Privacy Policy

Version 2026-10-03 · Last updated 3 October 2026

Who we are

Between Us is provided by Mark Stevenson, an individual (sole trader) trading as Between Us XO. He is the data controller for the information described here. You can contact the data controller at:

Privacy-first by design

You don't need an account, and we don't ask for your name, email or phone number to take the assessment. Each assessment is identified only by a random ID, and access uses secure, unpredictable private links stored on your device. We don't call the service anonymous: links, payment records and technical data could, in some cases, be connected to a person.

What we collect

Assessment answers. Your answers to the 24 questions. Some concern your intimate relationship.

Hidden Interests (optional). Your private selections in the "Things you might both be thinking" section. These concern your sex life and are special-category data under UK GDPR. Your partner never sees your individual selections, before or after purchase. Only an item you both independently mark "Interested" can appear as a mutual match.

Partner link. That two answer sets belong to the same assessment, so they can be compared.

Results. Your overall and category scores, the list of mutual matches, and whether the full report has been bought.

Consent records. That you confirmed you are 18+, gave consent to sensitive answers, accepted the Terms and (if you answered it) gave separate consent for Hidden Interests — with the wording versions and time. No answers are copied into these records, and your partner can't see them.

Email addresses. The app itself never asks for or stores an email address. If you buy the report, you enter your email in Stripe's checkout form; Stripe keeps it to send your receipt and meet its legal duties. We don't copy it into our database. If you email us for support, we receive your email address and message in our mailbox and use it only to reply. We never use any email address for marketing.

Payment. Card details are entered directly into Stripe's secure form and go straight to Stripe; they never pass through or are stored by our app. We keep only a Stripe checkout reference, a payment reference, whether the report is unlocked and when, the payment mode (test or live), and when the buyer acknowledged immediate supply. Amount, currency, receipt and billing details stay with Stripe.

Usage counts. A count of journey steps (for example "assessment started") with a timestamp only — no answers, IDs, cookies or device identifiers.

Technical information. Our hosting provider processes IP addresses and request logs for security and reliability. We don't store IP addresses with your answers.

Why we use it and our lawful bases

To provide the assessment, comparison and report: performance of a contract (UK GDPR Article 6(1)(b)). To take payment and keep accounting records: contract and legal obligation (Article 6(1)(b) and (c)). To keep the service secure and count journey steps in aggregate: legitimate interests (Article 6(1)(f)). For answers about your intimate life and Hidden Interests, we rely on your explicit consent (Article 9(2)(a)). Hidden Interests have their own separate consent, given before that section.

Who receives it

Lovable Cloud (Lovable, with its infrastructure sub-processors) hosts the website and database. Stripe processes payments and handles card, email and billing details, tax and fraud checks. Stripe may process data outside the UK under its own safeguards. Our email provider stores any support emails you send us. We don't sell your data, use it for advertising, or share answers or Hidden Interests with any analytics or advertising service.

International transfers

Some of our providers may process data outside the UK. Where they do, we rely on the safeguards those providers offer, such as UK adequacy regulations or the UK International Data Transfer Addendum. Contact us for details.

How long we keep it

Unfinished assessments (your partner never completes): deleted automatically, including all answers and Hidden Interests, 30 days after the first partner confirms.

Raw answers and Hidden Interests of completed assessments: deleted automatically 72 hours after the report is generated. The invitation link stops working then.

Results and report (scores, mutual matches, purchase status): kept so both of you can return to your report, until either partner taps "Delete our data". Consent records are deleted with the assessment.

Stripe keeps payment records as the law requires. Support emails are kept only as long as needed to resolve your request. Infrastructure backups may briefly retain deleted data until they expire on their normal cycle.

Withdrawing consent and deleting data

You can withdraw consent at any time by tapping "Delete our data" on your profile, which permanently deletes the assessment, results and consent records for both partners. Because a mutual match is shared, withdrawing deletes the shared report for both of you. Before you confirm your answers, you can simply close the page — nothing is saved. Withdrawing doesn't affect processing that already happened.

Security

Answers are only reachable through server-side checks against your private link. The database is not directly reachable from browsers. Your partner's answers and Hidden Interests are never sent to your device. Data is encrypted in transit.

Cookies and on-device storage

We use no advertising, tracking or analytics cookies. We use essential on-device storage to remember your private link so you can return to your profile. Stripe's checkout sets its own essential cookies for fraud prevention. Because we use only essential technologies, no cookie banner is needed.

Age

Between Us is for adults aged 18 and over only. We don't ask for your date of birth.

Your rights

Under UK data protection law you can ask to access, correct, delete or restrict your data, object to processing, ask for a copy in a portable form, and withdraw consent. Because we don't hold your contact details, we may need your private link to find your assessment.

Complaints

Please contact us first at info@betweenusxo.com. You can also complain to the Information Commissioner's Office at ico.org.uk.