Privacy Policy

Last updated: July 2026

1. Controller

The controller for data processing within the meaning of the GDPR is ALPHA Counsel and Coaching UG (haftungsbeschränkt), Muthesiusstraße 6, 12163 Berlin, Germany, represented by its Managing Director Monika Katic, email: admin@layoverlinkapp.com.

2. Overview and principles

LayoverLink connects identity-verified airline crew who are on a layover in the same city during the same period. We process personal data only for defined purposes, in a data-minimising way, and on the legal bases set out below. A core principle is data minimisation: other users only ever see first name and airline.

3. Data processed, purposes and legal bases

a) Account and registration data (first name, airline, email, authentication identifier). Purpose: providing and managing the user account. Legal basis: performance of the user contract, Art. 6(1)(b) GDPR.

b) Verification media (photo of the work ID/crew badge and a selfie). Purpose: manual review of eligibility (active airline crew) to safeguard the protected nature of the service and user safety. Legal basis: your explicit consent, Art. 6(1)(a) GDPR. The verification media serve solely for manual human visual review; no processing of special categories of personal data within the meaning of Art. 9 GDPR (in particular biometric data) takes place. Safeguards: the images are made available only to an authorised reviewer via a password-protected admin console, deleted immediately upon the review decision, and automatically removed permanently after 30 days at the latest.

c) Layover data (city and date of the layover). Purpose: automatic assignment to a city- and date-based group chat. Legal basis: performance of the user contract, Art. 6(1)(b) GDPR.

d) Chat content (via the processor Stream). Purpose: providing the chat function; only first name and airline are shown in the chat profile. Legal basis: performance of the user contract, Art. 6(1)(b) GDPR.

e) Safety and moderation data (reports, blocks, review logs). Purpose: protecting users, preventing abuse, and meeting platform-related obligations. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, and legal obligations, Art. 6(1)(c) GDPR.

f) Technical data (e.g. access and error logs). Purpose: operation, security and stability of the service. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

g) Pre-launch website waitlist (email address, city/base, language). Purpose: joining the waitlist and being notified about the launch in the respective city. Legal basis: your consent under the double-opt-in procedure, Art. 6(1)(a) GDPR. As proof of consent, we log — only at the moment of the confirmation click — the time, IP address and user agent (Art. 7(1) GDPR). The confirmation and launch emails are sent via Brevo (EU); you can unsubscribe at any time via the link in every email.

4. Recipients and processors

To provide the service we use carefully selected providers acting as processors under Art. 28 GDPR on the basis of a data processing agreement:

  • Stream: chat infrastructure (US provider; see section 5).
  • Firebase Authentication: authentication/sign-in (Google/Firebase).
  • Hetzner (Germany): operation of servers, database and encrypted storage in data centres in Germany/the EU.
  • IONOS & Supabase (EU): operation of the pre-launch website and storage of the waitlist in the EU region (Frankfurt).
  • Brevo (Sendinblue): sending of the waitlist emails (double opt-in, launch); EU provider (France).
  • Meta (WhatsApp): operation of the city-based WhatsApp communities you can voluntarily join via a link (US provider; see section 5). We ourselves neither collect nor store phone numbers.

Identity verification by an external provider (Persona) is technically prepared but not currently active. No transfer to third parties for advertising purposes takes place.

5. Transfers to third countries (USA)

The core infrastructure (servers, database, image storage) runs at Hetzner in Germany; the website and waitlist at IONOS and Supabase in the EU; email delivery via Brevo within the EU. Insofar as individual processors process data outside the EU/EEA, in particular in the USA (Stream, possibly Firebase, and Meta/WhatsApp for the city-based communities), this takes place on the basis of a data processing agreement, your consent to processing by these processors, and — where applicable — the EU Commission's Standard Contractual Clauses (Art. 46 GDPR).

6. Retention

We store personal data only for as long as necessary for the stated purposes. Verification media are deleted upon the review decision, at the latest after 30 days. Verification status is valid for 12 months. Account and chat data are processed until the account is deleted; account deletion includes deleting the chat identity held by the processor. Statutory retention obligations remain unaffected.

7. Your rights

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7(3)); the lawfulness of processing carried out until withdrawal remains unaffected. A message to admin@layoverlinkapp.com suffices to exercise these rights.

8. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), which is responsible for the controller's registered office.

9. Obligation to provide data

Providing account and verification data is necessary to use the service. Without verification, participation in the chats is not possible. There is no obligation to provide data; however, without the required data the service cannot be used.

10. Data security and changes

We take appropriate technical and organisational measures to protect your data (including restricted access to verification media, encryption of image storage, and deletion concepts). This privacy policy may be adapted to reflect changes in the law or in features; the version provided at the time applies. Provider details can be found in the Imprint.