Tschillie’s Privacy Policy

To our users,

If you're perusing this document, you likely share the widespread concern regarding the safeguarding of personal data. We aim to assist you by elucidating how your personal data is handled upon registration for our services or upon accessing our mobile application and related services. Personal data encompasses any information that can be linked to your identity.

Given the intricacies of data protection legislation, we offer a concise overview of pertinent matters:

Data Controller

In any instance of personal data processing, there exists a designated entity responsible for such processing (referred to as the data controller). This entity serves as your primary contact for matters pertaining to data protection and ensures compliance with the standards outlined in European legislation. In the context of Tschillie services, we, Maroon Innovations LTD., assume the role of data controller. You may contact us via:

Maroon Innovations LTD.

2 Bibi Family Court

Triq it-Tempju

Qala, QLA1063

Malta

Email: privacy@marooninnovations.com

Further company details can be accessed through our imprint available at Maroon Innovations LTD.

Overview of Data Processing Procedures

Legal basis for the Processing of Data

Under the law, processing of personal data is primarily prohibited unless it falls under specific justifications:

• Art. 6 para. 1 sentence 1 lit. a GDPR ("Consent"): Processing is permissible if the data subject has provided voluntary, informed, and unambiguous consent for specific purposes.

• Art. 6 para. 1 p. 1 lit. b of the GDPR: Processing is allowed if necessary for fulfilling a contract with the data subject or for undertaking pre-contractual measures at the data subject's request.

• Art. 6 para. 1 p. 1 lit. c of the GDPR: Processing is permissible if necessary to comply with a legal obligation imposed on the controller (e.g., record-keeping obligations).

• Art. 6 para. 1 p. 1 lit. d of the GDPR: Processing is allowed if necessary to protect the vital interests of the data subject or another natural person.

• Art. 6 para. 1 p. 1 lit. e GDPR: Processing is permissible if necessary for tasks carried out in the public interest or exercising official authority vested in the controller.

• Art. 6 (1) p. 1 lit. f GDPR ("Legitimate Interests"): Processing is allowed to safeguard legitimate interests (especially legal or economic) of the controller or a third party unless overridden by the data subject's interests or rights (especially if the data subject is a minor).

For our processing operations, we specify the applicable legal basis in each case. A processing operation may rely on multiple legal bases.

Storage Duration Policy and Data Deletion

We outline below the duration of data storage and the criteria for deletion or blocking. If no explicit storage period is specified, personal data will be deleted or blocked once the purpose or legal basis for storage ceases.

However, data may be retained beyond specified periods in the event of (threatened) legal disputes or other legal proceedings, or if required by applicable legal regulations. Upon expiration of statutory storage periods, personal data will be blocked or deleted unless further storage is necessary and justified by legal basis.

Please find more information in the section ‘Additional Information on Data Retention and Deletion’.

Data Security Measures

At Tschillie, we prioritise the implementation of appropriate security measures to safeguard your information against loss, misuse, unauthorised access, or disclosure. We employ reasonable security protocols, including secured cloud servers with firewalls and encrypted transmission channels, to maintain the confidentiality of your personal data.

However, it's important to note that no mobile application or digital transmission can guarantee complete security. While we strive to uphold stringent security standards, we cannot guarantee immunity against unauthorised access, hacking, data loss, or other external security breaches.

In-App Security Protections and Technical Limitations

To safeguard the privacy of our members and the confidentiality of communications within the Tschillie mobile application, we deploy dedicated technical security measures designed to restrict screenshots, screen video recordings, and display mirroring.

However, no software-based security measure can completely eliminate captures conducted through external physical means. You expressly acknowledge that the application cannot prevent third parties from using an external camera, a secondary smartphone, or other optical hardware to photograph or film their own screen displaying profiles, photos, or private conversations.

While such conduct constitutes a severe material breach of our Terms and Conditions resulting in the immediate termination and permanent banning of the offending user's account without prior notice, we disclaim any and all liability for unauthorized captures performed outside of our technical application environment using third-party physical hardware beyond our control.

To help enhance the security of your data, we recommend the following measures:

• Always lock your device or log out of your account after use to prevent unauthorised access by third parties.

• Refrain from sharing your Tschillie account password or access credentials with anyone else.

• Consider periodically changing your password for added security.

Furthermore, we employ suitable technical and organisational measures to safeguard data against accidental or deliberate manipulation, partial or complete loss, destruction, or unauthorised access by third parties (e.g., TLS/HTTPS encryption for network communications). These measures consider the latest technological advancements, implementation costs, nature, scope, context, and purpose of processing, as well as existing risks of data breaches.

If you suspect that someone has gained unauthorized access to your password or account, please contact our support team immediately.

Cooperation with Processors

Similar to larger companies, we engage external domestic and international service providers (e.g., IT, cloud infrastructure, telecommunications, customer support, and analytics) to process business transactions. They act solely on our instructions and are contractually obligated to comply with data protection regulations under Art. 28 GDPR.

Profiling Practices and automated Decision-Making

Tschillie is dedicated to fostering kind and equitable relationships. To achieve this, we've developed advanced matching algorithms aimed at predicting compatibility between users. These algorithms analyse various factors, including user profiles and interactions within the app, such as swiping patterns and mutual matches.

We utilise this data to recommend profiles that are deemed highly compatible with each user, enhancing the likelihood of meaningful connections. Our matching algorithms leverage machine learning techniques to continually refine and optimise profile rankings, maximising the chances of finding suitable matches.

The data used for predicting compatibility and generating profile recommendations include:

1. User Profile Information: Details provided by users in their profiles, such as age, distance, and gender, enable us to suggest individuals who are likely to be compatible and reciprocate interest.

2. App Interaction Data: Information about user activity within the app helps identify individuals who are actively seeking new connections and are available to engage.

3. Device Coordinates: Utilised to determine proximity to other members, facilitating connections with individuals in close geographic proximity.

The legal basis for processing profile and proximity information is rooted in the necessity to fulfill our contractual obligations to users under Article 6(1)(b) of the GDPR. Additionally, processing information concerning app activity is justified by our legitimate interests as outlined in Article 6(1)(f) of the GDPR. Specifically, our interest lies in providing more personalised and relevant recommendations to enhance the user experience within our app.

In cases where users include sensitive information in their profiles, such as beliefs, processing of this data is contingent upon voluntary and explicit consent.

Personal Data Disclosure Policy

Overview of Data Disclosure

We do not disclose your personal data to third parties except as described in this privacy policy. Your personal data is only shared with third parties under the following circumstances:

• You have expressly consented in accordance with Art. 6 para. 1 p. 1 lit. a GDPR.

• The transfer is necessary for processing contractual relationships in accordance with Art. 6 para. 1 p. 1 lit. b GDPR.

• We are subject to a special legal or statutory obligation to provide the processed personal data to third parties, especially public bodies, in accordance with Art. 6 (1) p. 1 lit. c GDPR.

• Disclosure is necessary for the assertion, exercise, or defense of legal claims pursuant to Art. 6 (1) sentence 1 lit. f GDPR, and there is no overriding interest worthy of protection in non-disclosure of your data.

Types of Recipients

Presently, the following categories of recipients receive personal data from us:

• State authorities and courts.

• Technical and infrastructure service providers.

• Cloud hosting service providers.

• Transactional email and notification service providers.

• User engagement and marketing service providers.

• Customer support service providers.

• Advertising and distribution partners.

• Mobile application stores and payment operators (Apple App Store, Google Play Store).

• Mobile telemetry and analysis services.

• Affiliated companies.

Data Transfer to Third Countries

In adherence to legal requirements, data transfer to third countries may occur. Such transfers are limited to countries with confirmed adequate protection levels by the EU Commission, or where EU standard contractual clauses or other security guarantees permit. Otherwise, data transfer only occurs with your consent.

Understanding Your Rights

In the processing of your personal data, data protection law grants you various rights. These include:

• Requesting information about your processed personal data in accordance with Art. 15 GDPR.

• Requesting correction of incorrect or incomplete personal data stored by us in accordance with Art. 16 GDPR.

• Requesting deletion of your stored personal data in accordance with Art. 17 GDPR.

• Requesting restriction of processing of your personal data in accordance with Art. 18 GDPR.

• Receiving personal data you provided to us in a structured, commonly used, and machine-readable format or requesting a transfer to another controller in accordance with Art. 20 GDPR.

• Revoking your consent at any time with effect for the future per Art. 7 (3) GDPR.

• Lodging a complaint with a supervisory authority in accordance with Art. 77 GDPR.

If your personal data is processed based on legitimate interests pursuant to Art. 6 (1) p. 1 lit. f GDPR, you have the right to object to processing pursuant to Art. 21 GDPR unless grounds for objection arise from your particular situation or the objection is against direct advertising.

To exercise your right of revocation or objection, simply email privacy@tschillie.com.

Data Processing During Platform Visits and Logfiles

Upon accessing our application services or associated informative web pages Click here, our servers automatically record technical diagnostic details in a log file. This data is temporarily stored without your intervention and remains until automatic deletion. The following information may be collected:

• Device type, model, and hardware identifiers

• Operating system and version

• App build version

• IP address of the accessing device

• Date and time of server request

We process this data for the following purposes:

• Ensuring smooth and stable technical application operations.

• Facilitating intuitive user navigation and experience.

• Evaluating security, diagnosing crash reports, and defending against fraud or abusive attacks.

The legal basis for data processing is Art. 6 para. 1 p. 1 lit. f GDPR, based on our legitimate interest outlined above. Your data will only be processed for the duration necessary to achieve the specified purposes.

Data Processing During Registration

To access features within our app, registration as a user is required. You have the option to register via email submission, Google, or Apple Sign-In.

Email Registration

Registration can be completed directly on our app by providing your username, country, postcode, birthday, gender, gender search preference, and email address in the registration form. By submitting this information, you consent to the processing of the data entered during registration (Art. 6 para. 1 p. 1 lit. a GDPR).

We will utilise the email address provided during registration to inform you of important changes, such as alterations to our services or technically necessary updates.

Data Sharing through Google and Apple Sign-In

Should you choose to register or sign in with your Apple ID or Google account, you provide Google or Apple with consent to share your login credentials, a name (editable by you), and an email address (optional to conceal, wherein Apple/Google generates an anonymous relay email address to protect your personal inbox). This email address will be linked to your Tschillie account and utilised for account recovery and identification purposes.

Subsequently, we utilise this personal data to establish your Tschillie account. If you remove the Tschillie app from your Google or Apple ID permissions, token synchronization ceases. However, we retain the account data obtained during initial creation (formal account deletion within the app is required to permanently purge these records).

Where available, Facebook Connect (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) may also be used, in which case basic profile data (name, verified email, and profile photo) is processed under Facebook's policies and your explicit consent (Art. 6 para. 1 p. 1 lit. a GDPR).

Your User Profile

Within your user profile, you have the option to store and customize the following data:

• Gender
• Sexual orientation
• Age
• Country and region
• Status
• Hobbies, interests, and relationship status
• A profile text for self-description
• Profile photos

We process this data to facilitate connections with other users and identify common interests. The legal basis for this processing is Art. 6 para. 1 p. 1 lit. a GDPR. If you provide information regarding your sexual orientation, we process this data solely with your explicit consent in accordance with Art. 9 para. 2 lit. a GDPR, and only if you choose to make your profile visible to other community members in line with Art. 9 para. 2 lit. e GDPR.

You can review, update, or remove profile elements at any time within the app settings.

Chats with Other Users

Our platform offers a chat function for communication between Tschillie users. Content exchanged in chats is accessible only to the participants involved. We do not inspect private messages unless a safety violation is reported by a user or disclosure is mandated by law.

Location Data

As a registered user, you have access to location-based discovery services through our Connect function. Within this feature, we recommend profiles and match suggestions based on your geographic vicinity or live positioning. Additionally, general location data may be used to adapt promotional content.

Your precise location data is processed only with your explicit consent in accordance with Art. 6 para. 1 p. 1 lit. a GDPR, granted via your mobile operating system's permission dialogue. You can revoke this permission at any time in your smartphone system settings.

Further information is available in the ‘Geolocation Information’ section below.

Account

If your account is deleted by either yourself or us without any associated payable contracts, your data will be permanently removed from our active systems eight (8) weeks after the date of account deletion. This temporary retention period is implemented to prevent abuse, such as repeated deletion and re-creation of accounts to inappropriately access free introductory offers, and to handle pending safety complaints (legitimate interest pursuant to Art. 6(1)(f) GDPR).

In instances where there is no activity on an account for at least 180 days and no payable contract is in place, we reserve the right to delete the account to maintain system efficiency and ensure the community remains free of inactive accounts (Art. 6(1)(f) GDPR). Prior to deletion, we will notify you via email, allowing you the opportunity to prevent deletion by logging in.

If you have entered into a payable purchase or contract with us, the transaction records will be retained until the closure of your account, followed by archiving under statutory commercial and tax retention schedules.

Upon account deletion, chat contents are immediately blocked from view by respective chat partners. Conversations are initially retained in our backend for eight (8) weeks post-deletion for tracing purposes in the event of reports, abuse claims, or disputes (legitimate interest under Art. 6(1)(f) GDPR), before being permanently purged from our servers.

Data Processing for In-App Purchases and Paid Services

Upon purchasing Tokens or premium features, transactions are handled directly by the mobile app stores (Apple App Store or Google Play Store) acting as the Merchant of Record. We do not store your complete banking credentials or credit card numbers. We solely receive order tokens and transaction confirmations essential to credit virtual items to your account (Art. 6(1)(b) GDPR).

Transaction logs are retained strictly in compliance with applicable statutory fiscal and accounting obligations.

Contact Us

Should you wish to get in touch with us, our contact options and support channels are available for use:

Email: privacy@tschillie.com

Data provided in connection with support requests is processed to answer and resolve your inquiry (Art. 6 para. 1 p. 1 lit. a or b GDPR).

Communications are retained until your request has been fully resolved or until statutory limitation periods expire.

Data Processing in the Tschillie App

General Information Overview

Upon installing and utilizing the Tschillie mobile app, we process technical data necessary for mobile operations. The foundational principles stated above apply directly, supplemented by mobile-specific processing described below.

Data Processing During Download and Installation

Upon downloading the Tschillie app, the app store operator processes certain account details independently (store account email, device model, download timestamps). These operations fall under the privacy policies of the respective store platform. To deliver mobile services, the Tschillie app requests necessary device permissions (location, photo library, push notifications), which you can configure or revoke at any time in your device settings.

Geolocation Information

If you have granted Tschillie access to your device's location settings, we gather location data (via GPS, cellular networks, or Wi-Fi) to calculate relative distance between members and present nearby profile suggestions.

If you wish to disable location access, you can adjust this anytime in your mobile OS:

• For iOS (iPhone): Go to Settings → Privacy & Security → Location Services → Tschillie → Never or Ask Next Time.

• For Android: Go to Settings → Apps → Tschillie → Permissions → Location → Don't allow.

In-App Purchases

In-app purchases involve secure transaction processing via native mobile app store frameworks. For further details, refer to the "Data Processing for In-App Purchases and Paid Services" section above.

Photo and Device Information

When you select photos for your profile, the app requests access to your photo library or camera with your prior permission. The selected images are processed to establish your public profile.

Additionally, technical image parameters (dimensions, aspect ratio) are processed to optimize display resolution across varying mobile device screens.

Links and Redirections

The app may provide links to our social channels or help center. Interacting with these links may log general click telemetry to measure support resource traffic.

Your Information and How We Use It

Our primary objective is to ensure your experience on Tschillie remains safe, smooth, and enjoyable. We utilize your data to:

• Deliver all mobile services and community features.

• Keep you informed about critical app updates, security patches, and new features.

• Personalize profile recommendations and optimize matching feeds.

• Conduct diagnostic research and performance monitoring to debug crashes and optimize performance.

• Resolve user reports, safety complaints, and enforce our General Terms and Conditions.

• Investigate fraudulent activities, protect against security breaches, and uphold platform rules.

• Send you relevant service alerts or marketing communications where you have opted in or granted permission. You can manage push notification preferences at any time in the app or system settings.

• Safeguard community members from harassment, abuse, identity theft, and violations of personal rights.

Our Policy Regarding Age Requirements

The Tschillie application is strictly intended for individuals who are at least 18 years of age.

Tschillie does not intentionally gather information from or target minors under 18 years of age. Should we become aware that a minor has registered and provided personal data, we will immediately suspend the account and delete all associated personal information.

Analytical Tools

Using Google Analytics with Firebase

Our mobile app utilizes Google Analytics for Firebase ("Firebase"), provided by Google Ireland Limited. Firebase enables technical telemetry and usability analysis within the app, including screen views, button clicks, in-app transaction success, stability crash logs, and feature utilization. The data processed includes pseudonymized app instance IDs, mobile operating system details, device models, and general geographic statistics.

Tschillie’s Social Media Channels

Our app links to our official social media channels on Facebook and Instagram. Visiting these external platforms occurs under the privacy terms of their respective providers.

Meta Platforms (Facebook/Instagram)

Refer to Meta Platforms Ireland Limited's Privacy Policy at Facebook and Instagram.

Additional Information on Data Retention and Deletion

We retain your personal information only for as long as necessary for the specified purposes.

Upon deletion of your account from within the app, your profile immediately ceases to be visible to other members. For a safety window of up to 28 days, account restoration remains possible upon request in case of inadvertent deletion. After eight (8) weeks from the date of account deletion, we initiate the permanent deletion of your data from our active databases, unless:

• Statutory retention obligations (e.g., fiscal and commercial record-keeping duties for in-app transactions) require longer storage.
• Retention is necessary for evidentiary purposes in connection with ongoing disputes or to assert, exercise, or defend legal claims.
• The data is needed for fraud prevention and platform safety (such as maintaining ban identifiers to prevent users excluded for severe abuse, harassment, or safety breaches from re-registering).

Please note regarding shared content: Direct messages voluntarily sent to another user remain accessible within that recipient's private conversation thread for as long as their account remains active, unless a specific deletion request is processed.

Updating and Amending this Privacy Policy

As our mobile application and services evolve, or as regulatory mandates change, adjustments to this privacy policy may become necessary. The current effective version is always accessible in the application settings as well as on our website at Tschillie Privacy Policy.

This Privacy Policy was updated on the 5th October 2026.