Tism Privacy Policy

Effective Date: December 7, 2025 | Last Updated: December 7, 2025

Welcome to the Tism Privacy Policy. Tism App LLC, a limited liability company organized and existing under the laws of the State of Florida, United States of America, Planet Earth (“we”, “us”, “our”, or “Tism”) is a specialized dating and social-connection platform designed exclusively for autistic and neurodivergent adults aged 18 and over. We recognize the unique sensitivities and vulnerabilities within our community, including the potential for heightened risks related to data privacy, such as doxxing, harassment, or misuse of sensitive health-related information. This policy is crafted with transparency, clarity, and respect in mind, avoiding dense legalese to ensure it's accessible to all users, including those who may prefer straightforward language.

This Privacy Policy details how we collect, use, store, protect, disclose, and manage your personal data. It ensures full compliance with key global privacy laws, including but not limited to:

The European Union General Data Protection Regulation (EU GDPR - Regulation (EU) 2016/679)
The United Kingdom General Data Protection Regulation (UK GDPR)
The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA - California Civil Code §§ 1798.100 et seq.)
Other applicable laws such as the Swiss Federal Act on Data Protection (FADP), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil's Lei Geral de Proteção de Dados (LGPD), and Australia's Privacy Act 1988.

We are committed to the principles of data minimization, purpose limitation, accuracy, storage limitation, integrity and confidentiality, and accountability. If you are a resident of California, please refer to our supplemental California Privacy Notice at the end of this policy. For residents of other U.S. states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah), your rights are outlined in Section 8.

Good to Know: This policy applies to all interactions with Tism, including our waitlist sign-up, future app usage, websites, emails, and any related services. If you do not agree with this policy, please do not access or use our services.

1. Data Controller and Contact Information

Tism operates as a sole proprietorship. Depending on your location, the data controller responsible for your personal data is:

For users in the EEA, UK, or Switzerland: Tism EU Branch (hypothetical entity for compliance; contact via headquarters).
For users elsewhere: Tism, Inc. (or equivalent legal entity).

Email: chad@cummings.law
Postal Address: 24850 Burnt Pine Drive, Suite 1, Bonita Springs, FL 34134-0905
Data Protection Officer (DPO): We have appointed an internal DPO who can be reached at the above email. For EU/UK users, our DPO ensures ongoing compliance with GDPR requirements.

If you believe your data rights have been violated, you may lodge a complaint with your local supervisory authority (e.g., CNIL in France, ICO in the UK, or the California Attorney General for CCPA issues).

2. Categories of Personal Data We Process

We collect only the data necessary to provide, improve, and secure our services. Data collection is minimized to respect your privacy, especially given the sensitive nature of neurodivergence-related information. Below is a comprehensive breakdown of data categories, examples, sources, purposes, and whether the data is mandatory or optional.

Category	Examples (Non-Exhaustive)	Source	Purpose(s)	Mandatory/Optional	Sensitive/Special Category?
Identifiers	Email address, IP address, device ID, username, hashed passwords	Directly from you (e.g., sign-up form); automatically (e.g., server logs)	Account creation, authentication, waitlist management, communications, fraud prevention, personalized service delivery	Mandatory for core services	No, unless linked to sensitive data
Internet/Network Activity	User-Agent string, browser type, timestamps, session duration, pages viewed, referral URLs	Automatically via cookies, pixels, or logs	Security monitoring, abuse prevention, analytics for service improvement, debugging	Automatic (opt-out via cookie settings)	No
Geolocation (Approximate)	IP-derived country, region, or city; no precise GPS unless consented	Automatically from IP; device if location services enabled	Fraud detection, regional compliance (e.g., age verification laws), future matching features based on broad location	Optional (can be disabled)	No
Future Profile Data (Post-2026 Launch)	Photos, bio, preferences (e.g., interests, relationship goals), neurodivergence details (e.g., autism spectrum level if shared), gender identity, sexual orientation	Voluntarily provided by you during profile setup or updates	Core app functionality like matching, profile display, community building; ensuring neurodivergent-only environment	Optional (basic profile mandatory for use)	Yes (special category under GDPR: health, sexual orientation; sensitive under CCPA)
Payment/Financial Data	Transaction IDs, payment method type (no full card details stored), billing address	Directly from you or payment processors	Processing subscriptions or premium features (if implemented), refunds, fraud prevention	Mandatory for paid services	No
Customer Support Data	Inquiries, complaints, feedback, attached files	Directly from you via support channels	Resolving issues, improving service, compliance with reports	Optional	Possibly (if includes sensitive details)
Inferences	Derived preferences from interactions (e.g., inferred interests from profile views)	Generated from other data	Personalization, matching algorithms	Automatic	Possibly sensitive

We do not collect or process precise geolocation, audio/video recordings, genetic data, or any data unrelated to our core mission. At the waitlist stage, we limit collection to essentials (email, IP, User-Agent). For future app features, any sensitive data (e.g., neurodivergence specifics) is processed only with explicit consent and for the purpose of community verification and matching. We do not use facial recognition or biometrics at this time but may introduce optional verification in 2026 with separate consent.

Good to Know: If you link social media accounts (e.g., for profile import), we receive limited data like profile photos or contacts, but only with your permission. You can revoke access anytime via the third-party platform.

3. Legal Bases for Processing (GDPR Art. 6 & 9; CCPA Equivalent Notices)

We process data only where we have a valid legal basis. For special category data (e.g., health/neurodivergence info), we require explicit consent. Below is a detailed mapping:

Processing Activity	Legal Basis	Explanation & Examples
Account creation and waitlist management	Performance of a contract (Art. 6(1)(b))	To fulfill our agreement to add you to the waitlist and notify you upon launch. Example: Using your email to send confirmation and updates.
Fraud prevention and security	Legitimate interests (Art. 6(1)(f))	Our interest in maintaining a safe, neurodivergent-only space outweighs risks. We conduct balancing tests and DPIAs for high-risk activities.
Processing sensitive data (e.g., neurodivergence details)	Explicit consent (Art. 9(2)(a))	You must affirmatively opt-in; consent is granular, informed, and revocable without detriment.
Marketing communications	Consent (Art. 6(1)(a))	Optional; you can unsubscribe anytime via email links or settings.
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))	E.g., responding to law enforcement requests or tax audits.

For CCPA/CPRA, we do not "sell" or "share" data for targeted advertising. Any sharing is for operational purposes only (see Section 5).

4. How We Use Your Data

4.1 Primary Uses

We use data to deliver, personalize, and secure our services. Examples:

Service Delivery: Email for waitlist confirmation; future use for matching based on preferences.
Personalization: Tailoring notifications or features to neurodivergent needs (e.g., sensory-friendly interfaces if implemented).
Analytics: Aggregated data to understand usage patterns, improve accessibility.

4.2 Security and Fraud Prevention

We employ advanced measures to protect our community:

IP logging to detect suspicious activity (e.g., multiple sign-ups from one IP).
Automated and manual reviews for non-neurodivergent infiltration.
Incident response plans for breaches, with notification within 72 hours if required (GDPR Art. 33).

4.3 Marketing and Research

With consent, we may send promotional emails or conduct anonymized research on community trends. No targeted ads without opt-in.

Good to Know: We do not use automated decision-making that produces legal effects (GDPR Art. 22). All matching algorithms are overseen by humans.

5. Data Retention Schedule

We retain data only as long as necessary, with strict limits:

Data Type	Retention Period	Reason	Deletion Process
Waitlist Emails & Identifiers	Until December 31, 2026 or consent withdrawal	Service fulfillment	Secure erasure; backups purged within 90 days
Security Logs (IP, User-Agent)	180 days max	Fraud investigation	Automatic anonymization or deletion
Sensitive Profile Data	Until account deletion + 30 days	User control	Irreversible hashing or full wipe
Support Tickets	6 years	Legal defense	Pseudonymized after resolution

Upon deletion request, we confirm within 10 days and complete within 30 (GDPR) or 45 (CCPA) days.

6. Recipients & Sub-Processors

We share data only with trusted parties under strict contracts (GDPR Art. 28 DPAs). No sales or unrelated sharing.

Recipient Type	Examples	Purpose	Safeguards	Location
Hosting Providers	Contabo GmbH (Germany), AWS (US)	Data storage and processing	EU SCCs (2021/914), encryption, access controls	EU/US
Security/CDN	Cloudflare, Inc.	DDoS protection, traffic management	SCCs, BCRs, regular audits	Global
Email Services	SendGrid or equivalent	Transactional emails (e.g., waitlist confirmations)	DPA, SCCs, TLS encryption	US
Payment Processors	Stripe, PayPal	Future premium features	PCI DSS compliance, pseudonymization	US/EU
Legal/Regulatory	Law enforcement, courts	Compliance with subpoenas	Only upon valid legal request; user notification where possible	Varies

We audit sub-processors annually and ensure they meet GDPR adequacy standards. For CCPA, these are "service providers" not involving sale/sharing.

7. International Transfers

Data may be transferred outside your jurisdiction. Primary storage: US (with EU mirrors for EEA users).

Mechanisms: EU SCCs, UK IDTA, Swiss-US Privacy Shield equivalents.
Supplementary Measures (per Schrems II): Encryption, pseudonymization, transfer impact assessments (TIAs) for each transfer.
Risk Mitigation: No transfers to high-risk countries without additional safeguards.

We conduct TIAs for all non-adequate transfers and make summaries available upon request.

8. Your Rights – Comprehensive List and Exercise Instructions

You have extensive rights over your data. Requests are free (unless excessive) and verified via email/IP checks.

Access (GDPR Art. 15 / CCPA §1798.110): Receive a copy of your data, sources, purposes, recipients.
Rectification (Art. 16): Correct inaccurate data.
Erasure/Deletion ("Right to be Forgotten" - Art. 17 / CCPA §1798.105): Delete data when no longer needed or consent withdrawn.
Restriction (Art. 18): Limit processing while disputes are resolved.
Portability (Art. 20): Receive data in machine-readable format and transfer to another controller.
Objection (Art. 21): Oppose processing based on legitimate interests or for marketing.
Withdraw Consent (Art. 7): Revoke at any time; does not affect prior processing.
Opt-Out of Sale/Sharing (CCPA §1798.120): Not applicable, but we honor "Do Not Sell My Personal Information" requests.
Limit Sensitive Data Use (CPRA): Restrict use of sensitive data to necessary purposes.
Non-Discrimination (CCPA §1798.125): No penalties for exercising rights.
Complaint (Art. 77): Lodge with supervisory authority (list available on request).
Automated Decisions (Art. 22): Request human review if applicable (none currently).

How to Exercise: Email chad@cummings.law with your request, including verification details. Response times: 30 days (GDPR), 45 days (CCPA, extendable). Appeals: If denied, appeal within 30 days; we respond within 60 days.

9. Security Measures

We implement robust technical and organizational measures (TOMs) per GDPR Art. 32 and CCPA requirements:

Encryption: TLS 1.3 for transit; AES-256 for at-rest data.
Access Controls: Role-based access, multi-factor authentication, least privilege principle.
Monitoring: 24/7 logging, anomaly detection, regular penetration testing by third-party experts.
Incident Response: Dedicated plan with breach notification protocols (72 hours for GDPR high-risk).
Vendor Management: DPAs with all processors, annual security audits.
Data Protection Impact Assessments (DPIAs): Conducted for all high-risk processing (e.g., sensitive data matching).
Employee Training: Annual privacy training, non-disclosure agreements.

In case of a breach, we notify affected users and authorities as required.

10. Automated Decision-Making and Profiling

We do not engage in automated decision-making with legal or significant effects (GDPR Art. 22). Future matching algorithms may involve profiling for recommendations, but:

Based on explicit consent.
Human oversight for disputes.
No sensitive data used without opt-in.
Transparency: You can request details on logic and implications.

11. Children's Privacy

Tism is exclusively for adults 18+. We do not knowingly collect data from minors. If discovered:

Immediate deletion.
Account termination.
Parental notification if required (COPPA compliance, though not targeted at children).

We use age gates and verification to enforce this.

12. Cookies and Similar Technologies

We use cookies for essential functions, analytics, and (with consent) marketing. See our separate Cookie Policy for details:

Essential Cookies: Session management, security.
Analytics: Google Analytics (anonymized IPs).
Opt-Out: Browser settings or our consent banner.
Do Not Track (DNT): We honor DNT signals; no tracking if enabled.

13. Changes to This Policy

We may update this policy to reflect changes in practices or laws. Material changes (e.g., new data uses) will be notified via email at least 30 days in advance. Continued use constitutes acceptance. Non-material changes are effective immediately. Archived versions available upon request.

14. Supplemental Notice for California Residents (CCPA/CPRA)

This supplements the main policy for California residents:

Categories Collected (Past 12 Months): Identifiers, geolocation, inferences (as above); no financial details beyond transactions.
Sources: You, automatic, third parties (e.g., processors).
Business Purposes: Service provision, security, debugging, marketing (opt-out).
Disclosures: To service providers only; no sales.
Rights: Know, delete, correct, opt-out, limit sensitive use. Use chad@cummings.law.
Authorized Agents: Permitted with verification.
Shine the Light: We do not share for third-party marketing.

15. Additional Notices for Other Jurisdictions

15.1 EU/UK/Switzerland

Data transfers protected as in Section 7. Supervisory authorities: EDPS (EU), ICO (UK), FDPIC (Switzerland).

15.2 Other U.S. States

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA): Similar rights to CCPA; no material differences in our practices.

15.3 Global

We comply with PIPEDA (Canada), LGPD (Brazil), etc., via equivalent protections.

© 2025 Tism App LLC. All rights reserved.
This policy is comprehensive to empower our neurodivergent community with full knowledge and control over their data. If anything is unclear, contact us – we're here to help.