Privacy notice

Draft for legal review — not legal advice, not published, not accepted. Prepared 27 September 2026; revised 28 September 2026; revised 29 September 2026 for a worldwide listing.

Revised under task pollinate-1m3kn9zj2nkfc against the texts themselves: the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"), Apple's App Review Guidelines and Google Play's User Data policy. No lawyer has reviewed it: Rohit accepted launching without a paid lawyer on 28 September 2026, with the risks listed in docs/policies/2026-09-28-policy-revision-notes.md. Each change and the clause it answers is in those notes. PDPL article numbers below were checked against an English translation of the law (the Arabic text prevails; the official portal refused automated reading).

Worldwide revision (29 September 2026, issue #150). Rohit chose a worldwide store listing (19:30 UTC, "worldwide obviously"; every storefront except mainland China, and Israel by his choice at 21:00 UTC). This revision adds the EU GDPR and UK GDPR, India's Digital Personal Data Protection Act 2023 and Rules 2025 ("DPDP"), Brazil's LGPD, and Australia's age-check conditions, as read in the worldwide recheck and its research notes. The PDPL remains the UAE layer. Worldwide legal clearance is not verified: several countries were read only from secondary sources, and some were not researched.

Markers: R# are open questions for Rohit, L# are legal points still uncertain, G# are places where the product doesn't yet do what this notice needs; all are listed in README.md. This banner and the markers stay until Rohit accepts the text.

This is Pollinate's privacy policy. It explains what personal data we collect, why, who we share it with, how long we keep it and what you can do about it. It applies to everyone who uses Pollinate, wherever they are. Where the law where you live gives you more, you get more; the sections below say where.

Who we are

Pollinate Social ("Pollinate", "we") is run by Entropy Negative Technologies [registered legal name, licence number and registered address — to be confirmed at store enrolment; R1], a company in the United Arab Emirates. We decide how your personal data is used for Pollinate, so we are the "controller" responsible for it (the "data fiduciary" under India's DPDP, and the "controlador" under Brazil's LGPD).

Questions about your data, and requests to use any of your rights below: support@pollinate.social [mailbox to be set up before launch; R5]. Rohit Sabu, Pollinate's founder, reads and answers every message himself. He is also:

• the person who answers questions about your data in India (DPDP Rules, rule 9), and Pollinate's grievance officer under India's IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021;
• Pollinate's channel for data subjects in Brazil (LGPD; we name him as our encarregado);
• the person in charge of protecting personal information for members in Quebec.

Representatives required by the GDPR and UK GDPR:

• European Union (GDPR Art. 27): not appointed at present (R18).
• United Kingdom (UK GDPR Art. 27): not appointed at present (R19).

Until one is appointed, write to us at support@pollinate.social.

We haven't appointed a data protection officer. The PDPL asks for one when processing is high-risk or involves a large amount of sensitive data (Art. 10); the GDPR asks for one only where a company's core activity is large-scale monitoring or large-scale sensitive data (Art. 37). Pollinate is small and keeps no ID images or face data itself, but the age check uses face images at our vendor, so whether we need one is still uncertain. [L1] If we appoint one, their contact details will go here.

The idea in one paragraph

Pollinate is a place for real, verified adults to find interest communities where they live and meet in person. That needs some personal data: a phone number, proof you're over 18, the city you live in, and what you post. We try to keep as little as we can. We don't keep images of your ID or your face, we don't sell your data, we show no ads and do no tracking in version 1.0, and we never give your private details to other members, including community admins.

Pollinate is for adults, in every country

You must be 18 or older to have an account, in every country, even where the local age of digital consent, or the age for social media, is lower. Everyone passes an age check before taking part (below).

What we collect, and why

The legal bases we use

Data laws ask us to name a legal reason ("basis") for each use of your data. The names differ from country to country. Each row in the tables below shows one of these labels, and this table says what it means where you are.

The legitimate interests we rely on (GDPR Art. 13(1)(d)) are: stopping people guessing sign-in codes and abusing the service; delivering the service and protecting it from attack; keeping Pollinate for adults only; keeping an honest record of what staff see and do; stopping a banned person from coming back; letting public posts be found on the web, with a way to opt out; keeping the city Pulse fair; and fixing errors. We weighed each against your interests and kept the data to the minimum; a written record of that weighing is still to be done. [L20]

In other countries we rely on the closest basis the local law offers to the ones above. The basis shown for each row is our own reading of the law, not a lawyer's. [L2]

India's DPDP duties start in full around May 2027 (DPDP Rules, rule 1(4)). Before then, we will show members in India a separate consent notice. [G39]

"Built" means the product does this today. "Being built" means it is under way for launch. "Planned" means it comes later, and this notice will change before it does.

Browsing without an account

What guests can see is in the guest content policy.

Your account

Age check (everyone, at sign-up)

Everyone on Pollinate must be 18 or older. You can't just tell us your age: we use an approved check. In the UAE, our research reads the child-safety rules as not accepting a self-declared age (Cabinet Resolution 106 of 2026, as summarised in our research; we haven't re-read it for this revision). [L4] Australia's eSafety guidance is reported to say the same.

Two ways to prove your age. You take a selfie, and our identity vendor Didit estimates your age from it. If the estimate is clear, that's all: no ID document is needed. If it isn't clear (today, an estimate under 25), Didit asks for a photo of an ID document and a liveness check, and matches the face to the ID. [R23] Whether the selfie route stays on is Rohit's decision, because it costs money per check; without it, only the ID route is left, which some countries don't accept as the only way (Australia, Online Safety Act s 63DB). The selfie estimate is used only to estimate an age, not to identify you. [to confirm with Didit]

The estimate is automatic, and it can be wrong. Didit's software makes it, not a person, and the app tells you so before you start. If it doesn't show you're 18 or over, you can still prove your age with an ID document, as above.

We keep the result, not the images. The selfie, ID images and liveness video go to Didit, not to us. Didit works on our instructions as our processor. By default Didit keeps verification data indefinitely and may use it to improve its models, so before launch we will switch off that model training and delete each check at Didit as soon as we have its result, including the face template Didit keeps unless told otherwise. [G30] Deleting it after use is also what Australia's law requires (Online Safety Act s 63F). Didit processes data in the European Economic Area by default.

If the check turns you down, you can ask a person at Pollinate to look at it again, by writing to support@pollinate.social (see "Automated decisions").

Level 2 verification (government ID, optional)

Level 2 is needed only to host gatherings, vote on admin actions, handle money in later releases, and own or co-found a community of more than 500 members. It's free during launch. Not built yet. [G2] When it is:

We never store images of your ID or any face data ourselves.

What you post and do

Location

We never read your phone's location in version 1.0: the app doesn't ask for location permission. The cities and area on your profile are ones you choose. When you meet someone in person, we use the country your internet connection comes from (from Cloudflare), keep only that country, and never keep your IP address or coordinates. When you check in at a gathering, we record the country the gathering is in. Your personal map of places you've been is built: it is worked out when you open it from your cities, check-ins, meetings and memberships, stored nowhere of its own, and shown only to you. A memory photo's location can be sent once as proof you were at a gathering (above); only its distance from the venue is kept.

Anonymous posts

Not in version 1.0. Anonymous posting is switched off (owner decision, 27 September 2026). If it returns, this notice will change first, and the anonymous posting policy will apply.

Moderation and safety

AI moderation

The app shows a shorter version of this explanation when it asks for your agreement. Apple requires that sharing personal data with third-party AI is clearly disclosed and agreed to first (App Review Guideline 5.1.2(i)); the PDPL and the GDPR require that you can withdraw consent easily (PDPL Art. 6(1)(C); GDPR Art. 7(3)).

• What is sent. The words of each post (title and text), comment and gathering chat message you write, when you publish it and again if you edit it, together with the guidelines of the community it's in and the country the community or gathering is in, so the check can apply that country's rules (see "Rules that depend on the place" in the community rules). The words that describe a gathering you host (title and description), a community you run (name, description and guidelines) and your profile (your handle and display name) are checked the same way, because they're shown to other people too. Photos you add to posts are checked by OpenAI's moderation model only, not by Cloudflare. The app's explanation names all of these. Direct messages are not sent.
• What is not sent. Your phone number, account ID, location, or anything that says who wrote a post, comment or message or who added a photo. Pollinate's own records of who wrote what stay with Pollinate. Words you write can still identify you if you put identifying details in them, and your handle and display name are, of course, your name on Pollinate. Like any company, a provider may have to hand over what it received if the law requires, and TypeSafe's terms let it report content it suspects is illegal to the authorities. [TypeSafe: to confirm with TypeSafe (SF-4); applies with Jev]
• Who receives it. OpenAI's moderation model checks first for severe content. OpenAI contracts with us through OpenAI OpCo, LLC in the United States; under its terms, data from members in the European Economic Area and Switzerland is processed by OpenAI Ireland Limited. Then Cloudflare Workers AI checks it against our rules and the community's guidelines, on Cloudflare's network, which may process it in any country. [to confirm: each provider's retention of what it receives] [When Jev is switched on, add: "TypeSafe's Jev model (TypeSafe AI, Inc., in the United States) also answers questions about the words, based on our rules and the community's guidelines. None of them may use it to train their AI models." Keep the training sentence only if it is confirmed for OpenAI's and Cloudflare's terms as Pollinate uses them, otherwise say it of TypeSafe alone (its terms promise it, MCA §4.1). To confirm: TypeSafe's retention, from its answer to our written questions of 28 September 2026.]
• Why. To find content that breaks the law, our rules or a community's guidelines. Something seriously wrong in a post, comment or message is hidden until a person at Pollinate reviews it; anything else found is queued for people to decide. AI never deletes anything you write. A photo is different, because it's checked before anyone else sees it: one that seriously breaks our rules is never shown and is deleted, except that one that might show a child being abused is kept, unseen, for a person at Pollinate and the child-safety report.
• Your choice. We ask before you first post, add a photo, comment or send a chat message. If you don't agree, you can still browse, read, vote, join communities and say yes to gatherings; you just can't post, add photos, comment, send chat messages, or create or edit gatherings and communities. Your profile (handle and display name) is then checked by a person instead of AI, and a photo you added that is still waiting to be checked isn't sent to AI either: it stays hidden unless you agree again, and a person at Pollinate may remove it. You can withdraw at any time under You in the app; what was checked before stays as it was (PDPL Art. 6(2); GDPR Art. 7(3)). If we change what is sent, to whom or why, we ask again. [L20] Whether consent is the right basis in the EU and UK, where posting depends on it, is uncertain.

Automated decisions

Some things on Pollinate happen automatically:

• posts fade as they lose approval;
• your abilities (commenting, posting) shrink or return with your approval rating;
• AI may hide content until a person reviews it;
• a group of accounts that votes together to push posts up may be flagged, and its votes discounted in the city Pulse;
• the age check may turn you down or ask for an ID;
• recommendations are chosen and ordered for you from your own record (profiling). You can ignore a suggestion and clear what they have learned.

These are part of how Pollinate works, as the terms of service and community rules explain. No one is banned or suspended by a machine alone: a person at Pollinate decides those.

You can always ask a person at Pollinate to review an automated decision about you, give your side, and challenge it, from You → Restrictions in the app or by email (PDPL Art. 18(4) in the UAE; GDPR and UK GDPR Art. 22(3), in the cases it covers; LGPD Art. 20 gives a right to a review), and we give a person's review to everyone for every automated decision. Built in the app and server for restrictions; staff answer requests from the console. An age-check refusal is reviewed on request by email. A review route for a voting-ring flag is not built yet. [G6]

Who we share your data with

Other members and the public

• What you post in a community is visible to whoever that community's visibility allows. Posts in public communities can be read by anyone, including people without an account, and appear on Pollinate's public web pages with your display name, and may show in search engines. [R9] In the EU and UK you can object to this (below); a switch to keep your posts out of search engines is not built yet. [G38]
• Your profile shows your display name, handle, residence city and area, home city, communities (you can hide them), your verification level, and factual signals like gatherings hosted.
• Community admins never get your private details (phone number, ID details, documents). They see only your verification level. If you're put on notice, admins of your communities see a red state on your profile, but no private details.

Service providers

These companies process data for us, on our instructions, only to run Pollinate. We accept each one's data-processing terms when its account is set up, and keep a dated copy. [to confirm per provider] Most are outside the UAE and outside the country you live in; see "International transfers" below.

We don't use SMS providers for sign-in at launch.

International transfers

Pollinate is run from the UAE, its main database is in India, and its providers are in several countries. So your data is handled outside the country you live in. This is how each law we've read deals with that.

Everywhere. We send data only to the providers above, only what each needs, and only under their data-processing terms. You can ask us for a copy of the safeguards for any transfer.

UAE. The PDPL allows personal data to go outside the UAE to countries the UAE Data Office approves as adequate (Art. 22), or in listed cases (Art. 23), such as: to countries where there is no data protection law, under a contract that binds the recipient to the law's standards (Art. 23(1)(a)); with your express consent (Art. 23(1)(b)); or where the transfer is needed to enter into or perform a contract with you (Art. 23(1)(d)). The detailed rules for these cases are for the law's Executive Regulations, which we could not confirm have been issued (Art. 23(2)). What we do: for the main database, hosting, storage, sign-in codes and the age check, we rely on the transfer being needed to provide Pollinate to you (Art. 23(1)(d)), with each provider's data-processing terms; for AI moderation by OpenAI and Cloudflare Workers AI (and TypeSafe once Jev is switched on), which only happens with your consent, we rely on your express consent (Art. 23(1)(b)): the app tells you the data may leave the UAE, including to the United States, before you agree. TypeSafe's data-processing terms cover transfers only under EU and UK clauses and don't mention the UAE, so the contract route (Art. 23(1)(a)) isn't available for it as written. We have not had this reviewed by a lawyer or the UAE Data Office, and it may need an extra step. [L3]

EU and UK. When you sign up from the EU or the UK, you send your data to us in the UAE yourself; that is not a "transfer" in the GDPR's sense (EDPB Guidelines 05/2021), but the GDPR still applies to how we handle it. When we pass it to our providers in India, the United States and Singapore, that is a transfer. None of those countries, nor the UAE, has an EU or UK adequacy decision (the United States only for companies in its Data Privacy Framework). So we rely on the EU standard contractual clauses and the UK Addendum in each provider's terms (GDPR Art. 46), with a written assessment of each destination. [G41] The assessments are not written yet. For EEA data, OpenAI receives it in Ireland.

Brazil. When you send us your data from Brazil, that is not an international transfer under Brazil's rules (ANPD Resolution 19/2024, Art. 6). Where we pass it on, the EU and Brazil recognise each other as adequate, which covers Didit in the EU; for other providers we will use the ANPD's standard clauses where a provider offers them. We will publish a page in Portuguese about these transfers (Resolution 19/2024, Art. 17). [G40] Not written yet.

India. India has not restricted transfers to any country so far (DPDP Act s.16).

Other countries. Where your country's law restricts sending data abroad, we rely on the closest safeguard it offers: the provider contracts above, or the transfer being needed to provide Pollinate to you.

Authorities

We give personal data to authorities only on a lawful request, following our legal-request process, with your own consent at the time, or, in a real emergency, to protect someone's life. Never because a community voted for it. Whether, and when, we tell you about a request is not decided. [R14, L5]

No selling, no ads, no tracking

We don't sell your data, and we don't "share" it for advertising. We show no ads in version 1.0 and do no tracking: no advertising identifier, and no advertising or analytics code from other companies, so no other company collects what you do on Pollinate to follow you across other sites and apps. That's why Pollinate works the same whether or not your browser or phone sends a Do Not Track signal: there's no tracking for it to switch off.

If Pollinate changes hands

If Pollinate's business is transferred, your data would go to the new owner, who would have to follow this notice. We'd tell you before it happens. [L2]

How long we keep it

We keep your data only as long as we need it for the reason we collected it (PDPL Art. 5(7); GDPR Art. 5(1)(e)). The full table is in the retention schedule. In short:

• your account data, while your account is open or dormant;
• sign-in codes for minutes, and sign-in counters for about a day;
• ID and selfie images: never by us; at Didit, only until the check's result reaches us [G30];
• content you delete is wiped, except what is under moderation or held for a legal order;
• copies in database backups, until the backups expire [to decide: a stated period; R7].

Many exact periods are still to be decided, and most are not yet enforced automatically. [R7, G27] From around May 2027, India's rules ask us to keep logs of processing for a year, even after an account is deleted; how that fits with "delete everything" is Rohit's decision. [R21]

Your choices and rights

Everyone gets these rights, wherever they live. Use them for free, in the app where shown, or by writing to support@pollinate.social (or to our EU or UK representative, once we have one). We'll check it's you (usually by your phone number) and reply within 30 days. That is within the time every law we've read allows (one month in the EU and UK; 90 days for grievances in India (15 days under the IT Rules 2021); the PDPL leaves timings to its Executive Regulations). If a request is complex we may need longer where the law allows, and we'll tell you why within the 30 days.

• Information: what we process, why, whom we share it with, how long we keep it, how to complain. This notice is our answer; ask us if you want anything more. (PDPL Art. 13; GDPR Arts 13 and 15; LGPD Art. 18(I), (II) and (VII); DPDP s.11.)
• A copy of your data, and taking it elsewhere: under You → Export your data, as a file you can open or move to another service (JSON). Built. Very long histories are cut at a limit, newest first, and the file says so; ask us for the rest. It includes the statements we gave you about actions on your content or account (except any a legal order stops us telling you about) and your own requests for a review, with the answers. It also includes your abilities and approval rating, the moderation proposals and votes you made in your communities, your votes while a community was in crisis mode, the phones you registered for notifications (only the kind of phone and the dates, never the code that delivers notifications to it), and your requests to close your account. Your own direct messages are in it; messages other people sent you aren't, because they're theirs. Things that aren't yours alone, such as reports others made about you, who has blocked you, or our internal moderation notes and flags, aren't included. (PDPL Art. 14; GDPR Arts 15 and 20; LGPD Art. 18(V).)
• Correction: edit your handle, display name and cities in the app (a residence change once every 90 days, a home city change once a year), and your posts within the rules. For anything else, write to us. (PDPL Art. 15(1); GDPR Art. 16; LGPD Art. 18(III); DPDP s.12.)
• Erasure: delete posts and comments at any time, or close your account (below). Some things we keep, as listed under "What we keep". (PDPL Art. 15(2); GDPR Art. 17; LGPD Art. 18(IV) and (VI); DPDP s.12.)
• Restriction: write to us if you think your data is wrong or used for something you didn't agree to, and we'll stop using it, except to store it, while we check. (PDPL Art. 16; GDPR Art. 18; LGPD Art. 18(IV).)
• Objection: you can object to anything we do on the basis of legitimate interests, including your public posts appearing in search engines, and we'll stop unless we have a strong reason that outweighs yours, or need it for legal claims. We do no direct marketing and no surveys. (PDPL Art. 17; GDPR Art. 21; LGPD Art. 18 §2.)
• Withdraw consent at any time, for example for AI moderation under You in the app. Withdrawal doesn't undo what was done before. In Brazil, you can also ask what happens if you don't give consent. (PDPL Art. 6(2); GDPR Art. 7(3); LGPD Art. 18(VIII) and (IX); DPDP s.6(4).)
• Human review of an automated decision, as above (PDPL Art. 18(4) in the UAE; GDPR and UK GDPR Art. 22(3), in the cases it covers; LGPD Art. 20 gives a right to a review), and we give a person's review to everyone for every automated decision.
• Name someone to act for you if you die or can't act yourself (India, DPDP s.14 and Rules, rule 14(4)); anyone may also use their rights through someone they authorise, where the local law allows.
• Close your account, in the app under You, or by email if you no longer have the app (see pollinate.social/delete-account). You choose:
  • Delete everything: your posts, comments, chat messages and direct messages are withdrawn and wiped (with their earlier versions and photos), your name and handle are removed, you leave every community, whom you met and where is erased, and your phone number, devices and recovery code are deleted.
  • Keep your posts, remove your name ("ghost"): your posts and comments stay, shown as from "Former member"; you leave every community and your phone number, devices and recovery code are deleted.
  • Review your posts first: delete the ones you choose, then close as a ghost.
  • Keep it all for two years (dormant): everything stays with your name, you're signed out everywhere, and nobody can use the account until you reclaim it. This is not deletion. Reclaiming isn't built yet, and nothing happens yet when the two years end. [G15, R11]

  Every choice signs you out everywhere, withdraws your answers to gatherings that haven't started, and hands on or cancels gatherings you host.

Complaints

Complain to us first, so we can put it right. In the UK, you can do this with an online complaint form, and we'll acknowledge it within 30 days (Data (Use and Access) Act 2025). [G37] Until the form exists, email works everywhere.

You can also complain to the data protection authority where you live, or where you work, or where you think the problem happened (GDPR Art. 77). For example:

• in the UAE, the UAE Data Office (PDPL Art. 24). [L1] Which regulator applies can depend on where Pollinate's company is registered: companies in a free zone with its own data law (such as DIFC or ADGM) follow that law instead (Art. 2(2)(g)). [R1]
• in an EU country, that country's data protection authority;
• in the UK, the Information Commissioner's Office (ICO);
• in India, the Data Protection Board of India, once you have used our grievance route (from around May 2027);
• in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados).

Pollinate has no company in the EU, so there is no single "lead" authority for it; your local one is the right one to go to.

What we keep, whichever way you close

Google Play, the PDPL and the GDPR all let us keep some data after deletion for legitimate reasons, if we say what. This is what we keep today:

• posts, comments and messages named in a legal order, or needed for a legal claim, for as long as that needs (PDPL Art. 15(3)(b); GDPR Art. 17(3)(b) and (e)); and those being moderated, for their reviewers, which is our own reading of what the law allows [L16];
• a record that the account existed and was closed, with no name, handle or phone number, so a closed account is never reopened by a code;
• votes you gave, your pollen and standing history, reports you made and your answers to past gatherings, linked to that nameless record [R10, G16];
• if the account was banned or suspended when it closed, a scrambled (keyed hash) form of the phone number, so the same number can't be used to escape the ban (provisional, for Rohit's decision);
• if the account was banned when it closed, the keyed fingerprint of the verified ID document, never the document itself, so the same ID can't verify another account, unless we find it wasn't that person's document;
• copies in database backups, until the backups expire [L15; R7];
• from around May 2027, for members in India, a log of processing for a year, if Rohit decides to keep one [R21].

Whether the nameless record and its votes and histories should also be deleted is Rohit's decision. [R10]

Age

Pollinate is for adults, in every country: everyone must be 18 or over and pass the age check before taking part. If we learn that an account belongs to someone under 18, we suspend it. [proposal for Rohit] People without an account can browse public content; see the guest content policy.

Security

All traffic is encrypted in transit (TLS). Secrets never live in the app. Every request is checked against what that person may see. Staff access is limited and logged in an audit log that can't be edited. Recovery codes and device keys are kept only as scrambled (hashed) forms, and so will be WhatsApp sign-in codes. Some short-lived codes are kept as they are for the minutes they're valid: the codes you swap when meeting someone, and, until WhatsApp sign-in replaces them, today's sign-in codes. Backups allow recovery to a point in time.

If a breach puts your data at risk, we'll tell you, say what happened and what we're doing about it, and report it to the authorities that need to know:

• the UAE Data Office, as soon as we know (PDPL Art. 9; the exact deadlines are left to its Executive Regulations) [L13];
• in the EU and UK, the data protection authority concerned, within 72 hours of becoming aware, unless the breach is unlikely to put anyone at risk (GDPR and UK GDPR Art. 33); and you directly when the risk to you is high (Art. 34);
• in India, from around May 2027, the Data Protection Board, without delay and in full within 72 hours, and each person affected (DPDP Rules, rule 7);
• in Brazil, the ANPD and the people affected, within the deadline its rules set [L25];
• elsewhere, the authority and people the local law names, within its deadline.

Our breach runbook is being updated to match. [G31]

Changes

We'll tell you in the app before any change to this notice takes effect, and ask again where a change needs your consent. Where a change adds a new purpose that relies on consent (for example in India or Brazil), we ask you to agree to it first.

Contact

Entropy Negative Technologies [registered address — to be confirmed] · support@pollinate.social [to be set up]. [R1, R5]

• Grievance officer (India) and person answering data questions: Rohit Sabu, support@pollinate.social.
• EU representative: not appointed at present (R18).
• UK representative: not appointed at present (R19).