Kwelo — Privacy Policy

Interim policy — effective 30 August 2026, under final legal review. It accurately describes Kwelo’s real data practices as of this date. A small number of items are being finalised with our legal advisers: appointing our EU Article 27 Representative and confirming our UAE→EU transfer paperwork. Our privacy contact email moves to privacy@kweloapp.com once that mailbox is live.

1. Who we are (the data controller)

Kwelo is operated by Kwelo Computer System and Communication Equipment Design L.L.C-FZ, a Limited Liability Company incorporated in the Meydan Free Zone (Meydan FZ), Dubai, United Arab Emirates (Formation No. 2652765, Licence No. 2652765.01), registered office Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. (“Kwelo”, “we”, “us”). We are the data controller for the personal data described in this policy.

• Privacy contact: privacy@mesta.eu.com

We serve users in Finland and the EU. Because we offer our service to people in the EU, the EU GDPR applies to us even though we are established in the UAE (GDPR Art. 3(2)).

Our EU Representative (GDPR Art. 27): an EU Representative is being appointed. Until then, EU/EEA users may contact us directly at privacy@mesta.eu.com on any data-protection matter.

Personal data is hosted in the European Union (Ireland). As a UAE-based controller (Meydan Free Zone — a Dubai free zone that falls under the UAE federal data-protection regime, not a separate DIFC/ADGM data law) we also comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

2. Scope

This policy covers the Kwelo mobile app (iOS and Android) and the kweloapp.com website. It explains what personal data we collect, why, our legal basis, who we share it with, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (Tietosuojalaki 1050/2018).

3. What data we collect

You give us:

• Account: email address, username, password (passwords are stored hashed by our auth provider — we never see them in plain text), and your date of birth — used to verify you meet the minimum age (13) and to age-gate content such as nightlife; not shown to other users. Later: Apple/Google sign-in identifiers.
• Profile: display name, home city, language preference.
• Your activity in the app: venues you favourite, saved lists / day plans, reviews and ratings you write, and (later) photos you upload.
• Loyalty: check-ins at partner venues, points earned, rewards/redemptions, and subscription/entitlement status if you join Kwelo+.

Collected automatically:

• Approximate/precise location — only with your permission, used for city selection and to verify a loyalty check-in is genuinely at the venue. Location permission is requested “while using the app” only, and the app works without it (you can pick a city manually).
• Device & technical data: device type, operating system, app version, and IP address (via server logs) for security, fraud prevention and reliability.
• Push token (if you enable notifications).

Analytics / tracking: In the app, we currently use no third-party analytics or advertising trackers. On our website we use Plausible — a privacy-friendly, cookieless analytics tool that collects no personal data and cannot identify you — and, only if you accept it, the Meta and TikTok advertising pixels (see our Cookie Policy). If we add analytics elsewhere in future, we will update this policy, disclose the provider, and — where required — ask for your consent first.

4. Why we use your data, and our legal basis (GDPR Art. 6)

5. Who we share it with (processors / subprocessors)

We do not sell your personal data. We share it only with service providers who process it on our behalf under a data-processing agreement:

• Supabase — database, authentication, and hosting (EU region, Ireland).
• Apple / Google — app distribution, in-app purchases, and push notifications.
• Expo / EAS — app build and delivery infrastructure.
• A transactional email provider — for sending verification and account emails (provider to be confirmed before launch).

(Marketing-content tools we use to make our own promotional videos do not process your personal data and are not listed here.)

Selling or sharing your data for advertising. We do not currently sell or share your personal data with advertisers or other third parties for their own marketing, and we never do so by default. We may introduce advertising-related data sharing in the future — if and when we do, we will first: (a) update this policy to state exactly what is shared and with whom; (b) obtain your explicit opt-in consent; (c) show Apple’s App Tracking Transparency prompt where it applies; and (d) give you a clear way to opt out at any time. We will never sell your personal data without your consent. Separately, we may share aggregated or anonymised information that does not identify you (e.g. overall trends) — this is not personal data.

6. International transfers

Your data is stored in the EU (Ireland). However, because our controlling entity is in the United Arab Emirates, your personal data may be accessed from or transferred to the UAE. The UAE is not covered by an EU adequacy decision, so these transfers are protected by Standard Contractual Clauses (SCCs) or other appropriate safeguards under GDPR Chapter V. Some providers (e.g. Apple, Google) may also process data outside the EEA under equivalent safeguards. You may request details of the safeguards from privacy@mesta.eu.com. As Kwelo expands internationally, we maintain appropriate safeguards and update this section.

7. How long we keep it

• Account data: for as long as your account is active.
• After you delete your account: we delete or anonymise your personal data within 30 days, except where we must retain limited records to meet legal obligations (e.g. payment/tax records).
• Reviews: on account deletion, we anonymise your reviews — the rating and text remain useful to other users, but they are no longer linked to you.
• Server logs: kept for a short period for security, then deleted.

8. Your rights (GDPR)

You have the right to: access your data, rectify it, erase it (“right to be forgotten”), restrict or object to processing, data portability (get a copy in a portable format), and to withdraw consent at any time. To exercise any right, email privacy@mesta.eu.com — you can also delete your account and data directly in the app (Settings → Delete account), see Account & Data Deletion.

We respond within one month (GDPR Art. 12). We will not discriminate against you for exercising your rights.

9. How we protect your data

• Encryption in transit (HTTPS/TLS everywhere) and at rest.
• Row-Level Security on every database table, so one user can never read another user’s data.
• Session tokens stored in the device’s secure enclave (Keychain/Keystore), not plain storage.
• Strict key hygiene — no secrets in the app; server-only privileged access.
• Payment card details are handled by Apple/Google, never by us.

10. Children

Kwelo is not directed at children under 13. In Finland the age of digital consent is 13; users under that age require verifiable parental consent. We do not knowingly collect data from children under 13; if you believe we have, contact privacy@mesta.eu.com and we will delete it.

11. Complaints

If you have a concern, please contact us first at privacy@mesta.eu.com. You also have the right to lodge a complaint with the Finnish supervisory authority:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) — tietosuoja.fi — or with the supervisory authority in your EU country of residence.

12. Changes

We will update this policy as Kwelo evolves and post the new “last updated” date. Material changes will be notified in-app or by email.

13. Contact

privacy@mesta.eu.com · Kwelo Computer System and Communication Equipment Design L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.