Privacy Policy

Draft — must be checked against what the product actually does.

A privacy policy is a description of real processing, so it cannot be finished from the outside. Confirm every processor, retention period and app permission listed here against your actual stack, fill in the highlighted fields, and have it reviewed before publishing.

1. Who is responsible

The controller for the personal data described here is [legal company name], [address], Germany — [email address]. Company details are in our Impressum.

Data protection contact: [email address, or the name and contact details of your Datenschutzbeauftragte(r) if you have appointed one].

2. What we collect

Data you give us

Account: name, email address, password (stored hashed), and optionally a photo, city and short bio.
Host profile: what you teach, your listings, and the videos and photos you upload.
Bookings: which workshops you booked, when, for how many people, and any note you send the host.
Payments: handled by our payment provider. We receive confirmation, amount and a masked reference — not your full card number.
Messages and support: what you write to us or to a host through the app.

Data collected automatically

Usage: pages and listings viewed, searches, taps, and when.
Device and connection: device type, operating system, app version, browser, language, and IP address.
Approximate location: to show workshops near you. Precise location only if you grant the permission — see section 9.

3. Why, and on what legal basis

Running your account and your bookings: Necessary to perform our contract with you — Art. 6(1)(b) GDPR.
Taking payments and paying out hosts: Contract performance, Art. 6(1)(b), and our legal accounting duties, Art. 6(1)(c).
Showing you workshops near you: Contract performance, Art. 6(1)(b), or your consent where precise location is used, Art. 6(1)(a).
Keeping the platform safe — fraud, fake listings, abuse: Our legitimate interest in a platform people can trust, Art. 6(1)(f).
Improving the product through usage statistics: Your consent where this uses cookies or similar technologies, Art. 6(1)(a); otherwise our legitimate interest, Art. 6(1)(f).
Marketing emails: Your consent, Art. 6(1)(a). Every email has an unsubscribe link.
Meeting legal obligations: Art. 6(1)(c) — tax and commercial record-keeping in particular.

4. Cookies and device storage

Cookies and comparable storage on your device are only used beyond what is strictly necessary with your consent, under § 25(1) TDDDG. Strictly necessary storage — keeping you logged in, remembering your consent choice, security — needs no consent under § 25(2) TDDDG.

You can change or withdraw your choice at any time via [link to your cookie settings]. Withdrawing does not affect processing that already happened.

Current non-essential tools: [list each analytics or marketing tool, its provider, and what it stores — or state that none are used].

We do not sell personal data. We share it only where it is needed to run the service:

Hosts — the details of your booking. See section 6.
Payment provider — [provider name], to take payments and pay out hosts.
Hosting and infrastructure — [provider name and region].
Email and notifications — [provider name].
Analytics — [provider name, or "none"].
Authorities — where we are legally required to, or to establish or defend legal claims.

Providers acting on our instructions are bound by a data processing agreement under Art. 28 GDPR.

6. Between hosts and participants

When you book, the host receives what they need to run the session: your name, the number of people, and any note you sent. Contact details are shared only where the workshop requires it, and the host may not use any of it for anything other than that workshop.

When you host, participants see your public profile — your name, photo, bio and listings. Your address is shown only for workshops you choose to run at a location you have published.

7. Transfers outside the EEA

We try to keep data in the EU. Where a provider processes data outside the EEA, we rely on an adequacy decision, or on the European Commission's Standard Contractual Clauses together with additional safeguards.

Providers that currently involve a transfer: [list, or state that there are none].

8. How long we keep it

Account data: while your account is open, then deleted within [30] days of closure.
Booking and payment records: up to 10 years, as German tax and commercial law requires.
Content you posted: until you delete it, or your account closes.
Usage and analytics data: [period].
Support messages: [period].

9. App permissions

The app asks for these only when the feature needs them, and you can revoke any of them in your device settings:

Location — to sort workshops by distance.
Camera and photo library — to record or upload a workshop video, or set a profile photo.
Notifications — booking confirmations and reminders.

10. Your rights

Under the GDPR you can ask us to:

tell you what data we hold about you, and give you a copy (Art. 15);
correct anything wrong (Art. 16);
delete your data (Art. 17);
restrict how we use it (Art. 18);
hand it over in a portable format (Art. 20);
stop processing based on legitimate interest — including profiling (Art. 21).

Where processing rests on consent, you can withdraw it at any time, with effect from that point onwards.

Write to [email address] and we will respond within one month. You can also complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, though you may complain to the authority where you live or work instead.

11. Children

Twiggli is not intended for children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We update this policy when the product or the law changes. The date at the top shows the current version. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.