Privacy Policy
Last updated: October 2026
This privacy policy explains which personal data we process when you visit our website (walloho.com), use our portal (app.walloho.com) and our interfaces (API, wallet passes).
1. Controller
Controller within the meaning of the General Data Protection Regulation (GDPR):
SoHo – Unzeitig e.U., Kettenbrückengasse 20/14, 1040 Vienna, Austria.
Contact: office@walloho.com
The full provider details (address, company register number, VAT ID) are in the imprint.
2. Overview: our roles
- As controller we process data of website visitors, of Walloho account holders (our customers) and billing data.
- As processor we process the data of pass recipients (our customers' end customers) solely on behalf of and on the instructions of the respective customer. The basis is the data processing agreement concluded with the customer; for that data the customer is the controller.
3. Visiting the website
Our website is hosted by Vercel. When you access it, technically necessary connection data (including IP address, date/time, page requested, browser type) is processed in the host's server logs to deliver the page and secure operation. Vercel is a US provider; see section 7 for the basis of transfer.
We use no analytics, tracking or advertising services on the website. Fonts and icons are self-hosted (no Google Fonts or similar), and no cookies are set. To show current prices, the home page fetches data server-side from our own portal.
4. Portal app.walloho.com (account)
For a Walloho account we process the data provided at registration (email address; for local sign-in a password, stored only as a cryptographic hash) and the information required for account management and billing. The portal and its database run on a server in Austria.
The portal sets the following strictly necessary cookies:
| Name | Purpose | Lifetime |
|---|---|---|
| .AspNetCore.Identity.Application | Keeping you signed in after login | up to 14 days (sliding) |
| .AspNetCore.Antiforgery.* | Protection against cross-site request forgery on forms | Session |
| wp_imp | Support access: marks that a staff member is viewing an account for a support request | Session |
Support access: for troubleshooting, staff can temporarily view a customer account "on behalf" via a dedicated function. Such access is logged.
5. Sign in with Google
You can sign in with your Google account. During sign-in we receive from Google your name, email address,
profile picture and Google account identifier (scopes openid, profile,
email).
We permanently store only your email address and a unique identifier of your Google account — solely to link the sign-in to your Walloho account. Name and profile picture are not stored permanently.
- Purpose: solely sign-in and management of your Walloho account.
- No sharing with third parties, no sale, no use for advertising, no training of AI models.
- Retention: as long as your account exists; deletion on request to office@walloho.com or with account deletion.
- Revoke the link: any time at myaccount.google.com/permissions.
Walloho's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Sign in with Microsoft (Entra ID)
Alternatively you can sign in with a Microsoft account (Microsoft Entra ID). During sign-in we receive your name, your email address or sign-in name and a Microsoft account identifier. We permanently store only your email address and a unique identifier of your Microsoft account to link the sign-in to your Walloho account. Purpose, retention and deletion are as in section 5; manage the link in your Microsoft account.
7. Email delivery (Amazon Web Services / SES)
To send emails (e.g. pass delivery, account and billing emails) we use Amazon Simple Email Service (SES) of Amazon Web Services, Inc. This processes the recipient address, the email content and any links. Delivery runs via a region in the USA. The EU-US Data Privacy Framework and the EU Commission's standard contractual clauses serve as the framework for the transfer to the USA. We do not make a blanket claim about the provider's certification status; it must be verified separately.
8. Wallet passes (Apple & Google)
To provide wallet passes we transmit pass contents to the wallet services of Google (Google Wallet API) and Apple. For Apple updates we also process the device/push identifier (APNs push token) created when a pass is registered on the device, in order to send updates to the device. These providers also process data outside the EU (framework as in section 7). We process pass contents and recipient data on behalf of our customer (section 2).
9. Payments (Stripe)
For payment processing we use Stripe (currently in test mode). Payment and invoice data are processed directly by Stripe; we do not receive full card data. Stripe also processes data outside the EU (framework as in section 7).
10. Legal bases
- Art. 6(1)(b) GDPR (contract): account, portal use, pass creation and delivery, payments.
- Art. 6(1)(c) GDPR (legal obligation): retention of invoice and billing data.
- Art. 6(1)(f) GDPR (legitimate interest): secure operation, server logs, abuse prevention, support.
- For pass recipients' data we act as processor; the legal basis lies with the customer (controller).
11. Retention
We store account data for as long as the account exists and delete it afterwards or on request, unless legal retention obligations apply (e.g. tax/commercial periods for invoices). Deleted media files are permanently removed after a retention period (currently 30 days). Revoked passes are deactivated.
12. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection; you may withdraw any consent at any time. Please contact office@walloho.com.
You also have the right to lodge a complaint with a supervisory authority, in Austria the Austrian Data Protection Authority (dsb.gv.at).