Privacy Policy

2.1 Server log files (Vercel)

When you visit our website, your browser automatically sends data to our hosting provider Vercel Inc. This includes: IP address (anonymized), date and time of access, URL requested, HTTP status code, amount of data transferred, browser type and version, and operating system.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and trouble-free operation of the website). The logs are automatically deleted after 30 days at the latest.

2.2 Waitlist and referrals

When you join our waitlist, we process your email address, optionally your first name, the language you signed up in, and the time you signed up (for older entries, also the university we asked for at the time). If you come via a campaign or referral link, we also store the campaign parameters of the link (UTM parameters, e.g. source and campaign) and the referral code of the person who invited you. The data is stored in our database (Supabase, EU region Frankfurt).

Your sign-up only counts once you confirm it via the link in our confirmation email (double opt-in; the link is valid for 72 hours). As proof, we then store the time of your confirmation, the version of the consent text and a hash value of your IP address generated with a secret key, not the IP address itself. We also record which emails we sent you and when.

We show you your personal referral link right after you submit your sign-up; after you confirm, we also send it to you by email. We count how many people join the waitlist via your link; if you invite many friends, you can get access to the app earlier. Section 2.6 describes which emails you receive from us.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw it at any time, via the unsubscribe link in every email or by email to hello@s-up.social. We store the data until you ask us to delete it. This also applies to sign-ups that were not confirmed; however, we do not send any further emails to them. After you unsubscribe, or after a permanent delivery failure or a spam complaint, your entry remains stored together with the time it was unsubscribed so that you do not receive any further emails and keep your previous place if you sign up again (Art. 6(1)(f) GDPR). On request, we will delete it completely.

2.3 Contacting us by email

If you contact us by email, we process the data you send us (name, email address, message) to handle your request. Emails to our mailboxes (e.g. hello@s-up.social) are processed and stored by our email hosting provider Strato AG (Berlin, Germany); we have a data processing agreement with Strato. For booking an intro call, see section 2.9.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest). We keep the correspondence for as long as it is needed to handle your request; after that, it is removed as part of our deletion policy, unless statutory retention obligations apply.

2.4 BOB AI chatbot

BOB, an AI-powered assistant, is available on the website. When you use BOB, your chat messages are sent to Mistral AI (registered office: Paris, France; EU) for processing. Chats are not stored on the server on an ongoing basis: the history only exists in your browser during the current session, and with each request only the most recent messages of the current conversation are sent along for context processing. Exception: if you rate a reply (thumbs up/down) or our automatic quality detection identifies a clearly dissatisfied reaction, we store the exchange in question (your message, BOB's reply and up to four previous messages) to improve quality.

Data processed: chat content (text), technical metadata of the request. BOB only starts when you actively open the chat window and send a message yourself. For using BOB in the S'Up app (including voice mode), see section 3.5.

If you chose “Accept all” in the cookie banner or told BOB your first name, the website also sends a short visitor profile from your browser when you chat: first and last visit, number of visits and chats and, if given, your first name. This lets BOB recognise you and reply accordingly.

Legal basis: Art. 6(1)(b) GDPR (providing the feature you actively use) or Art. 6(1)(f) GDPR. We have a data processing agreement (DPA) with Mistral in accordance with Art. 28 GDPR. Data is not used to train public models.

2.5 Personalization (“Learn from your usage”)

In the S'Up app, you can optionally turn on the personalized suggestions feature (“Learn from your usage (Feed, Discover & BOB)”). It is off by default. If you turn it on (consent), we derive rough interest weights per activity category (e.g. sports, food, music) from your interactions so that Feed, Discover and BOB can show you better suggestions. This is based on likes, comments and viewing time in the Feed, as well as RSVPs and saved events in Discover. For the personalization, we only store the category, the type of signal and the time of these Discover signals, but no event IDs. If the feature is not turned on, viewing time is discarded on the server and not stored (independently of this, we keep a technical record of which posts you have seen, without viewing time).

Impression data from Discover: To further develop the suggestions, we also store, on the basis of this consent and for up to 12 months, which events were shown to you in Discover. For each event and each day, we record the first time it was shown: the area of the app (list, search or map), position, category, whether it is an S'Up event or an event from an external source, whether it matches your interests, the weight up to that point and the ranking score, whether it is a paid placement, the approximate distance in four bands (under 3 km, under 10 km, under 25 km or at least 25 km), price, lead time until the event, the weekday and hour the event starts, and whether you had already saved the event or RSVPed to it at that point. We store the time the event was shown only to the hour. In addition, we record whether you opened the event afterward, how long you looked at it and whether you saved it, RSVPed to it, removed it again or canceled your RSVP. We do not store any locations or coordinates. We plan to use this data later to develop and train a method that improves the order of suggestions in Discover. If you turned the feature on in an older version of the app, we only collect impression data after you have agreed to the extended consent in a current version of the app.

• Data minimization: For the personalization itself, we only use the aggregated category weights. The impression data contains no locations, and we store the time an event was shown only to the hour.
• No sensitive data (Art. 9 GDPR) is derived.
• Storage period: Discover signals and the viewing time in the Feed are automatically deleted after 60 days, and the impression data, including how long you looked at events in Discover, after 12 months. The learned category weights are recalculated daily.
• Withdrawal at any time in the app's Privacy settings. Withdrawing immediately deletes your learned profile, your Discover signals, the viewing time and the impression data. Likes and comments remain in place as your contributions, but are no longer analyzed for personalization.
• No automated decision-making with legal effect (Art. 22 GDPR): the feature merely sorts suggestions.
• No sharing with third parties, no advertising.

Legal basis: Art. 6(1)(a) GDPR (consent). The processing is turned off by default; if you withdraw your consent, the learned profile and the data listed above are deleted on the server immediately and completely.

Distinction: The order of the public Feed (ranking based on the interests you have specified, your friendships and public popularity) is part of the core service (Art. 6(1)(b) or (f) GDPR) and is independent of this consent. Only the personalization learned from your behavior is optional and based on consent.

2.6 Emails to the waitlist

After you confirm, we use our email delivery service Resend to send you a welcome email, followed by an automated email series with insights and development updates (about 7, 14, 30 and 60 days after you sign up). We also send individual emails on special occasions, for example an invitation to test the app, the announcement of the launch in the App Store or an overview of new blog articles. The emails are sent in the language you signed up in; the emails in the series address you by your first name if you provided it. In the case of permanent delivery failures or spam complaints, we automatically take your address off our mailing list.

Each of these emails contains an unsubscribe link that works with one click. The link is valid for 365 days; after that, you can unsubscribe at any time by email to hello@s-up.social. Once you have unsubscribed, you will no longer receive any of these emails. Emails that are necessary for using the service (e.g. confirmation of your sign-up, login confirmation, password reset) are exempt from this.

Legal basis: Art. 6(1)(a) GDPR (consent given when signing up for the waitlist) or Art. 6(1)(b) GDPR for the emails that are necessary for using the service.

2.7 Inviting friends (invite link and code)

In the S'Up app, you can invite friends via a personal invite link or invite code. Using this feature is voluntary; nobody has to send invitations or enter a code. If an invited person successfully signs up via your link or code, we store the relationship between the inviting and the invited person in our database (Supabase, EU region Frankfurt): the user IDs of both accounts, the invite code used, the time and the status of the invitation. The purpose of the processing is to unlock the benefits for both sides and to prevent abuse (e.g. self-invitations or automated sign-ups).

When the invited person becomes active (e.g. by creating their own event, RSVPing to an event or booking an event), we record this with the date and notify the inviting person by push notification with the name of the invited person. In the app, the inviting person can also see how many of the people they invited have signed up and are active. Up to and including August 2, 2026, both accounts received the “Founding member” badge when this happened. We store it with the date it was awarded; in the app, we show it only to you, in your profile.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract, providing the invite feature) or Art. 6(1)(f) GDPR (legitimate interest in preventing abuse). The data is automatically deleted when your account is deleted.

2.8 Photo gallery for events (e.g. /party)

For some events, we offer a photo gallery. Until 11 October 2026, visitors could upload pictures to it, even without an account. Uploading has not been possible since then. Every upload was automatically checked for prohibited content before it was published (Microsoft PhotoDNA and Sightengine, see section 5) and was only shown publicly once it had been approved. When uploading, visitors could optionally enter their email address (e.g. for a waitlist perk); to prevent abuse, we also processed technical identifiers (including a hashed IP value as rate-limit protection). Approved photos remain visible in the gallery, where they can be viewed and saved.

People shown in photos: Photos of public events may show third parties. It is not possible for us to inform everyone shown individually (Art. 14(5)(b) GDPR). This privacy policy serves as the substitute information. If you can be seen in a photo and want it removed, write to hello@s-up.social. We will then remove the picture promptly.

Legal basis: Art. 6(1)(a) GDPR (voluntary upload) or Art. 6(1)(f) GDPR (gallery for a public event, balancing of interests taking into account § 23 of the German Art Copyright Act (KunstUrhG)); moderation: Art. 6(1)(c)/(f) GDPR.

2.9 Online appointment booking (meetergo)

For businesses, we offer the option of booking a free intro call on our business page (/for-business). For this, we use meetergo (meetergo GmbH, Hauptstraße 44, 40789 Monheim am Rhein, Germany). Booking takes place on meetergo's booking page, which opens in a new tab. When you book an appointment, we process your first name, your last name, your email address and the appointment time you chose in order to arrange and hold the call. When you open the booking page, meetergo also processes technical data such as your IP address and information about your browser. There is no field for a message.

The call takes place as a video call via meetergo Connect, the video conferencing feature built into meetergo. It runs on servers of Hetzner Online GmbH in Germany. We have not connected an external calendar to meetergo. We have a data processing agreement with meetergo in accordance with Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (taking pre-contractual steps) if you book the appointment for yourself. If you book on behalf of a company, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in talking to companies about our offer). We do not obtain consent via the booking form. We keep the appointment data for as long as it is needed for processing and remove it as part of our deletion policy.

2.10 Business account for event organizers

Event organizers can create a business account on this website to publish events in the S'Up app. For this, we process the email address of your account and the information you enter in the dashboard: the name, type, description and categories of your business, the short name for your profile address, contact details (address, phone, website, Instagram profile), logo, cover image, opening hours and your target audience settings (e.g. audience type, radius, universities, age range). We also process the plan you chose, the status of your setup and the end of the trial period. Uploaded logos and cover images are automatically checked for prohibited content before they are published (Microsoft PhotoDNA and Sightengine, see section 5). For published events, app users see the name of your business as the organizer.

Address search: When you enter an address or place name while creating an event, we determine its coordinates using the Nominatim service of the OpenStreetMap Foundation (Cambridge, United Kingdom). For this, our server sends the address or place name you entered to the OpenStreetMap Foundation. Your IP address is not transmitted. For the United Kingdom, there is an adequacy decision of the European Commission (Art. 45 GDPR).

New business accounts can try S'Up for free for 30 days. We send you an email reminder three days and one day before the trial period ends. If you have not completed the setup after about 48 hours, we send you a one-time reminder. Payments for a plan are processed via Stripe (see section 5).

Legal basis: Art. 6(1)(b) GDPR (contract for the business account), also for the reminders about the end of the trial period. As you are a customer, we send you the one-time setup reminder and other marketing emails about S'Up for Business under § 7(3) of the German Act against Unfair Competition (UWG) and Art. 6(1)(f) GDPR (legitimate interest in advertising our own similar offering). You can object to this use of your email address at any time without incurring any costs other than the transmission costs at basic rates: via the unsubscribe link in each of these emails or in the dashboard under Account, in the “Marketing emails” setting. The business account is deleted together with your account (see section 6).

3.1 Location

For features such as “Events near you” and Discover, the app requests your location as a one-time query after you have granted the iOS system permission (target accuracy configured to approx. 100 m, no continuous tracking). The location is used only transiently to calculate the results: it is not stored on our servers, and no location history or movement profile is created. Using the same reduced location, we optionally request the current weather from Apple (WeatherKit) to give you more suitable event suggestions; only the weather text (e.g. “Rain”) is sent to our AI service Mistral, never your location.

Exception (opt-in), home city for friends: If you turn on the “Location for friends” toggle in the Privacy settings, we store your home city at city level (e.g. “Konstanz”, never coordinates or addresses) in your profile. It is visible only to accepted friends (blocked contacts excluded) and is used to match which of your friends are free in the same city right now; the current city of the person asking is only used transiently and is not stored. When you turn off the toggle, the stored city is deleted immediately.

Legal basis: Art. 6(1)(b) GDPR (core function of the app) based on your iOS permission, which you can revoke at any time in the iOS settings; for the opt-in home city, Art. 6(1)(a) GDPR (consent), which you can withdraw at any time using the toggle in the Privacy settings.

3.2 Contact matching (currently disabled)

The feature for finding friends via your address book has been disabled since September 13, 2026. The app does not request access to your contacts for this purpose and does not send us any phone numbers or hash values. We have deleted previously stored hash values of phone numbers. Invitations to contacts are sent only by you, via the iOS share menu; we do not send any messages to your contacts. Should we reintroduce contact matching, we will add to this section beforehand.

3.3 Calendar (finding a time)

If you allow calendar access, the app checks locally on your device when you are free and can add S'Up events to your calendar. Your calendar contents do not leave your device. On our servers, we only store the link between an S'Up event and your calendar entry, as well as the sharing level you chose for finding a time with friends (free/busy only / off). Depending on the level, friends only see free/busy time slots from S'Up events you have RSVPed to, never the contents of your calendar.

Legal basis: Art. 6(1)(b) GDPR; you can revoke access at any time in the iOS settings and change the sharing level at any time in the app.

3.4 Push notifications

For push notifications (e.g. friend requests, event invitations and reminders, comments), we use the Apple Push Notification Service (APNs). For this, we store the device token issued by Apple, linked to your account; to Apple, the token is pseudonymous. Notification contents (such as the name of the person sending a request or an event title) pass through Apple servers (USA) for delivery. You can turn off the notification categories (friend requests, event invitations, reminders, comments, BOB) individually in the app settings. Only important service messages (e.g. moderation decisions) stay active; you can turn off push system-wide in iOS at any time. We promptly delete device tokens that have become invalid.

Legal basis: Art. 6(1)(a) GDPR (iOS push permission) for the channel, Art. 6(1)(b) GDPR for delivery as part of the service.

3.5 BOB in the app (chat and voice mode)

Before your first chat with BOB, the app asks for your explicit consent. Without it, no AI processing takes place. If you agree, your messages are sent to Mistral AI (France, EU) together with this context from your account: your first name, your interests, the title, time and status of your upcoming events and invitations, the names of your friends (only friends who have also consented to BOB), up to 20 events from Discover (title, date, time, venue name, price), the current weather and the latest messages of your conversation including BOB's own replies, which may contain place names. The conversation history is not stored on our servers; it only exists on your device during the session. In the optional voice mode, your voice recording is sent to Mistral (EU) for transcription and BOB's reply text for speech output, each without a user identifier, and neither is stored by us.

Legal basis: Art. 6(1)(a) GDPR (consent, which you can withdraw at any time in the app's Privacy settings). We have a data processing agreement with Mistral; your data is not used to train public models.

3.6 Content, moderation and reports

Content you create (posts, photos, comments, events, groups) is automatically checked for prohibited content before it becomes visible to others (text: Mistral, images: Sightengine, both in the EU). We also check images with Microsoft PhotoDNA against known child sexual abuse material; only a non-reversible hash of the image is sent to Microsoft (details in section 5). A match leads to the image being blocked and deleted and the account being permanently suspended. If the content does not pass the check, it is not published and a warning entry (strike) may be created; in the case of repeated or serious violations, the account may be suspended temporarily or permanently. If your account is suspended, you receive an email with a statement of reasons and a link to appeal. A human decides on any appeal. We inform you about removed content by notification, and you can challenge the removal at any time via the contacts in section 8. We review reports that other users submit via the report feature; moderation decisions by our team are logged in an audit-proof manner (Digital Services Act, DSA). Messages in the event chat are automatically deleted 90 days after the event ends.

Legal basis: For the automatic checks, warnings and suspensions, Art. 6(1)(b) GDPR (enforcement of our Terms of Service) and Art. 6(1)(f) GDPR (legitimate interest in protecting the community from illegal content). For handling reports and giving reasons for our decisions, Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 DSA.

If you upload photos in which other people can be recognized, we also process their image data. Please only upload such photos if the people shown agree to it. Anyone who appears in a photo and does not want to be in it can report it via the report feature or by email to report@s-up.social, and we will then remove it. The legal basis for processing the data of the people shown is Art. 6(1)(f) GDPR (legitimate interest in providing the platform); they can object to this under Art. 21 GDPR.

Reports and appeals are handled exclusively by our two managing directors via an internal admin dashboard. There, they see the account, report and appeal data needed for this, as well as automatic warnings and suspensions, which they can lift. Their moderation actions (e.g. suspending an account, lifting a suspension, deciding on an appeal) are logged with the time and the account concerned so that our decisions remain traceable. The log is accessible only internally; we keep it for as long as it is needed as proof of our decisions.

3.7 SplitBob (splitting costs)

With SplitBob, event participants can keep track of who covered which costs and settle their shares among themselves. It is purely a list for keeping track, without any actual payment processing. We process the expenses you enter (title, amount, who paid, shares). They are visible only to the participants of the respective event. The data is deleted together with the event or your account.

Legal basis: Art. 6(1)(b) GDPR (feature you actively use).

3.8 Crash and error diagnostics

When app errors occur, our error tracking (Sentry, EU servers in Frankfurt) collects technical diagnostic data: device model, iOS version, stack trace and an account identifier. Before sending, we remove the email address and IP address; screenshots or screen contents are not transmitted.

Legal basis: Art. 6(1)(f) GDPR (stability and troubleshooting).

3.9 Beta tests (TestFlight) and app analytics

If you take part in beta tests via Apple's TestFlight, Apple collects data such as your name, email address, usage and crash data under its own terms and makes some of it available to us; we are the controller for the data that reaches us and use it exclusively to improve the app. The same applies to the app analytics and crash reports from the App Store, which Apple only provides to us if you have turned on “Share With App Developers” in iOS. Details from Apple: TestFlight & Privacy.

Legal basis: Art. 6(1)(b) GDPR (conducting the beta test) or Art. 6(1)(f) GDPR (product improvement); the collection by Apple itself is governed by the consent you give to Apple.

If we invite you from our waitlist to the beta test, we ask you by email about a week later to take part in a voluntary survey about the app. We store your answers on our servers (Supabase, EU region Frankfurt) together with your waitlist entry and use them only to improve the app. We delete them together with your waitlist entry, but no later than 12 months after the app's public launch.

Legal basis for the survey: Art. 6(1)(a) GDPR (consent through voluntary participation). You can withdraw your consent at any time with effect for the future; a reply to our email is enough.

3.10 Event data from public sources (Ticketmaster)

In the Discover area, the app also shows events near you that were not created via S'Up. For this, we take publicly available information from Ticketmaster (Live Nation Entertainment, Inc., USA) via the Ticketmaster Discovery API. We only process information about the event: title, start and end, venue with address and coordinates, category, price and currency, the link to the source, the address of the event image and a short info text from Ticketmaster (no more than 300 characters). The title may contain the name under which performers appear publicly, for example artist or stage names.

The app loads the images of these events directly from Ticketmaster's servers. In the process, Ticketmaster receives your IP address, information about your browser or app and the time of the request. This is a transfer to a third country (USA).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is making publicly announced events findable in one place.

Your right to object: If you are named in connection with such an event in the app and do not want this, you can object at any time under Art. 21 GDPR by emailing hello@s-up.social. We will then remove the entry without delay and block it permanently so that it is not imported again.

4.1 Necessary cookies

We use technically necessary cookies that are required to operate the website (e.g. session cookies for logged-in users in the dashboard area). These cookies are automatically deleted at the end of your browser session and do not require consent.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical operation).

Storage in your browser: In your browser's local storage (localStorage) we only keep settings and data for features you use yourself: your cookie choice, the colour scheme, whether BOB is minimised, the history of your BOB chat during the session, your daily counter for BOB messages and your progress in tools such as the first-week checklist. A visitor profile for BOB (first and last visit, number of visits) is only created with your consent (“Accept all”). This data stays in your browser, except for the BOB visitor profile, which is sent along when you chat (see 2.4). You can delete it at any time in your browser settings. Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the feature you use), for the visitor profile Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent).

4.2 PostHog (product analytics)

We use PostHog to analyze product usage (e.g. which features are used and how, conversion funnels). PostHog servers are located in the EU (eu.posthog.com, Frankfurt data center). IP addresses are anonymized. No cookies are set for cross-site tracking.

A/B tests on the website: We test different variants of individual page elements, for example the headline of the home page or button labels. PostHog determines which variant you see using feature flags. For this, your browser loads the PostHog software and asks PostHog on every page view which variant should be displayed, even if you have not given consent in the cookie banner. For technical reasons, this transmits your IP address, your browser identifier (user agent), the time zone of your browser and random identifiers that are held only in the memory of your browser and disappear when you reload or close the page. Nothing is stored on your device for the variant request. We only record usage events together with the variant shown once you have given consent.

In the S'Up iOS app, we initially collect usage statistics (e.g. which onboarding steps are completed and which features are used) only anonymously: without your name, email or any link to your account, without a cross-device identifier and without advertising IDs; IP addresses are discarded during collection. Only once you actively agree (toggle during onboarding or in the Privacy settings) do we link these statistics to your account. In the Privacy settings, you can end the link to your account at any time (statistics are then anonymous again) or turn off the statistics completely, in which case nothing is transmitted anymore.

If you come to S'Up via an invite link, we assign a pseudonymous invite identifier to your sign-up. This applies both to single-use invite links and to a user's personal invite code; in each case, only a cryptographic hash is processed (no plain-text link, no plain-text code). This identifier is processed in certain analytics events (opening the invite link: “invite_link_opened”, completing sign-up: “signup_completed”, assigning the invitation in the app: “referral_claimed”) to measure whether invitations lead to sign-ups. It does not allow any conclusions to be drawn about address book or contact data.

Legal basis: Website: Art. 6(1)(a) GDPR (consent via the cookie banner) or Art. 6(1)(f) GDPR (legitimate interest in product optimization where processing is anonymized). For requesting the test variant without consent: Art. 6(1)(f) GDPR (legitimate interest in improving our website). App: Art. 6(1)(f) GDPR for the anonymous statistics (legitimate interest, identification not possible); Art. 6(1)(a) GDPR (consent, which you can withdraw at any time) for linking them to your account.

How to exercise your rights

• Copy of your data (Art. 15 and 20 GDPR): On this website, you can log in with your S'Up account and request a copy of your account data, including your uploaded images, as a ZIP archive under Account. If you have uploaded a very large number of images, the archive contains the most recent ones and links to all others. We send you the download link by email; it is valid for 7 days. You can request a new export once every 24 hours. We automatically delete the archive after 30 days.
• Erasure (Art. 17 GDPR): In the app, you can delete your account in the settings; the deletion takes effect immediately. On this website, you confirm the deletion via a link that we send you by email (valid for 7 days). From the time you confirm, you have 30 days to cancel the deletion under Account; we then permanently delete your account, including your uploaded files and your customer record with the payment service provider Stripe. If you delete your account via the website, we record as proof that we carried out the deletion and when, together with the reason if you gave one (Art. 5(2) GDPR). Statutory retention obligations, for example for invoices, remain unaffected.
• All other requests: Send us an email at hello@s-up.social. To make sure we do not disclose your data to unauthorized persons, we may ask you to prove your identity. We respond within one month (Art. 12(3) GDPR).