Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on Tanbuh is:

For any questions about data protection and to exercise your rights, please contact us at the email address above.

Data security

All data between your browser and our servers is transmitted encrypted via TLS (HTTPS). We store passwords only as bcrypt hashes, so we cannot see them in plain text.

In addition, we take appropriate technical and organisational measures (Art. 32 GDPR) to protect your data against manipulation, loss, destruction and unauthorised access, and we continuously adapt them to the state of the art.

When you visit the website

You can use Tanbuh without an account. Below we inform you in accordance with Art. 13 GDPR which personal data we process when you use it, for what purpose, on what legal basis and for how long.

Each time you visit our website, your browser automatically transmits data to our server and to the upstream service Cloudflare (see below). The following is processed:

- your IP address

- date and time of access

- the page or file requested (URL)

- the website from which you reached us (referrer URL)

- browser type and version as well as operating system (user agent)

We use this data for the following purposes:

- delivering the website and ensuring a smooth connection

- security and stability of the system, in particular error analysis

- protection against abuse, e.g. limiting login attempts, sign-ups and requests per IP address

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the purposes mentioned. For abuse limits, the IP address is only held briefly in memory. We do not draw conclusions about your person from this data.

Registration and account

Certain features (provider profile, reviews, favourites, forum, feedback) require an account. When you register, we collect your name, email address, gender and a password, as well as your confirmation that you are of legal age. This information is required for registration; without it we cannot create an account. The password is stored only as a bcrypt hash.

For login we use NextAuth.js with signed JSON Web Tokens. After login, technically necessary cookies are set: __Secure-next-auth.session-token (keeps you logged in, up to 30 days), __Host-next-auth.csrf-token (protection against cross-site request forgery, session) and __Secure-next-auth.callback-url (redirect after login, session). The cookies contain no login credentials in plain text.

The legal basis is Art. 6(1)(b) GDPR (providing the account) and Art. 6(1)(f) GDPR for protection against abuse (e.g. limiting login attempts). You can delete your account yourself at any time in the account settings or request deletion by email to [email protected]. What is deleted and what remains without any link to you is described in the section “Storage period”.

Provider profiles and events

Providers (tantra masseurs, studios, trainers) can create a public profile. The information in the profile is fully public and is indexed by search engines. This includes in particular: display name, username, title and self-description, profile and gallery images, gender, year of birth/age, languages, services offered, prices, working hours, locations (city, address, mobile radius), contact channels (email, mobile number, website, social media links), FAQ entries, details of team members (name, photo) and events (title, description, location, dates, prices, cover image).

We review every provider profile manually before it is first published. You can change or remove individual details in the profile editor at any time, set the profile offline or delete your account. The legal basis for publication is Art. 6(1)(b) GDPR (providing the directory listing); for voluntary information such as year of birth or photos, it is your consent (Art. 6(1)(a) GDPR), which you can withdraw by removing the information. Anyone who uploads photos or details of other people (e.g. team members) must have obtained their consent.

Addresses are sent to Geoapify to calculate coordinates; images are stored with ImageKit and are publicly accessible via their URL (see the respective section).

Providers see statistics about their profile in their account (e.g. views, clicks, requests). These metrics, the reviews and the completeness and activity of the profile are used automatically for the “Recommended” sorting (details in section 2 of the terms). The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest lies in an order of profiles that is helpful for visitors.

Reviews

Logged-in users can review provider profiles. A review consists of a star rating (1–5) and optionally a title, a text and a display name (without a display name, “Anonymous” is shown). One review per account and profile is possible, and at most one review every three days overall. Reviews are shown publicly on the profile immediately; your account ID and email address are not published.

The provider is notified of new reviews by email and can reply publicly; we notify you of the first reply by email. You can edit or delete your review at any time. Reviews that violate the terms may be hidden or deleted by moderation (see section 9 of the terms). The legal basis is Art. 6(1)(b) GDPR.

Forum

In the forum, logged-in users can start threads, reply and add reactions (e.g. “helpful”). Posts contain your display name, the time and the content. They are publicly visible and indexed by search engines. Please do not publish information there that identifies you or others.

You can delete your own posts within 24 hours, and also edit the opening post of a topic during that time. Deleted posts are hidden from others but remain stored so that reports and abuse can be traced. If you delete your account, your posts remain without any link to your account (“deleted user”). Reports are stored together with the reporting account. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in a functioning, coherent discussion (Art. 6(1)(f) GDPR).

Feedback board

Logged-in users can submit suggestions for improvement and bug reports. The title, description, type of entry and your profile name are publicly visible; our team is notified by email. If you delete your account, the entry remains without any link to your account. The legal basis is Art. 6(1)(b) and (f) GDPR.

Favourites

Logged-in users can mark provider profiles as favourites. For this we store the link between your account and the profile and the time. Your favourites are visible only to you; the provider does not learn who added them, but the number of new favourites is included anonymously in the profile statistics. The legal basis is Art. 6(1)(b) GDPR. You can remove favourites at any time.

Requests to providers

Using the contact form of a profile or event, you can send a request to a provider. We process your name, email address, message and – if provided – your mobile number, the desired service, preferred date, preferred team member, and event and number of seats. We store the request in our database, send it by email to the provider (with your email address as reply-to address) and send you a confirmation. From receipt onwards, the provider is responsible for any further processing of your data.

Some profiles were created by the operator and are not (yet) managed by the provider themselves. Requests via such profiles are received by the operator instead of the provider.

To protect providers, we automatically check requests against fixed rules (e.g. threats, insults, sexual expectations, links, disposable email addresses). Depending on the result, a request is delivered normally or with a warning, or held back until we review it manually. For this purpose we additionally store an encrypted hash of your IP address (no plain-text IP). Providers can report requests via a link in the email; we may then block the email address, phone number or IP hash across the platform. Requests from blocked senders are not delivered, without separate notification.

The legal basis is Art. 6(1)(b) GDPR (forwarding your request at your instruction) and Art. 6(1)(f) GDPR; our legitimate interest lies in protecting providers from harassment and abuse.

If you click “Show contact details”, we count this without any link to your account for the profile statistics (see “Our own audience measurement”) and limit the number of reveals per IP address to prevent mass harvesting of contact details (Art. 6(1)(f) GDPR).

Contact form to us

If you use our contact form, we process your name, email address, subject and message in order to answer your enquiry. The enquiry is stored in our database and also delivered by email to our mailbox ([email protected]).

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering it). We delete your enquiry once it has been fully dealt with and no statutory retention obligations apply, or earlier at your request.

Newsletter

For the newsletter we collect your email address (mandatory) and – if you provide it – your first name.

Sign-up uses the double opt-in procedure: after submitting, you receive an email with a confirmation link. You will only receive the newsletter after clicking it. The link is valid for 7 days.

The legal basis is your consent (Art. 6(1)(a) GDPR). We use your data exclusively for sending the newsletter until you unsubscribe.

The newsletter is sent via our email service Google Workspace (see “Sending emails”).

You can withdraw your consent at any time, e.g. via the unsubscribe link in every newsletter. When you unsubscribe, your entry is completely deleted from our newsletter database. The lawfulness of processing carried out until then remains unaffected.

Alternatively, you can unsubscribe at any time by email to [email protected].

Recipients and disclosure of data

Content you publish (e.g. profile details, reviews, forum and feedback posts) is visible to all visitors. Your email address is not published unless you, as a provider, enter it yourself as a public contact channel. Requests to providers are received by the respective provider.

Beyond that, we only pass personal data on to third parties if:

- you have expressly consented (Art. 6(1)(a) GDPR),

- this is necessary to perform a contract with you (Art. 6(1)(b) GDPR),

- we are legally obliged to do so (Art. 6(1)(c) GDPR), or

- it is necessary to establish, exercise or defend legal claims and there is no overriding legitimate interest on your part (Art. 6(1)(f) GDPR).

To operate the platform, we use the service providers listed below. Where they process data on our behalf, we have concluded data processing agreements with them in accordance with Art. 28 GDPR. We do not sell data and do not pass it on for advertising purposes.

Transfers to third countries

Some of our service providers are based in the USA or process data there. For the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework, Art. 45 GDPR) insofar as the recipient is certified under it; this applies to the US service providers named below. In addition, the service providers rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Hosting and database (Heroku)

We operate our website and database with Heroku, a service of Salesforce, Inc. (415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA). Heroku processes on our behalf all data that arises when you visit the website or that you enter with us. The legal basis is Art. 6(1)(f) GDPR (reliable operation of the platform) or Art. 6(1)(b) GDPR where the processing serves the performance of a contract. For transfers to the USA, see “Transfers to third countries”.

Sending emails (Google Workspace)

We send our emails (e.g. requests to providers and confirmations, password resets, review notifications, newsletter) via Google Workspace (Gmail) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the sender, recipient, subject and content of the emails on our behalf; a transfer to Google LLC in the USA is possible. The legal basis is Art. 6(1)(b) GDPR or, for the newsletter, your consent (Art. 6(1)(a) GDPR).

Cloudflare

Our website is delivered via the network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Cloudflare acts as a reverse proxy and content delivery network: all visits to our website pass through Cloudflare servers, which process the data listed above under “When you visit the website”, including your IP address, in order to detect and fend off attacks and to deliver content quickly.

To distinguish humans from bots, Cloudflare may set technically necessary cookies (e.g. __cf_bm, lifetime 30 minutes).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and fast provision of the website. For cookies, the legal basis is Section 25(2) no. 2 TDDDG. More information: https://www.cloudflare.com/privacypolicy/.

Images (ImageKit)

We store images (profile, gallery, team and event images) with the service ImageKit (contracting party: ImageKit Inc., USA; technical operation: ImageKit Private Limited, India) and deliver them from there. When uploading, your browser sends the file directly to ImageKit. When displaying, your browser loads the images directly from ImageKit (ik.imagekit.io); your IP address and browser data are transmitted to ImageKit in the process. Uploaded images are publicly accessible via their URL.

The legal basis is Art. 6(1)(b) GDPR (displaying profiles) or Art. 6(1)(f) GDPR (fast, resource-efficient image delivery). For transfers to third countries, see “Transfers to third countries”. More information: https://imagekit.io/privacy-policy.

Cookies and local storage

Cookies are small text files that your browser stores on your device. We set technically necessary cookies without consent on the basis of Section 25(2) no. 2 TDDDG; the subsequent data processing is based on Art. 6(1)(f) GDPR. We set all other cookies only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We use:

- tan-1.0.0 – stores your choice in the cookie banner (necessary, 1 year)

- NEXT_LOCALE – stores the selected language (necessary, until you close the browser)

- NextAuth.js login cookies – only after login (necessary, see “Registration and account”)

- __cf_bm – bot detection by Cloudflare (necessary, 30 minutes)

- _ga, _ga_* – Google Analytics (only with consent, up to 2 years)

In your browser’s local storage (localStorage), the forum temporarily keeps a quote you want to include in a reply; it is removed after inserting (necessary).

You can change or withdraw your choice in the cookie banner at any time via the “Cookie settings” link in the footer of every page. You can also delete or block cookies in your browser; without necessary cookies, however, some features (e.g. login) will not work.

Google Analytics

On our public pages we use – only if you choose “All cookies” in the cookie banner – Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). Without your consent, Google Analytics is not loaded. Google Analytics is never loaded in the account and admin areas. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”.

Google processes pseudonymous usage data, in particular pages viewed, time spent, referrer URL, browser, operating system, device type and approximate location. According to Google, Google Analytics 4 does not log or store IP addresses; the IP address is only used to derive the approximate location.

We use the data to evaluate the use of our website statistically and to improve our offering. Usage data is deleted after 14 months at the latest. A transfer to Google LLC in the USA is possible (see “Transfers to third countries”). More information: https://support.google.com/analytics/answer/6004245?hl=en.

Fonts

Fonts are served locally from our own server (next/font). When you visit our website, no connection is made to Google Fonts or other font providers.

Our own audience measurement (without cookies)

For profile statistics and the “Recommended” sorting, we record certain events ourselves, without cookies and without third parties: page and profile views, appearances in result lists, clicks, opened contact forms, revealed contact details, new favourites and requests. We store the type and time of the event, the page visited, the profile concerned, the referring page (referrer) and a pseudonymous visitor ID.

We generate the visitor ID anew every day as a hash of IP address, browser identifier, date and a secret key. We do not store the IP address and browser identifier themselves, and visits on different days cannot be linked. Bots are not recorded; views by the operator and by providers on their own profile are not counted.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in meaningful statistics for providers and fair sorting. The events are deleted automatically after 90 days. You can object to the processing under Art. 21 GDPR.

Error and performance monitoring (Sentry)

To detect and fix technical errors, we use Sentry by Functional Software, Inc. (45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). If an error occurs, technical information is sent to Sentry: error message and stack trace, URL visited, browser and operating system. In addition, we record performance data (e.g. loading times) for about every tenth page view.

Sentry is configured not to send default personal data (e.g. IP address, cookies, user ID); we remove passwords, email addresses and tokens before sending. We do not use session recordings (Session Replay). For technical reasons, Sentry nevertheless receives your IP address when the connection is established. Sentry does not set cookies.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the stability and security of our services. Error reports are deleted after 90 days at the latest. For transfers to the USA, see “Transfers to third countries”. More information: https://sentry.io/privacy/.

Location search and geocoding (Geoapify)

To convert addresses into coordinates and to show place suggestions in the search, we send the address or search term entered to Geoapify (KEPTAGO LTD, N. Nikolaidi & T. Kolokotroni, Onisiforou Center, 2nd Floor, 8011 Paphos, Cyprus). This concerns the locations of providers and place entries by visitors in the search. The requests go through our server; your IP address is not sent to Geoapify.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in an accurate radius search. Geoapify processes the data in data centres in the EU and, according to its own statements, generally stores request data for no more than 24 hours. More information: https://www.geoapify.com/privacy-policy.

Storage period

We only store personal data for as long as is necessary for the respective purpose or required by statutory retention obligations. In detail:

Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The automatic sorting of profiles and the rule-based pre-check of requests serve presentation and protection against abuse respectively; we review held-back requests manually.

Your rights

You have the following rights towards us. Simply contact us by email at [email protected].

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can send your objection informally by email to [email protected].

Changes to this privacy policy

We update this privacy policy when our services or the legal situation change. The version published here applies.

Last updated: 2026-10-15