1. Controller pursuant to Art. 13 GDPR
Schindler & Bachmann UG (haftungsbeschränkt), Erlanger Strasse 17, 91083 Baiersdorf, Germany, email: info@schindler-bachmann.com, website: heylu.app
Data protection officer: Bastian Bachmann
2. Introduction
heylu.app is a random chat for adults aged 18 and over. You are connected with other people by video or text, can add interests, send friend requests and message your friends.
We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
3. Data we process
3.1 Account data
- Email address
- Password (stored only as a hash)
- Verification codes for confirming your email address and resetting your password
- Username, date of birth and gender
- Optional: profile picture, first and last name, text about yourself
3.2 Location data
We derive your country and city from your IP address. Your country is shown to chat partners and used for the country filter unless you turn on Ninja Mode. Other users only see your city if you don't hide it. We don't collect your precise location.
3.3 Video and audio
Video and audio are sent encrypted via WebRTC directly between you and your chat partner. If no direct connection is possible, they are relayed encrypted through a relay server (TURN) we operate. We don't record video or audio.
To protect everyone, moderators can watch and listen to ongoing video chats live. While a moderator has a chat open, your camera and microphone signal is also sent to the moderator's browser. For the moderation overview, low-resolution still images are transmitted and not stored permanently.
3.4 Reports and evidence
When someone is reported, we store a still image of both cameras, the chat history, the reason and the time of the report. When we ban an account, we store an evidence photo in the original and a blurred version. The blurred version is shown to the banned person on the ban page; only moderators can see the original.
3.5 Chat messages
Messages written in the random chat are kept for 30 days so abuse can be traced, then deleted automatically. Direct messages between friends are kept until you delete them or your account.
3.6 Usage data
- Connections (matches): participants, start, end, mode (video or text), participants' countries and cities and shared interests
- Your interests and filter settings
- Friend requests, friendships and notifications
- Reports you file or that are filed about you
- Bans with reason and time
3.7 Premium and payments
If you buy Premium, we process the plan, term, status and a transaction reference. Browser payments are processed by Stripe. Only Stripe receives full card or account details, we don't.
3.8 Server logs and sessions
Each request may involve your IP address, date and time, pages visited, browser, operating system and error messages. For signed-in sessions we also store IP address and user agent.
4. Purposes
- Providing and operating heylu.app
- Creating and managing your account
- Connecting video and text chats, preferably with people who share your interests
- Friendships and direct messages
- Moderation, handling reports, securing evidence and preventing abuse
- Sending verification codes and important notices by email
- Providing Premium features
- Security and stability
- Meeting legal obligations and enforcing or defending legal claims
We don't use advertising trackers and we don't sell data.
5. Legal bases
- Art. 6(1)(b) GDPR: performance of the user agreement, in particular account, chat matching, friendships, messages and Premium.
- Art. 6(1)(f) GDPR: legitimate interest in a safe service, in particular live moderation, chat logs, evidence, abuse and fraud prevention.
- Art. 6(1)(a) GDPR: consent, for example camera and microphone access in the browser and optional cookies.
- Art. 6(1)(c) GDPR: legal obligations such as retention duties.
6. What other users see
Your chat partners see your username, profile picture, age, gender and country unless you turn on Ninja Mode, as well as your camera image and audio. Your email address and exact date of birth are never visible to other users.
7. Recipients and service providers
7.1 Hosting
Servers, database, relay server and file storage are operated by our hosting provider in Germany. The provider will be added.
7.2 Email
We use an email service for verification codes and system messages. It processes your email address and the content of the email.
7.3 Stripe
Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe receives your name, email address, the payment details you enter at checkout, amount and item, and technical data for fraud prevention. Stripe's privacy policy at https://stripe.com/privacy also applies.
7.4 Authorities
Authorities and other bodies where we are legally required to or where it is necessary to enforce or defend legal claims, in particular for content relevant under criminal law.
8. Transfers outside the EU
Using Stripe may involve processing in the USA. Such transfers are based on appropriate safeguards under Chapter V GDPR, in particular the EU-US Data Privacy Framework or standard contractual clauses.
10. Camera and microphone
For video chat your browser asks for access to your camera and microphone. Video chat can't be used without a camera; text chat can. You can revoke access at any time in your browser settings.
11. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawing consent with effect for the future
- Lodging a complaint with a supervisory authority (Art. 77 GDPR)
An email to info@schindler-bachmann.com is enough for any request.
12. Retention and deletion
You can delete your account at any time in the settings. Your profile, friendships, messages and notifications are then deleted unless legal duties or legitimate reasons require otherwise.
Random chat messages are deleted automatically after 30 days. Reports, evidence photos and ban records are kept as long as necessary to prevent repeat violations, investigate crimes or defend legal claims. Billing records are kept for up to ten years under commercial and tax law.
Deleted data may remain in backups for a limited time and is overwritten in the regular backup cycle.
13. Security
- Encrypted transport (TLS, WebRTC with DTLS-SRTP)
- Passwords stored as hashes
- Limits on sign-in and code attempts
- Moderation data accessible to administrators only
- Regular software updates
14. Changes
We update this privacy policy when our services, providers or legal requirements change. The current version is always available at heylu.app/privacy.