Kwelo — Privacy Policy
English is the controlling version. Last updated 20 October 2026.
1. Who we are (the data controller)
Kwelo is operated by Kwelo Computer System and Communication Equipment Design L.L.C-FZ, a Limited Liability
Company incorporated in the Meydan Free Zone (Meydan FZ), Dubai, United Arab Emirates (Formation No. 2652765,
Licence No. 2652765.01), registered office Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai,
U.A.E. (“Kwelo”, “we”, “us”). We are the data controller for the personal data described in this policy.
- Privacy contact: tietosuoja@kweloapp.com
- We have not appointed a Data Protection Officer; the law does not require one for a service of our size and
kind. The privacy contact above handles every data-protection question.
We serve users in Finland and the EU. Because we offer our service to people in the EU, the EU GDPR
applies to us even though we are established in the UAE (GDPR Art. 3(2)).
Our EU Representative (GDPR Art. 27): we are appointing a representative established in the EU, whom you
may contact instead of us on any data-protection matter. Their name and address will be published here as soon
as the appointment is complete.
Personal data is hosted in the European Union (Ireland). As a UAE-based controller (Meydan Free Zone — a
Dubai free zone that falls under the UAE federal data-protection regime, not a separate DIFC/ADGM data law) we
also comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
2. Scope
This policy covers the Kwelo mobile app (iOS and Android) and the kweloapp.com website. Kwelo was
previously called Mesta; the old mesta.eu.com address and its mailboxes are no longer in use. It explains
what personal data we collect, why, our legal basis, who we share it with, how long we keep it, and your
rights under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act
(Tietosuojalaki 1050/2018).
3. What data we collect
You give us:
- Account: email address, username, password (passwords are stored hashed by our auth provider — we
never see them in plain text), and your date of birth — used to check you meet the minimum age (16) and
to keep nightlife out of what we recommend to under-18s; not shown to other users. If you sign up with a
friend’s referral code, we store that code (their username) on your account.
- Sign in with Apple or Google (coming in a later version): when we add it, choosing it will send us the
account identifier, your e-mail address (Apple may give a private relay address instead of your real one) and
the name on that account; Google also sends your profile-picture link. We will still ask you for a username and
your date of birth, because Apple and Google do not tell us your age. We will update this section when it ships.
- Profile: today the profile row on our servers holds only your account id and your username. Your language
choice and the city you browse stay on your phone. If we start storing a display name, home city or language on
our servers, we will update this section first.
- Stored on your phone, not on our servers (today): the places you favourite, saved lists and day plans,
your private ratings, your check-ins, your mood and interest choices, your dietary preference (including the
alcohol-free setting), who you usually go out with, your sauna timer sessions (heat, cold and rest
minutes, rounds, and the sauna temperature you typed — from which the app calculates a rough sweat estimate
on your phone; nothing is measured by a sensor), and — as these features arrive — your trail logs and the
badges and streaks the app awards you for places you have been. These stay on your device and are cleared when you sign out.
If you tap Share on a finish card, the app makes an image on your phone with the place, the day, your
minutes and the estimate, and hands it to the app you choose; we never receive that image. If we later sync them to your account so they follow you between devices, we will update this policy
first and ask for your consent where the data could reveal something sensitive (for example a dietary choice
linked to religion).
- Loyalty (when Kwelo Rewards launches): verified visits at partner venues, receipt totals and receipt
photos entered by venue staff, points, treats and redemptions, and — for check-ins you do on your phone at
trails, events and parks — the location of your tap. We will update this section and the app-store privacy
labels before this goes live. Kwelo+ subscription status if you join Kwelo+ (not yet offered).
Collected automatically:
- Location — only with your permission, and only while you use the app. Today it is used on your phone
to show places near you, position the map, and confirm you are at a place when you check in; your
coordinates are not sent to our servers — a check-in records only which place. The app works without
location (you can pick a city manually).
- Device & technical data: device type, operating system, app version, and IP address (in our provider’s
server logs) for security, fraud prevention and reliability.
- Website waitlist: if you join the launch waitlist on kweloapp.com we store your email address, when you
joined, and which page or ad brought you (campaign tags) — to email you about the launch and to know which
of our ads work. We also use your email address for advertising audiences: we send a one-way hashed
(unreadable) version of it to Meta (Instagram and Facebook) so that Kwelo ads can be shown to you and to
people whose interests resemble yours, and so we stop showing sign-up ads to people who have already joined.
Meta cannot read the address; it only matches it against accounts it already holds. This applies to sign-ups
made on or after 19 September 2026. You can opt out at any time using the link in every email we send or
by writing to tietosuoja@kweloapp.com; we remove you from those audiences within 24 hours.
- App usage analytics (first-party): which screens, categories, places and features you open, searches
(only whether a search returned results and how long the query was — never the words you typed), the city
you browse, your language, platform and app version, and a random session identifier. When you are signed in,
these events are linked to your account ID so we can understand how members use Kwelo. This data goes only to
our own database — no third-party analytics SDK, no advertising identifier, no cross-app tracking. You can
turn usage analytics off at any time in Settings → Analytics.
- Crash and performance reports: if the app crashes or misbehaves, a technical report (error message, code
location, device model, OS version, app version) is sent to our crash-reporting provider so we can fix it. We
strip personal data (emails, usernames, tokens, location) from these reports on your device before they are
sent, and they are not linked to your account.
- Invitations: if you invite a friend, we record that an invitation was shared and, when they sign up with
your code, that they were referred by you.
Advertising trackers: the app contains no advertising or cross-app tracking SDK (no Meta, Google or
TikTok SDK), so Apple’s App Tracking Transparency prompt does not apply. The website uses privacy-friendly,
cookieless page analytics (Plausible) by default; advertising pixels (Meta, TikTok) load on the website only
after you accept them in the cookie banner — see the Cookie Policy.
4. Why we use your data, and our legal basis (GDPR Art. 6)
| Purpose |
Legal basis |
| Create and run your account; provide favourites, lists, reviews, loyalty |
Contract (Art. 6(1)(b)) |
| Verify loyalty check-ins; prevent fraud/abuse; keep the service secure |
Legitimate interest (Art. 6(1)(f)) |
| Process Kwelo+ subscription payments (via Apple/Google) |
Contract + legal obligation (tax/accounting) |
| Website waitlist / launch emails; any marketing emails |
Consent (Art. 6(1)(a)) — you can withdraw anytime |
| Advertising audiences on Meta built from waitlist emails (hashed) |
Legitimate interest (Art. 6(1)(f)) — reaching people like our early sign-ups; opt out at any time |
| In-app usage analytics |
Legitimate interest (Art. 6(1)(f)) — improving Kwelo; you can turn it off in Settings |
| Advertising pixels on the website |
Consent — the cookie banner |
| Comply with legal obligations |
Legal obligation (Art. 6(1)(c)) |
5. Who we share it with (processors / subprocessors)
We do not sell your personal data. We share it only with service providers who process it on our behalf
under a data-processing agreement:
- Supabase — database, authentication, and hosting (EU region, Ireland); also stores our first-party
usage analytics.
- Apple / Google — app distribution and, when offered, Sign in with Apple / Google (they act as independent
controllers for the sign-in itself) and in-app purchases.
- Google (Maps) — on Android, the map inside the app is drawn by the Google Maps SDK, which receives the
map area you look at and standard device information under Google’s privacy policy. On iOS the map is
Apple Maps.
- Expo / EAS — app build and over-the-air update delivery (the update check sends your app version and
platform, nothing about you).
- Resend — sending verification, password-reset and account emails (EU region, Ireland).
- Sentry — crash and performance reporting for the app (technical reports only, personal data stripped on
the device; EU region, Germany).
- Google Workspace — our email (the tietosuoja@ and asiakaspalvelu@ mailboxes, waitlist notifications).
- Hetzner — a server in the EU running our own automation that turns website form submissions into emails
to us.
- Plausible Analytics — cookieless, aggregate page analytics on the website only (EU-hosted).
- Meta — advertising measurement on the website (pixel and server call, only if you accept in the
cookie banner) and advertising audiences built from hashed waitlist emails (opt-out in every email; see §3).
TikTok — website pixel only, consent-gated; we do not send TikTok your email. Neither is present in the app.
See the Cookie Policy for exactly what is sent.
(Marketing-content tools we use to make our own promotional videos do not process your personal data and are
not listed here.)
Advertising audiences. We do not sell your personal data. The one advertising use we make of it today is the
Meta audience described in §3, built from hashed waitlist email addresses, with an opt-out in every email. If we
ever go further than that — for example sharing data with advertisers for their own marketing, or tracking you
across other apps — we will update this policy first, ask for your explicit opt-in consent, show Apple’s
App Tracking Transparency prompt where it applies, and keep a clear way to opt out. We may also share
aggregated or anonymised information that does not identify you (e.g. overall trends) — this is not personal
data.
6. International transfers
Your data is stored in the EU (Ireland and Germany) with the providers listed in §5. Because Kwelo the
company is in the United Arab Emirates, our team may access that data from the UAE to run the service.
The UAE is not covered by an EU adequacy decision. GDPR applies to Kwelo directly (Art. 3(2)), and we are
putting in place the additional safeguards GDPR Chapter V requires for this access — Standard Contractual
Clauses or the mechanism our EU legal advisers confirm — and will name the mechanism here once confirmed.
Some providers (Apple, Google, Meta, TikTok) may process data in the United States
under the EU-US Data Privacy Framework or Standard Contractual Clauses. You may request details of the
safeguards from tietosuoja@kweloapp.com.
7. How long we keep it
- Account data: for as long as your account is active.
- After you ask us to delete your account: your account is kept for a 30-day grace period (sign back in
during that time and it is restored), then your account and personal data are permanently deleted, except
where we must retain limited records to meet legal obligations (e.g. payment/tax records).
- Reviews (when public reviews exist): on account deletion we anonymise your reviews — the rating and
text remain useful to other users, but they are no longer linked to you.
- Usage analytics events: kept for 13 months, then deleted automatically; deleted with your account.
- Crash reports: kept by our crash-reporting provider for up to 90 days.
- Website waitlist: until we have emailed you about the launch and for 12 months after, unless you tell us
you want to keep hearing from us; you can unsubscribe at any time.
- Server logs: kept for a short period for security, then deleted.
8. Your rights (GDPR)
You have the right to: access your data, rectify it, erase it (“right to be forgotten”),
restrict or object to processing, data portability (get a copy in a portable format), and to
withdraw consent at any time. To exercise any right, email tietosuoja@kweloapp.com from the address on
your account — you can also delete your account and data directly in the app (Profile → Settings → Delete
account; see Account & Data Deletion).
We respond within one month (GDPR Art. 12). We will not discriminate against you for exercising your rights.
9. How we protect your data
- Encryption in transit (HTTPS/TLS everywhere) and at rest (by our database provider).
- Row-Level Security on every database table, so one user can never read another user’s data.
- Session tokens stored in the device’s secure storage (iOS Keychain / Android Keystore), not plain storage.
- Strict key hygiene — no secrets in the app; server-only privileged access.
- Payment card details are handled by Apple/Google, never by us.
10. Children
Kwelo is not directed at children. You must be 16 or older to create an account (the legal minimum in
Finland is 13; we set ours higher because Kwelo lists nightlife). We do not knowingly collect data from anyone
under 16; if you believe we have, contact tietosuoja@kweloapp.com and we will delete it.
11. Complaints
If you have a concern, please contact us first at tietosuoja@kweloapp.com. You also have the right to lodge a
complaint with the Finnish supervisory authority:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) — tietosuoja.fi — or with the
supervisory authority in your EU country of residence.
12. Changes
We will update this policy as Kwelo evolves and post the new “last updated” date. Material changes will be
notified in-app or by email.
tietosuoja@kweloapp.com · Kwelo Computer System and Communication Equipment Design L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.