Privacy Policy — The Third Connection

1. Who we are

The Third Connection is a social events and dating service for adults (18+). It is operated by:

RELAYLANE LABS LTD Company number 17162321 Lavender Cottage Hazelden Farm, Marden Road, Cranbrook, England, TN17 2LP

RELAYLANE LABS LTD is the controller of your personal data — that means we decide how and why it is used, and we are responsible for looking after it.

• Privacy contact: privacy@thethirdconnection.com

We have not appointed a Data Protection Officer.

2. This policy in short

• We collect only what we need to run the service: your account details, your profile, your messages with matches, your ticket purchases, and safety records.
• We never use your location. We only ask which city you want events in.
• We do not use advertising or analytics trackers, and we never sell your personal data.
• Your sexual orientation and who you express interest in are special category data. We only use them for matching, with your explicit consent, which you can withdraw at any time.
• You can delete your account and data at any time by emailing us — see section 8. An in-app deletion option is planned.

The rest of this policy explains all of that in detail.

3. What we collect and why

3.1 Contact and account information

What: your email address and the display name you choose.

Why: to create your account, send you sign-in codes, and send you essential service emails (like ticket confirmations). Your display name is shown to other attendees and matches — that is what a profile is for.

Lawful basis: performance of our contract with you (UK GDPR Article 6(1)(b)).

Who helps us: Resend delivers our emails as our processor.

3.2 Your profile

What: date of birth, gender, sexual orientation, home city, optional interests, and your profile photos. When you express interest in someone, we also record whether your intent is romantic or friendship for that person.

Why:

• Date of birth — to check you are 18 or over, and to balance event groups by age band. Lawful basis: contract, and legal obligation (keeping under-18s off the service).
• Gender — to balance event groups and provide matching context. Lawful basis: contract. We treat gender as sensitive information even where the law does not strictly require it.
• Sexual orientation and match intent — to match you with the right people. Orientation, and who you express romantic interest in, are special category data under UK GDPR Article 9. We only process them with your explicit consent. You can withdraw that consent at any time by contacting us at privacy@thethirdconnection.com; if you do, matching stops but the rest of your account keeps working.
• City — to show you events near you. This is the only location information we hold: a city you choose, never GPS. Lawful basis: contract.
• Interests — optional; used for icebreakers and matching context. Lawful basis: your consent. You can remove them at any time.
• Photos — shown on your profile, and reviewed by our moderation team before other users can see them, to keep the service safe. Lawful basis: contract (display) and our legitimate interest in moderation (safety).

3.3 Phone number (optional)

What: a phone number, if you choose to give one, together with your per-channel messaging choices (SMS and WhatsApp).

Why: to send event reminders by SMS or WhatsApp. Lawful basis: your consent, given separately for each channel, and withdrawable at any time in your contact settings.

Who helps us: Twilio will deliver these messages as our processor when this feature goes live. At the time of writing we are not yet sending SMS or WhatsApp messages.

3.4 Chat messages

What: the text messages and timestamps of your conversations with people you have matched with.

Why: to deliver your messages — chat is only available between matched users. Lawful basis: contract.

Your messages are private communications. They may naturally reveal sensitive things about you — we do not analyse them for that, and we protect chat to the same standard as special category data. Chat content is never included in push notifications: a notification only says you have a new message.

3.5 Safety reports, blocks and feedback

What:

• Safety reports you submit — the category, your description, and who or what event the report is about.
• Blocks — a record of who you have blocked and who has blocked you.
• Post-event feedback you choose to give — your comments and ratings on event quality.

Why: to keep the service safe — reviewing reports, enforcing our rules, and making sure a block actually stops contact (blocked users cannot message or match with you). Feedback helps us improve events. Lawful bases: our legitimate interest in user safety (reports and blocks); your consent (feedback). Where a report involves possible unlawful conduct, we may also process it to comply with legal obligations, including under the Online Safety Act.

Important: safety reports and block records may be kept after an account is deleted — see section 8. This is so that blocks keep working and serious reports are not erased by deleting an account. Your free-text feedback comments are your personal data and are deleted with your account; we may keep anonymised structured ratings.

3.6 Payments and purchases

What:

• Card details — collected directly by Stripe, our payment provider. We never see or store your full card number.
• Purchase history — your tickets, orders, refunds and promo-code use.
• Fraud-prevention signals — when you pay in the app, the Stripe software collects certain device and activity signals and sends them to Stripe to detect fraudulent payments.

Why: to sell you event tickets, manage orders and refunds, and prevent payment fraud. Lawful bases: contract (purchases); legal obligation (keeping financial records); our legitimate interest in preventing fraud (Stripe's device signals).

Who helps us: Stripe processes payments and fraud signals. Stripe handles card data under its own terms and PCI security standards; we hold only payment references, amounts and ticket status.

3.7 Sign-in and security credentials

What: passkey credentials (a credential ID, a public key, and the device name you give it) and short-lived session tokens.

Why: to sign you in securely and let you sign out everywhere at once. Lawful basis: contract.

Note on biometrics: if you unlock your passkey with your face or fingerprint, that check happens entirely on your own device. No biometric data ever reaches us — we only receive the cryptographic public key.

3.8 Push notifications and device information

What: if you turn on notifications, a push token for your device, plus your device platform and timezone (so we respect your quiet hours). Basic device details (model and operating system) may accompany this for support and delivery purposes.

Why: to deliver notifications — ticket receipts, event reminders, and alerts when you get a match or a message — and to honour your per-category notification preferences and quiet hours. Lawful basis: your consent (the operating-system notification permission) and our legitimate interest in reliable delivery.

Who helps us: Expo relays our push notifications and stores your push token as our processor; Apple and Google then deliver the notification to your device. Notification content is generic (see 3.4) — no message text or profile data is included.

3.9 Logs and diagnostics

What: IP addresses and technical request details in our server logs, and internal, service-level performance metrics.

Why: security, preventing abuse (rate limiting), and keeping the service running. Lawful basis: our legitimate interest in securing and operating the service. Our diagnostics are self-hosted and internal — we use no third-party analytics services.

Retention: server logs, including IP addresses, are kept for 30 days and are then deleted.

3.10 Event check-in (TTC Host staff app)

What: when you attend an event, our staff scan your ticket QR code with the TTC Host app. This records that you (name and ticket) checked in, and when. The staff device keeps a temporary, encrypted local copy so check-in works even without signal; it is kept only as long as necessary to run the event.

Why: to manage entry to the event you bought a ticket for, and to record attendance. Lawful basis: contract.

Camera note: the staff app's camera is used only to decode QR codes on the device. Camera images are not stored and never leave the device. The main The Third Connection app does not use your camera at all.

3.11 Waitlist (website)

What: if you join the waitlist on our website, your email address and chosen city.

Why: to tell you when we launch in your city. Lawful basis: your consent. Every waitlist email includes an unsubscribe link, and unsubscribing removes you. If you register an account with the email address on the waitlist, your waitlist entry is deleted automatically when your account is deleted. Waitlist entries also expire automatically six months after we launch in your city.

4. What we do NOT collect

We think it is just as important to be clear about what we don't do:

• No GPS or precise location. Neither app asks for location permission. We only know the city you chose.
• No access to your contacts, calendar, photos library scanning, health data or clipboard.
• No advertising identifiers, no ad networks, no tracking and no third-party analytics. There are no advertising, analytics or attribution SDKs in our apps or website.
• We never sell your personal data, and we do not share it for cross-app tracking or targeted advertising.
• Chat content never appears in notifications — a notification only tells you a message exists.
• No religion or ethnicity fields. We do not ask for these.
• The main app does not use your camera or microphone. Your ticket QR code is displayed, not scanned, by your app.

5. Who we share data with (processors)

We share personal data only with service providers who process it on our instructions ("processors"), and with Apple and Google to deliver notifications. We never sell it.

We may also disclose personal data where the law requires it — for example to law enforcement under a valid legal process, or to regulators. Our approach to law-enforcement requests is described in our law-enforcement guidance.

6. International transfers

Our systems are hosted in the United Kingdom (AWS London region). Some of our processors — Stripe, Resend, Twilio and Expo — are US companies and may process data in the United States.

Where personal data leaves the UK (or the EU), we rely on appropriate safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the ICO's International Data Transfer Addendum, as applicable to each provider. You can ask us for more information about these safeguards using the privacy contact in section 1.

7. How long we keep your data

We keep personal data only as long as we need it for the purposes described in this policy. In summary:

Backups: we keep encrypted backups for disaster recovery. When you delete data, copies may persist in backups for a limited period on their normal cycle before being destroyed. During that window backup copies are put beyond use — they are never restored into live systems except for disaster recovery, and if a restore ever happens, we re-apply deletions before the service returns.

8. Deleting your account

You can delete your account and data at any time by emailing privacy@thethirdconnection.com from the email address on your account, with the subject "Delete my account" — see our dedicated page at www.thethirdconnection.com/delete-account for exactly how it works. An in-app deletion option is planned; until it is available, email is the way to delete.

Deletion removes your profile, photos, orientation and matching data, chat messages, push tokens and sessions. Your chat messages are deleted for both sides: your conversations are also removed for the people you matched with. A small, defined set of records survives deletion because we are legally required to keep them or they are needed for safety:

• financial records — kept for 6 years, as required by UK law;
• safety reports involving your account — kept for up to 2 years after the case is closed, then deleted;
• block records, kept indefinitely in identifier-only form (user IDs only, no name or profile), so people you blocked (or who blocked you) stay blocked;
• a minimal record of any ban or suspension to prevent banned users returning.

We complete deletion within one month of your request. In complex cases the law allows up to two further months — if we ever need that, we will tell you within the first month and explain why.

9. Your rights

Under UK GDPR (and EU GDPR if you are in the EU), you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — have your data deleted (see section 8).
• Restriction — limit how we use your data in certain situations.
• Portability — receive the data you gave us in a machine-readable format.
• Object — object to processing based on our legitimate interests.
• Withdraw consent — at any time, for anything based on your consent (orientation-based matching, interests, phone messaging, notifications, waitlist, marketing). Withdrawing consent does not affect processing that already happened.
• Not be subject to solely automated decisions with legal or similarly significant effects — we do not make any such decisions about you.

To use any of these rights, contact us at privacy@thethirdconnection.com. We will respond within one month. We will never charge you for a reasonable request.

Complaints: if you are unhappy with how we handle your data, please complain to us first at privacy@thethirdconnection.com — we will look into it properly and respond. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, or, in the EU, to your local supervisory authority.

10. If you are in the EU

RELAYLANE LABS LTD is a UK company. If we make the service available in the EU/EEA we will appoint an EU representative under Article 27 GDPR and name them here.

11. If you are a US state resident

This section applies to residents of US states with comprehensive privacy laws, including Connecticut, Texas, Nebraska and Rhode Island.

• Controller: the controller (and, where a state requires a designated controller contact, the designated controller) of your personal data is RELAYLANE LABS LTD, Lavender Cottage Hazelden Farm, Marden Road, Cranbrook, England, TN17 2LP, United Kingdom. Contact: privacy@thethirdconnection.com.
• Sensitive data: sexual orientation is sensitive data under these laws. We process it only with your opt-in consent, and you can withdraw that consent at any time.
• No sale, no targeted advertising: we do not sell personal data, and we do not process personal data for targeted advertising or profiling with legal or similarly significant effects. Because of this, there is no "Do Not Sell or Share" choice to exercise — there is nothing to opt out of.
• Your rights: you may request access to, correction of, deletion of, or a portable copy of your personal data by contacting privacy@thethirdconnection.com. We will respond within 45 days (extendable once by a further 45 days where reasonably necessary — we will tell you if so).
• Appeals: if we refuse a request, you may appeal by replying to our decision or writing to privacy@thethirdconnection.com with the subject "Privacy appeal". We will respond to appeals within the period your state's law requires. If your appeal is refused, you may contact your state Attorney General.

12. Children

The Third Connection is strictly for adults aged 18 or over. We do not allow under-18 accounts, and we require your date of birth at sign-up to enforce this. If we learn that an account belongs to someone under 18, we will close it and delete the data. If you believe a user is under 18, please report it in the app or at safety@thethirdconnection.com.

13. How we protect your data

• Passkey sign-in — no passwords to steal; biometric checks stay on your device.
• Encryption in transit — all connections use TLS (HTTPS).
• Encryption at rest — data is encrypted on our servers, and staff-device check-in caches are encrypted locally.
• Access controls — staff access to personal data is role-restricted and logged; safety and moderation actions are recorded in an audit log.
• Short-lived sessions — sign-in tokens expire quickly, and you can sign out of all devices at once.

No system is perfectly secure, but if a breach ever put your rights at risk, we would notify the ICO and, where required, you, in line with our breach-response plan.

14. Staff app processing (event check-in)

When our event staff use the TTC Host app, they see limited attendee data — your name and ticket status — solely to check you in to an event you bought a ticket for. Staff devices hold a temporary encrypted local copy for offline check-in, kept only as long as necessary to run the event. Staff access is limited to the events they work. Camera use is on-device QR decoding only; no camera images are stored or transmitted (see 3.10).

15. How consent is recorded

Where we rely on your consent — orientation-based matching, interests, phone messaging channels, waitlist and any marketing — we record what you consented to and when, and we record withdrawals the same way. Withdrawing is always as easy as giving consent: you can withdraw any consent at any time by contacting privacy@thethirdconnection.com.

16. Changes to this policy

If we change this policy, we will update the "Last updated" date and publish the new version at www.thethirdconnection.com/privacy. For significant changes — especially any new purpose, new data type or new recipient — we will tell you in the app or by email before the change takes effect, and where the law requires it we will ask for your consent again. We will not use your data for materially new purposes without telling you first.