Kolabing

Last updated: 12 July 2026

English · Español

Privacy Policy

This Privacy Policy explains how Kolabing collects, uses, shares and protects your personal data when you use our platform, mobile applications and related services (the "Service"). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

1. Who We Are

The data controller responsible for your personal data is:

  • Serra GCVC OÜ
  • Registered address: Tööstuse 75-71, Tallinn, Estonia, 10418
  • Company registration number: EE102834158
  • Privacy contact: privacy@kolabing.com

2. Information We Collect

We collect the following categories of personal data:

  • Account and identity data. When you sign in with Google or Apple, we receive your name, email address, email-verified status and profile photo/avatar. If you use email sign-in, we process your password and password-reset requests. Your profile may include a handle, city, interests and language preference.
  • Photos. Profile photos, business "offer" photos, profile gallery photos and event photos that you choose to upload. We also process QR codes when you scan them for event check-in and reward redemption.
  • Location data. With your permission, we process your approximate or precise location (latitude and longitude) to show you nearby events and to enable event check-in.
  • Push notifications. If you enable notifications, we process a device push token (through Firebase Cloud Messaging) and your notification preferences.
  • Messaging. In-app chat threads and messages exchanged between users.
  • Payment data. If you are a business user with a monthly subscription, the payment is processed by Apple through your App Store account (in-app purchase). We do not receive or store your card details; we retain limited subscription status and transaction identifiers returned by Apple.
  • Usage and analytics data. Product analytics collected through PostHog to understand how the Service is used and to improve it. You can opt out of analytics.
  • Support communications. The content of any messages you send us for support.

3. App Permissions We Request

To provide certain features, our app may ask for the following device permissions. These permissions are optional, and you can grant or revoke them at any time in your device settings:

  • Camera and photo library — to take or select profile, offer, gallery and event photos, and to scan QR codes.
  • Location — to discover nearby events and to check in to events.
  • Notifications — to send you push notifications about your activity on the Service.

If you decline or revoke a permission, the related feature may not work, but you can continue to use the rest of the Service.

4. How We Use Your Information and Our Legal Bases

Under Article 6 of the GDPR, we rely on the following legal bases:

  • Performance of a contract (Art. 6(1)(b)). To create and manage your account, provide the Service, enable collaborations, process subscriptions and provide support.
  • Consent (Art. 6(1)(a)). To access your camera, photos, location and to send push notifications; and to use optional analytics. You can withdraw consent at any time.
  • Legitimate interests (Art. 6(1)(f)). To keep the Service secure, prevent fraud and abuse, improve and develop features, and communicate with you about the Service, balanced against your rights.
  • Legal obligation (Art. 6(1)(c)). To comply with accounting, tax and other legal requirements.

5. Sharing and Processors

We do not sell your personal data. We share it only with trusted service providers ("processors") who process it on our behalf under contract, and where required by law. These include:

  • Google and Apple — sign-in and authentication.
  • Apple (App Store / In-App Purchase) — subscription billing and payment processing.
  • Firebase Cloud Messaging and the Apple Push Notification service — delivery of push notifications.
  • Cloud hosting providers — hosting and storage of the Service and its data.
  • PostHog — product analytics.

We may also share data with other users as part of the Service (for example, your profile and messages), and with authorities or advisers where necessary to comply with the law or protect our rights.

6. International Transfers

Some of our processors may store or process data outside the European Economic Area (EEA). Where this happens, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or an adequacy decision, so that your data receives an equivalent level of protection.

7. Data Retention

We keep your personal data only for as long as necessary for the purposes described in this policy. In general, we keep account data for as long as your account is active. When you delete your account, we soft-delete it and then remove or anonymise your personal data within a reasonable period, except where we must retain certain information to comply with legal obligations (such as tax and accounting records) or to resolve disputes.

8. Your Rights

Under the GDPR and the Estonian Personal Data Protection Act, you have the right to:

  • Access — obtain a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion of your data ("right to be forgotten"). You can delete your account at any time, and we will erase your data subject to our retention obligations.
  • Restriction — ask us to limit how we process your data.
  • Portability — receive your data in a structured, commonly used, machine-readable format.
  • Objection — object to processing based on our legitimate interests.
  • Withdraw consent — withdraw any consent you have given, at any time, without affecting prior processing.

To exercise your rights, contact us at privacy@kolabing.com. You also have the right to lodge a complaint with the Estonian supervisory authority, the Data Protection Inspectorate (Andmekaitse Inspektsioon), at www.aki.ee.

9. Children

The Service is intended only for people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us so we can delete it.

10. Security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encryption in transit, access controls and secure hosting. No system is completely secure, but we work continuously to protect your data and will notify you and the Data Protection Inspectorate of a personal data breach where required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example, in the app or by email) and update the "Last updated" date above. We encourage you to review this policy periodically.

12. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us: