Privacy Policy — CHEOLO

CHEOLO is an adults-only travel, dating and travel-companion matching platform. A personal profile can contain details about your identity, preferences, destinations and the people you contact. We are committed to explaining what information the service uses and giving members meaningful control over what other people can see.

This notice applies to CHEOLO's website, accounts, profile and discovery features, messaging, trips, Rendezvous experiences, Premium membership functions when they become available, and support channels. It does not replace the privacy notices of independent websites you choose to visit.

The business operating CHEOLO is the data controller for information described in this notice. The controller's verified legal name and address must be published in the Imprint before CHEOLO accepts real members. Requests about privacy and data protection can be sent to support@cheolo.com. An email address alone does not substitute for the controller identity required by GDPR Article 13.

Account and eligibility information. When registering, members provide an email address, name, password, and date of birth. Passwords are processed as protected password hashes, not stored in readable form. Date of birth is used for age eligibility and related account controls. CHEOLO is for people aged 18 or older. Confirmation codes, consent versions, session records and anti-abuse counters help protect account access.

Profile, preferences and discovery information. Depending on what a member adds, records can include city or country, profile introduction, photographs, languages, gender identity, who they wish to meet, dating intentions, interests, travel style, travel destinations, upcoming travel dates and visibility preferences. Some details—especially dating preferences—may reveal sensitive aspects of a person's private life. We use these settings to provide the functionality members request; we do not claim that every possible special-category processing purpose is covered merely by accepting the Terms. Where GDPR requires explicit consent or another specific Article 9 condition, that condition must be established before the processing begins.

Member activity. We process likes, matches, message requests, chat messages, profile views where this feature is enabled, trip publications, join requests, Rendezvous invitations, blocks, reports and related status records so requested services work. Message contents are not public. We do not sell members' private conversations to advertisers.

Moderation and support information. If a member reports harassment, an impersonation attempt, fraud or other misconduct, we handle the report, the submitted evidence, investigation notes, actions taken and any appeal. Access should be restricted to staff who need it for that case.

Payment and subscription information. CHEOLO's live payments are not active while merchant approval and sandbox validation remain outstanding. If payments are activated, we expect an approved processor to handle payment-card collection. CHEOLO would keep transaction references, subscription plan, amount, currency, renewal dates, receipts, cancellation and refund status, but not card security codes or complete card numbers. The actual payment processor, recipient and transfer arrangements must be disclosed before checkout is enabled.

Technical and operational information. Necessary service requests may involve IP addresses, device/browser details, timestamps, session identifiers, error events, security logs, service performance counters and backup records. These support network delivery, abuse prevention, debugging and security. CHEOLO should not claim to use no device information when an HTTP server necessarily receives connection details.

For account registration, login, requested matching, profiles, communications, trips and other features that members choose to use, the usual lawful ground is performing the contract (GDPR Article 6(1)(b)), where the processing is genuinely necessary for that service. For fraud prevention, service protection, limited operational analytics and enforcing community safety standards, the ground may be legitimate interests (Article 6(1)(f)), assessed against individuals' rights and expectations. For mandatory records, lawful disclosure and consumer accounting, we may rely on legal obligations (Article 6(1)(c)). We rely on consent (Article 6(1)(a)) only where consent is appropriate and freely given—for instance, optional public member previews or nonessential cookies if introduced.

Any biometric face processing or processing of information that reveals sexual orientation requires a separate analysis under Article 9 GDPR. No broad acceptance of this policy constitutes consent to facial recognition. In the reviewed prelaunch build, FaceTrust is disabled for real members and automatic biometric approvals are disabled. It must not be enabled by a generic admin toggle. Before any real biometric processing begins, CHEOLO must publish a feature-specific notice explaining the data, models, recipients, retention, lawful grounds, alternatives, risks, withdrawal mechanism and the approved DPIA.

Other members may see the portions of your profile you have made available through the relevant product settings, including approved pictures, first name, age, location at the resolution you select, shared interests and your published trips. Your password, private email address, complete date of birth, private chat history and payment credentials are not shown on public profile pages. Some gender or matching preferences may be used to filter results without being openly displayed. This visibility behavior must be verified against the deployed interface before publication.

A member may choose to make a profile preview publicly visible on CHEOLO's homepage only through a dedicated permission. Removing that permission should remove the preview promptly across all servers. Search engines and third-party screenshots can retain content already exposed publicly; removal from CHEOLO cannot retract copies previously made elsewhere.

CHEOLO uses chosen destinations, compatible travel dates, age ranges, gender and meeting preferences, shared interests, profile visibility and safety restrictions to find and organize candidate profiles. These recommendations are suggestions, not promises of a match or a human relationship. An explanation such as a shared interest should be supported by the member data involved. CHEOLO must assess whether any specific automated decision-making activity creates legal or similarly significant effects; such a feature should not be enabled without appropriate additional disclosure and rights safeguards.

Hosting, email delivery, payment processing, storage, monitoring and other operations may require carefully selected service providers. The final privacy notice must identify the deployed hosting arrangement, email processor and activated payment provider as applicable; the exact recipient categories, locations and applicable international transfer safeguards must reflect the actual production configuration. No provider is deemed active merely because its integration exists in source code. Service-provider contracts and appropriate GDPR Article 28 arrangements should be completed before live use.

Information is retained for the period required by its purpose, and then deleted, anonymized or restricted unless a lawful obligation requires longer retention. Profile data is generally retained for the life of the account; an account-deletion request initiates removal of member-facing profile data, photos and related records, subject to legal retention needs, safety investigations, chargeback disputes and short-lived recoverable backups. Members may request information about a particular record's retention period by contacting support.

The reviewed previous legal configuration refers to 180 days for profile-visit history, 180 days for outbound notification records, 90 days for email delivery events, 400 days for product-event analytics, and 30 days for certain error logs. These periods are deployment-specific and must be checked against current code, production services, backups and the retention inventory before this version goes live. Do not publish a contradictory policy.

CHEOLO uses strictly necessary session or security mechanisms needed to remember authentication and protect accounts. If the website adds optional analytics, advertising cookies or third-party tracking, it will request any legally required consent before activating them, and describe each service and retention period in the Cookie Notice. The final cookie inventory must be confirmed using a real production-browser scan.

Subject to legal conditions, you can ask for access, correction, deletion, restriction, portability or an objection to processing, and withdraw consent without affecting lawful processing that happened earlier. You can request an export or account deletion through the appropriate account controls, where available, or write to support@cheolo.com. If a data subject request involves another person, CHEOLO may need to verify identity before disclosing or changing data. You also have a right to complain to the competent data protection supervisory authority; the controller's registered location determines the relevant German authority.

CHEOLO uses authentication restrictions, controlled database access, rate limiting, moderated content workflows and other technical measures intended to reduce unauthorized access. No online service can promise absolute security. Report suspected account compromises or personal-data incidents to support@cheolo.com. Legal notifications about qualifying breaches are handled under applicable GDPR requirements.

CHEOLO is for adults aged 18 and over. Anyone who is under 18 must not register, and accounts identified as belonging to minors may be restricted or removed. Age-related checks must be used proportionately and may not constitute an identity guarantee.

Substantial changes will be communicated as appropriate before they take effect; archived policy versions should be maintained for accountability. A policy revision does not retroactively validate processing that required an earlier consent. Questions: support@cheolo.com.