so may mean the Genuine badge cannot be granted or is removed, and does not override a retention obligation described above.
- Call, group video and livestream recordings (see §3.1): one-to-one and group call recordings are retained for 120 days from recording; livestream recordings for 30 days. Both are then automatically and permanently deleted, save where subject to a legal hold, an active investigation, or a mandatory retention obligation.
- Deleted account data: purged within 30 days, except where required by law
- 2257 custodial records: retained for 7 years as required by 18 U.S.C. § 2257
- Payment records: retained as required by the applicable payment processor and by law
- CSAM incident logs: retained indefinitely
6. Your Rights
DCZ has members worldwide, with a large South Asian diaspora community in the United Kingdom, European Union, United States, Canada, Australia, the Gulf and India. Your rights depend on where you live. In all cases you may contact privacy@desicouplesz.app to exercise them, and we will respond within the timeframe your law requires. We may be unable to delete data we are legally required to retain (for example 18 U.S.C. § 2257 records or CSAM reports).
6.1 Who is responsible for your data
The data controller is DCZ Media Holdings LLC, a Wyoming limited liability company.
6.2 Legal bases we rely on (UK / EU members)
- Performance of a contract — creating your profile, matching, messaging and running the service you signed up for.
- Consent — precise (GPS) location, verification recordings, and any explicit content you choose to upload. You may withdraw consent at any time (see 6.4).
- Legitimate interests — approximate (IP-based) location, fraud and bot prevention, moderation and community safety.
- Legal obligation — age and record-keeping requirements, and mandatory CSAM reporting.
Some of what you may choose to share — for example sexuality or relationship orientation — is special category data under UK/EU law. We process it only because you have manifestly made it public on your profile and have given explicit consent by providing it. You are never required to supply it.
6.3 Where your data is stored (international transfers)
Our servers are located in the United States (Oregon), with video infrastructure in Finland. If you are in the UK, EEA, or another country with data-transfer rules, your personal data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses and equivalent safeguards for those transfers. You may request details of the safeguards in place.
6.4 Withdrawing consent
Withdrawing consent is as easy as giving it. For precise location, go to Settings → Location & Privacy, where you can see whether DCZ holds your coordinates and delete them in one click. You may also revoke the permission in your browser or device settings. Withdrawal does not affect the lawfulness of processing before it, and never removes your account or approval.
6.5 Rights by region
- United Kingdom & European Economic Area (UK GDPR / GDPR) — access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and withdrawal of consent. You may complain to your supervisory authority: in the UK the Information Commissioner's Office, or in the EEA your national authority.
- India (DPDP Act 2023) — access, correction, erasure, grievance redressal, and nomination. Complaints may be raised with the Data Protection Board of India after contacting us first.
- California (CCPA / CPRA)— know, delete, correct, and opt out of “sale” or “sharing”. We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. Because we neither sell nor share personal information, an opt-out preference signal such as Global Privacy Control has no processing to act upon, and we do not change how we treat your data on receiving one. Should we ever sell or share personal information, we will honour that signal as a valid opt-out and will say so here before doing so.
- Canada (PIPEDA) — access and challenge accuracy; complaints to the Office of the Privacy Commissioner of Canada.
- Australia (Privacy Act) — access and correction; complaints to the Office of the Australian Information Commissioner.
- Everywhere else — we extend access, correction and deletion to all members regardless of location.
7. Automated Decision-Making & Matchmaking
DCZ ranks profiles for you using an automated compatibility score. It combines what you and the other member each said you are looking for, shared interests and languages, heritage, experience level, distance between you, how recently each of you was active, and any grooming preferences you set. Verified members receive a ranking boost.
- It orders results — it does not gate access. A low score never hides you from anyone, blocks messaging, or excludes you from search. Preferences you set rank members higher or lower; they never filter people out.
- No legal or similarly significant effects. Nothing about your rights, money or account status is decided automatically, so this is not decision-making under Article 22 of the UK/EU GDPR.
- Moderation is human-reviewed. Automated tools flag content, but a person makes the decision to approve, reject, suspend or ban — except for confirmed CSAM, which is actioned and reported immediately as the law requires.
- You can ask. Contact us for an explanation of how your profile is ranked, or to object to automated ranking.
8. Making a Request
Email privacy@desicouplesz.app from the address on your DCZ account, stating what you want (access, correction, deletion, export, objection, or withdrawal of consent).
- Identity check. We confirm you control the account email or phone number. We will not demand government ID for a routine request — asking for more data than necessary would defeat the purpose.
- Response time. Within 30 days, extendable once by a further 30 days for complex requests, in which case we will tell you why.
- Cost. Free. We charge nothing for exercising your rights, regardless of whether you are a paid member.
- Refusals. If we cannot act — for example where a record must be kept by law — we will say so and explain your right to complain.
9. Data Breach Notification
If a breach affects your personal data, we will investigate immediately, contain it, and notify you without undue delay where there is a risk to your rights. Where the law requires it we will also notify the relevant supervisory authority — within 72 hours under the UK/EU GDPR — and cooperate with law enforcement. Given the nature of this platform we treat any exposure of profile content, private media or location data as high risk by default.
10. Marketing & Communications
Service messages you cannot opt out of while your account is open — security alerts, verification codes, approval decisions and policy changes. Everything else is optional.
- Manage every notification channel in Settings → Notifications
- Use the unsubscribe link in any marketing email
- Or email privacy@desicouplesz.app to opt out of all marketing
- We do not share your address with third-party advertisers, ever
11. Cookies
We use HTTP-only cookies for authentication (session tokens). We use Cloudflare Turnstile for bot detection. We do not use advertising cookies or third-party tracking pixels. See our full Cookie Policy for the complete list of cookies, what each one does, and how long it lasts.
12. Security & Staff Access
We use HTTPS/TLS for all data in transit, bcrypt for passwords, HTTP-only cookies for sessions, presigned short-lived links for private media, and encrypted storage for sensitive records. No system is 100% secure — if you believe your account has been compromised, contact us immediately.
12.1 Staff access
Access to member data is restricted to authorised personnel who need it to operate the service — for example to review a signup, moderate reported content, or resolve a support request. Staff are bound by confidentiality obligations, and we maintain internal controls and monitoring appropriate to the sensitivity of the data. Private media is never publicly accessible; it is served through short-lived links that expire rather than permanent public URLs.
13. Children
DCZ is strictly for adults 18 years of age or older. We do not knowingly collect information from minors. Any account found to belong to a minor will be immediately terminated and the incident reported to appropriate authorities.
14. Changes to This Policy
We may update this policy periodically. We will notify you of material changes via email or an in-app notice. Continued use of DCZ after the effective date constitutes acceptance of the updated policy.
15. Contact
DCZ Media Holdings LLC
30 N Gould St Ste N
Sheridan, WY 82801, United States
Email: privacy@desicouplesz.app