This Privacy Policy ("Policy") describes how TwoBetter Tecnologia Ltda. ("TwoBetter", "we", "us", "Controller") collects, uses, shares, stores, and protects personal data of users of the TwoBetter Dating application ("App"). This Policy applies to residents of Brazil (under Law No. 13,709/2018 — LGPD), the European Economic Area, the United Kingdom, and Switzerland (under Regulation (EU) 2016/679 — GDPR, and equivalent laws), and the United States (including, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act — CCPA/CPRA, and analogous state laws). Where the requirements of these laws diverge, we apply the standard most protective of the data subject within each jurisdiction of residence.

This version fully replaces any prior text shown on the App's "Policies and terms" screens, including the March 2026 version, which described collection of a full home address and a phone number for geolocation purposes, and treated faith answers as "mandatory". Those practices are not part of this version: location is collected via approximate GPS only (Section 2.2), and faith answers are optional and subject to specific consent (Section 2.3).

TwoBetter Dating shares account infrastructure (authentication via AWS Cognito) with the TwoBetter Learning application, operated by the same controller. Each app maintains its own processing purposes, privacy settings, and deletion flow; data collected exclusively within TwoBetter Dating (such as relationship preferences and religious practice) is not used for TwoBetter Learning's purposes, and vice versa, with one exception, described in Section 4.1: TwoBetter Learning progress indicators (level and badges) are shown on your TwoBetter Dating profile if you use both apps with the same account.

2.1. Registration and account data

• Name; email address; authentication method (email and password, Google, or Apple);
• Authentication and session data managed through AWS Cognito;
• Device biometric data (fingerprint), when you opt to confirm access using your device's local biometrics — processed and stored only on your device, not on our servers.

2.2. Profile and onboarding data

• Gender and gender-preference for matching; age range of interest;
• Approximate geographic location, obtained via device GPS subject to operating-system permission, used to calculate and display to other users the approximate distance to you (for example, "10 km away") on Discovery cards. We do not collect a full home address or a phone number for this purpose;
• Relationship goals, willingness to relocate, views on children and family involvement;
• Answers to a twenty-statement personality inventory;
• Attachment style, communication and conflict-resolution style;
• Values, life priorities, career ambition, financial approach;
• Alcohol and tobacco use habits;
• Religious practice, frequency, and denomination, treated as sensitive data under Section 2.3;
• Interests, hobbies, and free-text answers about your "perfect date";
• Profile photos and, when you choose to connect your Spotify account, your favorite artists and songs shown on your profile;
• AI-suggested profile text generated from your onboarding answers, when you use that feature — the text is subject to your review and editing before publication;
• Free-text answers submitted during your city's waitlist period ("waitlist"), where applicable, and the "profile strength" indicator calculated from your registration;
• Your "notify me when available" preference, when you opt to be notified if a temporarily unavailable user becomes eligible for new matches again.

2.3. Sensitive data (special categories)

Under Article 5(II) of the LGPD and Article 9 of the GDPR, we process the following special categories of personal data:

• Religious belief data (denomination, practice frequency, involvement in ministries or prayer groups, and the role of faith in relationship decisions);
• Facial biometric data, collected during the selfie-based identity-verification flow.

Collecting this data is preceded by specific, separately obtained, and informed consent, gathered on a dedicated introduction screen for the "Faith & practice" step, distinct from and additional to the general sign-up acceptance. That screen clearly states the purpose of collection, that the data is a special category, that a summary of your practice (for example, denomination and attendance frequency) may be shown to other users on compatibility screens and your profile, and offers the option to decline or skip ("Skip") the step without preventing basic use of the App.

If you decline or skip the faith step: (i) your denomination and religious practices will not be collected or displayed; (ii) faith-related compatibility filters and score components will not be calculated for your profile, while other compatibility criteria remain active; and (iii) you can still use the rest of the App normally. You may withdraw consent at any time in the App's Privacy settings, without affecting the lawfulness of processing carried out before withdrawal.

2.4. Usage, device, and communication data

• In-App interactions: likes, matches, messages exchanged, reports, blocks;
• Device identifiers, operating system, app version, IP address, network data;
• Payment and subscription data, processed by third-party processors (app stores or payment gateway) — we do not store full card numbers;
• Customer-support records and communications with us.

We process your data based on the following legal bases, as applicable in each jurisdiction:

• Contract performance (LGPD Art. 7(V); GDPR Art. 6(1)(b)): creating and managing your account, operating the matching algorithm, operating the city-waitlist mechanic, processing subscriptions;
• Consent (LGPD Art. 7(I) and Art. 11(I); GDPR Art. 6(1)(a) and Art. 9(2)(a)): collecting sensitive data (religion, facial biometrics), optional Spotify connection, sending optional promotional communications;
• Legitimate interest (LGPD Art. 7(IX); GDPR Art. 6(1)(f)): fraud prevention, platform security, content moderation, AI-assisted profile-text generation, service improvement, aggregate analytics;
• Compliance with a legal or regulatory obligation (LGPD Art. 7(II); GDPR Art. 6(1)(c)): tax-data retention, responding to court orders, age verification.

We use your data to: create and manage your account; operate Discovery, compatibility, and messaging features; personalize your experience and recommendations; ensure security, prevent fraud, and moderate content; process subscription payments; communicate updates, events, and features; comply with legal obligations and respond to requests from authorities; and conduct aggregate, anonymized statistical analysis to improve the product.

We do not sell, rent, or trade your personal data to third parties. We share data, always to the extent necessary for the relevant purpose, with:

• Companies within TwoBetter's corporate group, including outside Brazil, for technical operation and support;
• Other users, to the extent necessary for Discovery and matching: name, age, photos, approximate distance, profile information, music interests (if connected), aggregate compatibility score and, once you have consented as described in Section 2.3, your religious denomination and a summary of your faith practice (for example, the "Evangelical" tag and a summary of prayer habits, shown on the Faith & Values compatibility card). We never share raw facial biometric imagery or device-biometric data with other users — that data only produces, respectively, the "Verified" badge and local unlock of your own device;
• Infrastructure service providers (cloud hosting, authentication, email and push-notification delivery, payment processing, AI text generation, data analytics, and fraud detection), under confidentiality and data-processing agreements;
• Strategic partners (for example, partner religious communities and organizations), only with your additional specific consent, never automatically;
• Public authorities, when required by law, court order, or to protect rights, safety, or to investigate fraud and crime.

4.1. What TwoBetter Learning shares with us

If you use TwoBetter Dating and TwoBetter Learning with the same account, your TwoBetter Learning progress level and badges are shown as an informational block on your TwoBetter Dating profile, visible to other Dating users. No other TwoBetter Learning data — lesson answers, community posts, ranking — is shared with TwoBetter Dating. Deleting your TwoBetter Dating account does not, by itself, delete your account or data on TwoBetter Learning, and vice versa, except where expressly stated on the applicable deletion screen at the time of the request.

Our servers and service providers may be located outside Brazil, including in cloud environments with internationally distributed infrastructure. Where data is transferred outside Brazil, the European Economic Area, or the United Kingdom, we ensure: (i) compliance with LGPD (Art. 33) and, where applicable, GDPR Chapter V, including standard contractual clauses or equivalent adequacy mechanisms; (ii) adequacy of the destination country or specific contractual clauses where the country is not deemed adequate; and (iii) security measures equivalent to those required in Brazil, including the parameters of ANPD Resolution CD/ANPD No. 19/2024.

We retain your data for as long as necessary to fulfill the purposes described in this Policy, subject to the following reference periods, without prejudice to a different period required by a specific legal obligation:

• Registration and profile data: up to 5 (five) years after account closure, for defense in judicial, administrative, or arbitration proceedings, and legal compliance;
• Conversation and message content: up to 6 (six) months after permanent account deletion;
• Access and security logs: up to 6 (six) months, under Article 15 of Brazil's Marco Civil da Internet (Law No. 12,965/2014), where applicable;
• Inactive accounts: data of accounts with no login for more than 1 (one) year may be anonymized or deleted, following prior notice sent to the registered email before deletion.

6.1. Freezing your account

You may freeze your account at any time. Freezing makes your profile invisible in searches and matching, and stops sending and receiving likes and messages, but keeps your data, conversations, matches, and preferences stored. You may reactivate your account at any time by logging in again.

6.2. Permanent deletion

You may request permanent deletion of your account, after selecting a reason, in the App's security settings. The App's screen states that data is "permanently removed"; that statement refers to data tied to your user experience (profile, conversations, matches, preferences), which becomes inaccessible to you and other users immediately upon confirmation. We may still retain, for the minimal residual periods indicated in this Section and within the limits of the law, records necessary to comply with a legal obligation (for example, payment tax records) or for defense in legal proceedings, even after account deletion. You will need to create a new account to use the App again after deletion. Deleting your TwoBetter Dating account does not, by itself, delete an active TwoBetter Learning account, except where expressly stated on the applicable deletion screen at the time of the request; each deletion must be requested separately, in the corresponding app.

We implement technical and organizational data-protection measures, including: encryption of data in transit (TLS/SSL) and at rest; role- and privilege-based access controls; continuous monitoring of threats and vulnerabilities; periodic staff training on data protection; and regular security assessments. No system is one hundred percent secure. In the event of a security incident that may pose relevant risk or harm to data subjects, we will notify the competent authorities and affected data subjects, and will act in accordance with the LGPD, GDPR, and other applicable laws.

We use automated processing, including statistical and machine-learning models, to: calculate the compatibility score shown before a profile's face is revealed; order and recommend profiles on the Discovery screen; generate, at your request, profile-text suggestions from your answers; and support the initial triage of reports and potentially non-compliant content.

You have the right to request clear and adequate information about the criteria and procedures used in these automated decisions (LGPD Art. 20), and to request human review of automated decisions that produce legal effects or significantly affect you, including account blocking or content removal (LGPD Art. 20; GDPR Art. 22). Review requests may be made through the channels indicated in Section 12.

We use cookies, device identifiers, and similar technologies for authentication, remembering preferences, measuring performance, and, where consent is required, for analytics and marketing purposes. You may manage cookie and tracking preferences (including your device's advertising identifier, where applicable) in your device or App settings.

10.1. Users in Brazil (LGPD)

Under Article 18 of the LGPD, you have the right to: confirmation of the existence of processing; access to your data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary data or data processed unlawfully; portability to another service provider; deletion of data processed with consent; information about entities with which we share data; information about the possibility of not giving consent and the consequences thereof; withdrawal of consent; and review of automated decisions.

10.2. Users in the European Economic Area, United Kingdom, and Switzerland (GDPR)

You have the right to: access (Art. 15), rectification (Art. 16), erasure ("right to be forgotten", Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing, including for direct marketing (Art. 21), and the right not to be subject solely to automated decisions with legal or significant effect (Art. 22). You also have the right to lodge a complaint with the data protection authority in your jurisdiction.

10.3. Users in the United States

Residents of California and other states with equivalent legislation (for example, Virginia, Colorado, Connecticut, and Utah) have the right to: know what categories of personal data we collect and with whom we share it; request access to and a copy of their data; request deletion of personal data; correct inaccurate data; opt out of the sale or sharing of personal data for cross-context behavioral advertising — TwoBetter does not sell personal data and does not conduct third-party behavioral advertising based on the App's sensitive data; and not be discriminated against for exercising these rights. We do not perform automated processing of sensitive data for third-party advertising profiling purposes.

10.4. How to exercise your rights

Requests can be made directly in the App's settings ("Security" > "Privacy") or through the contact channels listed in Section 12. We will respond within a reasonable time and, in any case, within the deadlines required by the law applicable to each request. We may request identity verification before processing requests related to sensitive data.

The use of facial biometrics (selfie-based identity verification) and device biometrics (fingerprint for access unlock) constitutes processing of sensitive and biometric data. Device biometrics are processed locally by the operating system and are not transmitted to our servers. Verification facial biometrics are processed by a specialized service provider, under a confidentiality agreement and purpose limited to identity verification and fraud prevention, and are not used for other purposes, including advertising. Users in U.S. states with specific biometric-data legislation (for example, Illinois' Biometric Information Privacy Act) have the right to additional prior notice and consent, obtained within the verification flow itself, and to request deletion of their biometric data, subject to applicable legal retention periods.

Controller: TwoBetter Tecnologia Ltda., taxpayer ID (CNPJ) [to be completed], registered at [full address to be completed]. Our Data Protection Officer ("DPO"), [name to be completed], can be reached at dpo@twobetter.com or through the support channels available in the App, for the exercise of rights, questions, complaints, or notification of incidents related to personal data.

The App is intended exclusively for individuals 18 years of age or older. We do not knowingly collect data from minors. If we become aware that a minor's data has been collected, we will block the account and permanently delete all personal data collected, as detailed in Section 2 of the Terms of Use.

This Policy may be updated periodically to reflect changes in our practices or in applicable law. Material changes will be communicated through a prominent notice in the App or by email, with reasonable advance notice before they take effect. This version fully replaces any prior version shown in the App.

This Policy will be interpreted under Brazilian law, without prejudice to the application of GDPR provisions and U.S. state laws to data subjects residing in those jurisdictions, as set out in this Policy.