Privacy Policy
Bumpy https://bumpy.app and Wonder https://wonder.dating
Version 2.0
Effective Date: 04 October 2026
Last updated: 04 September 2026
1. Who we are
Bumpy and Wonder are dating applications owned and operated by the same corporate group. Bumpy https://bumpy.app is a general dating app; Wonder https://wonder.dating is a dating app for gay people. They share the same legal owner, the same infrastructure and the same support team, and this Privacy Policy applies to both Apps on a combined basis.
Depending on where you live, one entity acts as your primary controller for whichever App you use (Bumpy or Wonder). In some cases (for example, where both entities jointly determine why and how certain core Service processing takes place), the entities act as joint controllers under Article 26 GDPR:
In this notice, "Bumpy", "Wonder", "we", "us" or "our" means the controller responsible for your personal data based on where you live and which App(s) you use. Where the entities act as joint controllers, they have entered into a joint-controller arrangement under Article 26 GDPR.
Essence of the arrangement: (i) you can send privacy requests to either entity; (ii) we coordinate responses; (iii) we apply common security and vendor-management standards; and (iv) MV Bumpy Group Limited acts as the main point of contact for the lead supervisory authority for EEA processing across both Apps. The full text is available on request to legal@bumpy.app. Regardless of which entity is the lead controller, you can exercise your rights against either of us.
This notice covers the Bumpy mobile application (iOS and Android) and the website at https://bumpy.app, and the Wonder mobile application (iOS and Android) and the website at https://wonder.dating, together with the related services (together, the "Service" or the "Apps"). Except where this notice expressly distinguishes between Bumpy and Wonder, it applies equally to both.
2. Definitions
To keep this combined notice easy to read across both Apps, we use the following defined terms:
● "App" means, as applicable to the product you use, the Bumpy mobile application and/or the Wonder mobile application (iOS and Android).
● "Site" means, as applicable, https://bumpy.app and/or https://wonder.dating.
● "Service" means the Site(s), the App(s) and the services provided through them.
● "Companies", "we", "us" or "our" means Bumpy Inc. and/or MV Bumpy Group Limited, acting as controller(s) as described in Section 1, in respect of either App.
● "User" or "you" means an individual using the Bumpy App/Site and/or the Wonder App/Site.
3. At a glance
This notice explains what personal data we collect, why we use it, and the choices you have. You do not need to read the whole document to understand the basics - start with the quick summary below.
If you only read one section, read this:
● We collect the information you provide (like your profile, photos and messages), plus device and usage data, and location data (approximate by default; precise only if you turn it on).
● We use it to run the Service, keep it safe, prevent fraud, and meet legal obligations. We use advertising and non-essential analytics only when the law requires us to get your consent.
● Some profile fields can be sensitive (for example, sexual orientation or the gender(s) you are seeking). We process sensitive data only when you choose to provide it and you give explicit consent (where required). You can withdraw that consent at any time in the App.
● If you use Bumpy and indicate you are seeking a same-sex match, your profile may also be shown to Wonder users, and if you use Wonder, your profile may also be shown to Bumpy users. See Section 8 for how this works and how to opt out.
● We share data with other Users you interact with, our service providers (under contract), and authorities when legally required.
● We may transfer data internationally. Where required, we use safeguards such as the EU Standard Contractual Clauses and (when available) the EU-US Data Privacy Framework.
● You have privacy rights (access, delete, export, object, withdraw consent; and in some US states opt out of “sale/share” for targeted advertising). Contact us at legal@bumpy.app or use the in-App Privacy Choices screen.
4. Personal data we collect
5. Sensitive data controls
Some profile fields may be sensitive (also called “special category data” in the EEA/UK), such as sexual orientation, ethnicity, and religion.
● Optional by design: you do not have to provide sensitive profile data to use core features of the Service.
● Your choices: you control whether to add these fields and whether they are visible to other Users.
● Explicit consent where required: we use explicit consent while you decide to provide sensitive data, you can skip and not enter the data by your choice
● Withdrawal: you can withdraw consent at any time in Profile → Edit Profile Information and remove the chosen parameter. This affects future processing and may remove or hide related profile fields and features.
6. Cross-app data sharing between Bumpy and Wonder
Bumpy and Wonder are operated by the same corporate group on shared infrastructure, and we display profiles across both Apps in a specific, limited situation described below.
If, on Bumpy, you indicate that you are seeking a same-sex match - that is, based on the gender(s) you have selected as your stated match preference in your profile settings - your profile data may also be shown to users of Wonder, our sister app for gay people. The reverse also applies: Wonder users may have their profile shown to Bumpy users, depending on match settings.
This is important to get right: the trigger for cross-app visibility is your stated match/seeking preference (a functional setting you choose so the product can show you and others relevant profiles), not a self-declared sexual-orientation label. We do not infer, assume, or record your sexual orientation as a category from this setting, and a match preference is not treated by us as equivalent to an orientation disclosure. We nonetheless treat this processing with the heightened care described below.
Current mechanism: cross-app visibility based on stated match preference is enabled by default for the affected profiles. You can opt out at any time by emailing support@bumpy.app (Bumpy users) or support@wonder.dating (Wonder users) and asking us to disable cross-app visibility for your profile. Once processed, your profile will no longer be shown on the other App, though we cannot retrieve or delete copies already delivered to other Users (for example, matches or messages already exchanged) - see Section 10.
7. How we obtain and record your consent
We collect consent granularly, not as a single bundled acceptance:
● Separate toggles at registration: when you create an account, you are asked to accept the Terms of Service (required to use the Service) and are given separate, individually-switchable toggles for optional processing such as marketing communications and non-essential analytics/advertising cookies and SDKs.
● A distinct sensitive-data consent wording: before we process sensitive profile data (Section 9) - including sexual orientation, the gender(s) you are seeking (to the extent it is used to drive cross-app display under Section 8), religion or philosophical beliefs, ethnicity/nationality, or biometric photo-verification data - we present a dedicated wording, separate from general registration, that explains what will be processed, and asks for your explicit, opt-in consent field-by-field or category-by-category by choosing an option to share the information.
You can review and change your consent choices at any time in Profile → Edit Profile Information (settings icon)
8. How we use personal data and our legal bases
Where this notice refers to GDPR Articles, the same legal bases apply under UK GDPR. For the US, Canada, Brazil and Australia, see the country-specific sections.
Where we rely on legitimate interests (Article 6(1)(f)), our interests typically include keeping the Service safe, preventing fraud and abuse, protecting other Users, and improving the reliability of the Service. You can object to processing based on legitimate interests where applicable; we will assess your request and stop processing unless we have compelling legitimate grounds or another lawful basis.
9. Special category / sensitive personal data
We treat the following as sensitive and process them only with your explicit consent, unless another lawful condition applies (e.g. data you have manifestly made public, or processing necessary for the establishment, exercise or defence of legal claims):
● Sexual orientation and information about your sex life
● Religion or philosophical beliefs (only if you choose to share)
● Racial or ethnic origin (only if you choose to share)
● Biometric data used to uniquely identify you (photo verification)
You can withdraw your consent at any time in Profile → Edit Profile Information (settings icon), with effect for the future. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
10. Profile data shared with other Users (interaction notifications)
When another User interacts with your profile (or you interact with theirs) - including a User on the sister App under Section 6 - we may include parts of your profile that you have made public (first name, age, country, profile photo) in service messages such as match notifications and emails to that User. If you later delete or change your profile information, we will update it within the Service going forward. However, we may not be able to retrieve or delete copies already delivered to other Users (for example, in their inboxes or notifications). This is a practical limitation and, where applicable, we may also need to retain limited records to protect the rights of other Users and to establish, exercise or defend legal claims.
11. Ambassador Program
If you choose to take part in the Bumpy or Wonder Ambassador Program (governed by the applicable Ambassador Public Agreement), we additionally process the following personal data:
We do not collect bank details or tax forms from Ambassadors because the only compensation is a free in-App subscription. The Ambassador Agreement governs the licence to use the Content; this notice governs how we handle your personal data within that programme. Withdrawing your consent or terminating the Ambassador Agreement does not affect our right to keep using Content already published, as set out in the Ambassador Agreement.
12. Use of AI and automated tools
We use artificial intelligence and machine-learning tools in connection with the Service. These tools help us:
● Translate messages and other text between languages so Users can communicate across languages.
● Moderate content (for example, detecting nudity, scams, harassment, spam and underage Users) to keep the Service safe.
You can ask us about the AI uses connected to your account by writing to legal@bumpy.app (the shared privacy contact for both Bumpy and Wonder).
13. Cookies, SDKs and similar technologies
We and our partners use cookies, SDKs and similar technologies on the Apps and websites. We use them in three categories: Essential, Analytics and Marketing. Analytics and Marketing technologies are off by default in the EEA, the UK and Switzerland and run only after you opt in via our cookie banner or in-App privacy controls. On iOS, App Tracking Transparency also applies.
If you opt out of targeted advertising (or “sale/share” where that concept applies), we will apply your choice to advertising SDKs and similar technologies used in the App and on the website, subject to technical limitations (for example, where a platform setting controls ad tracking).
You can update your choices at any time:
● In the App: Profile → Edit Profile Information (settings icon) (name may vary depending on your device and version)
● On the website: via the cookie banner (or the “Cookie settings” link, where available)
14. How we share personal data
We do not sell personal data for money. Some sharing for advertising and analytics may qualify as a “sale” or “sharing” under California and other US state laws - see Section 19. You can opt out at any time.
We do not sell sensitive personal data for money. We do not share biometric identifiers for targeted advertising.
15. International data transfers
We are based in the EU and the US, and our service providers are located in many countries. When personal data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, we rely on:
● The European Commission's Standard Contractual Clauses (Decision 2021/914), with the UK International Data Transfer Addendum and the Swiss Addendum as relevant;
● The EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF, where the recipient is certified;
● Other Article 46 GDPR safeguards or, exceptionally, an Article 49 derogation.
You can request a copy of the safeguards by writing to legal@bumpy.app.
16. How long we keep personal data
These are our default retention periods. We may keep specific data for longer if a law requires it or if it is necessary to defend legal claims. After the period ends, we delete the data or irreversibly anonymise it.
17. Security
We use technical and organisational measures appropriate to the risk, including:
● Encryption in transit (TLS) and at rest (AES-256);
● Role-based access control and access logging;
● Vendor due diligence and Data Processing Agreements;
● A 72-hour personal data breach notification process to the lead supervisory authority for both Apps - the Office of the Commissioner for Personal Data Protection of Cyprus - as required by Article 33 GDPR.
No system can be 100% secure. If you suspect a security problem, please write to support@bumpy.app or support@wonder.dating.
18. Your rights - EEA, UK, Switzerland
You have the right to:
● Access your personal data and obtain a copy;
● Ask us to correct inaccurate data;
● Ask us to delete your data (“right to be forgotten”), subject to limited exceptions;
● Restrict or object to certain processing, including direct marketing - you can object to direct marketing at any time without giving a reason;
● Port your data to another controller in a structured, commonly used, machine-readable format;
● Withdraw consent at any time, where processing is based on consent;
● Complain to your supervisory authority. Our lead authority is the Cyprus Office of the Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy). UK Users may complain to the Information Commissioner's Office (ICO) (https://ico.org.uk). Swiss Users may contact the FDPIC.
To exercise your rights, write to legal@bumpy.app or use the in-App “Contact us” section in Settings. We will respond within one month (extendable by two further months for complex requests) and may need to verify your identity.
19. Your rights - California (CCPA / CPRA)
If you are a California resident, you have additional rights:
● Right to know what personal information and Sensitive Personal Information we have collected, used, disclosed and “sold/shared” in the past 12 months (or longer on request);
● Right to delete personal information;
● Right to correct inaccurate personal information;
● Right to opt out of “sale” and “sharing” (cross-context behavioural advertising);
● Right to limit the use and disclosure of Sensitive Personal Information to purposes permitted by the CPRA;
● Right to non-discrimination for exercising your rights.
You may submit requests via legal@bumpy.app or use the in-App “Contact us” section in Settings, and you may use an authorised agent (we may still ask you to verify your identity).
We collect the following CCPA categories of “personal information”: identifiers; customer records; characteristics of protected classifications (with consent); commercial information; internet/network activity; geolocation; audio/visual; professional/employment-related (only for Ambassadors); inferences; and Sensitive Personal Information. We retain each category in line with Section 16.
California transparency (high level):
● We do not sell personal information for money.
● Depending on your settings and how you use the Service, we may disclose certain categories of personal information to advertising and analytics partners to measure campaigns and (where enabled) provide targeted advertising. Under California law, some of this may be considered “sharing” for cross-context behavioural advertising.
● You can opt out at any time via legal@bumpy.app or use the in-App “Contact us” section in Settings.
20. Your rights - Other US states
If you live in Colorado, Connecticut, Virginia, Texas, Minnesota, Utah, Oregon, Delaware, Iowa, Indiana, Tennessee, Montana, New Hampshire, New Jersey, Rhode Island, Kentucky, Maryland, Nebraska or another US state with a comprehensive privacy law, you may have rights similar to those in Section 19: access, correct, delete, port, opt out of targeted advertising, opt out of profiling that produces significant effects, and opt out of the sale of personal data. We honour universal opt-out mechanisms (such as GPC) where required. To exercise these rights, write to legal@bumpy.app. If we deny a request, you may appeal by replying to our response email.
Global Privacy Control (GPC): Where required by law (including California), we honour GPC signals received from your browser by treating them as a request to opt out of certain types of data sharing or targeted advertising for the browser/device sending the signal. Depending on your device and settings, you may need to enable GPC in your browser or use a browser/extension that supports it.
21. Applicability of other privacy laws
Depending on where you live, additional privacy laws may apply to our processing of your personal data (for example, national privacy laws in Canada, Brazil, Australia and other countries).
Where those laws apply, we will comply with them in addition to the GDPR / UK GDPR and the US state privacy rights described above.
In general, these laws may give you rights to access, correct, delete or obtain a copy of your personal data, and to object to or withdraw consent for certain processing (subject to legal or contractual limitations).
To exercise any of these rights, contact us at legal@bumpy.app. If you believe we have not handled your request appropriately, you may also contact your local data protection authority.
22. Children
The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has used the Service, contact us at legal@bumpy.app and we will investigate and delete the account.
23. Contact us
Privacy & DPO contact: legal@bumpy.app
Bumpy Inc. - 1007 N Orange St. 4th Floor, Wilmington 19801 Delaware, United States (controller for Users of Bumpy or Wonder outside the EEA, UK and Switzerland)
MV Bumpy Group Limited - Strovolou 77, 4th floor, office 401, 2018 Nicosia, Cyprus (controller for EEA / UK / Swiss Users of Bumpy or Wonder)
General contact: support@bumpy.app (Bumpy) or support@wonder.dating (Wonder)
24. Changes to this policy
We will update this Policy from time to time. Where the law requires, we will notify you of material changes in advance (for example, by in-App banner or email) before they take effect. The current version and effective date are shown at the top of this page.
Version: 2.0
Effective date: 04 October 2026
Replaces: Bumpy Privacy Policy v1.0 and the Wonder Privacy Policy dated 29 June 2024
