Kuwboo is operated by Guess This Ltd, a company registered in the United Kingdom. In this policy, "Kuwboo", "we", "us", or "our" refers to Guess This Ltd.
Guess This Ltd is the data controller for personal data processed through the Kuwboo mobile app and website. Contact details are in Section 13.
We collect only what we need to run Kuwboo. The categories below reflect the features enabled in your account.
| Category | Examples | When collected |
|---|---|---|
| Account identifiers | Phone number, email address, Apple/Google sign-in ID, username, date of birth | At sign-up and when you sign in |
| Profile content | Display name, bio, photos, interests, module preferences (video, marketplace, dating, social) | When you complete your profile |
| User-generated content | Videos, images, posts, marketplace listings, comments, reviews | When you post |
| Communications | Chat messages, group conversations, voice notes, reports you file against other users | When you use chat or moderation tools |
| Location data | Approximate city (IP-derived) always; precise GPS only with your explicit permission (used for nearby discovery and event proximity) | While the app is in use |
| Transaction data | Purchase history, listing prices, payment timestamps. We do not store card numbers — payments are processed by our payment provider | At checkout |
| Device and log data | Device model, OS version, app version, crash logs, IP address, session timestamps, language | Automatically, for security and reliability |
| Age assurance signals | Self-declared age, optional age-estimation signals (if you opt in to photo-based verification) | Per UK and US child-safety law (see Section 9) |
| Biometric-derived data | Face-match templates, if you opt in to photo verification. Raw photos are not retained after template generation. | Only if you enable photo verification |
| Cookies and similar | Session cookies on our website. The mobile app does not use web cookies. | When you visit our website |
We do not sell personal data, and we do not collect sensitive categories of data (race, religion, political opinions, health) unless you voluntarily post them as profile content.
Under UK GDPR, each processing activity needs a lawful basis:
We require all processors to meet UK GDPR / EU GDPR standards via data-processing agreements. We do not sell or rent personal data to advertisers, data brokers, or any third party.
| Data type | Retention |
|---|---|
| Active account data | For as long as your account exists |
| Deactivated account (partial deletion) | Up to 30 days, then moves to full deletion unless you reactivate |
| Deleted account — personal identifiers | Purged within 30 days of full-deletion request |
| Deleted account — legal/financial records | 6 years (UK Companies Act / HMRC requirement for transaction records) |
| Deleted account — messages sent to others | Remain in the recipient's inbox, attributed to "Deleted user". Your identifier is removed. |
| Content under active moderation or legal hold | Until the investigation closes, then per the row it belongs in |
| Aggregated, anonymised analytics | Indefinitely — no longer personal data |
| Device and log data | 90 days, then purged or anonymised |
| Crash reports | 90 days |
You have the right to:
To exercise any of these rights, email us at neildouglas33@hotmail.co.uk. We respond within 30 days; complex requests may take up to 90 days with notice.
You can delete your Kuwboo account at any time. We offer two options:
Full instructions and the in-app path are on our Delete Account page.
Kuwboo is not for children under 13 (USA, COPPA) or under 16 for certain features in the UK and EU. We apply age assurance per the UK Online Safety Act and the ICO Age Appropriate Design Code:
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or other US states with comprehensive privacy laws, you have rights similar to those in Section 7: to know what we collect, to delete it, to correct it, to receive a copy, and to opt out of any sale or sharing for targeted advertising. We do not sell personal data and do not share it for cross-context behavioural advertising.
If you are a resident of Illinois and you opt in to photo-based verification, you are consenting to the collection and use of biometric-derived data under the Illinois Biometric Information Privacy Act (BIPA). Biometric templates are deleted within 3 years of your last login or when you delete your account, whichever is sooner. You may revoke this consent at any time in the app settings or by emailing us.
To exercise US rights, email neildouglas33@hotmail.co.uk. We verify your identity before acting on the request.
We protect your data with TLS in transit, encryption at rest (AES-256), scoped-access credentials managed in AWS Secrets Manager, and least-privilege access controls. Chat messages are transport-encrypted; they are not end-to-end encrypted at this time. No system is perfectly secure — if we ever have a breach that affects you, we will notify you and the ICO as required by UK GDPR (within 72 hours).
Our primary data residency is the United Kingdom (AWS eu-west-2, London). Some processors (e.g., Apple, Google, Firebase) may process data in the United States. We rely on UK International Data Transfer Agreements and EU Standard Contractual Clauses for these transfers, together with the provider's own safeguards.
Guess This Ltd
Email: neildouglas33@hotmail.co.uk
Data Protection Officer enquiries: same email, subject line "DPO".
For complaints you can also contact the UK Information Commissioner's Office: ico.org.uk/make-a-complaint.
We may update this policy from time to time. If we make a change that materially affects your rights, we will notify you in the app and by email. The "Last updated" date at the top of this page always shows the current version. Previous versions are available on request.