Privacy policy

This English version is provided for convenience. The German version is legally binding.

1. Controller

TZN Media Services Ltd.
Main Street, P.O. Box 596
Charlestown, Nevis - Federation of Saint Kitts and Nevis

2. Particularly sensitive data

Gearbook is aimed at adults arranging meetings in a kink context. Merely using it can allow conclusions about sex life or sexual orientation. Such data is specially protected under Art. 9 GDPR. We only process it on the basis of your explicit consent (Art. 9 (2) (a) GDPR), which you give separately at registration and can withdraw at any time by deleting your account. Guests consent separately with each booking and can withdraw and delete their data at any time via their appointment link. Consent is voluntary, but the service cannot be used without it, as it exists only for this purpose.

Principles

We only process data needed for the service. There is no tracking, no advertising and no external fonts or scripts. We set a single technically necessary sign-in cookie (§ 25 (2) TDDDG), so no cookie banner is required.

3. Visiting the website

When you visit, our infrastructure processes technically necessary connection data such as your IP address in order to deliver the site and fend off attacks (Art. 6 (1) (f) GDPR). The site runs through the network of Cloudflare, Inc. as a processor; for transfers to the USA, Cloudflare relies on the EU-US Data Privacy Framework and standard contractual clauses. Abuse-prevention counters are deleted after 24 hours at the latest.

4. Customer account

For your account we process your email address, name, password (only as an Argon2id hash), settings and the times of your consents (Art. 6 (1) (b) GDPR). Two-factor sign-in is optional.

5. Payment

Payments are handled by Stripe Payments Europe, Ltd. (Ireland). Stripe receives your email address and billing and payment details directly from you. We do not see complete payment details. The legal basis is Art. 6 (1) (b) and (c) GDPR. Billing data is kept for the statutory periods.

6. Connected calendars

When you connect a calendar, Gearbook reads events on your instruction (Art. 6 (1) (b) GDPR). Only the time ranges of blocking events are stored permanently, never titles or contents. Access credentials are encrypted with AES-256-GCM.

7. Guest data

For bookings we process name or nickname, optionally email address, agreements, location and appointment on behalf of the inviting person (Art. 28 GDPR). That person is the controller and is named on the booking page. The legal basis is the guest's explicit consent (Art. 9 (2) (a) GDPR). Please do not enter health data. Data is deleted automatically after the chosen period (default 30 days after the appointment) or immediately via the appointment link.

8. Email

We send transactional emails via our mail server. Subject lines contain no details of your agreements. Contents are not stored after sending.

9. Retention

After your subscription ends, your account remains available for export for 30 days and is then deleted. We delete unconfirmed registrations after 7 days and logs after 12 months. Backups are overwritten on a rolling basis.

10. Your rights

You have the right of access, rectification, erasure, restriction, data portability, objection (Art. 15 to 21 GDPR) and withdrawal of consent (Art. 7 (3) GDPR). You can trigger export and deletion yourself at any time in your account. You may also lodge a complaint with a data protection supervisory authority.