Privacy policy

Controller

Sosta — Owner: Valerian Huber, Dahlienweg 11, 83109 Großkarolinenfeld. Contact: datenschutz@sosta.app.

Data protection officer

Reachable at dsb@alpin-code.de. Messages to this address go straight to her; we do not store them.

Data we process

• When you visit the directory pages, our server writes an access log (IP address, page requested, time, browser identifier). It is used solely to defend against attacks and spam (Art. 6(1)(f) GDPR) and is deleted after eight days at the latest. Within the application itself, we store your IP address only in hashed form (audit log).
• We do not use tracking, advertising or third-party analytics cookies (Google Analytics, Facebook Pixel or similar). Audience measurement is carried out with Umami (self-hosted in the EU, analytics.alpin-code.de): cookieless, aggregated and without any personal reference.
• Strictly necessary cookies that do not require consent (Section 25(2) TDDDG, German Telecommunications Digital Services Data Protection Act): sosta-age-self-declared — when you confirm in the 18+ gate that you are of age: so that the gate does not reappear on every page, storing only “confirmed”, not your year of birth. It applies to sosta.app and every establishment website under sosta.app — if you confirm in one of these places, we do not ask again in the others (lifetime: up to 400 days if you confirm on sosta.app (the browser maximum), 30 days if you confirm on an establishment’s website); sosta_locale — when you choose a language: so that the site stays in your language (lifetime: 1 year); sosta_token — when you sign in as an establishment: keeps you signed in (httpOnly, unreadable to scripts) (lifetime: 30 days or until you sign out); sosta-trusted-device — when you choose “remember this device” while signing in with a code: skips asking for the code on every sign-in on this device (httpOnly) (lifetime: 90 days); sosta-oauth-state, sosta-oauth-verifier, sosta-oauth-return, sosta-oauth-seat — when you choose “Sign in with Google”: protects the sign-in return path against forgery (lifetime: 10 minutes). As we use only such strictly necessary cookies and cookieless audience measurement, no cookie banner is required.
• Your browser’s local storage (not cookies, and not transmitted to us). Merely visiting the site stores nothing there; an entry is created only by something you do — the sole exception is the error marker, and only when an error occurs. In local storage: sosta-pwa-nudge — when you dismiss the “install as app” prompt: so that it pauses for 30 days and stops appearing after the second time (lifetime: until you clear your browser’s site data); sosta-pwa-installed — when you install Sosta as an app: so that the install prompt no longer appears (lifetime: until you clear your browser’s site data); sosta-merkliste — when you save a profile or establishment: your saved list, without any account (lifetime: until you clear your browser’s site data); sosta.gast.pk — when you first write to a talent: your random device identifier for the chat, see below (lifetime: until you clear your browser’s site data); sosta.talentChat.gelesen — when you open a chat with a talent: so that it stays visible which messages you have already read (lifetime: up to 90 days per chat); sosta-gast-name — when you give yourself a name in the chat with a talent: the name she sees you by — voluntary, no real name needed; it is sent with your messages and deleted together with the chat (lifetime: until you clear it or your browser’s site data); sosta_inquiries — when you send an inquiry to an establishment: so that you can find your inquiries again without an account (lifetime: until you clear your browser’s site data); sosta.hausVorschlag — when you follow an establishment’s link (e.g. from a notice): so that this establishment is suggested when you sign up (lifetime: 14 days); sosta-start-anker — when you search for a place on the map, request your location, or use the map, the list or the filters on a city page: so that the map starts there next time, with a location rounded to about 1 km (lifetime: until you choose “forget” on the map, at most 180 days); sosta-verzeichnis-country-tab — when you choose a country in the directory: the chosen country (lifetime: until you clear your browser’s site data); sosta-last-signin-email — when you sign in with your e-mail address: so that it is pre-filled the next time you sign in (lifetime: until you clear your browser’s site data); sosta:venue-setup:* — when you start setting up your establishment’s website: your draft, so that nothing is lost (lifetime: until you clear your browser’s site data); sosta-2fa-banner-dismissed-until — when you dismiss the two-factor sign-in notice: so that it pauses for 30 days (lifetime: 30 days). In session storage (this tab only): sosta-last-map-url — when you use the map: so that “Map” takes you back to your last view (lifetime: until you close the tab); sosta-talent-blaettern — when you open a profile from a list: so that you can page to the next profile in the list (lifetime: until you close the tab); sosta-registrierung — when you register a venue and request a code: so that your address and details survive a reload until the account is created (lifetime: until you close the tab); sosta-scroll-anfrage — when you choose “Inquiry” from a profile: so that the page jumps to the inquiry form after closing (lifetime: until the form is reached); sosta-user-geo-cache-v1 — only if you have granted your browser permission to share your location: to calculate distances directly in your browser (lifetime: 5 minutes, at most until you close the tab); sosta-cer — only if an error occurs on the page: so that the same error is not reported repeatedly (lifetime: until you close the tab). In your browser’s database (IndexedDB): sosta-gast — when you first write to a talent: the key pair for your device identifier — the private key cannot leave your device and proves with every chat message that it comes from this device (lifetime: until you clear your browser’s site data). As a service worker (a background script your browser keeps for sosta.app): /sw.js — only if you have installed Sosta as an app and open it: a service worker with a cache that holds only the offline page — it appears when you have no signal instead of a browser error (lifetime: until you uninstall the app or clear your browser’s site data); /manager/sw.js — after you sign in as an establishment: a service worker without a cache — it makes the Manager installable as an app and passes every request through unchanged (lifetime: until you uninstall the app or clear your browser’s site data). You can remove all of this at any time via your browser’s site data. If the map or the talent list uses your location (“near you”), your location is sent to us with the search request, rounded to about 1 km. We do not store it; like any request, it appears at most in the access log (see above).
• When the operator of an establishment takes over its directory listing via the claim form, we store name and e-mail address to verify the entitlement. If the claim is rejected or never confirmed, we delete it 30 days later; an accepted claim becomes the establishment's account, which is subject to the account's deletion rules.
• If you contact an establishment via the inquiry form: your name/pseudonym (optional), e-mail or phone number (optional) and your message are stored. Replies reach you through an anonymous chat within the app — no e-mail is sent to you. Chat content is stored encrypted (AES-256-GCM) and can be viewed by the establishment you contacted; Sosta itself accesses the plain-text content only in audited exceptional cases (abuse or legal review, “break-glass” access with mandatory logging). Your inquiry is deleted automatically 12 months after the last message or 90 days after the chat was closed — you can also delete it yourself at any time (bin icon in the chat history). All information in this form is voluntary. We notify the establishment of a new inquiry by e-mail. This e-mail contains neither your name nor your contact details nor your message, only a note to view the inquiry in the Sosta Manager. Your name and contact details are visible only to the establishment you contacted, so that it can reach you.
• If you write to a talent via the chat on her profile: you do not need an account for this. Your browser generates a random device identifier once and stores it locally on your device; we know only its public part and cannot use it to identify you. Your messages are stored encrypted (AES-256-GCM) and deleted automatically 24 hours after the last message in the conversation; every new message — yours or hers — extends the period for the whole conversation. After that, an empty entry without any wording remains for up to 90 days after the last message: the name you voluntarily give yourself (if you leave it empty, you are “Guest”), the days of the conversation and the number of messages — so that the talent recognises you if you write again. You can remove this entry at any time; once both sides have removed it, we delete it immediately. With “Delete conversation now” you delete the conversation for both of you immediately; anything of yours the talent has not read yet remains until she has read it, and for one more hour after that so that she can report it — at most until the period expires. We do not analyse messages automatically and we do not read along; to protect against spam, we merely count how often a device identifier or a hashed IP address sends messages (counters only, kept for no more than 24 hours). If either party reports a message while it still exists, it is retained for review for up to 90 days and can be viewed by our moderation team during that time — it is then no longer visible to the other party. If a talent blocks you, your device identifier remains blocked for her, even after the messages have been deleted. The legal basis is your consent given by sending the message (Art. 6(1)(a), Art. 9(2)(a) GDPR). You can delete the device identifier yourself at any time by removing the site data for sosta.app in your browser.
• When you register and use an account (establishment or talent): your e-mail address for signing in and out and for system notifications; for the voluntary phone verification of talents, additionally the mobile number, to send a one-time confirmation code (SMS). If you register as a talent and do not confirm your e-mail address within 14 days, we delete the account together with everything created up to then; we do not send a reminder beforehand.
• If you write to us via the contact form: name (optional), e-mail address and message reach us as an e-mail so that we can reply (Art. 6(1)(f) GDPR). We store none of it in the application itself.

Hosting

The application, database and image storage (MinIO) run in an EU data centre (Hostinger VPS, Frankfurt am Main, Germany); encrypted backups are kept with Contabo (Germany). This core infrastructure processes data exclusively within the EU/EEA.

Backups are overwritten after less than 30 days, so by then at the latest a deletion has disappeared from them too. To stop a restore from a backup bringing deleted accounts back, we keep a deletion register: one file per day with salted hashes (HMAC) of the identifiers of deleted accounts and establishments, without names, e-mail addresses or any other plain text. It is also stored with Contabo, each file is deleted after 40 days, and after a restore we delete the accounts and establishments listed in it again (Art. 6(1)(c) in conjunction with Art. 17 and Art. 5(2) GDPR).

Service providers we use (processors)

To provide the service, we use the following processors (Art. 28 GDPR). A data processing agreement is in place with each of them. Where a service provider processes data outside the EU/EEA, this is done on the basis of EU standard contractual clauses or an adequacy decision (EU-U.S. Data Privacy Framework).

• Hostinger (Frankfurt am Main, Germany) — hosting of the application, database and image storage.
• Contabo (Germany) — encrypted off-site backups.
• Resend — sending of transactional e-mails (e.g. sign-in links, account and system notifications, form forwarding).
• seven.io (Germany) — SMS delivery for the voluntary phone verification (one-time confirmation code).
• Telegram (Telegram Messenger Inc., based in Dubai/UAE) — only for the voluntary Telegram verification: you start a chat with our bot yourself and thereby confirm that the Telegram username you provided belongs to you. Telegram processes the chat messages under its own responsibility, like any message sent to a bot, and can see in the process that your Telegram account is connected with Sosta. We do not pass your phone number or any other profile data to Telegram; we store only your confirmed Telegram username and the time of confirmation.
• CARTO (USA/Spain) — basemap tiles for the interactive directory and talent map; your IP address is transmitted to the map service in the process.
• Mapbox (USA) — static map preview images (e.g. city header, tour planning); your IP address is transmitted to the map service in the process.
• Nominatim (OpenStreetMap Foundation, United Kingdom) — converting public business addresses into coordinates when we maintain the directory; nothing of yours is transmitted.

Your data is not passed on to third parties for advertising or profiling purposes. You can find the complete, continuously updated list of all sub-processors, with their purpose, location and data protection safeguard, under Sub-processors.

Our Telegram channel and bot

We run the public channel “sosta für Talents” on Telegram. The platform is provided by Telegram Messenger Inc., which is itself responsible for the processing on Telegram (Telegram’s privacy policy: telegram.org/privacy).

As the channel operator, we only see aggregated figures, such as how many people have subscribed to the channel and how often a post has been viewed, but not who is reading. Comments are turned off.

Insofar as we are joint controllers with Telegram for these statistics (CJEU, judgment of 5 June 2018, C-210/16), you can also exercise your rights directly against Telegram. Requests to us go to datenschutz@sosta.app or to our data protection officer (dsb@alpin-code.de).

If you write to our Telegram bot, we process your Telegram ID, your display name and your message, solely in order to reply. We do not store the message, and our logs contain no message text. If you confirm your Telegram username for your profile via the bot, we store only that username and the time of confirmation; you can undo this with /stop.

The legal basis is our legitimate interest in providing information about Sosta (Art. 6(1)(f) GDPR); for confirming the Telegram username, it is the performance of our user agreement (Art. 6(1)(b) GDPR).

Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and the right to lodge a complaint with a supervisory authority (Art. 77).

Please send requests to datenschutz@sosta.app.

Data processing (establishments)

For establishments, the separately concluded data processing agreement (DPA) under Art. 28 GDPR also applies. The DPA governs the processing of talent and setcard data as special categories of personal data (Art. 9 GDPR).