Privacy notice

Last updated 8 November 2026.

The short version

Your profile is only ever seen by your weekly match, and by our staff when they check something.
Selfies and ID photos are deleted straight away. We keep the result, not the picture.
Your postcode, date of birth and who you’d like to meet are never shown to anyone.
Everything is kept on our own server in the UK. We don’t sell your data, and we don’t use it for adverts.
You can delete your account at any time, and everything goes at once.

Who we are

Second Look is run by PolTech Management, Kilmarnock, Scotland, which is the data controller. The person responsible is Stephen McNamara. To ask about your data, or to complain, email [email protected].

What we hold, why, and for how long

Your account: email address, a scrambled copy of your password, and sign-in records. To run your account. Kept until you delete it.

Your profile: first name, date of birth, town, postcode, photos, your write-up and answers, height, build, family and situation, and the habits you do. Your match sees your first name, age, town, a rough distance, the photos that passed our check, and your write-up and answers. Kept until you delete it.

Who you are and who you’d like to meet: “I am” is shown to your match. Who you’d like to meet, and whether you’re open to meeting trans people, are only used for matching and never shown. Who you’d like to meet can reveal your sexuality, which is “special category” data, so we only use it if you tick that you agree.

What the game learned: what matters most to you, the ages and looks you prefer, and your own answers. Used for matching only. The people you list in the game never leave your phone.

Messages: kept so you can read your chat back, and so our staff can read it if one of you reports the other. Staff don’t read chats otherwise. Messages are deleted 90 days after a match ends, or when either of you deletes their account, unless they are part of a report.

Register of interest: if you leave your email to hear when we open, we keep it to send you a short update each Sunday until then, and the date you joined. Every email has a link to stop them, and you can ask us to delete it at any time.

Practice questions: your practice answers stay on your own phone. They are never sent to us.

Inviting friends: when you share the game or tell someone their result, it goes straight from your phone to whoever you choose. We never see who you send it to or what it says.

Reports, warnings and staff decisions: kept for 2 years after the decision, so we can deal with repeat problems and help the police if needed. If the police ask for evidence about a crime, or someone is at serious risk, only the owner can send them a copy of the report and chat, and every time it happens is recorded.

Payments and extras: payments go through Stripe, on Stripe’s own page, so your card details never reach us. We keep a record of what you bought and when for 6 years, because tax law requires it; if you delete your account, that record is no longer linked to you. Your Relationship DNA report and voice intro are kept until you delete them or your account.

AI extras (only if you buy them and tick that you agree): to write your Relationship DNA report, we send your game answers (never names) to our AI provider, Anthropic. When you ask the chat coach for help, we send your own chat with your match, with names, phone numbers, email addresses and links taken out. Anthropic processes it for us under contract, keeps it only briefly, and doesn’t use it to train AI. Nothing goes to AI unless you press the button.

Voice intros: a person listens to each one and reads the captions before your matches can hear it.

The photo check, age check and “I am” check

To keep Second Look safe, everyone does a quick photo check before they can be matched. It uses face matching on our own server. Face matching counts as biometric data, so we only do it if you tick that you agree. If you’d rather not, you can ask a person to check one photo instead.

Your live selfie is compared with your profile photos, to show they’re really you.
The same selfie is used to estimate that you’re over 18. Anyone who looks under 25 is asked for a passport or UK driving licence, like in a shop. Its date of birth is read automatically, and its photo is compared with a fresh selfie.
The selfie is also compared with what you said under “I am”. Only if the face reading very strongly disagrees with “Man” or “Woman” does a senior staff member look before you can be matched. They may ask you to change your profile, or to send a photo of your birth certificate.

What we keep: only the results: that the checks passed, when, which kind of ID, and which of your photos matched. Selfies and ID photos are deleted straight away. To make sure the checks work fairly, 1 check in 100 is kept for 7 days, then deleted. Anything sent for a person to check (a photo, an ID, or a birth certificate) is deleted as soon as it has been checked, and after 30 days at most.

If someone is banned for breaking our rules, we keep a scrambled copy of their email address, the face “fingerprints” from their profile photos, and the random ID our website gave the phones or computers they used, so they can’t simply sign up again. Nothing else is kept. (We remember those random IDs for every member, the last 10, only for this purpose, and delete them with the account.)

Keeping members safe

Our system looks for signs of scams in messages, such as asking for money, gift cards or crypto. If it finds one, it tells our staff and shows the person receiving the message a reminder never to send money. Nobody is punished by the software alone: a person always decides.

Our legal reasons

Running your account, profile, matching and chat: our contract with you.
Using who you’d like to meet, and face matching: your explicit consent, which you can take back at any time by changing your answers or deleting your account.
Age checks: our legal duty under the Online Safety Act 2023 to keep children off Second Look.
Safety (reports, scam signs, the “I am” check, banning): our legitimate interest, and our legal duties, in protecting members and preventing crime.

Who else handles your data

Contabo runs our server, in the UK.
Cloudflare carries the website’s traffic to our server.
Brevo sends our emails (in the EU).
Stripe takes payments for extras.
Anthropic runs the AI for the paid AI extras, only for members who choose them (in the US, under UK data-transfer safeguards).
PolTech Management’s own server keeps our nightly backups for 14 days, scrambled so they can’t be read without a key kept elsewhere.

The face, age and ID checks run on our own server, so no photo or ID is sent to an outside service. We only pass information to the police or other authorities when the law requires it, or to protect someone from serious harm.

Postcodes

Your postcode is checked against Ordnance Survey’s postcode list, kept on our own server. It is never sent to anyone else and never shown to other members: they only see a rough distance, like “about 10 miles away”.

Your rights

You can ask to see the data we hold about you, to have it corrected, to have it deleted, to object to how we use it, or to take a copy. You can delete your account yourself at any time from the Account page. Email [email protected] and we’ll reply within a month.

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint.

For any data protection question or request, email [email protected], which goes straight to our Data Protection Officer (also reachable at [email protected]). To ask for a copy of your data, or to have it corrected or deleted, use our Your data rights form. If you think your data has been lost, leaked or sent to the wrong person, please report a data concern.

Complaining to the regulator. If you're unhappy with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: online at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO will usually ask you to raise it with us first, so please give us the chance to put it right. PolTech Management pays the ICO's data protection fee as a data controller.