Privacy Policy
2026-10-15 · EN
Draft for review. Not yet effective or available for acceptance. Supplier locations, retention and the current operator registration must be verified before publication.
445672727
Georgia, Batumi, Baratashvili street 26, commercial space N5, 6010
info@tpl-s.com
Scope and controller
This notice covers Pochill’s website and application. The Georgian operator identified below determines the purposes and means of account administration, discovery, communication, moderation and service analytics. Users do not become the controller of those operations merely by using Pochill. Organizers, ticket sellers and sign-in providers can independently control their own processing.
Accounts and profiles
We process account identifiers, email, sign-in credentials or provider identifiers, name, date of birth, gender, description, social links and photos that you provide. Account and communication data support the service contract; security and abuse prevention rely on necessary legitimate interests or legal duties where applicable. Optional profile material is voluntary. Required fields are indicated in the application. Without necessary account data, account features cannot be provided.
Location and participation
Selected city, country and location information help show relevant activities. Device location requires the device permission where applicable; granting it does not authorize unrelated uses. We process saved activities, participation requests, created events, preferences and interactions to deliver requested features. Do not publish sensitive information that is unnecessary for an activity.
Messages and support
We process messages, attachments, recipient and chat identifiers and timestamps to deliver conversations and provide support. Recipients obtain the messages you send. Authorized personnel and service providers may access relevant information for support, investigating reports, security or legal duties where necessary. We do not describe chats as end-to-end encrypted.
Public information
Public profile and event pages may show your name, photos, description, social links, city and activities and may be accessible without an account and indexed by search engines. Do not assume a public post is private. Email, authentication secrets and the full date of birth are not intended for public display. Other people can independently copy public information or messages; request removal from us and, where necessary, the recipient or search engine.
Device, technical and usage data
We process IP addresses, device and application information, language, request timestamps, device identifiers, push tokens and interaction/search records for delivery, diagnostics, security and understanding use. Push tokens can be linked to an account and device; they are not anonymous simply because they are tokens. Analytics identifiers and pseudonymous data may still be personal data. Optional analytics or tracking requiring consent must not operate until that consent is obtained.
Payments
For paid features, stores and payment providers process payment information under their own notices. Pochill processes purchase references, verification information and entitlement dates to activate benefits, prevent fraud and meet applicable legal duties. This does not mean Pochill receives your full bank-card details.
Marketing and permissions
Email and push marketing require a separate affirmative choice where required; accepting Terms of Use is not marketing consent. You may withdraw marketing consent in the relevant settings, an unsubscribe mechanism or by contacting us. Withdrawal does not affect earlier lawful processing. Necessary login, safety and transaction notices are distinct from marketing. Device permissions can be changed in the operating-system settings.
Recipients and suppliers
Recipients include communication recipients, public-page visitors, event organizers when needed for participation, and authorized providers for hosting, storage, email, authentication, push, analytics, maps, payment verification and automated content processing. The project includes Google/Firebase, Apple, DigitalOcean-compatible storage, Mailgun and external AI/map integrations; actual enabled providers, contracting entities, locations and data flows must be verified before this version is published. Do not send sensitive information into automated-content features. We do not promise that unrelated independent providers act only on our instructions.
International transfers
Our production databases and application servers are hosted in Amsterdam, Netherlands. Mailgun email delivery uses infrastructure in the United States. Firebase services can process data on Google’s global infrastructure, potentially including the United States; an Analytics reporting location does not establish the storage location. The operator must verify product-specific settings, destination countries, contracting entities and transfer safeguards before publication. Transfers must satisfy applicable law through appropriate safeguards or a valid statutory exception where required. Acknowledging this notice is not blanket consent to international transfers. Contact us for information about recipients and safeguards.
Retention and deletion
We retain account/profile information, participation and conversations while necessary for the requested account and features. On an erasure request we remove data without a continuing lawful basis and explain any specific retention. For Georgia we act or give a reasoned refusal within 10 working days of receipt, subject to applicable law. Login codes expire after 10 minutes and are cleared on use or scheduled cleanup. Our adopted schedule is 14 days for technical logs and failed-job records, 30 days for AI request/response diagnostic logs, and 90 days for identifiable daily activity. Completed import diagnostics use a seven-day window; external request caches expire according to purpose-specific TTLs, up to 30 days for translations. Minimal acceptance and erasure-completion evidence is retained for the account lifetime and three years after confirmed closure; unresolved necessary case evidence is isolated and reviewed every 90 days. Accounting documents are retained for six years after the relevant reporting period where Georgian law requires, without retaining the whole profile. We review accounts inactive for 24 months before any proposed closure, with advance notice. Separate copies held by recipients may require separate assessment. Our backup expiry target is 35 days; targets for Mailgun event logs and GA4 user/event data are up to 30 days and two months respectively. These external settings, all log sinks and product-specific exceptions must be verified before publication; local cleanup does not establish deletion at a supplier. Backups are restricted and erasures reapplied before restored data are used. A legal hold must be specific, necessary and reviewed; pseudonymisation alone is not anonymisation.
Your choices and rights
Depending on applicable law, you may request access and a copy, correction, deletion, restriction, portability, information about recipients and transfers, withdraw consent, or object to processing including direct marketing. Contact the email below or use account deletion in settings. We may proportionately verify identity; we will explain any lawful refusal or necessary retention and respond within applicable statutory deadlines. You may complain to the competent data-protection authority; in Georgia the current law assigns oversight to the State Audit Office. Contractual liability caps do not remove statutory data rights.
Security and incidents
We must apply organizational and technical measures appropriate to the risks. No system is absolutely secure, but this is not a waiver of our security obligations. We assess, record and respond to incidents and notify the competent authority and affected individuals when required within the applicable deadlines. Device and credential security also depend on your actions.
Age, imported sources and automated features
Pochill accounts are for adults aged 18 or over. Report suspected minor accounts so we can investigate and take appropriate measures. Imported public event information can contain names or contact details obtained from organizer websites or public channels; public availability does not remove privacy duties. Automated descriptions, translations and recommendations can be inaccurate. This notice does not authorize significant solely automated decisions or unrelated AI training on private data.
Updates and contact
We identify revisions by version and notify material changes. New consent is requested when the law requires it. This document is an information notice, not a promise that every optional purpose is necessary for the contract. Contact the controller below about privacy, recipients, retention and your rights.