Privacy Policy

Fancy a Drink (FAD)

Last updated: 30 August 2026

Fancy a Drink (“FAD”) is an app that helps people meet in real life in a low-threshold way at an affiliated bar. Because FAD leads to a real, physical meeting, we take privacy and safety extremely seriously and deliberately process no more data than necessary. This policy explains in plain language which data we use, why, with whom we share it, how long we keep it, and what rights you have.

1. Who are we?

FAD is offered by A.Y.V. Hubers Beheer B.V., established in Rotterdam. A.Y.V. Hubers Beheer B.V. is the controller for all personal data processed through the app and the associated bar portal.

A.Y.V. Hubers Beheer B.V.

Laan op Zuid 188

3071 AA Rotterdam, The Netherlands

Chamber of Commerce (KVK): 24425152 | VAT: NL818710093B01

Contact for privacy questions: [email protected]

Once a Data Protection Officer has been appointed, their contact details will be listed here.

2. What does the app do?

FAD shows you profiles of other members, lets you invite one another for a drink and meet in real life at an affiliated partner bar, where the first introductory drink is offered via a voucher. The app has five membership tiers: Preview (free, browsing and chatting, no physical meeting), Silver, Gold, Platinum and Ultra VIP. From Silver onward, verification is mandatory; a physical meeting and the voucher are available only to verified members.

Because the app leads to a meeting in the real world, we process certain data (such as a liveness check and your approximate location) precisely to make that meeting safer. We explain the reason for each item below.

3. What data do we collect?

3.1 Account and registration data

Email address, used for your account, logging in (via a 6-digit code) and necessary service messages.
Date of birth, which you enter at registration, to confirm that you are 18 or older.
First name and a self-chosen nickname. Other members initially see only your nickname; your first name appears only after a match.

3.2 Profile data

Real profile photos, visible when another member opens your profile.
A composed avatar (comic style) shown on the map instead of your real photo, so that your face is not linked to a map location.
Gender and the gender preference you are looking for.
Hobbies, interests, short profile texts and self-chosen personality traits.
Occupation or field of study (mandatory), so that other members get a realistic impression.

Assessment of photos. Every photo you upload is checked automatically before it is published. We check that it contains no nudity, and for your first, mandatory profile photo we also check that a face is visible, because that photo must be recognisable. This check is carried out by Google Cloud Vision, acting as our processor. The photo is processed solely for this assessment, is not retained by the processor and is not used to train models. If a photo does not pass, it is rejected and other members never see it. We tell you that the photo was rejected, but not which feature was detected, because that information would make it possible to circumvent the check. If you disagree with the outcome, you can contact us at [email protected] and a staff member will review the photo. The same check applies to photos you send in a chat.

Processing location. The nudity check takes place within the European Union. Two checks can only be carried out outside the European Union, because our processor’s European facility does not support those functions: the face check on the first profile photo, and the recognition of the logo on a payment card in the Ultra VIP asset check. In both cases this concerns a one-off processing of a single image, solely for that check. This transfer relies on the safeguards described in chapter 7. These checks create no biometric template and we build no facial database; we establish only that a face is present in the photo and how large it appears.

3.3 Location data

Approximate, before a match. On the map a profile is never shown at its exact location. The position shown is deliberately shifted relative to the actual location, within a radius of roughly 100 to 200 metres. This shows that someone is broadly nearby, without anyone being precisely traceable. This is our implementation of the GDPR principle of data minimisation.
Exact, after a match. Once two members have matched, the exact location is shared so that they can find each other for the meeting.
Live location (optional). You can temporarily show yourself as “active” within a radius of your choosing. This feature is off by default; you only see others if you share as well.

3.4 Biometric data — the liveness check (special category data)

From Silver onward you carry out a liveness check: a selfie used to establish that you are a real, living person, and to compare your face with your profile photo (against fake profiles and catfishing). This check is carried out by our verification partner Stripe Identity.

Processing your face for this check is a processing of biometric data and therefore a special category of personal data within the meaning of Article 9 GDPR. We process it solely on the basis of your explicit consent, which we request separately and independently of the other terms, before the check. You may refuse this consent. If you refuse, you can still use Preview for free; for the verified features we then offer you an alternative, non-biometric verification route (see below).

Roles. In this check Stripe acts in a dual role: as a processor, Stripe stores the recordings and the consent evidence on behalf of FAD, and as an independent controller, Stripe uses biometrics for its own fraud prevention.
Data minimisation and retention. FAD does not build a biometric database of its own and does not store a biometric template itself; we keep only a reference to the verification and its outcome (passed or not, and the verified age/name derived from it). At Stripe, the biometric features are fully deleted within one year; other identity data is generally kept by Stripe for up to three years as a processor. You can withdraw your consent for the biometric use at Stripe at any time via [email protected].
Alternative without biometrics. If you do not want a biometric check, we offer a manual route: you send a photo of yourself with your identity document and an indicated gesture or code, which a staff member assesses visually without automated biometric processing. This keeps access to the verified features possible without having to provide biometrics.

3.5 Identity data

On escalation (for example following a report or for access to higher tiers), a full identity check via a document scan may be requested, also via Stripe Identity. This processes your legal name, date of birth and a passport-photo comparison. The facial comparison in the document check is also a processing of biometric data under Article 9 GDPR, on the basis of your explicit consent.

3.6 Asset data (Ultra VIP only)

Ultra VIP is the only tier with an asset check. It does not apply to Platinum or to any lower tier, and for those tiers we request no financial data.

If you choose Ultra VIP, you demonstrate yourself that you meet the tier. You choose from three routes: a business credit report from a recognised provider together with a Chamber of Commerce registration or evidence of participation in a company, a photo of a payment card that is issued by invitation only, or a statement from a notary or accountant regarding assets or solvency. We never ask for bank details, bank statements or access to your account.

The document is read and assessed in an automated way. We check whether the name on the document matches the name on your account, whether the document is current, and whether it meets the applicable threshold. If that check passes, the source document is deleted immediately after the assessment and we keep only the outcome, the chosen route and the timestamp. If the check does not pass, a staff member reviews it; in that case the document is kept until that review is complete, with a maximum of thirty days.

If you choose the payment-card route, the photo is processed outside the European Union for the logo recognition, because our processor’s European facility does not support that function. Cover the card number before taking the photo; we do not need it and do not ask for it.

Your rights in this assessment. The first check is automated. You always have the right to human intervention, to state your own position and to contest the outcome. If your application is rejected, that human review follows automatically; you do not have to ask for it. If you disagree with that outcome, you can respond via [email protected].

In the route via a notary or accountant we never see the underlying data. The notary or accountant is the controller for the processing of that data and acts under their own professional rules.

Submitted documents are held in shielded storage. They are never visible to other members and are not used for anything else.

3.7 Telephone number and the “avoid” feature

Your telephone number is always shielded from other members; no one can find you via your number. We use it solely for the avoid feature and the safety contact.

With the avoid feature you can enter numbers of people you would rather not run into, via your phone’s contact picker — we never read your full address book. Only the numbers you deliberately tap are processed in encrypted/hashed form and compared; we do not store a readable telephone number and never reveal whether someone is on FAD.

3.8 Chat messages and photos in the chat

Messages you exchange with another member after a match.
Photos in the chat automatically expire 8 hours after being sent and are then physically deleted; no photo archive is deliberately built up. You can send at most six photos per conversation per day. Chat photos are held in shielded storage that only the two participants can access.

When a physical meeting becomes concrete, you can voluntarily provide one or more safety contacts (a telephone number or email address). We process those contact details on the basis of our legitimate interest in your physical safety (Article 6(1)(f)), solely to share — if you activate an emergency signal — a live location link with that contact; no name, photo or other data of your match. The data is not reused and not used for marketing. Where possible we inform the provided contact about this processing. The safety contact does not need a FAD account.

How the live location link works. The link points to a page on our own website with a unique, unguessable code in the address. Anyone who has the link can open the page; no account is needed, because a safety contact does not have to be a member. The page shows only your location and nothing about the person you are meeting, and states clearly that it comes from Fancy a Drink, with a reference to this privacy policy. The link works only while you have sharing active and expires automatically afterwards; sharing stops in any case after four hours and you can end it yourself at any time. The page is not indexed by search engines. If your safety contact forwards the link, that person can also follow along while sharing is running; only share the link with people you trust.

Automatic alert after silence. Besides the link you share yourself, there is one situation in which FAD sends a message to your safety contact on its own initiative. If an active share goes without a new location for about half an hour, or if you miss an agreed check-in, we send your safety contact an email containing your nickname, the time of the last known location and the link to the sharing page. We do not include raw coordinates, nor any data about the person you are meeting. That email is sent through our email processor Brevo, which therefore also sees the link. In the message we explain to your safety contact who we are, why it was sent, on what legal basis we process their details and where this privacy policy can be found, so that someone without a FAD account also knows what happens to their data. The period of about half an hour may be adjusted if practice requires it.

3.10 Reports, blocking and moderation

You can block and report other members. For a report we record who reports, against whom, the reason and any explanation, plus a status for handling. We use this data to safeguard the safety of the platform and to detect patterns of unsafe behaviour.

3.11 Payment and subscription data

Payments for paid tiers run mandatorily through Apple’s and Google’s in-app purchases, managed via RevenueCat. FAD does not receive credit card numbers or full payment data; we receive only the status of your subscription (which tier, active or not).

3.12 Technical data and age signals from the app stores

A technical device identifier and push tokens, to send notifications and to counter abuse.
Age signals. In regions where the law requires it, we receive an age category via the age-signal APIs of Apple (Declared Age Range) and Google (Play Age Signals), without your exact date of birth. We use this signal solely to provide age-appropriate access; we do not store it and do not use it for advertising or to share with third parties, in accordance with both platforms’ terms.
Consent for device data. For placing or accessing certain data on your device (such as push tokens) we ask your consent where the law requires it; strictly necessary technical identifiers, for example against abuse, we use on the basis of necessity.

3.13 Waiting list (landing page)

If you sign up via the public landing page for a city that is not yet active, we process your city, email address, telephone number, gender and age, solely to contact you at launch in your city and to measure demand per city. This is done on the basis of your consent, which is recorded with a timestamp.

3.13a Suggesting a venue (optional email address)

If you suggest a bar or venue through our website, you can optionally leave your email address. We process that address solely on the basis of your consent, given through a separate, unticked checkbox, to notify you when the venue you suggested joins or when FAD launches in your city. The field is optional: without an email address the venue is still submitted. You first receive a confirmation email (double opt-in); only after you confirm do we add you to a separate list at our email processor Brevo, kept apart from our business contacts. Every email contains an unsubscribe link; unsubscribing deletes your data in a single action. We keep your address until the purpose is met or at most twelve months after your submission, whichever comes first, and then delete it, including at Brevo.

3.14 What we do NOT collect

We never read your full address book or contact list.
We never sell or rent your data to third parties.
We do not use advertising IDs and do not show third-party advertisements in the app.
We do not build a biometric database of our own.

4. Why do we process this data (legal bases)?

Under the GDPR we have a legal basis for each processing operation:

Providing the service (account, matching, chatting, map, vouchers, location before and after a match): performance of the contract (Article 6(1)(b)).
Liveness and identity check (biometrics): your explicit consent (Article 9(2)(a)), alongside performance of the contract for the verified membership.
Asset verification (Ultra VIP only): performance of the contract for the tier you have chosen, with your consent for supplying the documents.
Avoid feature: your consent and our legitimate interest in members’ safety (Article 6(1)(a) and (f)).
Safety contact: our legitimate interest in your physical safety (Article 6(1)(f)); we inform the contact where possible.
Reports, blocking, moderation and abuse prevention: our legitimate interest in a safe platform, and where applicable compliance with a legal obligation (Article 6(1)(f) and (c)).
Waiting list and optional features: your consent (Article 6(1)(a)), which you can withdraw at any time.

5. Automated decision-making

A number of processes run wholly or partly automatically: the liveness and identity check via Stripe Identity, the assessment of asset documents for Ultra VIP, the automated assessment of uploaded photos, and the soft reduction of visibility in the event of a repeated pattern of no-shows (which restores itself once you appear normally again).

If an automated process (such as the verification, the income/asset check, the photo assessment or the no-show system) leads to a refusal, sanction or restriction of your account, you always have the right to human intervention: via [email protected] you can object, state your position and request a re-assessment. We guarantee that an account is never permanently restricted or blocked without a final human review. The no-show measure is a light, self-restoring restriction of your visibility with no legal effect.

We use automated image and text recognition for reading asset documents and for assessing uploaded photos. We inform you when you are dealing with an AI system. The provider of the AI service does not use the supplied data to train its models.

We engage only the processors listed below. We conclude a data processing agreement with each of them. In addition there is one situation in which data reaches someone outside those processors: if you provide a safety contact, that contact receives a message from us when a safety alert is triggered. That contact is not a processor but a recipient you designated yourself; see chapter 3.9. Beyond this, we share your data with no one.

Supabase, Inc. (hosting and database): our database and authentication; FAD’s data is held in the EU region (Ireland).
Stripe Payments Europe, Ltd. / Stripe, Inc. (payment and verification): the liveness and identity check (Stripe Identity) and payment handling.
Sendinblue SAS (Brevo), France (email): sending service messages, verification codes and safety alerts to a safety contact you have provided.
Fastly, Inc. (delivery of map imagery): delivering the map imagery on the page where a safety contact views a shared location. In doing so Fastly sees the visitor’s IP address and which map tile is requested; a tile covers an area of several hundred metres and is not the exact position. The map data itself comes from OpenStreetMap.
Cloudflare, Inc. (domain, DNS and email routing): our domain infrastructure.
RevenueCat, Inc. (subscription management): managing the in-app subscriptions on top of Apple and Google.
Google Ireland Limited / Google LLC (image and text recognition): the automated assessment of uploaded photos and the reading of asset documents (Ultra VIP only).
Apple Distribution International Ltd. and Google (app stores): distribution, in-app payments and, where legally required, age signals.

7. International transfers

FAD’s core processing takes place within the European Economic Area (EEA): our database is at Supabase in Ireland and our email runs via Brevo in France. A number of processors are (also) established in the United States, in particular Fastly and parts of Google, Stripe, RevenueCat, Cloudflare, Apple and Google.

For transfers to the US we rely on appropriate safeguards. The EU-US Data Privacy Framework (DPF) is a valid transfer mechanism: the General Court of the European Union confirmed its validity on 3 September 2025. We rely on the DPF where the processor concerned is DPF-certified (such as Stripe), and we additionally use the European Commission’s Standard Contractual Clauses (SCCs) as a fallback, partly because an appeal against the DPF is still pending before the Court of Justice.

8. How long do we keep data?

Account data: as long as your account exists; after deletion, erased or anonymised within 30 days, including back-ups.
Biometric source material (liveness/identity): not kept by FAD; only a reference and the outcome are kept for as long as your account exists. At Stripe: biometric features deleted within 1 year, other identity data up to 3 years.
Financial source documents: where the check passes, deleted immediately after the assessment; where it fails, kept until the review by a staff member is complete, with a maximum of thirty days. Only the outcome is kept.
Chat photos: automatically deleted 8 hours after being sent.
Chat messages: kept as long as the match exists; if either person deletes the match, the conversation disappears for both.
Location (approximate and live): kept no longer than necessary for the display or the session.
Reports and safety data: up to 24 months after handling, or longer if necessary for a legal obligation.
Safety contact details: kept for as long as you keep the contact in the app; if you delete the contact or close your account, they are erased immediately.
Waiting-list data: until launch in your city or a maximum of 12 months, whichever comes first.

9. How do we secure your data?

Telephone numbers for the avoid feature are processed solely in encrypted/hashed form, never stored in readable form.
Chat photos are held in shielded storage with access rules, so that only the two participants see them.
The voucher screen is protected against screenshots (blocked on Android, detected on iOS after which the voucher expires).
The processing of biometrics is outsourced to a specialised partner (Stripe Identity), so that we do not manage a biometric database ourselves.

10. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, data portability and objection. Where we process on the basis of consent, you can withdraw it at any time — in particular your consent for the biometric verification. You can delete your account in the app. Send a request to [email protected]; we respond within 30 days.

11. Minimum age and age verification

FAD is intended solely for persons aged 18 and over. This is a strict lower limit: the app leads to a physical meeting and is connected with the consumption of alcohol. By using the app you declare that you are 18 or older.

At registration we ask for your date of birth. From Silver onward your age is additionally verified via the liveness/identity check. Where the law requires it, we also use the age signals from the app stores and additional age verification that meets the locally applicable requirements (such as the “highly effective age assurance” prescribed by the Online Safety Act in the United Kingdom).

12. Changes to this policy

We may update this policy. For significant changes we show a notice in the app. The date at the top indicates when the policy was last updated.

13. Complaints and contact

Do you have questions or complaints? Email [email protected]. If we cannot resolve it together, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

14. Region-specific rights

United Kingdom (UK GDPR): users from the UK have equivalent rights. Complaints can be lodged with the Information Commissioner’s Office (ICO) via ico.org.uk. In addition, the obligations of the Online Safety Act apply to FAD in the UK (see chapter 11).

FAD is offered in the Netherlands, the other countries of the European Economic Area and the United Kingdom. The app is deliberately not available worldwide; we do not offer it in jurisdictions we do not yet serve.

Privacy Policy