1. Responsibility and contact
Southern Wolf, a sole trader trading as Blessed Union, New Zealand.
Email: [email protected]. Signed-in members can also use Contact support.
Do not email passwords, verification codes, identity images or document numbers. We may ask for proportionate account-ownership information before acting on a private request.
This policy covers information handled through the Blessed Union website, accounts, support and private verification. It describes the service’s current information handling. We will update it before materially changing collection or use.
2. Information collected and its purpose
- Accounts: name, email, password hash, account status and confirmation/recovery records enable registration, sign-in and recovery.
- Profiles and preferences: private birth date, derived age, adult declaration, photos, biography, broad city/region, Christian membership declarations, matching preferences, optional profile-text/interest searches and discreet discovery settings support the adult, marriage-seeking service. Optional faith details can reveal religious beliefs.
- Connections: likes, Intros, mutual relationships, messages, invitations, blocks, pauses and recipient preferences operate consent-based discovery and communication.
- Phone checks, when available: submitted number, pending provider reference/expiry, send/check limits and confirmed status. A number is linked after provider-confirmed possession; this does not check age or identity.
- Help and safety: support requests/replies, member reports, relevant message evidence and minimal review outcomes let us handle issues and moderate concerns.
- Technical records: network-derived abuse-limit keys, timestamps, request route/status/duration and provider delivery diagnostics help deliver, troubleshoot and protect the service. Hosts/providers may process IP addresses and browser/device details.
Information generally comes from you. Reports, messages and provider responses may supply information about you from others. We use it for relevant service/safety purposes and provide notices required by law, subject to lawful exceptions that protect investigations or other people.
3. Required steps and optional information
Name, email and password are needed for registration, with email confirmation before the first sign-in. Phone confirmation, private birth date, adult declaration, profile and approved photo are needed for member setup. Membership declarations and preferences determine new discovery. Without required information, the related feature cannot be provided.
Optional profile details, faith practice and approximate location can be left blank. The optional Didit ID or passport and selfie check and the optional human Photo checked review are free and separate from required setup. Phone possession, a document/selfie result and human profile-photo comparison are distinct checks; creating an account does not grant discovery or conversation access. Follow the checks shown on Verification. Setup, support, safety and account-exit routes remain available within account restrictions.
4. Member visibility and staff access
Eligible members see available profile details and approved photos, subject to visibility, consent and blocks. Intended recipients see your communications. Other members are not shown your email, phone, exact birth date, stored coordinates, identity images or support tickets.
Authorised staff access support/moderation records for their duties. Private identity images require an additional server-checked reviewer permission; ordinary admin status alone is insufficient. A Photo checked badge reveals a limited review outcome, not document details or a guarantee of safety.
Messages are stored by the service and are not end-to-end encrypted. Relevant messages can be examined through reporting/moderation. Avoid sharing information you do not want a recipient to retain.
5. Profile photos, identity images and location
Profile photos are decoded/re-encoded to remove embedded metadata such as EXIF location, and require moderation approval for member display. Fresh camera and ID images belong only in private verification. Do not submit them through support, email or chat. Staff must not copy document numbers into review records.
If you choose the Didit check when available, your document and selfie go directly to Didit for private identity, age and likeness checks. Blessed Union keeps a session reference, minimal check outcome and dates, without copying Didit’s identity images or document numbers into your account records. Identity documents are not shown on your profile. Review the provider’s privacy notice and consent in the verification flow. Our Didit application is configured with a two-year maximum retention period for verification evidence and to delete face templates with the session. We must delete evidence earlier when it is no longer needed for a lawful purpose. You can request earlier deletion through support or [email protected]; do not attach your ID or selfie to that request. We will assess the request, explain any lawful reason that prevents full deletion, and arrange applicable provider erasure. Provider recovery copies follow separate deletion handling, so we do not promise that every copy disappears immediately. The 24-hour human-review window below does not apply to Didit.
Images submitted separately for human Photo checked review are encrypted and kept separate from public profile photos. That review’s current access window is 24 hours. Expired evidence becomes inaccessible before scheduled database cleanup. Completed final decisions and account deletion remove live evidence; further-review submissions remain only within expiry. Minimal review outcomes remain. Cleanup is asynchronous, and encrypted backups can outlast live-image access.
Approximate location is used if you enable it. Coordinates are reduced in precision before storage; other members receive a broad distance band. Location applies mutual discovery radii. You can clear it in profile settings; otherwise discovery falls back to other criteria. Revoking browser location permission does not delete a location already saved.
6. Providers, disclosures and overseas processing
The intended cloud setup uses Render hosting, MongoDB account storage, private S3-compatible photo storage and Resend transactional email. Twilio Verify processes phone numbers/checks when SMS is activated. Didit holds and processes the document/selfie evidence submitted through the optional private identity flow, as described above. Before requesting a verification text, we record your explicit consent, the recipient number, the notice version and the time you agreed. This consent record stays with your account and is removed when account deletion completes. Enabled Cloudflare Turnstile checks process browser/network signals and challenge tokens. Actual provider activation and regions depend on deployment.
Providers may process information outside New Zealand. We must assess applicable safeguards, provider terms and their processing role before overseas processing/disclosure. The deployed region/provider register must be confirmed before broader registration; this policy does not promise New Zealand-only storage.
We do not sell member information or publish identity evidence. Relevant information may be disclosed where lawfully required or permitted to address serious safety issues, investigate abuse or protect rights. We assess purpose and scope rather than treating every request as authority to disclose.
Payments and subscription records
When Premium checkout is available, PayPal handles payment approval in its own window. We send the selected plan and a random reference that connects the subscription to your Blessed Union account. We do not send your profile, religious declarations, messages, identity evidence or account email in the PayPal subscription request. PayPal collects the information you provide in its payment flow and may process browser/device and fraud-prevention information under its Privacy Statement. We do not receive or store full card numbers or security codes.
We keep the provider, subscription and confirmed-payment references, checkout attempt and terms-acceptance time, membership tier, billing period, payment status, cancellation status and paid-through date to operate paid access, renewals and support. Verified payment notifications and fresh provider checks update those records. Payment providers may process information outside New Zealand. Any existing Stripe subscription continues to use its separate billing portal and Privacy Policy; new Premium checkout uses PayPal.
Account deletion stops the subscription before local billing identifiers are removed. If provider cancellation cannot be confirmed, deletion remains incomplete and support is needed. Payment providers and the operator may retain transaction records where needed for financial/legal obligations; account deletion does not erase provider transaction records or automatically refund payments. Contact support for access or correction requests concerning billing.
Our commitment on data use and AI training
We do not sell your personal information, use your private conversations to build advertising profiles, or train AI models on your profiles, messages, support requests or identity evidence. Information is processed for the account, communication, matching, verification and safety purposes described in this policy, rather than repurposed for unrelated commercial profiling.
We have opted the Blessed Union organisation out of Didit’s model-improvement programme. Didit says this excludes our existing and new verification data from future training, fine-tuning, evaluation, validation and dataset preparation. The opt-out does not reverse any model training that happened before it was applied, and it does not stop the automated identity checks, fraud prevention, security or support processing needed to provide verification. See Didit’s explanation of the control.
Private does not mean inaccessible to every other person. Intended recipients can read and retain communications; authorised staff may examine relevant information for support or reported safety concerns; service providers process the information needed for their functions. Messages are not end-to-end encrypted. The visibility and access limits above still apply.
7. Browser storage and tracking
The web app stores its sign-in token in browser local storage and removes the local token when you sign out. This is needed for the current signed-in experience. Sign out on shared devices. Clearing browser storage does not delete your account.
The current application includes neither advertising trackers nor a general analytics-cookie integration. Enabled security checks and hosting providers may use their own browser technologies under their notices. We will update this policy and obtain required choices before adding optional analytics or advertising tracking.
Who liked you and weekly reveals
For the Free weekly reveal, we keep the account references and reveal dates, plus the time when another reveal becomes available. These records enforce the weekly allowance and let you return to previously revealed Likes. They do not contain copies of profiles or photos. Each display still checks current blocks, privacy choices and eligibility; a reveal does not notify the other person or create a connection.
Your account export includes your own reveal history, with a notice if the export limit is reached. It does not show who revealed you. Completed account deletion removes reveal records involving that account. Deleting or blocking a revealed profile does not reset the remaining wait for another reveal.
Discovery selections and passed profiles
We keep the account references and dates of profiles you pass so that active Premium members can revisit their own passed profiles. This history starts when the feature is introduced and can be available if you later upgrade. It does not store copies of those profiles or photos, and passing does not notify the other person. Revisited profiles are checked against current blocks, privacy choices, mutual preferences and account eligibility before display.
Temporary daily selection records help avoid showing the same profile again that day and expire automatically. Passed-profile records remain for the feature until account deletion removes records involving that account. Your account export includes your own recorded passes, with an explicit notice if its export limit is reached; it does not reveal who passed on you.
Prayer garden: audience and author choices
Prayer requests, updates and encouragement are optional contributions to a members-only space. They may reveal sensitive personal circumstances or religious beliefs. Other members with access can read what you share, subject to blocks and moderation. There are no public profile links attached to a contribution. Anonymous hides your name from members; the service still holds your account association, and authorised staff can identify an author when investigating a concern. Do not include third-party identifying details, documents, contact information or requests for money.
You can close encouragement, add an update, mark your request answered or reopen it, and remove your request. A discovery pause does not hide voluntarily shared prayers. Removing a request also removes its encouragement from the garden; you can remove your own encouragement separately. Account export includes your own contributions without revealing anonymous authors you reported. Completed account deletion removes your contributions and encouragement on your requests. Existing safety reports retain only the reported text privately under the limited safety-evidence retention period below. People who already read content may have kept a copy; anonymity cannot conceal identity you disclose in your own words.
8. Retention, deletion and backups
Data is held while needed for your features and justified service/security/legal purposes. Completed account deletion removes or anonymises ordinary member-facing records, profile/photo data and support tickets. Export includes support requests/replies but excludes identity-image binaries and private information about others.
Limited report-linked or moderation-queued evidence may remain separately after deletion using pseudonymous identifiers for safety review. The approved retention period is 90 days from account deletion, after which evidence is eligible for automatic database cleanup. Cleanup runs asynchronously. Report context is limited to at most 20 messages from the 24 hours at or before each report; separately queued moderation evidence may also be retained. Pseudonymous evidence is not necessarily anonymous: message content may identify someone.
Backups/provider copies follow separate deletion cycles; every copy does not disappear immediately. Their retention periods still require operator confirmation before broader registration. The 90-day policy applies to the dedicated live safety-evidence collection.
9. Security and incidents
Password hashing, access controls, bounded requests, private image delivery and encrypted verification evidence reduce risk but cannot guarantee against unauthorised access. Staff access must stay limited to duties. Hosted keys, storage and backups need ongoing operational checks.
Tell us promptly about suspected exposure. We will assess incidents, take reasonable containment steps and give notifications required by applicable law. Do not send sensitive evidence through ordinary email or support messages.
10. Access, correction and complaints
Discreet discovery restricts visibility to people you chose and existing connections, subject to blocking and other restrictions. Once chosen it remains on after subscription expiry until you turn it off; previously received information is not erased. You can edit supported profile details, clear location, change preferences, turn discreet discovery off, pause discovery and request export/deletion in Settings. Export/deletion require password reauthentication. Contact the privacy contact above for birth-date correction, inaccessible accounts or information outside self-service export.
You can request access to personal information and correction of inaccurate information under applicable privacy law. We respond within the applicable legal timeframe, subject to lawful withholding grounds, identity checks or extensions. If correction is declined, you can ask for a statement of correction to be attached as required by law. Identity images sent by ordinary email are not required to make a request.
You may complain to New Zealand’s Office of the Privacy Commissioner. This policy and its self-service controls do not limit other mandatory rights.
11. Children and updates
The service is for adults 18 and older. Do not register if under 18. Contact support if you believe a child has registered or submitted information so it can be reviewed.
We will show the updated date and explain material changes before substantially changing information handling, with additional notice/consent where required. FAQ guidance does not replace this policy.