Coffee Meet
← Back to home

Privacy Policy

Effective date
31 August 2026
Last updated
31 August 2026

Effective date: 31 August 2026 Last updated: 31 August 2026

This Privacy Policy (the "Policy") describes what data the Coffee Meet Telegram bot (the "Service") collects, and how that data is used, stored and shared. The data controller is Individual Entrepreneur Dmitrii Biniukov, identification number 322782654, registered address: 7th Street N7, Village Varkhani, Adigeni Municipality, Georgia ("we").

This Policy forms an integral part of the Terms of Service published at https://coffeemeet.ge/terms.

By using the Service you agree to the processing of your data as described below.

This English version is provided for convenience. In case of any discrepancy, the Russian version published at https://coffeemeet.ge/privacy prevails.

1What data we collect

1.1. Profile data (provided voluntarily by you at registration):

  • name;
  • age;
  • city (Tbilisi / Batumi) and district;
  • preferred meeting format (online / offline / no preference);
  • a short description of your occupation;
  • list of interests;
  • a photograph (from your Telegram profile or uploaded separately).

1.2. Telegram technical data: your Telegram ID and username, used to pass your contact details to your match and to operate the bot.

1.3. Service usage data: meeting statuses (planned / took place / cancelled), matching history, your answers to the bot's weekly participation question, feedback texts and complaints.

1.4. Payment data. When you pay for a subscription we receive from our payment partner (JSC TBC Bank) only the fact and status of the transaction (successful/unsuccessful, amount, date). If you chose payment with auto-renewal, a payment token required for recurring charges is also stored; with a one-off payment, no token is created or stored. We do not collect, see or store full bank card details (number, expiry date, CVC) — these are entered exclusively on the bank's secure page.

1.5. Moderation data. During manual profile approval, a Service moderator reviews the profile data and photograph you have provided for compliance with the rules (see the Terms of Service).

1.6. Consent records. We record the fact, date and time of your acceptance of the Terms of Service and this Policy, and of your confirmation that the service should begin immediately (clause 5.7 of the Terms), together with the document version. This is necessary to demonstrate the lawfulness of processing and to handle disputed payment transactions.

We do not request or collect any special categories of data (health, religious or political views, sexual orientation, etc.), and we ask you not to include such information in the free-text fields of your profile (occupation, interests).

2Why we use the data

  • running the weekly random matching and notifying participants;
  • showing your profile (name, photograph, occupation, interests) to your match — this is the only case in which another user sees your profile data;
  • manual moderation of profiles before admission to matching;
  • processing subscription payments, automatic renewal and confirming access to the Service;
  • reviewing feedback and complaints, taking decisions on temporary/permanent blocks, and considering objections to a block (clause 8.6 of the Terms);
  • basic analytics to improve the bot (aggregated meeting statistics, not linked to an individual where possible);
  • contacting you about support matters.

We do not take decisions producing legal effects for you based solely on automated processing: profile moderation and blocking decisions are made by a human.

3Who we share data with

  • Your match — name, photograph, city/district, occupation, interests and Telegram username, so that the pair can get in touch and arrange a meeting. The recipient is obliged to use this data solely to arrange the meeting (clause 8.2 of the Terms of Service).
  • The payment partner (JSC TBC Bank, Georgia) — to process payment. The bank processes card data independently, under its own privacy policy and the PCI DSS standard.
  • The Service's administration team — a small number of people responsible for profile moderation, handling complaints and user support.
  • The hosting/infrastructure provider — the Service's server and database are located in a data centre in Germany; the provider has access to the data only to the extent technically necessary to operate the server infrastructure and does not use it for its own purposes.
  • Telegram — as the platform through which the bot operates; use of Telegram is also governed by Telegram's own privacy policy.

We do not sell your data or share it with third parties for advertising purposes.

4Legal bases for processing

Data is processed on the basis of: your consent, given when completing your profile and accepting the Terms of Service and this Policy; the necessity of performing the contract (providing access to the Service, processing payment and automatic renewal); our legitimate interest in the security and moderation of the community of participants; and compliance with obligations under Georgian law (in particular in relation to keeping records of settlements).

5Retention periods

  • Profile data and meeting history are kept while your account is active.
  • Transaction data and consent records are kept for at least 180 days from the payment — a requirement of the payment partner for handling disputed transactions (chargebacks) — and thereafter for the period required by Georgian tax legislation for the retention of settlement records.
  • If you request deletion of your account, profile data (photograph, description, interests, matching history) is deleted from the active database within 30 days, except for information we are required to keep longer under the requirements of the payment partner or the law.
  • Complaint texts and blocking decisions are kept for up to 3 years — as a basis for later decisions in the event of repeat violations and for considering objections. After that period they are deleted or anonymised.
  • Database backups are kept for no more than 30 days and are then overwritten. Deletions from the active database propagate to backups as they rotate.

6Data security

  • Access to users' personal data is limited to the small number of staff/moderators who need it for their tasks; access is granted under individual credentials and revoked when those tasks end.
  • The connection between the user, the bot and the Service's servers is protected by encryption in transit (TLS/HTTPS).
  • The database is not reachable from the public network: connections are possible only from the Service's server; administrative access to the server uses SSH keys, with password login disabled.
  • Database backups are performed and stored securely with restricted access.
  • We do not collect or store full bank card details — this is handled by a certified payment partner.

Breach notification. In the event of a personal data breach, we will notify the Personal Data Protection Service of Georgia within 72 hours of becoming aware of the incident and, where the breach presents a high risk to your rights, we will also inform you without undue delay, through the bot or the contact channel you have provided.

7Your rights

You have the right to:

  • obtain information about what data of yours we process, for what purposes, on what basis and to whom it has been disclosed;
  • request a copy of the data we hold, including in a structured, machine-readable format (data portability);
  • request correction of inaccurate or incomplete profile data (also available directly in the bot);
  • request deletion of your data and of your account;
  • withdraw your consent to processing — withdrawal does not affect the lawfulness of processing carried out before withdrawal;
  • request the blocking (suspension) of processing, or object to certain types of processing.

To exercise any of these rights, write to privacy@coffeemeet.ge or to the support bot @coffeemeet_support_bot. We respond to such requests within 10 calendar days. If a request requires additional time, the period may be extended by no more than a further 10 days — we will inform you of the extension and its reasons within the original period.

Right to complain to the supervisory authority. If you believe your rights have been infringed, you may contact the Personal Data Protection Service of Georgia (personaldata.ge) or the courts.

8Age of users

The Service is intended only for persons over 18. We do not knowingly collect data of persons under 18. If you become aware that a minor has provided us with their data, please tell us — we will delete the account and the data associated with it.

9Cross-border data transfers

The Service's server and database are located in Germany. Germany is included in the list of states providing appropriate safeguards for the protection of personal data maintained by the Personal Data Protection Service of Georgia; transfers to such states are permitted on general grounds and require no additional authorisation.

Payment processing is carried out by JSC TBC Bank within Georgia.

When you use the bot, data is also transmitted through the infrastructure of the Telegram messenger, whose servers are located outside Georgia; the terms of such transmission are determined by Telegram's privacy policy, which you accept by using the messenger.

We carry out no other cross-border transfers of your data. If the recipients or countries change, we will update this section and notify you through the bot before the change takes effect.

10Changes to this Policy

We may update this Policy from time to time. We will notify you through the bot of material changes (for example, new recipients of data, new purposes of processing, or a change in the country of storage) before they take effect.

11Contacts

For questions about the processing of personal data, contact: privacy@coffeemeet.ge / @coffeemeet_support_bot.