EN
EspañolCatalàEnglishFrançais
Join

Privacy policy

Last updated: October 21, 2026

At Chollo we process your data only to make the app work, to verify that you are between 18 and 26 years old and to charge for your subscription. We do not sell your data or use it for third-party advertising.

1. Data controller

2. What data we process and why

Account. First name, surname, email address, date of birth, phone number (optional), language, profile photo (optional) and your invitation code. Used to create and manage your account. Legal basis: performance of the contract.

Age verification. The photo of your ID document. A member of our team reviews it to check your name and date of birth, and it is deleted as soon as the decision is made. We only keep the result (verified or rejected) and, if rejected, the reason. Legal basis: performance of the contract (the service is reserved for people aged 18 to 26).

Use of deals. When you scan a venue's QR code, which deal you activate, and when and whether the staff validate it. Used to apply each deal's rules (once a day, once a month…), prevent fraud and give each venue aggregated statistics. Venues do not see your name or email. Legal basis: performance of the contract and legitimate interest in preventing fraud.

Subscription and payments. Plan, status, renewal dates and Stripe customer ID. Your card details are handled directly by Stripe; we never see them. Legal basis: performance of the contract and legal obligations (invoicing).

Invitations. The code you used when signing up, who invited you and whom you have invited, and the payments that give right to a reward. To prevent fraud (inviting yourself, duplicate accounts), we compare the random app installation identifier and your email address (normalised) with those of the person who invited you. The person who invited you receives none of that data: they only see your first name and the status of the invitation (pending, validated). Used to run the invitation programme and give out its rewards. Legal basis: performance of the contract and legitimate interest in preventing fraud.

Ambassadors. If you are a Chollo ambassador: your identity, contact details, IBAN, tax status (individual, self-employed, company or association), tax ID (NIF) and the amounts of your commissions, withholdings and payments. Used to calculate and pay your commissions and to meet our tax obligations (for example, reporting withholdings to the Spanish tax agency). Legal basis: performance of the ambassador contract and compliance with legal (tax) obligations.

Location. If you turn it on, your position is used only on your phone to sort venues by distance. We do not send or store it.

Notifications. If you accept them, we store your phone's notification identifier, its operating system (iOS or Android) and your language, to send you alerts about your account, new deals and venue events. You can choose what you receive in the app settings or turn them off on your phone. Legal basis: consent.

App audience measurement. Usage events that we record ourselves, without any third-party tools: the venues shown in lists, the venue pages you open and where you opened them from (list, map, What's new panel, notification…), whether the What's new panel was viewed, tapped or closed, and the notifications you open. Each event is linked to a random installation identifier and, if you are signed in, to your account. Used to improve the app and to give partner venues, in particular those sponsoring a placement, aggregated statistics: how many people saw or opened their page and how many then activated one of their deals (a deal activated within 7 days of a view counts as a conversion). Partners never receive individual data, and figures too small to stay anonymous are hidden. We do not use any advertising identifier, do not include any third-party advertising or analytics SDK, do not sell anything and do not track you across other apps or websites. Content paid for by a partner is always labelled "Sponsored". You can turn this measurement off at any time with the "Anonymous usage stats" switch in Settings (or in Account if you use the app without an account): from then on, no events are sent. Legal basis: legitimate interest.

Website. If you join the waiting list: your email, language, profile (local or Erasmus) and where you heard about us. If a business writes to us: venue name, contact person, phone number, email and message. Site audience is measured with Plausible, without cookies and without personal data. Legal basis: consent (waiting list) and legitimate interest (replying to businesses).

Marketing emails. Only if you tick the corresponding box when you sign up. You can withdraw your consent whenever you want. Legal basis: consent.

3. How long we keep it

When you delete your account, we erase your personal data. Activations may be kept anonymously for venue statistics, without any data that could identify you. App usage events are unlinked from your account.

4. Who we share it with

Only with providers that deliver the service for us and act on our instructions:

Partner venues do not receive your personal data: they only see aggregated figures, namely how many deals have been used at their venue and, for those sponsoring a placement, how many times their page was viewed and opened and how many conversions followed.

5. Transfers outside the European Union

Some providers (for example Stripe, Cloudflare, Expo or Anthropic) may process data in the United States. In that case, transfers are based on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

6. Your rights

You can request access to, rectification, erasure, restriction or portability of your data, object to its processing and withdraw your consent at any time by writing to hola@cholloapp.com. You can also delete your account directly from the app (Settings → Delete my account) and turn off the app's audience measurement with the "Anonymous usage stats" switch.

If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).

7. Minors

The service is reserved for people aged 18 to 26. We do not knowingly process data of people under 18: if a sign-up fails age verification, it is rejected.

8. Security

Data is encrypted in transit. Each user can only read their own data, ID documents are stored in a private space accessible only to the verification team, and payments are handled by Stripe.

9. Changes

If we make significant changes to this policy, we will let you know in the app before the change takes effect.