top of page

Privacy policy

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 Thank you for visiting the WhatsNext – Action website. This Privacy Policy explains how personal data is processed when you visit our website and, where applicable, access our app or related services. Personal data is information relating to an identified or identifiable individual.

1.2 The controller responsible for this website and the WhatsNext – Action service under the General Data Protection Regulation (GDPR) is CombMe UG (haftungsbeschränkt), Backesweg 54A, 63477 Maintal, Germany, Email: contact@whatsnext-action.com. The controller determines the purposes and means of processing personal data. Our website is www.whatsnext-action.com.

1.3 We use HTTPS and TLS encryption to protect data transmitted between your browser and our website. We also apply appropriate technical and organizational security measures. No internet-based system can be guaranteed to be entirely secure.

2) Data Collection When Visiting Our Website and Using the App

When you visit our website, technical information may be processed to deliver the requested pages, maintain security and troubleshoot errors. Our website and application data are hosted on a server operated for us by Hetzner. Depending on your use of the website, the following categories of server log data may be processed:

  • Website or resource requested

  • Date and time of access

  • Data volume transferred

  • Referring page, where transmitted

  • Browser type and version

  • Operating system and device information

  • IP address and technical connection information

We process technically necessary data to deliver our services (Art. 6(1)(b) GDPR, where applicable) and to protect the security, stability and availability of our systems (Art. 6(1)(f) GDPR). These logs are not used to analyze the contents of individual Actions. Access to operational data is restricted according to operational need. We retain log data only as long as needed for these purposes, subject to necessary investigation or legal retention obligations.

For app accounts, we process the account information needed to register, authenticate and operate the service, including mobile phone numbers used for verification. Twilio is used to deliver one-time authentication codes by SMS. The number and relevant delivery information are transmitted to Twilio for that purpose. SMS verification messages are not marketing messages. The lawful basis is Art. 6(1)(b) GDPR, supplemented where applicable by Art. 6(1)(f) GDPR for account security. Transfers outside the EEA are subject to the applicable requirements of Chapter V GDPR.

3) Disclaimer for Public Actions and Transactions

As the operator of WhatsNext – Action, CombMe UG (haftungsbeschränkt) enables users to create public groups free of charge and to organize and share Actions. In providing these features, we process account information, group memberships and content submitted by users to operate the service. The applicable legal basis is generally Art. 6(1)(b) GDPR; moderation and abuse prevention may also rely on Art. 6(1)(f) GDPR or a legal obligation under Art. 6(1)(c) GDPR.

Transactions:
Users may independently agree on expenses, participation fees or other arrangements outside the platform. Unless a specific transaction service is expressly offered by us, the Company is not a contracting party to such arrangements. This section describes the platform's role and does not exclude any rights or liabilities that cannot lawfully be excluded. We do not describe Stripe or PayPal as mandatory payment processors for creating public groups because that feature is free.

User Responsibility:
Users are responsible for the content they provide and should avoid publishing private or sensitive information about themselves or others without an appropriate legal basis. Reports of suspected unlawful content or violations of our rules can be submitted through available reporting features or to contact@whatsnext-action.com. We review such reports and take appropriate action as required by applicable law.

4) Information for Users of Public Groups

Visibility and Data Protection:
When you join a public group, information such as your chosen username, publicly shared content and participation in that group may be visible to other users according to the group's functionality and visibility settings. Your mobile phone number is used for authentication and is not intentionally displayed as part of your public group profile unless you choose to disclose it. Please consider that information you publish in a public area may be copied or shared by others.

Group Notifications:
You may receive service-related notifications about Actions, invitations or group activity depending on your notification preferences and device settings. You can manage available notification settings in the app or through your device. These notifications are intended to operate the service and are distinct from marketing messages.

Content Responsibility:
Users are responsible for the content they submit. We do not routinely pre-approve every user post, but we review reports and respond to sufficiently specific notices of suspected violations. We may remove content, restrict access or suspend accounts where appropriate and legally permissible. We may process relevant reports, account identifiers and related content to investigate abuse and fulfill legal obligations.

Risk Notice:
Participation in user-organized Actions, meetings or arrangements involves decisions made by the participating users. Do not disclose sensitive information unnecessarily. Nothing in this Privacy Policy limits rights under applicable privacy or consumer protection law.

5) Cookies

Cookies and similar technologies may be used to operate the website, maintain sessions, remember necessary settings and, where enabled with a valid legal basis, measure use of the website. Some technologies are stored for a session; others may remain on your device for longer. The technologies actually used and their retention periods depend on the website implementation.

Strictly necessary storage or access may be permitted under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), with related processing based on Art. 6(1)(b) or Art. 6(1)(f) GDPR as applicable. Non-essential analytics cookies or comparable access to information on your device will only be used where the necessary prior consent has been obtained, under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Merely using the website or app is not consent to non-essential analytics.

You can manage cookies through your browser. Refusing strictly optional analytics technologies must not prevent access to the site's basic functionality. Where consent-based analytics is used, consent may be withdrawn for the future using the consent controls made available for the website. Browser help pages include:

Your browser settings may limit some website functions. Blocking optional analytics will not prevent you from using the core WhatsNext – Action service.

6) Contacting Us

When you contact us, for example at contact@whatsnext-action.com, we process the personal information you provide and any technical metadata necessary to receive and answer your request. The legal basis is Art. 6(1)(f) GDPR (handling inquiries), Art. 6(1)(b) GDPR where your request relates to a contract, or Art. 6(1)(c) GDPR when a statutory duty applies. We retain correspondence only as long as necessary to process the matter, establish or defend legal claims, or meet mandatory retention periods.

7) No Use of Your Data for Direct Marketing Purposes and No Sale of Personal Data

We do not use personal data collected through WhatsNext – Action for our own direct-marketing campaigns or sell personal data to third parties. We use data to operate, secure and improve the service, respond to requests, and comply with applicable law. We use Google Analytics for internal statistical product analysis, such as understanding whether users create Actions and which features are used. We do not use Google Analytics to analyze the content of individual Actions or private conversations. Access to our internal Analytics reports is restricted to authorized personnel within CombMe UG (haftungsbeschränkt).

Providing the service requires some data to be processed by service providers. In particular, Hetzner provides server infrastructure, Twilio processes information needed for SMS verification, and Google processes information associated with Google Analytics where it is enabled. The fact that only authorized company personnel can access our reports does not mean service providers never process data. We may also disclose information where legally required. Applicable contractual, confidentiality and international-transfer safeguards must be observed.

8) Use of Social Media: Videos

Use of YouTube Videos

If our website displays an embedded YouTube video, activating or loading that embed may establish a connection to Google's or YouTube's servers and may result in the processing of technical identifiers, IP addresses and usage information. The processing carried out by YouTube is subject to Google's own privacy information. Where required, non-essential third-party media will not be activated before the relevant consent is given.

We do not assume that every visit to our website necessarily loads YouTube or transmits data to YouTube. Whether this takes place depends on the actual page and the embedding method. You can find Google's privacy information at https://policies.google.com/privacy.

9) Web Analytics Services

Google Analytics

We use Google Analytics to obtain statistical information about how WhatsNext – Action is used, with the aim of improving functionality, usability and service quality. For example, we may evaluate whether and how frequently users create Actions. We do not intentionally submit the text or other contents of individual Actions, private messages, or users' phone numbers as Analytics event parameters. Our internal reports are used only for product improvement, not for sale or personalized advertising by CombMe UG (haftungsbeschränkt).

Google Analytics may process online identifiers, device and browser information, events and other technical information. This information may constitute personal data even when reports available to us are aggregated and do not identify individual users. Google's own data processing, access and international transfers are governed by applicable contracts and legal safeguards. Where a transfer is covered by the EU–US Data Privacy Framework, this applies only to a participating and appropriately certified U.S. recipient; otherwise another valid transfer mechanism, such as standard contractual clauses, may be required.

Where analytics technologies require consent under applicable law, we will activate them only after a valid, voluntary and informed choice, and users may withdraw that choice for the future. Accepting our Terms of Use, reading this Privacy Policy or continuing to use WhatsNext – Action does not by itself constitute consent to analytics. If no suitable consent mechanism is available, consent-requiring analytics must remain disabled. Information about Google's data practices can be found at https://policies.google.com/privacy and https://support.google.com/analytics/.

10) Tools and Miscellaneous

Google Maps

Where a page on our website actually offers an embedded Google Maps feature, the map may transmit technical data, including your IP address, to Google when loaded. Where required, we will make an appropriate consent choice available before loading optional third-party map content. Google's privacy information is available at https://policies.google.com/privacy and its Maps terms at https://www.google.com/help/terms_maps/.

Google Web Fonts

Our website may use web fonts. Fonts stored locally on our own infrastructure do not require the visitor's browser to connect to Google for the font files. If fonts are instead loaded directly from Google servers, Google may receive technical connection information, including an IP address. We will assess that integration against applicable data-protection and device-access requirements. Google's privacy information is available at https://policies.google.com/privacy.

Hosting and SMS Authentication

Our website and application data are hosted on infrastructure provided by Hetzner. For app account verification, Twilio delivers authentication SMS messages. Access to personal data is restricted to what is needed for the respective service. We take reasonable steps to arrange required data processing terms and, for transfers outside the EEA, appropriate safeguards under Chapter V GDPR.

11) Your Rights

Subject to applicable law, including the GDPR, you have the following rights concerning personal data processed by CombMe UG (haftungsbeschränkt):

  • Right of Access: You may request confirmation of processing and access to relevant personal data.

  • Right to Rectification: You may request correction of inaccurate or incomplete data.

  • Right to Erasure: You may request deletion where the legal requirements are met; certain records may need to be retained for legal reasons.

  • Right to Restriction and Objection: You may request restriction of processing or object to processing based on legitimate interests, subject to legal conditions.

  • Right to Withdraw Consent: You may withdraw consent at any time with effect for the future without affecting earlier lawful processing. Account deletion is not the only way to withdraw consent.

  • Right to Data Portability: Where applicable, you may request personal data in a structured, commonly used and machine-readable format.

  • Right to Lodge a Complaint: You may complain to a competent data protection supervisory authority.

To exercise your rights, contact contact@whatsnext-action.com. We will respond in accordance with statutory time limits and may ask for reasonable verification of your identity.

12) Duration of Storage of Personal Data

We store personal data only for as long as necessary for the specific purposes described here, including providing accounts and group features, securing our systems, responding to inquiries and complying with law. Account-related data will generally be processed while an account exists; deletion requests are handled subject to legal retention periods, security needs and the rights of others. Content shared with other users may persist in copies outside our control. Backup copies may be deleted on a different technical cycle.

Server logs, security records, SMS-related verification records, support communications and analytics data may have different retention periods. We configure their retention based on operational necessity, data minimization and applicable legal requirements. We do not promise immediate deletion from every backup or system where that is not technically or legally possible. Please contact us for information about retention relevant to a particular category of data.

13) Additional Data Protection Rights for Specific Regions

Depending on your location and whether a particular law applies to our business, you may have additional privacy rights. We honor legally applicable rights and receive requests at contact@whatsnext-action.com.

13.1 Data Protection Rights for California Residents (CCPA/CPRA)
California privacy rights may apply if our business meets the law's applicability requirements. Where the California Consumer Privacy Act, as amended, applies, eligible residents may have rights to know, access, correct or delete personal information; to opt out of covered sales or sharing; to limit certain uses of sensitive personal information; and not to be discriminated against for exercising rights. We do not claim that this law automatically applies to every small business or every California visitor. We do not sell personal data as part of our business model.

13.2 Data Protection Rights for Brazilian Residents (LGPD)
Where Brazil's General Personal Data Protection Law applies, individuals may have rights including confirmation of processing, access, correction, deletion in applicable circumstances, information about sharing, and withdrawal of consent.

13.3 Data Protection Rights for Canadian Residents (PIPEDA)
Where applicable Canadian privacy law applies, individuals may have rights to access and correct personal information and to receive information about relevant collection, use and disclosure practices.

13.4 Data Protection Rights for Australian Residents (Privacy Act 1988 and NDB Scheme)
Where applicable, individuals may have rights of access and correction, and qualifying data breaches may trigger notification duties under Australia's Notifiable Data Breaches scheme.

13.5 Data Protection Rights for Singapore Residents (PDPA)
Where Singapore's Personal Data Protection Act applies, individuals may have rights to request access to or correction of personal data and to withdraw consent subject to applicable legal requirements.

For people in the EU or EEA, the GDPR rights described in Section 11 apply. Rights under UK data protection law may apply where UK law governs the processing. We may update this Privacy Policy to reflect service changes or applicable legal requirements, and will publish the updated version with an effective date.

bottom of page