Privacy policy

Effective 27 September 2026. WhoElse is operated by Bitweave Solutions, which is responsible for your data under Zambia’s Data Protection Act. Contact us about your data — this works without an account too.

Data we use

We process your sign-in phone number, the numbers you register, your name, selected city, uploaded profile photos, notification tokens, block lists, your Activity record, consent and age-confirmation records, support requests and feedback, purchase records and entitlement usage. Private labels stay on your device and are never sent to us. We do not access your address book or GPS location, use no advertising ID or third-party analytics, and do not sell your data or use it for advertising.

Why we use it

Your consent, recorded when you accept these terms, which you can withdraw by deleting your account; providing the service you asked for; legal obligations such as keeping payment records; and our legitimate interest in keeping the service safe (screening photos, handling reports, preventing fraud) and, for people who are not members, in holding a number a member registered so the comparison can work.

If your number was added and you are not a member

A member can register any phone number. We then hold that number, linked to the member who entered it, so it can be compared if you ever join. We hold nothing else about you. We do not text or call you, and do not show your number to anyone other than the member who entered it. You can ask what we hold, object, or ask us to delete it through our support page, without an account.

Notifications

Members may receive these notifications, none of which says who: someone added your number (only if the person who added you allows paid reveals, and never if either of you blocked the other, they opted out, or you were matched before); someone else added the person you are matched with; someone you added joined WhoElse; someone you added chose someone else. They can be turned off in Account → Notifications.

Disclosure and consent

Mutual matches and accepted connections share phone numbers. Paid reveals disclose your number only if you explicitly enable “Let people I’ve added reveal me” in Privacy & data. The default is off. You are not told beforehand; afterwards your Activity shows that someone you added revealed you, not who. Disabling reveals cannot retract information already disclosed. Your approved thumbnail is shared with matches and accepted connections; your full photo is not. Your name is not shown to anyone else.

Providers

Google Firebase provides sign-in and verification texts, database, storage, server processing, hosting, notification delivery and system logs, including the logs support requests are delivered through. Google Cloud Vision screens profile thumbnails before sharing. Apple Push Notification service delivers notifications to iPhones. Apple DeviceCheck and Google Play Integrity confirm requests come from a genuine app on a real device. Apple and Google process mobile purchases; ZynlePay processes Mobile Money and card payments. Payment providers receive the paying number, amount and reference, not your profile or registrations.

Where it is stored and how it is protected

Your account records are kept in Google Cloud in the United States, and the servers that work on them run in Google Cloud’s europe-west1 region (Belgium), so your data is stored and handled outside Zambia. Google may process data in other regions under its data processing terms with us. Data is encrypted in transit and at rest. Database rules let each member read only their own records. If a breach puts your data at risk we will notify the Data Protection Commissioner and the people affected as the Act requires.

Retention and deletion

Account data is kept while your account exists. Delete your account in Account → Delete account or request deletion here. Deletion removes your profile, photos, registrations, matches, Activity, connection requests, support requests and feedback, and the sign-in record. Payment records are kept as the financial record for disputes and tax, with what identifies you removed. Deleted data can remain in encrypted backups for up to 30 days. System logs, which can include support requests, are kept by Google for a limited period.

Your rights

Export your data in Privacy & data, edit your profile, request a phone number change in Account → Change phone number, disable paid reveals or notifications, block numbers, and delete your account. You can complain to the Data Protection Commissioner of Zambia; we would like the chance to put things right first through support.

Children

WhoElse is for adults 18+. Report suspected underage accounts through Support → Safety or our public safety form. We investigate and remove confirmed underage accounts.

Changes

If we change this policy materially we will ask you to accept the new version in the app, and record which version you accepted.