This summary helps you navigate the Policy. It does not replace the full text below.

Who we are— Binder Community Limited, a UK company, is the controller of your personal data.

Who can use Binder— Adults aged 18 and over, in the United Kingdom.

Sensitive data— We use data about your sexual orientation, gender identity, religious or philosophical beliefs, or health only where you give explicit consent, to keep people safe, to comply with legal or regulatory obligations, or to deal with legal claims.

Matching and profiling— We use an automated compatibility algorithm to suggest people, content and events. We may also analyse your activity (including the posts and events you engage with) to build a picture of what you like to attend. This is profiling; it affects the relevance, ordering and prominence of what you see, is not a solely automated decision with legal or similarly significant effects, and you can object to the profiling of your activity, and to our use of your plan picks, at any time. We may also ask you to pick example plans you’d go to. Other members do not see your picks. We may use them to suggest Signals, plans, events and communities near you and as one input to compatibility. See sections 12.2, 12.4 and 12.5.

Age assurance— Binder is for adults aged 18 and over. Members who join outside our closed beta take an age check with Stripe Identity: a photo of a government-issued identity document and a selfie with a liveness check. For this check, Binder keeps the result (an 18+ pass/fail flag, the date and Stripe’s reference), not your document, date of birth or biometric data. See section 12.1.

Location— Optional and consent-based. We apply location fuzzing to help protect your precise location.

Images and safety— Images you upload are automatically screened using Microsoft PhotoDNA against databases of known illegal content (CSAM), and the text you post is automatically checked for content that breaks our Community Guidelines, such as threats and identity-based abuse. Both checks operate now. We may also check images with our own system for nudity that may break our Community Guidelines; that check flags an image for a moderator. We will tell you before we use your data for a new purpose.

No automated screening can detect all illegal or harmful content; we apply reasonable endeavours and do not warrant that every item is detected. We do not use your data to train general-purpose or third-party AI models; we may use limited content to improve our own moderation and matching systems (sections 12.3 and 13).

Your content— Your messages and profile content are not end-to-end encrypted; we can access them to run the service and keep users safe.

Selling data— We do not sell your personal data.

Your rights— Access, correct, delete, restrict, object (including to the profiling of your activity and to any use of your data to train our own systems), portability, withdraw consent, complain to the ICO, and claim compensation under data-protection law.

This Policy covers both this website (including the waitlist sign-up) and the Binder app and related services (together, the Platform).

Binder Community Limited is the controller of your personal data, except where this Policy says we act as a processor on behalf of another party. Our details are:

Controller: Binder Community Limited, registered in England and Wales (Registered No. 17058768).

Registered office: 15 Montpelier Vale, London SE3 0TA.

Data Protection Officer: Cameron Farquhar. You can contact our Data Protection Officer at cameron@bindercommunity.app, or by post at the registered office marked “For the attention of the Data Protection Officer”.

ICO registration number: ZC191474.

We follow the UK GDPR principles: we use your personal data lawfully, fairly and transparently; only for specified, explicit and legitimate purposes; limited to what is necessary; kept accurate and, where necessary, up to date; kept no longer than necessary; and protected by appropriate security. We are accountable for meeting these principles. We keep the records needed to demonstrate our compliance with them.

‘Platform’ means the Binder mobile application, website and related services.

‘Stripe’ means Stripe Payments UK, Ltd, our age-verification and payment services provider.

‘personal data’, ‘special category data’, ‘controller’, ‘processor’ and ‘processing’ have the meanings given in the UK GDPR (the retained EU GDPR as it forms part of UK law, read with the Data Protection Act 2018).

The Platform is for adults aged 18 or over in the United Kingdom. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. We use an age check by Stripe Identity (an identity document and a selfie with a liveness check) to confirm that members who join Binder outside our closed beta are 18 or over (section 12.1). If we learn that a person is under 18, they cannot use Binder. We keep the account, blocked, and the result of the age check (section 17).

We collect the following categories of personal data, from you directly unless stated otherwise.

Some personal data is necessary to provide the Platform. You must provide account data to create and use an account, and you must confirm your age (section 12.1). If you do not provide the data we need, we cannot provide the Platform to you.

Other data is optional. You choose whether to share profile details, sensitive preference attributes, and location. Not sharing them only means certain features may be unavailable. Marketing is optional.

You choose whether to share special category data through your profile, using a control in Settings (“Review data and consent”) that you can turn on or off at any time. If you turn it off, we stop using that data for matching and some features become unavailable, so you use Binder in a more limited way (section 12.2).

We must have a lawful basis to use your personal data, and an additional condition for special category data. We rely on your consent to process the information you choose to share that reveals, or may reveal, special category information such as your religious or philosophical beliefs, sexual orientation, gender identity, or health, in order to provide our matching services (section 12.2), to let you send messages and take part in plans and conversations, and to let you join communities (section 15.1). We ask for this consent separately and specifically at sign-up, through a distinct opt-in. This consent is optional and you can withdraw it at any time (section 8). Without it, some features - including compatibility matching that relies on this information - may be unavailable to you, and you cannot send messages, respond to Signals or join plans or conversations, though you can still use the rest of the Platform. You can turn this consent on or off at any time in your settings. Our main purposes are set out below.

Where we rely on legitimate interests, we have weighed those interests against your rights, and you can ask us about that assessment. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

Data about special category data such as your sexual orientation, gender identity, religious or philosophical beliefs, and health is treated as especially sensitive. We therefore rely on you providing your consent to process it. Binder may from time to time process certain special category data under specific legal bases, for example to ensure user safety or to comply with legal or regulatory obligations, or to deal with legal claims (see section 7 and our Appropriate Policy Document).

We may collect sensitive data through our systems during onboarding and profile setup. This data may be used to calculate compatibility scores between users as part of Binder’s matching service (section 12.2). You control which information you share or whether to share any information at all, and you can change what you share on your profile at any time, or turn this consent off in Settings (“Review data and consent”). If you withdraw consent for special category data processing, we stop using that data and some features become unavailable.

You can turn consent for special category data processing on or off at any time. If you turn it off, we immediately stop using and hide this information; it is then deleted after 48 hours unless you turn consent back on before then, in which case it is restored. Some of the example plans we may show you (section 12.5) are about identity, belief or health, for example a night for a particular community. We show these, and keep a pick of one, only if you have given this consent; if you turn it off, those picks are hidden at once and then deleted with the rest of your special category data.

Because messages and the plans you join can reveal this information, you need this consent to send messages, to respond to a Signal or to join a plan or a conversation. Turning it off removes you from other people’s conversations, and conversations you started become read-only for you. Because joining a community needs this consent, turning it off also removes you from your communities and their Conversations, and archives any community you run on your own; turning it back on within 48 hours restores them. Turning it off does not remove content you have already shared with other users (for example in messages, group chats or community Conversations), which is governed by section 15.1. You can ask us to delete specific content, or close your account, at any time (section 19).

Please also take care with sensitive information you include in messages or share with other users. Once you share it with another person, you may not be able to control how they use it.

Because the Platform is for adults, we do not knowingly process the personal data of under-18s, except as section 4 describes. If you believe a child is using the Platform, please report it through the app or contact us, and we will take appropriate action, which can include closing the account. We keep what we need for safety or legal reasons (section 17).

We send marketing by email, SMS or push notification only where you have opted in, and you can opt out at any time using the unsubscribe link or your notification settings. We will still send essential service messages (for example about security, payments, or changes to our terms), which are necessary to provide the Platform and are not marketing.

Separately, where we use your content in our own external or public marketing (including where that marketing appears on third-party platforms such as social media), we use content that identifies you only with your opt-in consent. We do not hand your personal data to third parties for their own marketing. You can withdraw that consent at any time; withdrawal takes effect for the future only and does not affect uses that were lawful before withdrawal, materials already published or distributed, or sub-licences already granted. Where identifying content is personal data, your data-protection rights (withdrawing consent and erasure), not the content licence, govern its removal; and on withdrawal or erasure we take reasonable steps to notify any sub-licensees to cease further use, consistent with Article 17(2) UK GDPR. This use is a licence of the intellectual property in your content and not a sale of your personal data. Further detail on the licence over your content is in our Terms of Service and the UGC Licence.

Our website does not use advertising or analytics cookies. In the app, we store on your device what is needed to keep you signed in securely and to remember your settings, and our diagnostics provider (Sentry) collects technical details when the app runs into an error, and from a small sample of sessions, with text and images hidden, so we can find and fix problems (section 15.2). If this changes, we will update this Policy and, where the law requires, ask for your consent first.

On this website (including the waitlist) we do not currently use analytics or visitor-tracking technologies; we rely on the processing needed to run the site securely.

Age verification (12.1), matching (12.2) and image and content moderation (12.3) operate now. We may also ask you for plan picks and use them as section 12.5 describes.

To confirm that you are aged 18 or over, we use Stripe Identity. You photograph a government-issued identity document and take a selfie with a liveness check; Stripe compares the two and checks the document, and the result tells us whether you meet the age threshold. The check is a condition of using Binder. This is an automated decision: if you do not pass, you cannot use Binder. If the check fails, contact us (section 23): a member of our team will review the decision and can change it, and may offer you another attempt, and you can put your point of view and contest the outcome.

Stripe carries out the check for us. Stripe also uses verification data for its own purposes — to prevent fraud and, if you agree, to improve its identity service — as a separate controller under Stripe’s own privacy policy, and it keeps biometric data for no longer than one year, or until you withdraw your consent to Stripe, whichever is earlier. For this check, Binder keeps a confirmation of your age status (an 18+ pass/fail flag, the verification date and Stripe’s session reference); we do not store your identity document, your date of birth or your biometric data.

Our lawful basis is our legitimate interests in keeping Binder for adults and protecting children (Art 6(1)(f)). Your selfie and the liveness check are biometric data. We process them because it is necessary for reasons of substantial public interest, to safeguard children (Art 9(2)(g); DPA 2018 Sch 1 para 18), as our Appropriate Policy Document records. Stripe’s own screen asks you to agree before it captures your selfie; that step is part of Stripe’s process. If you choose not to continue, the check cannot be completed and you cannot use Binder.

Binder uses an automated matching system to suggest other users, content and events that may be relevant to you. This involves profiling within the meaning of Article 4(4) UK GDPR. It draws on your profile and preferences, your approximate location (to which we apply location fuzzing), your activity on the Platform, and - where you have given explicit consent - the sensitive attributes you have chosen to share, to estimate how relevant a suggestion may be to you.

This affects the order and prominence of what members see, such as suggestions and the people shown in an Orbit, and which suggestions appear when a member chooses to see just the people or Signals most closely aligned with them. Scores are used to order and highlight suggestions and what appears on the map; to let members choose to see just the people and Signals most closely aligned with them; and to choose, order and show how closely matched the people you have aligned with are, and what they share, in your Orbit and on your profile (which other members can see). It does not decide who may contact you and does not restrict your access to the Platform, and it is not a solely automated decision producing legal or similarly significant effects, so Articles 22A to 22D UK GDPR do not apply. You can change what you share or turn this consent off at any time (section 8).

To keep the Platform safe, images you upload are automatically scanned using Microsoft PhotoDNA, which compares them against lists of known child sexual abuse material (CSAM). This scanning operates now. Profile photos, cover images and Signal images are not shown to other users until the scan has cleared them. If an image matches, it is withheld from the Platform and preserved securely as evidence, the matter is recorded, and deletion of the account and its data is blocked while our team reviews it; where the review confirms it, we report it to the police or other appropriate authorities.

We may also run our own automated check on images, including images uploaded before the check began, to flag those that may show nudity that breaks our Community Guidelines. It runs within our own service and keeps only its result. A flag goes to a moderator, who sees a blurred version and decides whether anything should happen. We may use moderators’ decisions on flagged images to set how sensitive the check is (section 7). You can ask us to look again at any moderation decision (section 23).

We also automatically check the text you post, including your profile, Signals, plans, community pages and messages. The check runs within our own service. It looks for threats and identity-based abuse and, outside private conversations (direct messages, and plan, Signal, event and invite-only community Conversations), sexually explicit content. If text does not pass, it is not posted and you see a message saying so; you can change it and try again, or contact us (section 23) if you think the check got it wrong.

No automated screening can detect all illegal or harmful content; we apply reasonable endeavours and do not warrant that every item is detected.

Where a moderation decision significantly affects you, you can request human review, put your point of view, and contest the outcome.

We do not use your personal data, images or messages to train general-purpose or third-party AI models. We may use limited content to develop and improve our own content-moderation and matching/compatibility systems, as section 13 describes.

We retain details about your activity to operate our features. Separately, we may analyse this activity to build a picture of the kinds of plans, events and activities you like to attend, so as to make discovery and suggestions more relevant to you. Any such analysis is profiling within the meaning of Article 4(4) UK GDPR.

Our lawful basis for this profiling is our legitimate interests (Article 6(1)(f)) in operating and improving a relevant, useful service, weighed against your rights (and you can ask us about that assessment), and you have the right to object at any time (Article 21 UK GDPR — see section 19). This affects the relevance, ordering and prominence of what you see; it does not produce legal or similarly significant effects and is not a solely automated decision of that kind, so Articles 22A to 22D UK GDPR do not apply.

Where we go further and use this activity to develop or train our own systems, that is a separate purpose described in section 13.

We may ask you to pick example plans you would go to. They are made-up plans, labelled as examples, and each stands for a short list of tastes (for example “live music” or “climbing”). We may also ask you to pick venues you would go to. Picking is optional, and you can skip it.

Your picks are stored with your account. Other members, community organisers and venues do not see your picks, or how many you share with anyone.

We may use your picks in two ways: to choose and order the Signals, plans, events and communities near you that we suggest, and as one input to how closely your tastes match another member’s (section 12.2). “Near you” means near the city on your profile, not your phone’s location. This is profiling within the meaning of Article 4(4) UK GDPR. It affects the relevance, ordering and prominence of what you see; it does not produce legal or similarly significant effects, so Articles 22A to 22D UK GDPR do not apply.

Our lawful basis is our legitimate interests (Article 6(1)(f)) in a relevant, useful service, weighed against your rights (and you can ask us about that assessment). For picks that could reveal special category information, we rely on your explicit consent (section 8), and we will ask you separately before we use those picks for suggestions.

You can object to our use of your picks at any time (Article 21 UK GDPR — see section 19).

You can clear your picks in the app. If you do, we stop asking.

Binder may use user data and content to develop, train, test and improve its own content-moderation and matching/compatibility systems. This is limited to our own systems: we do not use your data, content, images or messages to develop or train general-purpose or third-party AI models.

Wherever possible, we use anonymised or aggregated data for this purpose, so that it does not identify you. Any use of data that identifies you, or of special category data, is subject to a further lawful basis:

We assess the risks first where the law requires it, and we tell you what we are doing.

You can object to this use, and to the profiling of your activity (section 12.4), at any time — see section 19 (Your rights).

We apply location fuzzing and other measures (such as coarsening or ‘ghosting’ location) to help protect your precise location. We do not collect location in the background unless a feature you have enabled needs it. If you host a community event, its exact location is shown to you, the community’s organisers and the people going; everyone else sees a rough area. Because the Platform can facilitate meeting people in person, please also read our Safety Guidelines before arranging to meet anyone.

Your profile, including what you choose to share on it, can be seen by other Binder members. Some features let you choose who sees what you post, such as who can see a Signal. If you join a community, the people who run it can see that you are a member, people you have aligned with who are in the same community can see that you share it, and the people in a community’s Conversations can see that you are in them and what you post there. Who can see that you are going to a community event depends on the event’s settings. Other members do not see your plan picks (section 12.5).

Other users may see information you make publicly visible, and we encourage you to take care when posting sensitive information. Each user is responsible for the information they make publicly available — see our Terms of Service for our liability position.

The providers below process personal data on our behalf, except where a row says a provider uses it under its own terms. Microsoft’s processing of images through PhotoDNA is carried out under Microsoft’s data-processing terms, which incorporate the Article 28 UK GDPR processor obligations.

Your profile content and messages are not end-to-end encrypted, which means we (and our service providers acting on our instructions) can access them to operate the Platform, provide support, and keep users safe. We do not have access to your password, which is stored in a secured (hashed) form. We do not use end-to-end encryption, so that we can meet our legal and safety obligations, including where we are lawfully required to access content.

We may disclose data where necessary to protect users or the public, to detect or prevent abuse, harassment, illegal content or fraud, to comply with a legal obligation or court order, to respond to lawful requests from law enforcement or regulators (including the National Crime Agency, CEOP, the ICO, and Ofcom), or to bring or defend legal claims.

In a merger, acquisition, financing or asset sale, data may be disclosed or transferred subject to appropriate confidentiality protections. If your personal data passes to a new owner, we will tell you, and the new owner must handle it in line with data-protection law. You can close your account at any time (section 19).

We do not sell your personal data, and we do not share it with third parties for their own marketing. Section 12.1 describes Stripe’s own use of age-verification data. Where we share personal data with third-party partners, it is for the operational purposes described in this Policy (section 15.2), and not for their marketing.

We distinguish your personal data from your user-generated content (‘UGC’). The licence we reserve over your content for marketing and other purposes applies to non-personally-identifying UGC unless consented to. That is a licence of the intellectual property in the content; it is not a sale, and it is not a marketing use of your personal data.

Binder takes the safety of its users seriously, and so does not licence Content that identifies you personally to third parties, or use it in its own marketing, without your consent. That consent is the lawful basis; it is optional and you can withdraw it at any time. Withdrawal and erasure of identifying content are governed by your data-protection rights, not by the content licence (see sections 10 and 19, and our Terms of Service).

The Platform is offered to users in the United Kingdom, and this Policy is governed by the law of England and Wales. Some of our providers are based outside the UK or may process data outside it. Where personal data is transferred outside the UK, we rely on an appropriate safeguard, such as the ICO’s IDTA or the UK Addendum to the EU SCCs, together with a transfer risk assessment. Transfer-mechanism details for each provider are set out in section 15. You can ask us for a copy of these safeguards using the contact details in section 23.

We keep personal data only as long as necessary for the purposes in this Policy, then delete or anonymise it. The table below is an indicative summary. Our full retention periods, triggers and bases are set out in our Data Retention Schedule, which is the controlling document; if this summary and the Data Retention Schedule ever differ, the Schedule governs.

A legal hold (for a safety, Online Safety Act, investigation or litigation matter) overrides every routine deletion period above and the 90-day deletion grace: where a hold applies, the affected account and data are kept until the matter closes plus a defined tail, notwithstanding any deletion request, expiry or grace period. Where Binder is required to retain data records by law enforcement agencies or regulators, we may retain data for longer subject to our obligations and requirements under applicable law and authority.

We design the Platform with privacy and security in mind (‘privacy by design and by default’) and apply technical and organisational measures appropriate to the sensitivity of the data, including encryption and access controls. No system can be guaranteed completely secure; we work to protect your data and will notify you and the ICO of a personal data breach where required.

Subject to conditions and exemptions in data protection law, you have the right to: access your data; have it corrected; have it erased; restrict processing; object to processing — including the right under Article 21 UK GDPR to object to direct marketing, to profiling based on our legitimate interests (such as the activity and attendance-preference profiling described in section 12.4), and to any use of your data to develop or train our own systems (section 13); data portability; withdraw consent at any time (including consent to sensitive or preference-based profile attributes, or to location); and request human review of any significant automated decision. You may also be entitled to compensation for damage under data-protection law (Article 82 UK GDPR and sections 168–169 of the Data Protection Act 2018); nothing in this Policy or the wider suite limits that entitlement.

When you delete your account or ask us to erase your personal data, your account first enters a 90-day grace period; after it ends, your account, profile and media are hard-deleted (section 17), unless the account is under a hold or we need to keep data to comply with legal obligations, or in reasonable contemplation of defending or bringing a claim. Some data may be kept for longer where the law requires or permits it — for example payment records and safety/moderation records — and any legal hold overrides this process (section 17). After deletion we keep a minimal proof-of-consent record — the consent event, its date, and the scope/policy version — for accountability under Article 7(1) UK GDPR. This minimal record is kept for up to 6 years from closure or erasure and is then deleted or anonymised.

Where you ask us to erase your personal data, or you withdraw consent, and we have shared that data with recipients or sub-licensees, we will take reasonable steps to notify them to cease further use, consistent with Articles 17(2) and 19 UK GDPR, taking account of available technology and the cost of doing so and where it is reasonably practicable, and subject to Binder giving no warranty or guarantee over the acts or omissions of third parties outside its direct control.

To exercise a right, contact us using the details in section 23. We respond within one month (extendable for complex requests) and there is normally no charge; we may need to verify your identity first. Some rights are not absolute — for example, we may need to keep certain data for safety or legal reasons.

If you are unhappy with how we have handled your personal data, please contact us first — including through Help & contact in the app’s Settings — so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk; helpline 0303 123 1113; Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

The Platform may link to or integrate third-party websites or services we do not control. This Policy does not apply to them, and we are not responsible for their privacy practices. Please review their privacy notices before sharing your data.

We may update this Policy from time to time. If we make material changes, we will give you reasonable notice through the Platform or by email; where a change affects the basis for consent-based processing, we will ask you to review and re-accept it before we rely on the change for that purpose. The version currently published on the Platform is the one in force; we keep internal records of earlier versions.

When you open a shared Binder event or community page on the web, you do not need an account. If you tap "I'm coming" or "Interested", we count you without knowing who you are.

For any question about this Policy or your personal data, contact our Data Protection Officer at cameron@bindercommunity.app or at Binder Community Limited, 15 Montpelier Vale, London SE3 0TA. Controller: Binder Community Limited (Registered No. 17058768). If you need this Policy in an accessible format, please contact us and we will help.