Privacy Policy

for the use of WhatsNext – Action
(www.whatsnext-action.com)

Last Updated: October 18, 2026

Chapter 1 – Introduction and Information About the Data Controller

1.1 Overview

This Privacy Policy explains how personal information is collected, used, disclosed, and protected when you visit the website or use the WhatsNext – Action mobile application (together, the “Service”). “Personal information” includes information that identifies you or can reasonably be linked to you, directly or indirectly, subject to applicable law.

The Service may be available internationally, including to users in the United States. Because our operator is established in Germany, the European Union General Data Protection Regulation (“GDPR”) may apply to certain processing activities. Additional U.S. federal or state privacy laws may apply where their legal requirements are met.

1.2 Operator and Data Controller

The Service is operated by:

CombMe UG (haftungsbeschränkt)
Backesweg 54 A
63477 Maintal
Germany
Email: contact@whatsnext-action.com
Website: https://www.whatsnext-action.com

CombMe UG (haftungsbeschränkt) is the entity responsible for determining the purposes and means of processing personal information within its own operations. It is the operator of the Service and the contracting party under the applicable Terms of Use. Its shareholders, managing directors, and employees do not become individual operators or parties to user agreements solely by virtue of their positions. This does not exclude responsibilities imposed by law.

1.3 Relationship to Our Terms of Use

Use of WhatsNext – Action is subject to our Terms of Use to the extent they are validly incorporated into your agreement with us. This Privacy Policy provides notice about our data practices; it is not itself a consent form. Creating an account, accepting the Terms of Use, or simply using the Service does not replace any separate privacy or analytics consent required by applicable law.

1.4 Security

We use reasonable technical and organizational measures designed to protect personal information, including safeguards appropriate to the Service and the information being processed. Where implemented, transmissions are protected with technologies such as TLS. No internet or electronic system can be guaranteed to be completely secure.

Chapter 2 – Information Collected When You Use the Website and App

2.1 Technical and Access Information

When you access the Service, our systems may process information needed to provide, operate, and secure it, such as IP address, access times, requested resources, response and error information, and browser, operating-system, or app-version details where technically available.

Purposes: operating the Service, maintaining reliability, troubleshooting, and preventing unauthorized access or abuse.
GDPR legal bases where applicable: Article 6(1)(f) (legitimate interests in secure and reliable operation) and, where necessary to provide requested services, Article 6(1)(b) (performance of a contract).

2.2 Account Information and Service Features

To create and use an account, we may process registration and profile information, a mobile phone number, account identifiers, and data needed for groups, Actions, and other features. This may include content you choose to publish, group memberships, and information needed to display and administer Actions.

Purposes: account registration, sign-in, providing community features, and detecting misuse.
GDPR legal bases where applicable: Article 6(1)(b), and Article 6(1)(f) for necessary security measures.

2.3 Hosting at Hetzner

The central platform data is hosted on a server operated or administered by us using infrastructure provided by Hetzner. Technical logs, security information, and backups may also be processed through that infrastructure. Where Hetzner acts as a processor on our behalf, applicable data-processing requirements, including GDPR Article 28 where relevant, apply.

2.4 SMS Verification Through Twilio

When registering or signing in, you may be required to verify your mobile phone number using a one-time passcode (“OTP”) delivered by SMS. We process the phone number you provide and the technical information needed to request and confirm verification. We use Twilio to deliver these messages and transmit the necessary delivery information to that provider.

These messages are sent for authentication and account security, not for SMS marketing. Requesting a verification code initiates that specific security message and does not mean you agree to unrelated marketing or tracking.

GDPR legal bases where applicable: Article 6(1)(b), with Article 6(1)(f) where necessary to protect accounts.
Retention: as needed for account security, authentication, and applicable legal obligations.
International transfers: Where Twilio or its subprocessors process data outside the European Economic Area, we rely on an applicable lawful transfer mechanism, such as an adequacy decision covering an eligible recipient or appropriate standard contractual clauses and additional safeguards where required. Carrier messaging or data charges may apply.

Chapter 3 – Public Groups, Actions, and User-Generated Content

3.1 Public Groups Are Free to Create

Creating a public group is free of charge. WhatsNext – Action does not require payment to create a public group and does not collect payment information solely because you create one.

3.2 Visibility of User Content

Depending on the features and visibility settings you use, your username, posts, group memberships, Actions, or other information you share may be visible to other users. Content you place in public areas may reach a wider audience than content shared in private groups. Please avoid sharing information publicly that you wish to keep confidential.

A mobile phone number provided for authentication is not made public merely because you join a group. However, contact details you independently publish in posts or other visible fields may be seen by others.

3.3 Processing for Community Features

We process content, membership data, and interactions as necessary to display posts and Actions, operate groups, and deliver the requested community features. GDPR legal basis where applicable: Article 6(1)(b).

3.4 Reports and Moderation

Users can report suspected illegal content, privacy violations, or breaches of community rules. When handling reports, we may process the report, relevant content, account details necessary for investigation, communications, and any resulting action. We review sufficiently specific reports and take appropriate measures as required by applicable law, which may include restricting content or accounts. We do not generally pre-screen every user submission manually.

GDPR legal bases where applicable: Article 6(1)(f) (protecting users and the Service) and Article 6(1)(c) where processing is necessary to fulfill a legal obligation.

Chapter 4 – Information for Members of Public and Private Groups

4.1 Group Visibility

The information visible to others depends on the type of group, available features, applicable settings, and what you choose to disclose. Public groups may expose information to a wider audience. We cannot control whether another user remembers, records, screenshots, or otherwise retains information made visible to them.

4.2 Notifications

The Service may display account, group, and Action notifications, including push notifications where supported. Your device permissions and operating-system settings may affect their delivery. If additional push-service providers are used, the related information practices must reflect the actual technical configuration.

4.3 In-Person Meetings and User Arrangements

Users may independently arrange meetings or activities. CombMe UG (haftungsbeschränkt) remains responsible for its own processing of personal information as required by applicable law. Separate data collection or handling carried out independently by other users is distinct from the Company's processing.

4.4 Deleting Content

You may remove content using available Service functions. Information already viewed, copied, or separately retained by other people may not be recoverable or removable by us. Deleted information may remain temporarily in system backups for a limited period consistent with our backup operations.

4.5 Reporting Privacy Concerns

Report suspected improper disclosure of personal information or other privacy and community concerns through available reporting tools or contact@whatsnext-action.com.

Chapter 5 – Cookies, Device Storage, and Consent

Our website and app may use storage or access technologies necessary to provide features such as maintaining a signed-in session or securing accounts. Applicable law may allow these strictly necessary technologies without separate consent.

For nonessential analytics technologies, including Google Analytics where it stores information on or accesses information from a device, we obtain advance, informed, voluntary consent wherever required by applicable law, including applicable European rules. Any required choice must be capable of being actively made and subsequently withdrawn.

Using WhatsNext – Action or accepting its Terms of Use is not, by itself, consent to Google Analytics. Where consent is legally required, the relevant nonessential analytics technology must not be activated before valid consent is obtained. Refusing optional analytics must not prevent access to basic features for which analytics is unnecessary.

Where legally required, the website or app must provide an effective way to manage or withdraw that consent. Other rights or opt-out mechanisms may apply to users in specific U.S. states, depending on the activities involved and the scope of the applicable law.

Chapter 6 – Contacting Us

If you contact us by email or an available contact feature, we process the information you provide, such as your contact details, message, and relevant account or support information, to respond to the inquiry and address related matters.

GDPR legal bases where applicable: Article 6(1)(f) for responding to inquiries, Article 6(1)(b) for contractual requests, and Article 6(1)(c) for legal compliance.

We retain support communications only as long as needed for the inquiry, legitimate recordkeeping, dispute resolution, or applicable legal requirements.

Contact: contact@whatsnext-action.com

Chapter 7 – Sharing and Disclosure of Personal Information

We do not sell personal information as part of our stated business model. However, we use service providers that may receive or process information to support the Service, including:

• Hetzner: hosting and server infrastructure;

• Twilio: SMS verification and delivery;

• Google / Google Analytics: product usage analytics where the service is enabled and an appropriate legal basis exists.

Other users can see the information that the relevant community features make available to them. We may also disclose information when required by applicable law, to respond to lawful requests, protect rights and safety, investigate security incidents, or establish, exercise, or defend legal claims, to the extent permitted by law.

Where required, we enter into appropriate data-processing agreements with providers. Whether a particular disclosure is legally classified as a “sale,” “sharing,” or targeted-advertising disclosure under a U.S. state law depends on that law and the provider's actual data use and contract terms. We do not use this notice to waive rights that applicable law grants to users.

Chapter 8 – External Links and Embedded Media

Users may share links to external websites, videos, or other content. When you follow a link or access another provider's service, that provider's privacy practices may apply.

Whether third-party media, including YouTube videos, are embedded directly in WhatsNext – Action and whether such an embed transmits information before you interact with it depend on the actual implementation. Any such integration requires an appropriate disclosure and, where legally required, a separate consent mechanism.

Chapter 9 – Google Analytics and Internal Product Improvement

9.1 Purpose of Internal Analytics

We use Google Analytics to understand how the Service is used and to improve its features, usability, reliability, and overall quality. For example, we may examine whether features are used and how often users create Actions.

Reports and insights obtained through Google Analytics are used internally by CombMe UG (haftungsbeschränkt) for product development and Service improvement. Access to our analytics reporting account is restricted to internally authorized personnel. We do not sell our internal analytics reports or use them as a separate commercial product.

This limitation on our internal use of reports does not mean Google receives no device, usage, or other technical data when providing Google Analytics. Google's processing depends on the actual integration, account settings, and applicable agreements.

9.2 Content and Identifiers

We do not use Google Analytics to analyze the text or content of individual Actions or private user messages. Our intended internal reports focus on usage trends, not identifying individual people.

Nevertheless, depending on how Google Analytics is implemented, the service may collect or process online identifiers, device information, or usage events that qualify as personal information under applicable law. Aggregated reports do not necessarily mean all underlying collection and processing are anonymous.

We do not intend to send Action text, phone numbers, or directly identifying profile details to Google Analytics as analytics-event parameters. This is separate from the technical identifiers or usage data the analytics technology may process.

9.3 Legal Basis and User Choice

Where consent is required, including under applicable EU rules for nonessential device access, Google Analytics is used only following valid consent, and users can withdraw that consent with effect for the future. Where a U.S. privacy law imposes additional disclosure, consent, or opt-out requirements on our activities, we comply to the extent it applies.

GDPR legal basis where applicable: Article 6(1)(a), together with applicable device-access consent requirements. See Chapter 5.

Information from Google about data processed through its services: https://policies.google.com/technologies/partner-sites

Chapter 10 – Service Providers and International Data Transfers

10.1 Hosting Infrastructure

Our core platform is hosted on infrastructure provided by Hetzner and administered or managed by us. The use of Twilio and Google Analytics means that not all information involved in providing the Service is processed exclusively on our Hetzner server.

10.2 Transfers Outside the European Economic Area

Twilio, Google, or their subprocessors may process information outside the European Economic Area depending on the services, contracts, and technical operations involved.

Where the GDPR applies to an international transfer, we use an appropriate mechanism recognized by applicable law, such as an adequacy decision for an eligible recipient or standard contractual clauses with supplementary safeguards where necessary. Such safeguards depend on the recipient and the actual transfer.

10.3 No Blanket Claims

We do not claim that all data is anonymous, that all processing occurs solely in Germany, or that providers never receive information. Our practices must reflect the Service's actual configuration.

Chapter 11 – Data Retention

We retain personal information for the period reasonably necessary for the disclosed purposes and any applicable legal, security, or recordkeeping requirements. Where an exact period cannot be specified in advance, the criteria below apply:

• Account data: generally while the account remains active and, after deletion, only as necessary or legally permitted;

• Groups and Actions: while needed to provide the relevant functions, subject to deletion requests, settings, and legal obligations;

• SMS verification information: as necessary for authentication, account security, and legally required records;

• Technical and security logs: as necessary for service operation, incident response, and legally justified records;

• Analytics information: according to the retention settings configured in Google Analytics and applicable consent and legal requirements;

• Support and moderation records: while the matter is being handled and longer if reasonably necessary to meet legal obligations or defend or pursue claims;

• Backups: deleted information may remain for a limited technical backup period before scheduled replacement or removal.

Deletion does not necessarily remove copies made independently by other users outside our systems.

Chapter 12 – Your Privacy Rights, Including U.S. State Rights

12.1 Rights Under the GDPR

Where the GDPR applies and subject to its conditions, you may have rights to access, correction, deletion, restriction, portability, objection to certain processing, and withdrawal of consent. You may also lodge a complaint with a competent data protection authority.

To exercise your rights, email contact@whatsnext-action.com. We may request information reasonably necessary to verify your identity before fulfilling a request.

12.2 Privacy Rights of U.S. Residents

Depending on your state of residence and whether the relevant law applies to our activities, you may have rights to request access to or confirmation of personal information processed about you, correction, deletion, a portable copy, or an opt-out of certain uses such as qualifying sales, sharing, or targeted advertising. Some laws also provide rights to appeal decisions regarding privacy requests or to limit certain uses of sensitive personal information.

For example, the California Consumer Privacy Act, as amended (“CCPA”), applies only when statutory criteria are met; it does not automatically apply to every small startup solely because some users live in California. We do not claim that all rights under every U.S. state law apply to every user.

If a particular law applies to us, we will honor its applicable rights, deadlines, verification procedures, and nondiscrimination requirements. You can submit requests using contact@whatsnext-action.com. We do not deny services or discriminate unlawfully because a user exercises an applicable privacy right.

12.3 Users Outside the United States and European Union

Other national or regional privacy laws may apply based on where you live, the nature of the Service, and applicable legal thresholds. We will respect mandatory rights where those laws apply.

12.4 Automated Decision-Making

Based on the current features described in this Policy, we do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects for users. If we introduce such processing, we will provide information and choices required by applicable law.

Chapter 13 – Data Security, Incident Response, and Support

13.1 Safeguards

We use security measures reasonably designed to protect personal information against unauthorized access, loss, misuse, or disclosure. These measures may include securing data transmission, limiting account or server access, and maintaining appropriate backup and recovery processes according to our actual configuration.

CombMe UG (haftungsbeschränkt) manages the Service, with hosting through Hetzner and specific processing by Twilio and Google when those tools are used. No representation in this Policy constitutes a guarantee that all security risks can be prevented.

13.2 Security Incidents

If we become aware of a security or privacy incident, we assess the circumstances and make notifications where required by applicable law, which may include the GDPR and relevant U.S. state breach-notification statutes. Applicable rules and timing depend on the nature of the incident, the information affected, and the jurisdiction.

13.3 Security Contact

To report a privacy or security concern, contact contact@whatsnext-action.com.

Chapter 14 – Changes to This Privacy Policy

We may update this Privacy Policy when our data practices, services, or legal requirements change. The updated version will be published through the Service or website with a revised “Last Updated” date. We will provide additional notice when required by applicable law.

Continued use of the Service is not automatically consent to new processing for which separate consent is legally required. Where such consent is required, we will request it separately. We will not retroactively expand the use of previously collected personal information in a manner that violates applicable law.

Chapter 15 – Privacy Contact and Regulatory Information

15.1 Contact the Responsible Company

CombMe UG (haftungsbeschränkt)
Backesweg 54 A
63477 Maintal
Germany
Email: contact@whatsnext-action.com
Website: https://www.whatsnext-action.com

15.2 Privacy Requests

For privacy questions, access and deletion requests, correction requests, objections, withdrawal of applicable consent, or security reports, please contact the email address above. We will process requests according to the law applicable to the request.

15.3 Data Protection Authorities

Where the GDPR applies, you may complain to an appropriate supervisory authority. For the Company's location in Hesse, Germany, this may include the Hessian Commissioner for Data Protection and Freedom of Information. Other supervisory authorities may also have jurisdiction under applicable law.

U.S. residents may also contact the relevant state attorney general or privacy regulator where applicable law provides for regulatory oversight.