Privacy Notice

LEVIATHAN app (com.meetleviathan.app). Last updated: October 28, 2026

This notice explains how we process your personal data when you use the LEVIATHAN app and the meetleviathan.com website. It is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties and, for people who live in other countries where we offer the service, under the laws listed in the annex by country.

1. Data controller

Conecta al Campo (Mexican tax ID, RFC, CCA190528QV0), with its address at Kioto 20, Col. Guadalupe Tlalpan, Alcaldía Tlalpan, C.P. 14388, Ciudad de México, México, is the controller of your data. Our personal data department handles any request through the privacy form.

2. Only for people aged 18 and over

LEVIATHAN is for adults. We do not knowingly collect data from people under 18. If we detect an account belonging to a minor, we suspend it, keep only the evidence needed to report a possible crime to the authorities and delete the rest of their data.

3. What data we process

• Identification and contact: email address or phone number, and the data Google or Apple give us if you sign in with them.
• Profile: name or alias, date of birth, gender, photos, bio, interests and whatever you decide to share.
• Precise location of your device while you use the app, to show you people nearby.
• Content and communications: messages, photos, videos and audio you send, and technical information about calls (calls are not recorded).
• Safety: reports you make or receive, blocks, moderation decisions and device identifiers used to prevent fraud and the return of banned accounts.
• Purchases: product purchased, Google Play or App Store transaction identifier, dates, subscription status and refunds. We only sell through the stores: we do not receive or store your card details.
• Device and usage: model, operating system, language, notification token, app usage events and crash reports.
• Advertising (free plan only): which ad was shown, whether you tapped it, whether you watched a rewarded ad and what you received, in order to limit how many you see and deliver your reward. Google AdMob receives the IP address, device model and advertising identifier directly from your phone.
• Consents: what you accepted or declined, the document version, the date and the platform.

4. Sensitive personal data

5. What we use it for and on what basis

Necessary purposes to provide you with the service:

• Creating, authenticating and protecting your account, and verifying that you are of legal age.
• Showing your profile and suggesting nearby and compatible people.
• Operating chat, calls and the private vault, and sending you service notifications about new matches, messages (without their content, unless you turn on the preview), stars, incoming or missed calls, a daily summary of new likes and reminders to complete or verify your profile (at most one per week). You can turn off each category in the app.
• Preventing and detecting fraud, fake profiles, abuse, exploitation and illegal content; handling reports and moderating content.
• Processing purchases, renewals, cancellations and refunds with the store, and notifying you before each renewal.
• Showing non-personalized ads in the free plan, which is what allows us to offer it at no cost, and delivering the rewards of the ads you choose to watch.
• Handling your requests and claims.
• Complying with legal obligations and requests from competent authorities.

Basis: the contract you accept when you sign up, compliance with legal obligations and, for the safety of the community, our legitimate interest in preventing harm.

Additional purposes, which are not necessary for the service and which we only carry out with your consent:

• Analyzing statistically, with Firebase Analytics, how the app is used in order to improve it. It is only activated if you turn on “Usage statistics”, an option that is off by default, and it never includes sensitive data.
• Sending you LEVIATHAN news and promotions, including reminders to come back to the app after some time without using it and notices about new people near you with real figures. These notices are sent at most once every 72 hours and stop after 3.
• Showing you ads personalized according to your activity in other apps and websites (free plan only).

Usage statistics, promotions and personalized ads are off until you accept them. To refuse any of these purposes, use the privacy form (right to object) or turn it off in the app settings. Refusing does not affect your access to the service. If we wanted to use your data for a different purpose, we will ask for your consent first.

6. Your location

We ask for location permission only while you use the app, never in the background. We use your location to calculate which profiles are within the distance you chose. We do not show your coordinates to other people, only an approximate distance. You can withdraw the permission from your phone settings; without it we cannot suggest people nearby.

In the dice (a Plus and Elite feature) we use your location only to calculate the distance to the other person; we do not show it to them. The voice notice that announces a pairing is generated on your device and we do not send audio to our servers; you can turn it off in Settings.

In Settings you can decide at any time whether you appear in Discover, whether others can see that you are online and whether your approximate distance is shown.

7. Automated decisions and artificial intelligence tools

• Suggestions: we rank the profiles you see by proximity, preferences, activity and compatibility. This produces no legal effects on you.
• Image moderation: an automated image analysis service from Amazon Web Services (Amazon Rekognition) reviews your profile photos and the images you send by chat to detect nudity and show it blurred. We have asked Amazon not to use those images to train its services.
• Sanctions: suspensions and bans are reviewed by a person, and you can appeal them as explained in the Terms of Use.

8. Who we share your data with

• Other users: they see your public profile (including your age, never your date of birth, and the interests and communities you decide to show), your approximate distance and whatever you send them. What you share with someone may be kept by that person.
• Providers that process data on our behalf (processors), under contracts with confidentiality and security obligations: Google Firebase (sign-in, notifications, crash reports and, only if you accept it, usage statistics), Amazon Web Services (servers, database, storage and image analysis), the real-time call server and, once activated, the identity verification provider. The full list is in Technology and providers.
• Google Play and Apple App Store: they charge for your purchases and confirm to us whether a payment is valid, renewed, canceled or refunded. They process your payment data under their own policies.
• Google AdMob (free plan only): shows the ads and verifies rewarded ads. Google also processes that data under its own privacy policy, and only uses it to personalize ads if you accepted.
• Authorities: when required by law or by an order of a competent authority, or when necessary to protect a person’s life or physical integrity, as set out in our guide for authorities.
• Corporate transactions: if LEVIATHAN merges, is sold or is reorganized, your data may be transferred to the new controller, who must respect this notice.

International transfers. Your data is hosted by Amazon Web Services and Google Firebase in the United States, and other providers may process it outside your country. We protect these transfers with contracts that require each provider to give protection equivalent to this notice; for users in Brazil we use the ANPD standard contractual clauses, and for users in Argentina, the AAIP model contracts. Data held in another country may be requested by its courts and authorities under its law. You can ask for more information about these safeguards through the privacy form.

We do not sell your personal data and advertisers do not receive data from your profile: they will not know your name, your photos, your preferences or your orientation. We never send Google or anyone else sensitive data for advertising. Our own campaigns, labeled “Sponsored”, are chosen only by your country.

9. What we ask you to accept

When you sign up, all checkboxes appear unchecked:

• Terms of Use and this notice (required).
• Notice that your data is hosted in the United States (to sign up you confirm that you have read it, because the service runs on servers in that country). It is information, not the basis for the transfer: the transfer is protected by the contractual safeguards in section 8.
• Processing of your sexual and partner preferences (optional; without it we do not store those preferences or calculate chemistry).
• Personalized ads (optional).
• LEVIATHAN promotions (optional).

We also ask you to separately accept recurring billing before each subscription and, once activated, the processing of your facial data before verifying your identity. You can review and change the optional ones at any time from the app.

10. How long we keep it

We keep your data for as long as you have an account. If an account remains inactive for 2 years, we may close it after giving you 30 days’ notice. When you delete your account, we immediately delete your profile, photos, messages, matches and location; backup copies are overwritten within 35 days at most. Facial data from identity verification is deleted no later than 30 days after the verification. We keep the following for longer, and only for the purpose stated: evidence of your acceptance of the terms and of your consents, for up to 10 years, as required by the Commercial Code of Mexico; purchase records, for 5 years, as required by tax law; reports and moderation decisions, without data that identifies you, for up to 3 years; and, if you were banned, the minimum identifiers needed to prevent you from registering again (such as an encrypted fingerprint of your email, phone number or device), for up to 5 years. Requests you send us through the contact form, and our replies, are kept for 3 years to show that we handled them on time. Information subject to a request from an authority is kept for as long as that authority indicates. Crash reports are kept for up to 90 days, and Firebase Analytics statistics, which are only collected if you turn on “Usage statistics”, for up to 14 months.

Product usage events are kept for 180 days to produce service statistics, and ad events for 400 days.

If you use LEVIATHAN from Brazil, we also keep your application access logs for 6 months, as explained in section 16.4. If face verification is activated, biometric data is kept as set out in section 16.2.

In some cases the law requires us to keep identified information even if you delete your account, always with restricted access and only for that purpose: the content of a report of child sexual abuse material, for 1 year (18 U.S.C. §2258A of the United States); information related to a case involving Canada, for the period required by Canada’s mandatory reporting law; the records of requests to remove non-consensual intimate content and of what we did with them, and the evidence of that content needed for a criminal complaint, for up to 3 years, to show that we handled them on time and to support the victim; and the information an authority asked us to preserve, for the time it specifies.

11. Your rights and how to exercise them

You can access your data, rectify it, cancel or erase it, object to its processing, limit its use or disclosure and revoke your consent.

• From the app: in Account and data you can get a copy of your account data, correct your profile, manage permissions and delete your account. For a full copy, including your files, request it using the privacy form.
• With the form: in the privacy form, choose the right (access, rectification, cancellation or erasure, objection or portability) and provide your account’s email address and the data it refers to. You receive a reference number and the response deadline. If we ask for it, we will request a document proving your identity or that of your representative. The procedure is free of charge.
• Alternative channel by email: if you cannot use the form, write to support@meetleviathan.com from your account’s email address with the same information.
• Deadlines: we will reply within the deadline set by the law of your country (see the annex).
• Where the law recognizes it, you can also request the portability of your data and not be subject to decisions based solely on automated processing that significantly affect you.
• If your account is suspended, you can exercise all these rights with the form (in the app or on the web) or through the alternative email channel.
• To delete your account without the app, follow the steps in delete your account.

12. Security and breaches

Communications travel encrypted (HTTPS and WSS), media are stored in private storage with controlled access, staff access is limited and recorded in an audit log. If a breach occurs that significantly affects your rights, we will notify you immediately of what happened, the data affected and the measures you can take, and we will notify the authorities when the law of your country requires it.

13. Tracking technologies

The app uses Firebase Crashlytics to detect crashes. Firebase Analytics, to measure usage statistically, is only activated if you turn on “Usage statistics” (off by default); it does not receive sensitive data or the advertising identifier. In the free plan, the Google AdMob SDK uses the phone’s advertising identifier to limit repetitions and prevent fraud, and to personalize ads only if you accept it; on iPhone, also only if you grant Apple’s tracking permission. In Plus and Elite the ads SDK is not activated. You can reset or turn off the advertising identifier from your phone settings. The legal pages of this website do not use cookies.

14. Changes to this notice

We will publish any change on this page with its new date. If the change is significant or requires your consent, we will notify you in the app before it applies.

15. Annex by country

Mexico. Federal Law on the Protection of Personal Data Held by Private Parties (2025). We reply to requests within a maximum of 20 days and, if appropriate, give effect to them within the following 15 days; both deadlines may be extended once when justified. If you consider that your right has been violated, you can go to the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).

Colombia. Law 1581 of 2012 and Decree 1074 of 2015. This notice is our information processing policy. Controller: Conecta al Campo, Kioto 20, Col. Guadalupe Tlalpan, Alcaldía Tlalpan, C.P. 14388, Ciudad de México, México. Area in charge of handling inquiries and claims: personal data department, through the privacy form. Inquiries are answered within 10 business days, extendable by 5; claims, within 15 business days, extendable by 8; if a claim is incomplete, we will ask you to complete it within the following 5 days. You are not obliged to authorize the processing of sensitive data. You can go to the Superintendency of Industry and Commerce (SIC) after exhausting the procedure with us. This policy is in force from October 28, 2026 and the databases will remain in force for as long as the service is provided.

Chile. Law 19,628 and, from 1 December 2026, Law 21,719. Under the new law you can request access, rectification, erasure, objection, portability and blocking of your data; your sensitive data is processed only with your express consent, and international transfers are protected as described in section 8. You can exercise your rights with us using the privacy form or through the alternative email channel indicated above; for residents of Chile, these are our means of contact for data subjects and the authority. If a breach occurs that requires it, we will notify the Agency and you as the law requires. Authority: Personal Data Protection Agency, once it is operational.

Argentina. Law 25,326. We reply to access requests within 10 calendar days and to rectification or erasure requests within 5 business days. The Agency for Access to Public Information (AAIP), the supervisory body of Law 25,326, handles complaints and claims for non-compliance with personal data protection rules.

Peru. Law 29733 and its Regulations (Supreme Decree 016-2024-JUS). Personal data officer: Noel Carro Gusman. You can exercise your rights with us using the privacy form or through the alternative email channel indicated above and, if you are not satisfied with the reply, go to the National Authority for Personal Data Protection (ANPD). If a security incident occurs that requires it, we will notify the ANPD and you within the 48 hours set by the Regulations.

Panama. Law 81 of 2019 and Executive Decree 285 of 2021. We reply to requests within 10 business days. Authority: National Authority for Transparency and Access to Information (ANTAI).

Uruguay. Law 18,331 and Decree 64/020. Data protection delegate: Noel Carro Gusman. Authority: Regulatory and Control Unit for Personal Data (URCDP).

Ecuador. Organic Law on Personal Data Protection and its Regulations. Authority: Superintendency of Personal Data Protection.

Paraguay. Law 7593/2025 on personal data protection, from its entry into force. Authority: National Personal Data Protection Agency, once it is operational.

Costa Rica. Law 8968 on the Protection of Individuals with regard to the Processing of their Personal Data. Your sensitive data is processed only with your express consent. Authority: Agency for the Protection of Inhabitants’ Data (PRODHAB).

El Salvador. Personal Data Protection Law. Authority: State Cybersecurity Agency.

Nicaragua. Law 787 on Personal Data Protection and its Regulations.

Dominican Republic. Law 172-13 on the protection of personal data.

Bolivia, Guatemala, Honduras and Venezuela. We apply this full notice: you can exercise all the rights in section 11 through the privacy form.

Jamaica. Data Protection Act 2020. Authority: Information Commissioner. Barbados. Data Protection Act 2019. Bahamas. Data Protection (Privacy of Personal Information) Act 2003; authority: Data Protection Commissioner.

Other Caribbean countries and territories, Belize, Guyana, Suriname and Haiti. We apply this full notice and the mandatory data protection rules of your country or territory.

The supplements for the United States, Canada and Quebec and Brazil are in section 16.

16. Regional supplements

These supplements add to the rest of this notice. If they conflict with another section, the supplement for your region prevails.

16.1 United States

• We do not sell your personal information or sensitive personal information, and we do not share it for cross-context behavioral advertising without your opt-in. Personalized ads are off until you accept them, and you can turn them off at any time.
• Your sensitive data (sexual orientation and preferences, intimate content, precise location and, if activated, biometric data) is processed only with your consent and never for advertising.
• Based on our current size, we may not yet meet the thresholds of the California Consumer Privacy Act or comparable state laws. Even so, we apply the commitments in this supplement and give you the rights in section 11: access, a copy, correction and deletion of your data, and opting out of personalized ads. We will update this notice if one of those laws comes to apply. If we deny your request, you can ask us to reconsider by replying to our response.
• We only process biometric data, which some laws (for example, Washington’s My Health My Data Act) treat as consumer health data, if you use face verification and give your separate consent (section 16.2). We process no other health data.
• LEVIATHAN is only for people aged 18 and over and does not knowingly collect data from children under 13.

16.2 Biometric data policy (Illinois, Texas, Washington and elsewhere)

This written policy applies to all users and includes what is required by the Illinois Biometric Information Privacy Act (740 ILCS 14), Texas Business and Commerce Code §503.001, Revised Code of Washington chapter 19.375 and the Colorado Privacy Act.

• Status: automatic face verification is being turned on gradually. If it does not appear in your app, it is still off for you and we collect no biometric data from you. It is not available in Quebec.
• Release first: before the camera opens we ask you, separately from any other consent and with an unchecked box, for a written release (electronic signature) stating the purpose, the retention period and the provider. Without that release we collect no biometric data.
• What data: three photos of you with the front camera (one facing forward and two with a gesture we ask for) and the face measurements obtained from them: face position, gestures, an estimated age and the similarity with your profile photos.
• Sole purpose: to confirm that you are a real person and that the person in the profile photos is the person using the account. We use this data for nothing else: not for advertising, recommendations or training systems. The estimated age only sends your case to a person for review; we never reject an account based on estimated age alone.
• Provider: Amazon Web Services (the Amazon Rekognition service), in the United States. It analyzes the photos on our behalf and does not store your face: we create no face collections or templates.
• What we keep: if the result is automatic (approved or rejected), we keep no photo, only the result and similarity scores. If the verification goes to human review, we keep only the front photo so that a member of our team can compare it with your main photo.
• Retention schedule and destruction: we permanently delete the verification photo and facial evidence within 7 days of the verification decision (the provider does not keep them) and, in any case, any biometric identifier or information within 30 days of that decision and in no case later than 3 years after your last interaction with us, whichever comes first.
• No sale: we do not sell, lease, trade or otherwise profit from biometric data. We do not disclose it without your consent, unless required by law or a court order.
• Provider: its contract prohibits it from using the data for its own purposes or to train its systems and requires it to delete the data within the period above.
• Security: we protect it with a standard of care equal to or greater than the one we give our other sensitive data.
• Quebec: before putting a biometric database into service, we will disclose it to the Commission d’accès à l’information within the time required by law, and verification will require your express consent.

16.3 Canada and Quebec

• Person in charge of the protection of personal information (Quebec Act respecting the protection of personal information in the private sector, s. 3.1) and privacy officer under PIPEDA: Noel Carro Gusman, whom you can reach through the privacy form or at support@meetleviathan.com.
• Communication outside Quebec and Canada: your data is hosted in the United States. Before communicating personal information outside Quebec we carry out a privacy impact assessment, and the communication is governed by a written agreement with each provider. Data held in another country may be requested by its authorities under its law.
• Location and profiling functions: we use your location to calculate approximate distances, and your activity and preferences to rank suggestions (sections 6 and 7). In Settings you can adjust whether you appear in Discover, whether others can see that you are online and whether your distance is shown.
• Rights: access, rectification, withdrawal of consent, de-indexing where applicable and portability in a structured, commonly used technological format, through the privacy form.
• Incidents: we keep a register of confidentiality incidents and, where there is a risk of serious injury, we will notify you and the competent authority.
• Complaints: you can go to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

16.4 Brazil (LGPD)

• Controller: Conecta al Campo. Encarregado pelo tratamento de dados pessoais: Noel Carro Gusman, available in Portuguese through the privacy form or at support@meetleviathan.com.
• Legal bases (Law No. 13,709/2018): performance of the contract (art. 7, V) to provide the service; compliance with legal obligations (art. 7, II); legitimate interest (art. 7, IX) for community safety and fraud prevention; consent (art. 7, I) for usage statistics, promotions and personalized ads; and specific and highlighted consent (art. 11, I) for your sensitive data.
• Rights (art. 18): confirmation and access, correction, anonymization, blocking or deletion, portability, information about whom we share your data with, withdrawal of consent and review of automated decisions (art. 20).
• International transfer: based on the ANPD standard contractual clauses, not on your consent.
• Access logs: we keep application access logs (IP address, date and time with time zone) for 6 months, confidentially and securely, as required by art. 15 of the Brazilian Internet Civil Framework (Law No. 12,965/2014), and disclose them only by court order.
• Incidents: we will notify the ANPD and you of security incidents that may create a relevant risk or harm to you, within the deadlines of the ANPD’s regulations.
• Complaints: you can file a complaint with the National Data Protection Authority (ANPD).

This page is also available in other languages, with the same content. If the versions differ, the version in the language required by the law of your place of residence prevails: in Quebec and Haiti, the French version (in Quebec, under the Charter of the French Language); in Brazil, the Portuguese version (Consumer Protection Code, Law No. 8,078/1990); in Mexico, the other Spanish-speaking countries and Puerto Rico, the Spanish version; everywhere else, this English version.