Back to home

    Privacy Policy

    How we protect your personal data

    Last updated: February 22, 2026

    1. Introduction

    At TwoStack, we place paramount importance on protecting your personal data. This privacy policy explains how we collect, use, and protect your information when you use Bond.

    We comply with the General Data Protection Regulation (GDPR) and Belgian data protection legislation.

    2. Data controller

    Controller: TwoStack (SASPJ)

    Address: Avenue du Roi Chevalier 129, 7020 Mons, Belgium

    BCE number: 0791.244.044

    DPO Email: [email protected]

    3. Data collected

    We collect different categories of data depending on your use of the Service:

    3.1. Registration data

    • Email address
    • First and last name
    • Date of birth
    • Gender

    3.2. Profile data

    • Profile photos
    • Voice messages
    • Content of the 6 chapters of your story
    • Search preferences (age, distance)
    • Location (city)
    • Sexual orientation
    • Parental status
    • Profession / industry
    • Lifestyle habits (smoking, alcohol)

    3.3. Communication data

    • Text messages exchanged with other users
    • Voice messages exchanged with other users
    • Correspondence with our support
    • Reports and blocks

    3.4. Payment data

    • Payment data processed by Stripe (we do not store your bank details)

    3.5. Technical data

    • Login and usage data

    4. Processing purposes

    Your data is used for:

    Service provision

    Account creation, profile display, matchmaking

    Service improvement

    Usage analysis, experience optimization

    Communication

    Notifications, updates, customer support

    Security

    Fraud prevention, user protection

    5. Legal basis for processing

    • Contract performance: for processing necessary to provide the Service
    • Consent: for marketing communications and certain cookies
    • Legitimate interest: for Service improvement and security
    • Legal obligation: for tax and legal obligations

    6. Processors and transfers

    We use trusted service providers for the operation of the Service:

    Supabase

    USA

    Database hosting

    Lovable

    USA

    Application hosting

    Stripe

    USA

    Payment processing

    Resend

    USA

    Transactional email sending

    Cloudflare

    USA

    Image and voice message storage

    These transfers are governed by the European Commission's Standard Contractual Clauses or the Data Privacy Framework.

    7. Retention period

    Active account

    Data retained for the duration of your registration

    After deletion

    Data deleted within 30 days, except for legal obligations

    Billing

    10 years (Belgian legal requirement)

    Technical logs

    12 months maximum

    8. Your rights

    Under the GDPR, you have the following rights:

    Right of access

    Obtain a copy of your data

    Right to rectification

    Correct inaccurate data

    Right to erasure

    Request deletion of your data

    Right to portability

    Receive your data in a readable format

    Right to object

    Object to certain processing

    Right to restriction

    Limit the processing of your data

    To exercise these rights, contact us at [email protected]. We will respond within one month.

    9. Security

    We implement appropriate technical and organizational measures to protect your data:

    • Data encryption in transit (HTTPS/TLS)
    • Data encryption at rest
    • Secure authentication
    • Need-based data access

    10. Complaint

    If you believe your rights are not being respected, you can file a complaint with the Belgian Data Protection Authority:

    Data Protection Authority

    Rue de la Presse 35, 1000 Brussels

    www.dataprotectionauthority.be

    11. Contact

    For any questions about this privacy policy, contact our team at [email protected]