Privacy Policy

1. General provisions

This Privacy Policy (the “Policy”) sets out how personal data is processed when you use the BeFrie mobile application and the website befrie.app (together, “BeFrie”). It is drawn up in accordance with the Law of Georgia on Personal Data Protection (the “Law”). The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “consent” have the meaning given to them by the Law.

BeFrie is intended only for persons who have reached the age of 18.

2. Controller

The controller of your personal data is Elene Malakmadze, a natural person in Georgia (the “Controller”, “we”), who determines the purposes and means of the processing described in this Policy. Requests and questions concerning personal data may be sent to [email protected].

3. Personal data we process

We process the following categories of personal data:

• account data: your email address and the method by which you sign in (Apple, Google or a code sent by email);
• profile data: your name, date of birth, a description of yourself, your profile photo and, if you provide it, your area;
• data on your use of BeFrie: the plans (meetings arranged through BeFrie) that you host or join, your requests to join them, and the messages, photos and video notes you send in their chats and in direct chats with other participants;
• location data: while you choose to share your live location with a plan, the latest location of your device and its accuracy;
• safety data: the reports you submit and the reports concerning you, the users you have blocked, and the moderation measures applied to an account;
• identity verification data: the fact and date of verification, the date of birth read from your identity document, a one-way code derived from your personal number, whether your profile photo matched your face, and a key identifying the application on your device. The Identity Verification Notice lists exactly what is and is not stored;
• technical data: your notification settings and, if you enable notifications, the push token of your device.

4. Purposes of processing

We process personal data in order to:

• create and maintain your account and profile;
• show you plans near you and enable you to host and join them;
• provide the chat of a plan and direct chats between its participants;
• verify the identity and age of persons who host or join plans;
• protect the safety of users, examine reports and prevent abuse of the service;
• send the notifications you have enabled;
• maintain the security and reliability of the service.

5. Legal grounds for processing

Personal data is processed on the following grounds provided for by the Law:

• performance of the agreement concluded with you (Article 5(1)(b) of the Law): account, profile, plan, chat and notification data are necessary to provide BeFrie to you under the Terms of Service;
• your written consent (Article 6(1)(a) and Article 9 of the Law): identity verification involves the processing of biometric data, which takes place on your device and only on the basis of the consent you give in electronic form in the application before the check begins. This processing serves the purposes of carrying out the Controller’s activity and of the security of persons who meet in person;
• your consent (Article 5(1)(a) of the Law): the application uses the location of your device only if you allow this in the settings of iOS, and shares it with the participants of a plan only when you choose to share your live location;
• the important legitimate interests of the Controller and of third parties (Article 5(1)(i) of the Law): reports, the blocking of users, moderation, usage limits and security logs are processed in order to keep users safe and to prevent abuse of the service;
• the performance of duties imposed on the Controller by the legislation of Georgia (Article 5(1)(d) of the Law), where such duties exist.

The provision of account and profile data is a necessary condition for concluding the agreement: without them an account cannot be created. You may decline identity verification, but in that case you cannot host or join plans.

6. Identity verification

Identity verification is required before you host or join a plan. BeFrie carries it out itself, without an identity verification provider. Your device reads the chip of your Georgian passport or identity card, establishes that a real person is in front of the camera, and compares your face with the photograph stored on the chip and with your profile photo. The camera images, the photograph from the chip and the facial measurements remain on your device and are deleted as soon as the check ends.

The Controller’s server receives the text data of the chip and the electronic signature of the State, verifies the signature, the validity of the document and your age, and then deletes them. Only the fact of verification, your date of birth, whether your profile photo matched, and a one-way code derived from your personal number are stored. Details are set out in the Identity Verification Notice.

7. Automated individual decision-making

The decision on identity verification is taken solely by automated means: your device determines whether the faces match, and the Controller’s server determines whether the document is genuine and valid and whether you have reached the age of 18. The decision is based on your consent and is necessary for concluding and performing the agreement with you.

At your request a person will take part in the decision: you may express your point of view and contest the decision by writing to [email protected].

8. Content and safety reports

Profile photos, messages, photos sent in chats and video notes are stored in order to provide the service and, where necessary, are reviewed for safety purposes.

When a report is submitted, we store, without alteration, the evidence relating to it: the profiles of the person who submitted the report and of the person reported and, depending on what was reported, the details of the plan, the reported message, and recent or surrounding messages from the same chat. This allows the report to be examined even if the content is later changed or deleted. Reports are examined by people, not by an artificial intelligence service.

9. Location

The application uses the location of your device only with your permission, in order to show plans near you. BeFrie does not store that location, except while you share your live location as described below.

Live location. From two hours before a plan starts until one hour after it starts, a participant may share their live location with the plan, for up to 30 minutes at a time. Sharing starts only when you choose it and continues while the application is in the background, until the 30 minutes are up or you stop it; it also stops when you leave the plan. While you share, the host and the participants of that plan, and nobody else, can see your location on a map together with your name and profile photo. Only your latest location and its accuracy are stored, and they are deleted as soon as sharing ends.

For each plan, the exact meeting point set by the host and, where added, the name or address of the venue are stored. They are visible only to the host and to the participants of the plan; other users see only the area and an approximate location within about 500 metres of the exact point.

The application uses Apple Maps for maps, place search and determining the area of a meeting point; the relevant locations and search terms are therefore transmitted to Apple.

10. Recipients of data

Other users of BeFrie can see your name, age, profile photo and description of yourself; the participants of a plan in which you take part can also see the messages you send in its chat and, while you share it, your live location.

Plan links. A plan can be shared with a link. Anyone who opens it, including people who don't use BeFrie, sees the plan's title, area, time, activity and how many people are going, but not who is going, the exact meeting point or the chat. The host can replace a plan's link at any time, after which the old link stops working.

The Controller uses the following service providers, to which personal data is disclosed to the extent necessary for their services:

• Supabase: hosting of the database, file storage and server functions (European Union, Ireland);
• Apple and Google: sign-in;
• Apple: delivery of push notifications (a notification may show a short excerpt of a chat message), maps and place search, and confirmation that an identity check originates from the genuine application (App Attest);
• Resend: sending of sign-in codes by email;
• Cloudflare: hosting of the website.

These providers process data in accordance with their own privacy and data processing terms.

11. Transfer of data to other states

Supabase stores BeFrie’s data in the European Union (Ireland). Some recipients, including Apple, Google and Resend, may process data in the United States of America or in other states. We use only providers that undertake, in their data processing terms, to protect personal data.

12. Storage periods

• account and chat data is stored until you delete your account;
• a live location is stored only while it is shared: the latest location is deleted when sharing ends, at the latest after 30 minutes;
• identity verification data (the fact of verification, your date of birth and the one-way code) is stored for as long as your account exists;
• when you delete your account, your profile, profile photo, messages, the photos and video notes you sent, the plans you host and your identity verification record are deleted. If the account is suspended for safety reasons at the time of deletion, the one-way code is stored until the suspension ends or, where the suspension has no end date, for two years;
• a profile photo that has not been confirmed is hidden from other users and is deleted when you replace it or delete your account;
• reports and the evidence relating to them may be stored after an account is deleted, for as long as is necessary to keep BeFrie safe;
• the service logs of our hosting provider are stored for no longer than 90 days. Deleted data may remain in encrypted backup copies for up to 30 days.

13. Data security

We take organisational and technical measures that are appropriate to the risks of the processing. Data is transmitted over encrypted connections, access to it is limited to the persons who operate and moderate BeFrie, and identity verification is designed so that as little data as possible is stored.

14. Your rights

Under Chapter III of the Law you have the right to:

• receive information on the processing of data concerning you;
• access the data concerning you and obtain a copy of them;
• have your data rectified, updated and completed;
• have the processing of your data terminated and the data erased or destroyed;
• have your data blocked;
• receive the data you have provided in a structured, commonly used and machine-readable format, or have them transmitted to another controller;
• not be subject to a decision based solely on automated processing, and request that a person take part in it;
• withdraw your consent at any time and without explanation.

To exercise these rights, write to [email protected]. We reply within the time limits laid down by the Law, as a rule within 10 working days.

Withdrawing consent to identity verification does not affect checks already carried out, but without verification you cannot host or join plans. You can delete your account in the application (Profile → Safety, legal and account → Delete account) or by writing to [email protected].

15. Right to appeal

If you consider that your personal data is processed in breach of the Law, you may apply to the State Audit Office of Georgia, which supervises the protection of personal data (sao.ge), or to a court.

16. Changes to this Policy and contact

We may amend this Policy. The version in force and the date of its last update are published on this page.

For questions and requests concerning personal data, write to [email protected].