Legal & Help

Privacy Policy

Effective date: 14 August 2026

Version: 1.1

Controller: KEEM sp. z o.o., ul. Jodłowa 8B/20, 16-001 Ignatki-Osiedle, Poland, Poland, KRS 0000993124, NIP 9662168329, REGON 523224424.

Privacy contact: [email protected]

This Privacy Policy explains how KEEM processes personal data when people use RandomFlirt.com and associated supported applications.

1. Scope and role

KEEM is the controller of personal data for RandomFlirt unless a specific activity states otherwise. Payment providers, email providers, hosting/security providers and other vendors may act as independent controllers, processors or sub-processors according to their actual legal role and contract.

2. 18+ service

RandomFlirt is intended only for persons aged 18 or over. We do not knowingly offer the service to children. If we learn that a person is under 18, we may restrict access and delete or preserve information as required for safety, legal claims, regulatory duties or law-enforcement obligations.

3. Categories of personal data

Depending on the live feature used, KEEM may process:

• account and identity data, such as email address, username, account ID, declared date of birth/age and verification status;
• profile data, such as nickname, profile text, preferences and user-uploaded images;
• guest/session data, such as generated guest identifier, session identifier and session state;
• communications/User Content, such as direct messages, room posts, reports and content submitted through support;
• safety/moderation data, such as blocked-message events, reports, blocks, moderation decisions and enforcement history;
• technical/security data, such as IP address, timestamps, user-agent/device/browser information, authentication/security events and fraud indicators;
• payment/subscription data, such as plan, entitlement, transaction status, payment-provider customer/payment identifiers and billing records; RandomFlirt does not store full card numbers; payment card data is handled by the enabled payment provider;
• preference/consent data, such as cookie choices and marketing consent records;
• support and complaint correspondence;
• analytics/advertising data only where the applicable legal basis and consent requirements are satisfied.

The categories above were checked against the production database, logs, cookies, browser storage, enabled services and vendor configuration on 13 August 2026.

4. Sources of data

We obtain data directly from users, automatically from their device/session, from other RandomFlirt users where they report or interact with someone, and from service providers such as payment, email, anti-abuse, hosting and security vendors.

5. Purposes and legal bases - EU/EEA/Poland

Where GDPR applies, KEEM relies on the legal basis appropriate to each purpose:

• contract / steps requested before contract: creating accounts, maintaining sessions, matching users, delivering messages, operating room membership, providing Premium and responding to service requests;
• legitimate interests: service security, fraud prevention, abuse prevention, basic operational logs, defending legal claims, product reliability and proportionate moderation, after balancing user rights;
• legal obligation: tax/accounting records, valid regulatory/law-enforcement obligations, certain consumer records and legally required disclosures;
• consent: non-essential cookies/SDKs where required, optional marketing where consent is the selected basis, and other optional processing expressly identified as consent-based;
• vital interests / other lawful grounds: only in exceptional circumstances where the applicable law permits and the facts justify it.

This public summary is supported by internal processing and legal-basis records maintained as required by applicable law.

6. Chat-system privacy differences

6.1 Random Flirt

Random Flirt is designed as an instant random one-to-one experience. Ordinary unreported Random Flirt messages are temporary and are removed when the match closes, including after a skip, leave or expired reconnect grace period. Limited report, security or legal records may be preserved separately where lawful.

6.2 Stranger Flirt

Stranger Flirt conversations are temporary. After inactivity, an intentional leave, or expiry of the reconnect grace period, the shared conversation closes for both participants; ordinary unreported messages and media are scheduled for physical deletion within one hour. Reported evidence is preserved separately for the configured moderation-retention period.

6.3 Flirt Rooms

Flirt Rooms are multi-user spaces. Room messages may be visible to multiple participants and may persist as room history according to the live product. Users should not submit information they expect to remain private in a multi-user room.

7. Blocked-message filter

RandomFlirt may evaluate outgoing text before delivery against centrally managed prohibited-word/phrase rules. When the simple blocked-words feature is used as currently approved by the owner, a blocked message is rejected before ordinary delivery and is not stored as an ordinary chat-history message. A short-lived client warning may be displayed to the sender.

KEEM may retain minimal security telemetry about the moderation event where reasonably necessary and lawful, but this limited event record does not make the rejected message part of ordinary chat history.

8. Reports, blocks and moderation

When a user files a report, blocks another user or when moderation is required, KEEM may process relevant account, message, room, session and technical context to evaluate the issue, protect users, enforce policies, prevent fraud/abuse, respond to legal claims or comply with law.

Access to moderation data is restricted by role and is audited where appropriate.

9. Payments

KEEM is the seller/merchant for RandomFlirt Premium under the sole-company model. Payment details may be transmitted directly to the selected payment provider. When a payment provider is enabled, the current provider and relevant privacy information will be identified before payment data is collected.

Stripe integration is installed but production checkout is disabled and unconfigured as of the effective date. RandomFlirt does not claim Stripe approval. This policy will be updated before live payment processing is enabled.

10. Cookies and similar technologies

Essential first-party cookies and local storage support registered authentication, temporary guest sessions, CSRF protection, abuse/security enforcement and remembering privacy choices. These remain available when optional processing is off because they are necessary to provide and protect the requested service.

Google Analytics 4, provided by Google LLC under measurement ID `G-KE07L9NYFD`, is used only after the user affirmatively saves Analytics as ON. Its purpose is to measure visits and page use for service improvement. The Google tag is not loaded and no Analytics measurement request is sent before that saved choice. Users may withdraw consent at any time through Cookie Settings in the global footer; future Analytics collection is then disabled and RandomFlirt removes its first-party Google Analytics cookies. Withdrawal does not affect processing lawfully carried out before withdrawal.

Adsterra is the active advertising provider for configured Native Banner, mobile banner and desktop banner placements; Social Bar remains paused. RandomFlirt Free is advertising-supported, so eligible guests and Free members receive configured advertising independently of Analytics or Cookie Settings interaction. Premium users are ad-free and RandomFlirt does not initialize its advertising provider for them. See the Cookie & Tracking Policy for the current service model and technology inventory.

11. Recipients and processors

Personal data may be shared, only as appropriate, with:

• hosting/infrastructure and content-delivery/security providers;
• email/communications providers;
• payment providers;
• anti-abuse, fraud and security vendors;
• professional advisers bound by confidentiality;
• competent authorities or courts where legally required;
• a successor in a lawful corporate transaction, subject to appropriate safeguards.

Production recipients include Cloudflare for DNS, edge delivery and Turnstile; Brevo for transactional email; the production hosting and local private-media storage provider; Adsterra for advertising delivery on the Free service; payment processing through Stripe when enabled and configured; and authorities or advisers when lawfully required.

12. International transfers

If personal data subject to GDPR/UK GDPR is transferred outside the EEA/UK, KEEM will use an applicable lawful transfer mechanism and supplementary safeguards where required, such as an adequacy decision or approved standard contractual clauses, and will document transfer assessments as required.

Production uses Cloudflare, Brevo and Adsterra services that may process data internationally under their applicable safeguards. Adsterra is used for the advertising-supported Free service; Premium does not initialize the provider. Stripe processes payment data only when checkout is enabled, configured and requested by the user.

13. Retention

KEEM keeps personal data only for as long as necessary for the purpose, legal obligations, security, fraud prevention and legal claims. The verified production retention schedule is set out below and may be shortened or extended only within the bounded administrator controls and applicable law.

RandomFlirt applies separate retention rules to:

• guest/session records;
• Random Flirt temporary messages;
• Stranger Flirt direct messages;
• Flirt Rooms messages;
• reports and moderation cases;
• security/authentication logs;
• account/profile data;
• deleted-account residual backups;
• payment/accounting records;
• marketing consent/suppression records;
• support tickets;
• cookie-consent evidence.

14. Security

KEEM uses technical and organizational measures appropriate to risk, including secure HTTPS transport, access controls, secure password handling, administrator MFA, logging, vulnerability/dependency management, backups, incident response and least-privilege access. This list describes intended controls, not a warranty that no security incident can occur.

15. Rights for EU/EEA users

Subject to GDPR conditions and exceptions, individuals may have rights to access, rectify, erase, restrict or object to processing, receive data in a portable format, withdraw consent where processing is based on consent, and lodge a complaint with a supervisory authority.

Withdrawal of consent does not affect processing already lawfully carried out before withdrawal.

Requests may be made to [email protected] or through the live privacy/account tools. KEEM may need to verify identity proportionately before fulfilling a request.

16. Polish supervisory authority

Where the Polish supervisory authority is competent, users may complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych - UODO). Current official information is available from the Polish UODO at https://uodo.gov.pl/.

17. United Kingdom addendum

Where UK GDPR applies, users have the applicable UK data-protection rights and may complain to the UK Information Commissioner's Office. UK online-safety duties are separate from privacy law and are addressed in the internal market-readiness checklist.

18. United States addendum

RandomFlirt is an 18+ general-audience service. If KEEM obtains actual knowledge that a particular user is under 13, the COPPA implications must be handled immediately; an 18+ statement alone does not justify continuing to process a known child's personal information.

Where a US state privacy law applies to KEEM because its statutory thresholds and territorial criteria are met, KEEM will provide the notices and rights required by that law. Different US state privacy laws may apply according to their territorial and statutory thresholds; this policy does not claim that a single federal privacy regime covers every US user.

If California's CCPA/CPRA applies, implement any required notice at collection and consumer-right request mechanisms, including sale/share/targeted-advertising controls where applicable.

19. Canada addendum

Where Canadian private-sector privacy law applies, KEEM will maintain accountable privacy practices, meaningful consent where required, safeguards, access/correction mechanisms and an identified privacy contact. Provincial private-sector privacy laws may apply instead of or alongside PIPEDA depending on the activity and province.

20. Australia addendum

Where Australia's Privacy Act and Australian Privacy Principles apply, KEEM will maintain an appropriate privacy policy and comply with applicable collection, use/disclosure, security, access/correction and cross-border disclosure obligations. The Australia market also has separate online-safety/age-restriction requirements addressed in the market-readiness checklist.

21. Marketing

Marketing emails or similar messages are sent only under an applicable legal basis and with the identification/unsubscribe features required by the recipient's jurisdiction. Account-security and service messages are treated separately from marketing where law permits.

22. Automated decisions

The current simple blocked-word filter is a content-delivery rule and is not intended to make a legal determination about a person. RandomFlirt does not currently use the blocked-word filter to make decisions that produce legal or similarly significant effects. This policy will be updated before any such processing is introduced.

23. Changes

We may update this Privacy Policy when laws, vendors or product practices change. Material changes will be communicated where required. The page will display its current version/effective date.

24. Contact

KEEM sp. z o.o.

ul. Jodłowa 8B/20, 16-001 Ignatki-Osiedle, Poland

KRS 0000993124 | NIP 9662168329 | REGON 523224424

Privacy: [email protected]

Verified production retention schedule

• Web sessions: until expiry; registered sessions up to 7 days and administrator sessions 30 minutes.
• Mobile session records: up to 90 days after expiry or revocation.
• Guest identity and security records: 30 days after expiry/closure.
• Random Flirt ordinary unreported messages/media: removed when the temporary match closes.
• Stranger Flirt closed unreported messages/media: physical cleanup within one hour.
• Registered direct messages and Flirt Rooms messages: up to 30 days.
• Moderation evidence: 365 days, adjustable by authorized administrators within 30 to 2,555 days.
• Product analytics events: 180 days.
• Security/administrator audit records: 365 days.
• Completed delivery records: 30 days.
• Privacy export download: 24 hours; completed privacy workflow records: 365 days.
• Deleted storage metadata: 30 days.
• Encrypted production backups: 14 days under the current backup setting.

Updated 2026-08-25