Legal & Regulatory Compliance Framework

In this Agreement, unless the context otherwise requires:

• “Account” means the registered user account created on the Service.
• “Agreement” means this consolidated framework, comprising the Terms of Service, Privacy Policy, Cookie Policy, Community Guidelines, AI Governance Policy and Security Statement.
• “Aura” means the artificial-intelligence relationship-coach feature operated by the Operator within the Service.
• “Conscious Closeness Algorithm” means the proprietary recommendation system used to suggest potential connections.
• “Content” means any text, images, audio, video, voice notes, profile information or other materials submitted to or generated through the Service.
• “Operator”, “we”, “us” or “our” means Puzled Limited, a company registered in England and Wales, having its registered office in London, United Kingdom.
• “Service” means the Puzled website, mobile and progressive web applications and related features.
• “Subscription” means a paid plan giving access to premium features.
• “User”, “you” or “your” means any natural person who accesses or uses the Service.

Headings are for convenience only. References to legislation include any amendment or replacement. The singular includes the plural and vice versa.

2.1 Eligibility

You may create an Account and use the Service only if all of the following are true. By using the Service you represent and warrant that:

1. you are a natural person aged 18 years or older;
2. you are legally capable of forming a binding contract with the Operator;
3. you are seeking a meaningful personal connection and are not using the Service for commercial solicitation;
4. you are not located in, ordinarily resident in, or a national of any country or territory subject to comprehensive sanctions administered by the United Kingdom, the European Union or the United States;
5. you are not listed on any sanctions or prohibited-persons list;
6. you have not been convicted of, nor pled guilty or no contest to, a felony, indictable offence, sex offence or any offence involving violence or a credible threat of violence;
7. you are not required to register as a sex offender with any registry;
8. you maintain no more than one Account on the Service; and
9. you have not previously been removed from the Service, unless we have given you express written permission to register again.

If at any time you cease to meet these requirements your authorisation to use the Service is automatically revoked and you must delete your Account without delay.

2.2 Your Account

You are responsible for maintaining the confidentiality of your login credentials and for all activities that occur under your Account. You must notify us immediately at security@puzled.com if you suspect any unauthorised access.

You agree to provide accurate, current and complete information during registration, to keep that information up to date, and to use only photographs that genuinely depict you and were taken within the last twenty-four months.

2.3 Acceptable Use

You agree that you will not, and will not permit any third party to:

• impersonate any person or misrepresent your identity, age, marital status or relationship intentions;
• harass, threaten, stalk, intimidate, defame or discriminate against any other User on any prohibited ground;
• post, send or otherwise make available any Content that is unlawful, hateful, sexually explicit involving minors, violent, fraudulent, or that infringes any third-party right;
• solicit money or any other thing of value from any other User, or otherwise use the Service for commercial purposes including advertising, multi-level marketing or the promotion of escort or sex-work services;
• upload viruses, malware or any code intended to disrupt or compromise the Service or any User's device;
• attempt to access, scrape, index or mirror any part of the Service through automated means, or to reverse-engineer, decompile or otherwise derive the source code of the Service;
• use the Service to develop, train or evaluate any machine-learning model that competes with the Service; or
• encourage, promote or facilitate any of the above.

2.4 User Content and Licence

You retain ownership of the Content you submit. By submitting Content to the Service you grant the Operator a worldwide, non-exclusive, royalty-free, sublicensable and transferable licence to host, store, reproduce, adapt, publish, translate, distribute and display that Content for the limited purposes of operating, providing, improving, securing and promoting the Service.

This licence terminates a reasonable time after you delete your Content or your Account, save where we are required to retain it for legal, regulatory or safety purposes, or where copies have been shared with other Users prior to deletion.

You represent and warrant that you own or have all necessary rights in your Content and that its submission to the Service does not violate the rights of any third party or any applicable law.

2.5 Operator's Rights

We may, without prior notice and in our reasonable discretion, refuse to publish, remove or restrict access to any Content, suspend any feature, or terminate any Account where we reasonably believe a User has breached this Agreement, applicable law, or where we are required to do so by a competent authority. We will inform affected Users of the reasons for such action where it is lawful and practicable to do so, in accordance with Article 17 of Regulation (EU) 2022/2065 (the Digital Services Act).

2.6 Subscriptions, Billing and Refunds

Certain features of the Service are made available on a paid Subscription basis. Subscription prices, billing intervals and feature inclusions are displayed at the point of purchase and form part of this Agreement.

Subscriptions renew automatically at the end of each billing period unless cancelled prior to renewal. You may cancel at any time through your Account settings or, where the Subscription was purchased via an app-store provider (Apple App Store, Google Play), through that provider's billing interface.

Users in the European Union, the European Economic Area or the United Kingdom may exercise the statutory right of withdrawal within fourteen (14) days of purchase, save that this right is lost once digital content has been supplied with the User's express prior consent and acknowledgement of the loss of that right. Outside those territories, all fees are non-refundable except where required by law.

2.7 Suspension and Termination

Either party may terminate this Agreement at any time. You may close your Account from within the Service. We may suspend or terminate your access for any material breach of this Agreement, for protection of other Users, or upon at least thirty (30) days' notice without cause. Termination does not affect rights or obligations accrued prior to termination.

2.8 Disclaimers

The Service is provided on an “as is” and “as available” basis. To the fullest extent permitted by law, the Operator disclaims all warranties, whether express, implied or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, and that the Service will be uninterrupted, secure or error-free. The Operator does not guarantee that you will find a match or that any User you interact with is who they claim to be.

2.9 Limitation of Liability

To the maximum extent permitted by applicable law, the aggregate liability of the Operator and its affiliates, officers, employees and agents arising out of or in connection with this Agreement shall not exceed the greater of (a) the amount paid by you to the Operator in the twelve months preceding the event giving rise to the claim, and (b) one hundred British pounds (£100). Nothing in this Agreement excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence and for fraud.

3.1 Controller

Puzled Limited is the controller of your personal data for the purposes of the UK GDPR and the GDPR. You may contact our Data Protection Officer at dpo@puzled.com.

3.2 Categories of Personal Data Processed

• Identification and account data: name, date of birth, email address, telephone number, profile photographs and biographical information.
• Profile and matching data: preferences, prompts, voice notes, swipe behaviour, compatibility signals and chat history.
• Special category data (Art. 9 GDPR): sexual orientation, religious beliefs and ethnicity, only where you choose to provide it. Processing of such data relies on your explicit consent under Article 9(2)(a) GDPR, which you may withdraw at any time.
• Technical data: device identifier, IP address, operating system, language, time-zone, crash and performance telemetry.
• Approximate location data: derived from IP address; precise location is processed only with your separate consent.
• Payment data: card token, billing country and transaction reference, processed by our payment service providers.

3.3 Purposes and Legal Bases

We process personal data on the following legal bases under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)) — to create and operate your Account, deliver matches and process Subscriptions.
• Legitimate interests (Art. 6(1)(f)) — to maintain platform safety, detect fraud, prevent abuse and improve the Service. You may object at any time.
• Consent (Art. 6(1)(a) and Art. 9(2)(a)) — for processing of special-category data, precise location and direct marketing.
• Compliance with a legal obligation (Art. 6(1)(c)) — for tax, accounting, anti-money-laundering and law-enforcement requests.

3.4 Automated Decision-Making and the Conscious Closeness Algorithm

The Conscious Closeness Algorithm produces personalised recommendations of other Users. These recommendations are decision-support tools; they do not produce legal or similarly significant effects on you within the meaning of Article 22 GDPR. You may at any time request a plain-language explanation of why a particular profile was recommended to you by contacting privacy@puzled.com.

3.5 Recipients

We share personal data only with: (a) processors acting on our documented instructions and bound by written agreements compliant with Article 28 GDPR, including our cloud-hosting, analytics, payments and customer-support providers; (b) other Users, to the extent your profile is visible to them; (c) competent authorities where required by law; and (d) successors in the event of a corporate transaction.

3.6 International Transfers

Where personal data is transferred outside the United Kingdom or the European Economic Area, we rely on adequacy decisions where available, on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) supplemented by appropriate technical and organisational measures, and on the UK International Data Transfer Addendum.

3.7 Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law. The retention schedule is set out in Schedule A to this document.

3.8 Your Rights

Subject to applicable law, you have the right to access, rectify, erase and port your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority — in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in the European Union, the supervisory authority of your habitual residence. You may exercise your rights at privacy@puzled.com or through the in-app Data Export and Delete Account controls.

3.9 California, Colorado and Other US State Rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah or another US state with comparable legislation, you have additional rights including the right to know the categories of personal information collected, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell personal information for monetary consideration. You may submit a request via privacy@puzled.com.

3.10 Children

The Service is not directed to persons under the age of 18 and we do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact safety@puzled.com and we will take steps to delete that information.

Cookies and similar technologies are small data files stored on your device. We use them only for purposes that are strictly necessary to operate the Service unless you have given your consent for additional purposes via the in-app consent banner.

• Strictly necessary cookies — required to authenticate you, maintain session integrity and prevent fraud. These cannot be disabled.
• Functional cookies — remember your preferences, such as language and theme.
• Analytics cookies — measure aggregate usage of the Service. These are loaded only after you grant consent.
• Advertising cookies — we do not currently use third-party advertising cookies.

You may withdraw consent at any time through the Privacy Settings within the Service. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Puzled exists to help people form meaningful connections. To make that possible, we ask every User to act with honesty, respect and care. The following conduct is prohibited:

• Harassment, hate speech, threats or discrimination on the basis of race, ethnicity, national origin, religion, sex, gender identity, sexual orientation, disability or any other protected characteristic.
• Sexual content involving minors, non-consensual intimate imagery, or any conduct prohibited by the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA-SESTA, Pub. L. 115-164).
• Solicitation of money, gifts or sexual services.
• Impersonation, catfishing or the use of artificially generated imagery that does not depict a real, consenting person.
• The promotion of self-harm, suicide, eating disorders, or other content harmful to vulnerable Users.

We provide tools to report, block and conceal other Users. Reports are reviewed by our trained moderation team in accordance with Section 6.

Any User or third party may submit a notice concerning Content believed to be illegal or in breach of the Community Guidelines by using the in-app report function or by writing to notices@puzled.com. Notices should identify the Content, explain the basis for the report and include the reporter's contact details and a good-faith declaration.

We will acknowledge receipt without undue delay and decide on the notice in a diligent, non-arbitrary and objective manner. Where action is taken against a piece of Content or an Account, we will provide the affected User with a Statement of Reasons in accordance with Article 17 DSA, including the legal or contractual ground relied upon and information about the available remedies.

Affected Users may appeal a moderation decision through the in-app appeals interface within six months of being notified of the decision. Appeals are reviewed by personnel not involved in the original decision. Users also retain the right to refer disputes to a certified out-of-court dispute settlement body under Article 21 DSA, and to seek redress before the competent courts.

7.1 Scope and Classification

The Aura coach is a general-purpose conversational assistant intended to provide supportive, non-clinical relationship guidance. The Conscious Closeness Algorithm is a recommendation system that ranks potential connections. Following our internal conformity assessment, neither system is classified as a prohibited AI practice under Article 5 of the AI Act, and neither falls within the high-risk categories listed in Annex III. They are nevertheless treated as systems requiring transparency and human-oversight obligations under Articles 50 and 52.

7.2 Prohibited Practices

In line with Article 5(1)(a) AI Act we do not deploy subliminal techniques beyond a person's consciousness, or purposefully manipulative or deceptive techniques, with the objective or effect of materially distorting the behaviour of a User in a manner that causes or is reasonably likely to cause that person significant harm.

7.3 Transparency

Where a User interacts with Aura, the User is clearly informed that they are interacting with an artificial-intelligence system. AI-generated content is labelled. Users may at any time request a plain-language explanation of any individual recommendation produced by the Conscious Closeness Algorithm.

7.4 Human Oversight

All safety-critical decisions, including content removal, Account suspension and escalation of crisis-risk signals, are subject to human review. Automated triage assists, but does not replace, trained human moderators. Aura includes guardrails that escalate to human moderators and surface professional crisis resources where signals of self-harm or abuse are detected.

7.5 Data Governance and Model Evaluation

Training and fine-tuning data are reviewed for representativeness and known biases. We perform periodic adversarial and red-team evaluations of Aura and the Conscious Closeness Algorithm. The results of these evaluations, together with the data-protection impact assessment performed under Article 35 GDPR, are documented and made available to competent authorities on request.

7.6 Behavioural Safeguards

To prevent the design of an addictive or manipulative product, the Service implements daily-use limits on certain features, transparent notifications, no dark patterns in subscription flows, and a clear path to deletion. These safeguards are reviewed at each major release.

• All User-submitted data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 within our cloud-infrastructure provider.
• Access to production systems follows the principle of least privilege and is granted on a documented role-based basis, with multi-factor authentication enforced for all administrative access.
• All access to infrastructure and systems is logged, retained for a minimum of twelve months, and monitored for anomalous behaviour.
• We engage independent security assessors to perform periodic penetration testing and conduct annual internal reviews against ISO/IEC 27001 control objectives.
• Security researchers are invited to report findings to security@puzled.com under our responsible-disclosure policy. We commit to acknowledge receipt within 72 hours and to refrain from legal action against good-faith research.
• Security is integrated into our development lifecycle through threat modelling, peer code review, automated dependency scanning and pre-release security testing.

We will notify the relevant supervisory authority of a personal-data breach without undue delay, and in any event within 72 hours of becoming aware of it, where required by Article 33 GDPR, and will notify affected Users where Article 34 applies.

9.1 Governing Law

This Agreement, and any dispute arising out of or in connection with it, is governed by the laws of England and Wales, without regard to its conflict-of-laws principles. Nothing in this clause deprives a consumer of the protection of the mandatory law of the country of their habitual residence.

9.2 Informal Dispute Resolution

Before commencing any formal proceedings, you and the Operator agree to attempt in good faith to resolve any dispute through informal negotiation. The complaining party must send a written notice to legal@puzled.com describing the nature of the dispute, the relief sought and the contact details of the complainant. The parties will then engage in good-faith discussions for a period of sixty (60) days.

9.3 Arbitration (Users outside the EU, EEA, UK and Switzerland)

If the dispute is not resolved through informal negotiation, it will be finally resolved by binding individual arbitration administered by a recognised arbitral institution mutually agreed by the parties, in accordance with that institution's then-current rules. The seat of arbitration is London, United Kingdom; the language is English; and judgment on any award may be entered in any court of competent jurisdiction.

THE PARTIES WAIVE THE RIGHT TO PARTICIPATE IN A CLASS, COLLECTIVE OR REPRESENTATIVE ACTION AND THE RIGHT TO TRIAL BY JURY. Claims of sexual assault or sexual harassment occurring in connection with the Service are exempt from this arbitration clause at the election of the claimant.

9.4 Courts (Users in the EU, EEA, UK and Switzerland)

If you are a consumer resident in the European Union, the European Economic Area, the United Kingdom or Switzerland, you may bring proceedings in the courts of your country of residence, and the Operator may bring proceedings against you only in the courts of your country of residence. The European Commission's online dispute resolution platform is available at ec.europa.eu/consumers/odr.

10.1 Entire Agreement

This Agreement, together with any document expressly incorporated by reference, constitutes the entire agreement between the parties relating to its subject matter and supersedes all prior understandings.

10.2 Severability

If any provision of this Agreement is held to be unenforceable, the remaining provisions shall continue in full force and effect, and the unenforceable provision shall be modified to the minimum extent necessary to make it enforceable while preserving the parties' intent.

10.3 No Waiver

The failure of the Operator to enforce any provision of this Agreement shall not constitute a waiver of that or any other provision.

10.4 Assignment

You may not assign or transfer this Agreement without our prior written consent. We may assign this Agreement to an affiliate or to a successor in connection with a merger, acquisition or sale of assets.

10.5 Notices

Notices to the Operator shall be sent to legal@puzled.com. Notices to you shall be sent to the email address on your Account or delivered through the Service.

10.6 Force Majeure

Neither party shall be liable for any failure or delay in the performance of its obligations under this Agreement due to events outside its reasonable control, including acts of God, war, terrorism, civil disturbance, pandemic, governmental action and failures of telecommunications networks.

• Account identification data — for the duration of the Account, plus twelve (12) months after deletion for fraud-prevention purposes.
• Profile content (photographs, prompts, voice notes) — for the duration of the Account; deleted within thirty (30) days of Account closure.
• Chat content — for the duration of the conversation, deleted within thirty (30) days of Account closure of either participant.
• Swipe and recommendation telemetry — aggregated after ninety (90) days; raw events deleted at that time.
• Moderation and safety records — retained for up to five (5) years where necessary to protect the community and to comply with the Digital Services Act.
• Payment and tax records — retained for seven (7) years to comply with applicable tax and accounting law.