Privacy Policy

The controller responsible for your personal data is Bastien Schwitz, a sole trader (natural person, no registered company) with a registered address at Chemin de Rionza 3, 1020 Renens, Vaud, Switzerland. For any privacy question, or to exercise your rights, contact us at privacy@qolloc.com.

Depending on how you use qolloc, we process:

• Account data: your email address and display name.
• Date of birth: collected to confirm you are at least 18. We may store the derived “18+” status rather than the full date once verified.
• Profile data: your photo(s), a short bio, your preferences, and the area or district you are looking in.
• Verification data: if you choose to verify a student email address, the address and its verification status. We treat this data with particular care.
• Match and request activity: the requests you send and receive and their status (accepted, declined, pending).
• Chat content: the messages you exchange with other users in the app.
• Technical and usage data: device and browser information, approximate location derived from your IP address, and product-analytics events (pages viewed, features used).
• Communications: messages you send us for support or reporting.

• To provide qolloc — create your profile, run discovery, handle match requests and chat. Legal basis: performance of our contract with you (art. 6(1)(b) GDPR; art. 31 FADP).
• To confirm you are 18 or older. Legal basis: our legitimate interest and compliance with legal obligations (art. 6(1)(c) and (f) GDPR).
• To keep the community safe — moderation, preventing fraud, abuse, and fake accounts. Legal basis: our legitimate interest in a safe, trustworthy service (art. 6(1)(f) GDPR).
• To offer optional student-email verification. Legal basis: your consent, which you can withdraw at any time (art. 6(1)(a) GDPR).
• To understand and improve the product through privacy-friendly analytics. Legal basis: your consent, which we ask for in a banner and which you can withdraw at any time (art. 6(1)(a) GDPR).
• To keep qolloc reliable and secure by monitoring errors and performance. The diagnostic data we collect for this is scrubbed of personal information. Legal basis: our legitimate interest in a stable, secure service (art. 6(1)(f) GDPR).
• To send you service and transactional emails (for example sign-in links and request notifications). Legal basis: performance of our contract (art. 6(1)(b) GDPR).
• To comply with our legal obligations and defend our rights. Legal basis: legal obligation and legitimate interest (art. 6(1)(c) and (f) GDPR).

Student-email verification is optional. Where you provide it, we collect the minimum needed to confirm the address, restrict who can access it, and use it only to display a trust signal to other users — never to advertise to you or to share with third parties for their own purposes.

Other users see the profile you choose to publish (your photo, bio, and preferences) and, once you connect, the messages you send them. That is how the service works.

We never sell your personal data and do not share it for third-party advertising. We rely on a small number of service providers (“processors”) who process data on our behalf, under contract and only on our instructions:

• Supabase — database, authentication, and file storage, hosted in the EU.
• Vercel — application hosting and content delivery.
• PostHog — privacy-friendly product analytics, on EU infrastructure. Loaded only if you accept analytics in our consent banner; configured to be cookieless and not to store your IP address.
• Sentry — error and performance monitoring so we can keep the service reliable and secure. Diagnostic reports are scrubbed of personal data before they are sent; we rely on our legitimate interest for this, not your consent.
• Resend — delivery of transactional emails (sign-in links, notifications).

We host your data in the EU wherever possible. Some providers may process limited data outside Switzerland or the EEA. Where that happens, we rely on appropriate safeguards recognised under the GDPR and the FADP, such as EU Standard Contractual Clauses and the Swiss addendum, or a recognised adequacy decision.

We keep your data for as long as your account is active. When you delete your account, we delete or irreversibly anonymise your personal data within a reasonable period, except where we must retain limited information to meet a legal obligation, resolve disputes, or prevent abuse. Analytics data is kept in aggregated or pseudonymised form. Verification data is kept only as long as your verified status is displayed.

Depending on where you are, under the GDPR and/or the FADP you have the right to:

• access the personal data we hold about you and obtain information about how we process it;
• have inaccurate data corrected and incomplete data completed;
• have your data deleted (“right to be forgotten”);
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive your data in a portable, machine-readable format and have it transferred where technically feasible;
• withdraw any consent you have given, at any time, without affecting past processing.

You can exercise these rights via your account settings or by contacting us at privacy@qolloc.com. We do not charge for this and will respond within the legal time limits.

If you are in Switzerland, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU/EEA, you can complain to your national data protection authority.

You can delete your account and personal data yourself at any time from your account settings, or by contacting us at privacy@qolloc.com. Self-service deletion takes effect immediately and cannot be undone.

We use a small number of strictly necessary cookies and browser storage to keep you signed in and to remember your language preference (the NEXT_LOCALE cookie). We also offer privacy-friendly analytics that run only after you accept them in our consent banner; these are cookieless and store your choice locally in your browser. We do not use advertising or cross-site tracking cookies. Separately, we monitor errors and performance to keep the service reliable and secure; that diagnostic data is scrubbed of personal information and relies on our legitimate interest.

qolloc is for adults only. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we will close it and delete the associated data.

We take appropriate technical and organisational measures to protect your data — including EU hosting, encrypted connections, access controls, and passwordless sign-in. No online service can be guaranteed completely secure, but we work to keep your data safe and to limit access to it.

We may update this Privacy Policy as qolloc evolves. We will change the “last updated” date above and, for material changes, take reasonable steps to inform you.

For any question about this policy or your data, contact us at privacy@qolloc.com.