DCZ Media Holdings LLC ("DCZ", "we", "our", "us") operates DesiCouplesZ at desicouplesz.app and desicouplesz.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our platform.
By creating an account or using DCZ, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our platform.
1. Information We Collect
1.1 Account Information
When you register, we collect your email address, date of birth (to verify you are 18+), display name, and password (stored as a bcrypt hash — never plaintext). Your email address is verified by a one-time code before your account is created.
Mobile number — optional. You are not required to provide a mobile number to register or to sign in. If you choose to add one, we use it solely to verify that the number is yours, to give you a second way to recover your account, and to display a verification badge on your profile. We do not use it for marketing, we do not disclose it to other members, and you may sign in with your email address or display name alone.
1.2 Profile Information
Information you choose to add to your profile: photos, bio, location (city-level only), relationship status, heritage, and preferences.
1.3 Age & Identity Verification
Age verification is performed by third-party providers engaged under written data-processing agreements, by means of facial age estimation from a selfie image. No identity document is requested at any point. Such providers process the image under their own privacy policies and as our processors. We receive only a verification outcome and a reference identifier; we do not receive or retain the image, any biometric template, or any identity document.
Genuine Member Verification. Separately from age verification, DCZ may require verification of any account as a condition of continued access to any feature, and determines, at its discretion and by reference to objective indicators of risk to the integrity or safety of the Platform, which accounts are required to complete it and when. Verification is conducted by means of a short recorded video session initiated from within the Platform, assessed with the assistance of automated tools and reviewed by authorised personnel before a determination is made. The resulting recording is held in private storage, is not published or made available to other members, and is retained for the period stated in §5. DCZ does not disclose the criteria, methods or tooling applied, disclosure of which would prejudice their effectiveness.
For 18 U.S.C. § 2257 compliance, custodial records (verified legal name, date of birth, ID type, and hashed ID number) are stored in a separate encrypted database accessible only to our designated records custodian.
1.4 Device, Technical & Usage Data
We automatically collect the following. This list is exhaustive as regards device and technical data and corresponds to the disclosures we make to the Apple App Store and Google Play:
- IP address, including the country and city derived from it. Used for security, fraud prevention, service delivery and compliance with legal obligations.
- Device type, browser user-agent and platform (web, iOS or Android). Used to deliver the service and to apply the content rules that differ between our website and our mobile applications.
- Push notification token — a device identifier issued by Apple or Google, collected only if you enable notifications and used only to deliver them. Deleted when you disable notifications or delete your account. We do not collect advertising identifiers (IDFA or AAID) and we do not track you across other applications or websites.
- Sign-in and session records — sign-in times, last endpoint accessed, and the device and network details above, retained as a security log.
- Precise location— collected only with your device's permission, optional, and withdrawable at any time in your device settings. See §8 of the Terms.
- Interaction data — pages and profiles viewed, searches and in-product actions.
We do not sell this data and do not share it with data brokers or advertising networks. Sharing is limited to the recipients listed at §4.
1.5 Communications
Messages sent between members are stored encrypted. We may access them only when required by law or to investigate abuse reports.
2. How We Use Your Information
- To operate and improve the platform
- To verify your age and identity
- To process payments through third-party payment processors and app-store billing systems
- To send service communications (account updates, security alerts)
- To detect and prevent fraud, abuse, and CSAM
- To comply with legal obligations (18 U.S.C. § 2257, NCMEC reporting)
- To enforce our Terms of Service
3. Content Moderation, CSAM & Communications Monitoring
Uploaded media is subject to automated screening and to review by authorised personnel before it becomes visible to other members. Screening is performed by DCZ and by third-party processors engaged under written data-processing agreements. Where material appearing to constitute child sexual abuse material (CSAM) is identified, whether by screening, by review or by report, it is removed, the account is permanently terminated, the material is preserved, and a report is filed with the National Center for Missing & Exploited Children (NCMEC) CyberTipline as required by 18 U.S.C. § 2258A. We do not inform the uploader of the specific reason for removal. DCZ does not disclose the tools or criteria applied in screening, disclosure of which would prejudice their effectiveness, and nothing in this section constitutes a warranty that every item of unlawful material will be detected.
Automated classification and human adjudication. Visual material is subjected to automated classification directed to sexually explicit conduct within the meaning of 18 U.S.C. § 2256(2) and to indicia of minority within the meaning of 18 U.S.C. § 2256(1); textual material is classified for prohibited expression, threats and off-Platform solicitation. Classifier output may cause material to be withheld or escalated, but no measure is imposed by automated means alone, all enforcement determinations being made by a natural person exercising independent judgement. Accordingly you are not subject to a decision based solely on automated processing within the meaning of Article 22 of Regulation (EU) 2016/679 and of the United Kingdom General Data Protection Regulation, and the safeguards at Article 22(3) are not engaged in respect of content moderation. See §4A.3 of the Terms of Service.
Account-level compliance audit; lawful bases.The Compliance & Security Team is authorised to audit an account in its entirety, comprising profile data, public and non-public media, albums and access grants, account, session and transaction records, and conduct directed toward other recipients of the service. Material designated private, restricted or view-limited is not removed from scope. Processing for this purpose is undertaken in reliance upon Article 6(1)(f) of Regulation (EU) 2016/679 (legitimate interests in the prevention and detection of unlawful acts and in the security of the service, as recognised at Recital 47 and Recital 49), and upon Article 6(1)(c) in so far as the processing is necessary for compliance with the obligations arising under 18 U.S.C. § 2258A, 18 U.S.C. § 2257 and 28 C.F.R. Part 75, the Online Safety Act 2023, and Regulation (EU) 2022/2065. In so far as the processing concerns data within Article 9(1), it is undertaken in reliance upon Article 9(2)(g) (substantial public interest), the condition at paragraph 10 of Part 2 of Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts) and, where the conduct concerns a child or an individual at risk, paragraph 18 of that Part, subject in each case to the Appropriate Policy Document maintained under paragraph 5 of Part 4 of that Schedule. Audit is not notified in advance, notification being incompatible with the purpose of the measure within the meaning of Article 14(5)(b).
3.1 Recording and review of interactive communications
Interactive video sessions conducted on the Platform — including one-to-one video calls, group video rooms and livestreams — are recorded by DCZ and may be reviewed by authorised personnel. Recording is automatic and applies to all such sessions. By initiating or joining an interactive video session you acknowledge and consent to this recording and review.
Purpose and limitation. Recordings are retained and reviewed for the sole purposes of (a) detecting, preventing and investigating unlawful conduct on the Platform, including CSAM, human trafficking, non-consensual content, coercion, extortion and the sexual exploitation of minors; (b) investigating reports made by members under our reporting mechanisms; and (c) responding to valid legal process. Recordings are not reviewed for marketing, profiling, advertising, model training, or commercial purposes of any kind, and are never shown to other members or made public.
Lawful basis (UK/EU). Where the UK GDPR or EU GDPR applies, this processing is carried out on the basis of our legitimate interests under Article 6(1)(f) — namely the prevention and detection of crime and the safety and integrity of the Platform and its users — and, where the recording contains special category data within the meaning of Article 9(1), on the basis of substantial public interest under Article 9(2)(g), as further specified in Schedule 1, Part 2, paragraphs 10, 11 and 18 of the UK Data Protection Act 2018 (prevention or detection of unlawful acts; protecting the public; safeguarding of children and of individuals at risk). We have completed a balancing assessment and consider that the interests pursued are not overridden by the interests or fundamental rights and freedoms of data subjects, given the safeguards described below. This processing also supports our obligations as an intermediary service provider under Regulation (EU) 2022/2065 (the Digital Services Act), in particular Articles 16 and 23.
Lawful basis (United States). Recording is undertaken with the consent of the parties to the communication, given through acceptance of these terms prior to use of the Platform, and in reliance on the service provider exception at 18 U.S.C. § 2511(2)(a)(i), which permits an electronic communication service provider to intercept, disclose or use communications in the normal course of employment while engaged in an activity necessarily incident to the rendition of the service or to the protection of the rights or property of the provider. This notice is provided so that recording is undertaken with the prior consent of all parties in jurisdictions imposing an all-party consent requirement, including but not limited to California (Cal. Penal Code § 632), Florida, Illinois, Maryland, Massachusetts, Montana, Pennsylvania and Washington. Nothing in this section derogates from our mandatory reporting obligation under 18 U.S.C. § 2258A.
Access controls and safeguards. Call recordings are encrypted at rest (AES-256) in private object storage, are never publicly accessible, and are retrievable only through short-lived, server-issued credentials. Access is restricted to a limited number of named personnel performing trust-and-safety review, is exercised on a least-privilege basis, and is subject to internal access controls. Recordings are not disclosed to any third party except (i) to law enforcement pursuant to valid legal process, (ii) to NCMEC where reporting is legally mandated, or (iii) where disclosure is otherwise required by law.
Retention. Call and livestream recordings are retained for the periods set out in §5 and are then automatically and permanently deleted, save where a recording is subject to a legal hold, an active investigation, or a mandatory retention obligation.
Your rights. You retain the rights described in §6 in respect of recordings, including the rights of access and erasure. Those rights are qualified to the extent that compliance would prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or a legal obligation to which we are subject. If you do not wish an interactive video session to be recorded, do not initiate or join one; all other features of the Platform remain available to you.
3.2 Regulatory basis, safeguarding rationale, technical scope and limiting measures
(a) Compliance framework. DCZ processes recordings of interactive video sessions in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation), the UK General Data Protection Regulation, the Data Protection Act 2018, Regulation (EU) 2022/2065 (the Digital Services Act), and applicable data protection legislation in each jurisdiction in which members are located. Processing is undertaken in accordance with the principles set out at Article 5 GDPR, including lawfulness, fairness and transparency, purpose limitation, data minimisation, storage limitation, and integrity and confidentiality, and is subject to the measures described at Article 25 (data protection by design and by default) and Article 32 (security of processing).
(b) Safeguarding rationale. The Platform permits adults to conduct private interactive video communications. Services of this character are known to be targeted for the commission of serious criminal offences, including the sexual exploitation and abuse of children, the production and distribution of child sexual abuse material, human trafficking and modern slavery, the creation and dissemination of non-consensual intimate imagery, sexual extortion, and coercive or controlling conduct. Recording is undertaken for the purpose of enabling the detection, investigation, prevention and reporting of such conduct, and for no other substantive purpose.
This purpose is directly referable to obligations and duties arising under, without limitation, 18 U.S.C. § 2258A (mandatory reporting of child sexual abuse material to the National Center for Missing & Exploited Children); 18 U.S.C. §§ 2251 and 2252A; the Trafficking Victims Protection Act; the Online Safety Act 2023 (United Kingdom), including the illegal content duties imposed on user-to-user services; the Modern Slavery Act 2015 (United Kingdom); and Articles 16 and 23 of the Digital Services Act concerning notice and action mechanisms and measures against misuse.
(c) Proportionality. DCZ has determined that no less intrusive measure would achieve the purposes described at paragraph (b). Contemporaneous human supervision of private communications would be materially more intrusive; reactive investigation absent a contemporaneous record would in the ordinary course be ineffective, since the conduct concerned is transient, is not otherwise evidenced, and is frequently unreported by the affected party. The retention periods specified at §5 represent the minimum period assessed as necessary to permit a report to be made, investigated and, where appropriate, referred to a competent authority.
(d) Material scope.A recording comprises the composited audio and video streams published to the session by its participants, for the duration of that session only. It does not comprise, and no mechanism exists by which it may comprise, any content not deliberately published to the session, any portion of a participant's device, display or physical environment not so published, or any activity occurring prior to a participant joining or subsequent to the session terminating.
(e) Excluded categories. Textual messages exchanged between participants within an interactive video session are transmitted directly between participant devices by means of a peer-to-peer data channel. Such messages are not transmitted to, processed by, retained by, or otherwise accessible to DCZ, form no part of any recording, and are not recoverable by DCZ at any time, including upon service of legal process.
(f) Technical and organisational measures. Recordings are (i) written to private object storage bearing no public access path and not addressable by unauthenticated request; (ii) encrypted at rest by means of AES-256 server-side encryption; (iii) retrievable exclusively by means of server-issued credentials expiring fifteen (15) minutes after issue, which cannot be generated, extended or reissued by any member; and (iv) at no time embedded, linked, indexed or otherwise exposed to any member.
(g) Excluded processing. DCZ does not deploy session-replay, screen-capture or interaction-recording technology within the Platform. Recordings, and any derivative work thereof, are not disclosed to any advertising network, data broker or analytics provider, are not used for profiling, audience segmentation, product marketing or commercial exploitation of any kind, and are not used as training data for any machine learning model, whether operated by DCZ or by any third party.
(h) Impact assessment. This processing constitutes systematic monitoring and involves special category data within the meaning of Article 9(1) on a significant scale. A data protection impact assessment has accordingly been conducted pursuant to Article 35 GDPR and Article 35 UK GDPR, and is maintained under periodic review. Where special category data is processed in reliance on the substantial public interest condition at Article 9(2)(g), an appropriate policy document is maintained as required by Schedule 1, Part 4 of the Data Protection Act 2018. A summary of either is available upon written request to the address specified at §15.
4. Sharing Your Information
We do not sell your personal data. We share information only with:
- Service providers (processors) — we use only the following, each bound to process data on our instructions:
- Infrastructure and hosting providers — server hosting and encrypted media storage
- Network security providers — content delivery, denial-of-service mitigation and automated-traffic detection
- Communications providers — transactional email and SMS one-time passcodes
- Real-time media providers — video calls, group rooms, livestreams and verification sessions
- Age and identity verification providers
- Content-screening providers — automated assessment of uploaded media
- Geolocation providers — approximate city-level lookup of your IP address for the review team
- Payment processors and app-store billing systems
- Law enforcement — when required by valid legal process
- NCMEC — CSAM reports as required by law
- Business transfers — in the event of a merger or acquisition, subject to the same privacy protections
5. Data Retention
- Active account data: retained while your account is active
- Verification recordings (the Genuine Member Verification session): retained for 90 days from recording, then automatically deleted. Processed on the basis of your consent, given on the verification screen, for the sole purpose of confirming your account is operated by a real adult. Never shown to other members, never made public, and never used for marketing or training. You may withdraw consent and request deletion at any time (see §6.4) — doing so may mean the Genuine badge cannot be granted or is removed.
- Call, group video and livestream recordings (see §3.1): one-to-one and group call recordings are retained for 120 days from recording; livestream recordings for 30 days. Both are then automatically and permanently deleted, save where subject to a legal hold, an active investigation, or a mandatory retention obligation.
- Deleted account data: purged within 30 days, except where required by law
- 2257 custodial records: retained for 7 years as required by 18 U.S.C. § 2257
- Payment records: retained as required by the applicable payment processor and by law
- CSAM incident logs: retained indefinitely
6. Your Rights
DCZ has members worldwide, with a large South Asian diaspora community in the United Kingdom, European Union, United States, Canada, Australia, the Gulf and India. Your rights depend on where you live. In all cases you may contact privacy@desicouplesz.app to exercise them, and we will respond within the timeframe your law requires. We may be unable to delete data we are legally required to retain (for example 18 U.S.C. § 2257 records or CSAM reports).
6.1 Who is responsible for your data
The data controller is DCZ Media Holdings LLC, a Wyoming limited liability company.
6.2 Legal bases we rely on (UK / EU members)
- Performance of a contract — creating your profile, matching, messaging and running the service you signed up for.
- Consent — precise (GPS) location, verification recordings, and any explicit content you choose to upload. You may withdraw consent at any time (see 6.4).
- Legitimate interests — approximate (IP-based) location, fraud and bot prevention, moderation and community safety.
- Legal obligation — age and record-keeping requirements, and mandatory CSAM reporting.
Some of what you may choose to share — for example sexuality or relationship orientation — is special category data under UK/EU law. We process it only because you have manifestly made it public on your profile and have given explicit consent by providing it. You are never required to supply it.
6.3 Where your data is stored (international transfers)
Our servers are located in the United States (Oregon), with video infrastructure in Finland. If you are in the UK, EEA, or another country with data-transfer rules, your personal data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses and equivalent safeguards for those transfers. You may request details of the safeguards in place.
6.4 Withdrawing consent
Withdrawing consent is as easy as giving it. For precise location, go to Settings → Location & Privacy, where you can see whether DCZ holds your coordinates and delete them in one click. You may also revoke the permission in your browser or device settings. Withdrawal does not affect the lawfulness of processing before it, and never removes your account or approval.
6.5 Rights by region
- United Kingdom & European Economic Area (UK GDPR / GDPR) — access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and withdrawal of consent. You may complain to your supervisory authority: in the UK the Information Commissioner's Office, or in the EEA your national authority.
- India (DPDP Act 2023) — access, correction, erasure, grievance redressal, and nomination. Complaints may be raised with the Data Protection Board of India after contacting us first.
- California (CCPA / CPRA)— know, delete, correct, and opt out of “sale” or “sharing”. We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.
- Canada (PIPEDA) — access and challenge accuracy; complaints to the Office of the Privacy Commissioner of Canada.
- Australia (Privacy Act) — access and correction; complaints to the Office of the Australian Information Commissioner.
- Everywhere else — we extend access, correction and deletion to all members regardless of location.
7. Automated Decision-Making & Matchmaking
DCZ ranks profiles for you using an automated compatibility score. It combines what you and the other member each said you are looking for, shared interests and languages, heritage, experience level, distance between you, how recently each of you was active, and any grooming preferences you set. Verified members receive a ranking boost.
- It orders results — it does not gate access. A low score never hides you from anyone, blocks messaging, or excludes you from search. Preferences you set rank members higher or lower; they never filter people out.
- No legal or similarly significant effects. Nothing about your rights, money or account status is decided automatically, so this is not decision-making under Article 22 of the UK/EU GDPR.
- Moderation is human-reviewed. Automated tools flag content, but a person makes the decision to approve, reject, suspend or ban — except for confirmed CSAM, which is actioned and reported immediately as the law requires.
- You can ask. Contact us for an explanation of how your profile is ranked, or to object to automated ranking.
8. Making a Request
Email privacy@desicouplesz.app from the address on your DCZ account, stating what you want (access, correction, deletion, export, objection, or withdrawal of consent).
- Identity check. We confirm you control the account email or phone number. We will not demand government ID for a routine request — asking for more data than necessary would defeat the purpose.
- Response time. Within 30 days, extendable once by a further 30 days for complex requests, in which case we will tell you why.
- Cost. Free. We charge nothing for exercising your rights, regardless of whether you are a paid member.
- Refusals. If we cannot act — for example where a record must be kept by law — we will say so and explain your right to complain.
9. Data Breach Notification
If a breach affects your personal data, we will investigate immediately, contain it, and notify you without undue delay where there is a risk to your rights. Where the law requires it we will also notify the relevant supervisory authority — within 72 hours under the UK/EU GDPR — and cooperate with law enforcement. Given the nature of this platform we treat any exposure of profile content, private media or location data as high risk by default.
10. Marketing & Communications
Service messages you cannot opt out of while your account is open — security alerts, verification codes, approval decisions and policy changes. Everything else is optional.
- Manage every notification channel in Settings → Notifications
- Use the unsubscribe link in any marketing email
- Or email privacy@desicouplesz.app to opt out of all marketing
- We do not share your address with third-party advertisers, ever
11. Cookies
We use HTTP-only cookies for authentication (session tokens). We use Cloudflare Turnstile for bot detection. We do not use advertising cookies or third-party tracking pixels. See our full Cookie Policy for the complete list of cookies, what each one does, and how long it lasts.
12. Security & Staff Access
We use HTTPS/TLS for all data in transit, bcrypt for passwords, HTTP-only cookies for sessions, presigned short-lived links for private media, and encrypted storage for sensitive records. No system is 100% secure — if you believe your account has been compromised, contact us immediately.
12.1 Staff access
Access to member data is restricted to authorised personnel who need it to operate the service — for example to review a signup, moderate reported content, or resolve a support request. Staff are bound by confidentiality obligations, and we maintain internal controls and monitoring appropriate to the sensitivity of the data. Private media is never publicly accessible; it is served through short-lived links that expire rather than permanent public URLs.
13. Children
DCZ is strictly for adults 18 years of age or older. We do not knowingly collect information from minors. Any account found to belong to a minor will be immediately terminated and the incident reported to appropriate authorities.
14. Changes to This Policy
We may update this policy periodically. We will notify you of material changes via email or an in-app notice. Continued use of DCZ after the effective date constitutes acceptance of the updated policy.
15. Contact
DCZ Media Holdings LLC
30 N Gould St Ste N
Sheridan, WY 82801, United States
Email: privacy@desicouplesz.app