Sosta · Transparency
How we handle data
What we store, for how long, who can see it and how we check it. Every retention period on this page comes from the same place in the code that runs the deletion jobs. When the code changes, this page changes with it.
This is a translation. The German version is authoritative. Read the German version
Version of this page: Version c28d8d253 · built on 31/10/2026
Controller
Valerian Huber (sole proprietorship). We decide on purposes and means and carry the responsibility.
in placeData protection officer
External; reviews our work independently and after the fact. Reachable at a separate, confidential address.
Appointment in progress — the contact will appear here once it is complete.
in progressImpact assessment (Art. 35 GDPR)
One is in place for the platform.
Before we approach talents ourselves, a separate one is written for that — it is in progress, and nobody is contacted before it is done.
in progressHosting
Data centre in Frankfurt am Main (Germany) (operator: Hostinger Operations UAB, Litauen (EU)). Images are kept separately in our own storage, never in the database. Encrypted off-site backups: Contabo GmbH, Deutschland (EU). So that a restore cannot bring deleted accounts back, we keep an off-site deletion register with salted hashes of their identifiers, without names or e-mail addresses.
checked dailyChats
Stored encrypted (AES-256-GCM). Nobody reads along. They are not end-to-end encrypted — if you report a message, we need to be able to read it in order to help.
implementedGuests
No account, no name, no number. No advertising or tracking cookies; we measure reach anonymously and without cookies.
implementedHow long we keep what
After that, a daily job deletes it — nobody has to remember.
| What | How long | Then |
|---|---|---|
| Chat between guest and talent | 24 hours | wording deleted, counted from the last message in the conversation |
| … what remains afterwards: the guest’s self-chosen name, days, number of messages — no wording | 90 days | deleted; immediately once both sides remove the entry |
| … if the talent reports a message | 90 days | frozen for review, then deleted |
| … if an authority orders it to be preserved | until the request ends | preservation ends with the request, then deleted as usual |
| Enquiries to an establishment (inbox) | 90 days after closing, 365 days without activity | deleted |
| Chat between establishment and talent | 730 days | deleted, per message |
| One-time codes (SMS, Telegram) | 30 days | deleted |
| Invitations to take over a profile | 90 days | deleted |
| Talent account whose email address was never confirmed | 14 days | deleted completely, with no further email |
| Deleting your own account | immediately | profile, images and numbers gone; the change log stays without personal reference |
| Change and security log | changes 365 days, sign-ins 90 days, payment records 10 years (by law) | deleted |
| Backups | 30 days | overwritten — so a deletion has left every backup by then at the latest |
When the police ask
What we do
- We hand over data only under a court or statutory order (sections 100j ff. of the German Code of Criminal Procedure).
- The only exception: an acute danger to life or limb. Then we hand over what is needed to avert it — only after calling the police station back on its official number.
- With an order, we can preserve chats before they expire (24 hours after the last message). Nothing is handed over by doing so.
- Every step is logged. The people concerned are told as soon as the investigation allows.
What we cannot do
- Identify a guest: guests have no account, no name and no number with us.
- Bring back expired messages: 24 hours after the last message they are gone unless they were reported or preserved.
- End-to-end encryption: in a reported case we can read — otherwise we could not help.
Your rights — and where to use them
Talent
- Access: in the Talents app settings — a complete export of your data.
- Deletion: in the same place, effective immediately.
- Withdraw consent: at any time; your profile disappears from public view.
Establishment
- Access and deletion: in the Manager settings, with an export beforehand.
- Data processing agreement: available in the Manager, with its version.
Guest
- Without an account we store nothing that identifies you. The device ID for the chat lives in your browser — clear the site data and it is gone.
- Questions and access requests: datenschutz@sosta.app
How we check this
- Before every change, automated checks run, including tests for deletion, encryption and the separation of establishments from one another.
- Daily: did the off-site backup arrive? Does the data keep what the app promises?
- This page itself: every retention period comes from the code. If a piece of evidence it names is missing, the build stops.