Privacy Policy

The data controller is SemanticLab ("we"), the operator of RankMates.

For any question about your personal data or to exercise your rights, contact us at: semanticlab.buisness@hotmail.com.

We only collect the data needed to run the service:

• •Account data: email address, password (hashed, never in clear text), and a public pseudo (generated or chosen).
• •Connection data: IP address and browser type (user-agent), tied to your session, for security and abuse prevention.
• •Linked accounts (optional): if you sign in with Discord, Google or Apple, we receive an identifier, your email address (with Apple, possibly a private relay address if you chose to hide yours) and, for Discord, your Discord handle.
• •Profile and onboarding: your answers to the conversational questionnaire (region/timezone, your age, which is stored as a year of birth, languages, playstyle, availability, teammate preferences), your bio, your avatar and the games you showcase.
• •Service usage data: your matches, mates, messages exchanged with your mates, and the reports you submit.
• •Product analytics and error reports: the pages you view, the actions you take in the app (for example creating a profile, liking a match or sending a message, never the content of the message), the technical errors you run into, a pseudonymous analytics identifier that is linked to your account once you are signed in, an approximate location derived from your IP address (country and city), and your browser and device type. You can turn analytics off at any time in Settings → Privacy.
• •Mobile app (Android and iOS): if you install the RankMates app and allow notifications, we store a push notification token (provided by Google's Firebase Cloud Messaging service) tied to your device, solely to send you notifications. Apart from that token and the analytics identifier above, no device identifier is collected. You can turn notifications off anytime in your phone or app settings.

We do not collect any special-category data within the meaning of Article 9 GDPR (origin, opinions, health, etc.) and ask you not to enter any in free-text fields.

We process your data for the following purposes:

• •Providing the service (creating your account, matching you, enabling chat), legal basis: performance of the contract (our Terms).
• •Computing compatibility between players from your answers, legal basis: performance of the contract.
• •Securing the service, preventing fraud and moderating content (reports, bans), legal basis: legitimate interest.
• •Measuring how the service is used and diagnosing errors in order to improve it (product analytics and error reports), legal basis: legitimate interest, with the ability to turn it off anytime in Settings → Privacy.
• •Running our internal operations and moderation channels (new-account alerts, reports, contact messages), legal basis: legitimate interest.
• •Sending you transactional emails (verification, password reset), legal basis: performance of the contract.
• •Sending you, at most every two days, a recap email of your pending matches and likes, legal basis: legitimate interest, with the ability to opt out anytime in your settings.
• •Sending you push notifications on your mobile device (new matches, likes, mates, messages), legal basis: legitimate interest, which you can turn off anytime in your device or app settings, or per person from your mates list.
• •Meeting our legal obligations, including answering requests from competent authorities, legal basis: legal obligation.

To build your compatibility profile, the text you type during onboarding is analyzed by language models (AI) via third-party providers (see "Recipients"). This analysis extracts gaming-personality traits and is not used for automated decision-making producing legal effects. We apply safeguards to filter out hateful or inappropriate content.

Your data is never sold. It is shared only with the technical providers needed to run the service, and with the authorities when the law requires it:

• •Cloudflare, hosting, database and application runtime.
• •Resend, email delivery.
• •OpenAI and Google (Gemini models), via OpenRouter and Cloudflare AI Gateway, AI analysis of onboarding text.
• •PostHog (hosted in the European Union), product analytics, error reports and metadata about the AI calls made for you (model, latency, token counts). Never the content of your private messages.
• •Google (Firebase Cloud Messaging), delivering push notifications to the mobile app, only if you install the app and allow notifications.
• •Discord, Google and Apple, only if you sign in through one of these services: they handle your sign-in and give us the identifiers described in section 2.
• •Discord, which hosts our internal operations and moderation channels: when you sign up, your account identifier, pseudo, sign-in method and language are posted there; so are the reports you submit (including the reported message when you report one) and the contact messages you send us (with your email address, so we can reply).
• •Competent authorities, only when the law requires it: in France PHAROS, and where applicable the National Center for Missing and Exploited Children (NCMEC), for confirmed child sexual abuse material. More generally, we may disclose account data to competent authorities where the law requires it, in response to a request made through the proper legal channels.

Some of these providers are located outside the European Union (notably in the United States). Transfers are governed by appropriate safeguards (European Commission standard contractual clauses).

• •Account and profile data: kept as long as your account is active. On account deletion, they are erased.
• •Connection data (IP, user-agent): kept for the duration of the session then purged; the IP address of sign-in attempts is also kept in our technical logs for 30 days (security and abuse prevention).
• •Technical logs (diagnostic events, AI call records): kept for 30 days then automatically deleted; your rows are also erased when you delete your account.
• •Product analytics and error reports: kept for 12 months at most from the event. Turning analytics off in Settings → Privacy stops collection from that browser or app install (page views, clicks, errors, and the analytics cookie). A small number of account events written by our servers (sign-up, onboarding and profile completion, likes, mate requests, quest claims, profile deletion, feedback) and the metadata of AI calls made for you (model, latency, token counts, never the text) are still recorded; to stop those too, or to delete data already collected, email us (see section 7).
• •Messages: deleted with the account or the relevant mate relationship.
• •Accounts locked out for being under 14: kept until the account is deleted, which the locked-out screen allows at any time (Delete my account); we also delete it on request (see section 7).
• •Reports: a report and the evidence saved with it (the reported message and, for context, the surrounding messages) are kept after the reported or the reporting account is deleted; the user identifiers on the report are then removed. They are kept as long as needed to handle the report and to meet our legal obligations.
• •Push notification token (mobile app): kept as long as the app is installed and you allow notifications; deleted when you sign out, uninstall the app, disable notifications, or after a period of device inactivity.

In accordance with the GDPR, you have the following rights: access, rectification, erasure, portability, restriction and objection.

• •Access and portability: you can export all your data as JSON from Settings → Data.
• •Erasure: you can permanently delete your account from Settings → Danger zone.
• •Rectification: you can edit your pseudo, bio and onboarding answers from your account.
• •Objection: you can disable non-essential emails in your notification settings and turn off browser analytics in Settings → Privacy (email us to object to the server-side events listed in section 6).

To exercise a right not directly available in the app, email us at semanticlab.buisness@hotmail.com.

RankMates asks your age at signup. It is stored as a year of birth, so it stays accurate over time, and cannot be changed afterwards. RankMates is open to players aged 14 and over. We never match a minor with an adult: the matching engine partitions matches by age, and mate requests between adults and minors are refused. A minor's exact age is never displayed and minors are not labelled on public pages. If you are below the applicable digital age of consent in your country (15 in France), the agreement of a holder of parental authority is required.

Reports concerning the safety of a minor are kept even if the reported account is deleted, and confirmed child sexual abuse material is reported to the competent authorities. See our Child Safety Standards at rankmates.net/legal/child-safety.

We implement appropriate technical and organizational measures: hashed passwords, encryption in transit (HTTPS), restricted data access and content moderation. As no system is infallible, we encourage you to use a strong, unique password.

If you believe the processing of your data does not comply, you may at any time lodge a complaint with the CNIL (the French data protection authority), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

This policy may be updated. In case of a material change, we will ask you to accept it again at your next sign-in. The last-updated date appears at the top of this page.