Privacy Policy
This is a translation for convenience. The legally binding version is the German original.
1. Controller
The controller for data processing on this website is:
Elisa Held
Candoo
Kurfürstenstraße 90
56068 Koblenz
Germany
Email: hello@candoo.space
2. General information on data processing
We only process personal data of our users to the extent necessary to provide a functional website and our content and services. The legal bases are in particular Art. 6 (1) lit. a, b and f GDPR.
3. Hosting and infrastructure
This website is hosted on the Lovable Cloud platform; the underlying database and auth infrastructure is operated by Supabase (Supabase Inc., USA). When the page is accessed, technically necessary connection data (e.g. IP address, date/time, requested resource, user agent) are processed to ensure delivery of the site and the security of the service. The legal basis is Art. 6 (1) lit. f GDPR. For transfers to third countries we rely on the EU Commission's standard contractual clauses.
4. Cookies and local storage
Candoo only uses technically necessary cookies and local storage entries, for example to store language preferences, your session or the state of an active conversation. No tracking or advertising cookies are set.
5. Registration and sign-in
To use Candoo you create an account. We process your email address and a password (stored encrypted) — or, if you choose "Sign in with Google", the basic data provided by Google (email, name, optionally profile picture). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing may also take place in the USA. The legal basis is Art. 6 (1) lit. b GDPR (performance of contract). For third-country transfers we rely on the EU Commission's standard contractual clauses.
6. Contacting us
If you contact us by email, your details will be stored to process your request and for possible follow-up questions. The legal basis is Art. 6 (1) lit. b or lit. f GDPR.
7. Matching help requests
To connect users with each other we process information you enter in the app yourself (e.g. requests, skills, messages, topics). This data is only made accessible to people relevant to a match. The legal basis is Art. 6 (1) lit. b GDPR.
8. Profile verification (selfie)
If you choose to verify your profile, you upload a selfie showing a displayed gesture. We use the image solely to check whether a real person is behind the profile. After review the selfie is automatically deleted; only the status ("verified / rejected") is stored. The legal basis is your consent under Art. 6 (1) lit. a GDPR. You may withdraw your consent at any time — verification is voluntary and Candoo can also be used without it.
9. Reviews
After a session with a verified professional you can submit a review. We process your review (stars, free text, optional recommendation) and link it to your account and the booking to prevent duplicate reviews. Reviews are shown to other users together with your display name. The legal basis is Art. 6 (1) lit. b GDPR.
10. Payment processing (Professional subscription)
For the paid Professional subscription we use the payment provider Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin, Ireland; where necessary also Stripe, Inc., USA). During checkout your payment data (e.g. name, email, card data or chosen payment method, billing data) are transmitted directly to Stripe and processed there — we do not store full card data ourselves. Candoo receives from Stripe only the information required to manage the subscription (customer ID, subscription status, period end). The legal basis is Art. 6 (1) lit. b GDPR. For third-country transfers we rely on the EU Commission's standard contractual clauses.
11. Video calls (Daily.co)
For video conversations we use the service Daily.co (Daily, operated by Pluot, Inc., USA). As soon as you take part in a video call, connection and media data are transmitted via the provider's servers to conduct the call. The legal basis is Art. 6 (1) lit. b GDPR. For transfers to third countries we rely on the EU Commission's standard contractual clauses.
12. Storage period
Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations require otherwise. Invoice and payment data from the Professional subscription are retained in accordance with commercial and tax law retention periods (usually 10 years).
13. Your rights
You have the right at any time to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21 GDPR). You may withdraw any consent granted at any time with effect for the future. To exercise your rights an informal message to hello@candoo.space is sufficient.
14. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority — for example the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate.