Effective Date: 22 October 2026
Version privacy@2026-10-22.3 · Last updated: 22 October 2026. Earlier versions are kept, and we will send you any of them on request.
The controller is Quelper LLC, a limited liability company registered in Delaware, USA (file number 10022353). The company is run entirely from Madrid, Spain, and every decision about Quelper is taken there. Under Article 3(1) GDPR, what counts is where a business actually operates, not where it is registered or where its servers are. That is why the GDPR applies to all users of Quelper, not only to people in Europe, and why our supervisory authority is the Agencia Española de Protección de Datos (AEPD).
If you are in the United Kingdom, the UK GDPR also protects you: write to us directly at the address below, and you can complain to the UK Information Commissioner’s Office (ICO).
Postal address: Quelper LLC, c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA (our registered agent in Delaware). More company details are on the Legal Notice page.
Contact for anything in this policy, including requests about your data: s.alekhin@quelper.com. This is also our designated address for requests under Nevada law (NRS 603A). We have not appointed a data protection officer. Neither Article 37 GDPR nor article 34 of Spain’s Organic Law 3/2018 requires one of us: we do not monitor people regularly and systematically on a large scale, process special categories of data on a large scale, or build user profiles on a large scale. The address above reaches the person who decides on your request.
The GDPR requires a legal basis for each use of personal data. We use four: contract (Art 6(1)(b): needed to provide what you signed up for), legal obligation (Art 6(1)(c): for example tax and accounting records), legitimate interest (Art 6(1)(f): a reason of ours that we have weighed against your interests, and that you can object to), and consent (Art 6(1)(a): you can withdraw it at any time). Each section below says which one applies.
What: your email address and password (our database provider, Supabase, stores only a one-way hash of the password), the name you enter at sign-up, and, if you signed up through someone’s invitation, who invited you. The sign-in system also records when you confirmed your email address and when you last signed in. You sign in with email and password only; we do not offer sign-in through Google, Facebook or similar services.
Why: to create your account, keep it secure, let you sign in and reset your password, and to write to you. The only automatic emails are the address-confirmation and password-reset messages: Supabase’s sign-in service prepares them, and our email provider, Resend, delivers them (section 4); and the emails about a card on the specialists map (section 2.21(c)). Apart from those, we write to your email address ourselves, one message at a time: about your account, your orders and payouts, changes to our terms and policies, and decisions about your account or your listings, and to answer you. We send no newsletters or advertising, except news about Quelper to people who asked for it (sections 2.20 and 2.21).
Basis: contract. Your email address, a password and a name are required: without them we cannot create an account for you.
What: display name, username (you can change it once), profile photo, cover image, bio, links you add to your website and social accounts (X/Twitter, Instagram, YouTube, LinkedIn, TikTok, GitHub, Telegram), and your language and currency settings.
Who can see it: once your profile is published, it is public at quelper.com/pro/your-username, without signing in. A new account’s profile starts unpublished; you publish it, or unpublish it again, in the creator studio. Every account is given a username automatically (such as user12345) until its owner chooses one. Your photo and cover image are stored as public files that anyone with their web address can open. If you run a community on Quelper and your card on the specialists map is marked “Quelper author”, the card shows your profile photo too (section 2.21(d)).
Search engines and AI crawlers. Our sitemap, the list of pages we offer to search engines, includes only the published profiles of creators (accounts that have become creators on Quelper, run a community, or have published a service, course, product or blog post) and their public pages. Other profiles are not listed in it, even when published. We allow search engines and AI crawlers to read every public page on Quelper, apart from the profiles of people who objected (below), including crawlers that collect web content for training AI models, such as Common Crawl (CCBot) and Google-Extended, so a published profile that is not in the sitemap can still be read by a crawler that reaches it, for example through a link. We add your social links to the page’s machine-readable data so that search engines can connect your profile to them.
Why and basis. Showing your profile to people who visit Quelper: a profile exists so that others can find and recognise you, and for creators being found is the reason to be on Quelper. Basis: contract. Listing creators’ profiles in our sitemap and letting search engines and AI crawlers read public pages, including for AI training, is a separate purpose: we want Quelper and its creators to be found and cited by search engines and AI assistants. Basis: legitimate interest. You can object to it by writing to us. If you do, we take your profile and the pages under its address (quelper.com/pro/your-username and everything after it) out of our sitemap and ask search engines and AI crawlers, in our robots.txt, not to read them; your profile stays visible on Quelper. Crawlers that ignore robots.txt, and copies made before, are outside our control. You can also unpublish your profile yourself in the creator studio, which takes it out of public view altogether.
When you replace your photo, the old file is not deleted automatically. Deactivating your account in Settings hides your profile page, but it does not by itself unpublish your listings, communities or posts.
What: services, courses, digital products and communities, with their titles, descriptions, prices, categories, languages and images.
In-person services: when you type a meeting address, Google’s address search suggests places, so Google receives what you type. We store the city and the country (if Google returns no city, the address you typed is stored in its place), the exact coordinates and Google’s identifier for the place. Every visitor to the service page sees the exact meeting point and any meeting instructions you write, so do not put door codes or anything else you would not put on a public sign into those instructions.
Basis: contract.
What: posts, comments, likes, poll votes, questions and answers in communities; blog posts and portfolio items; community events and your replies to them; your progress through courses; and direct messages to other members (text only).
How files are stored:
Deleting: deleting a community post, a community comment or an item in a community’s content library hides it from everyone. The record stays in our database, and its files stay in storage, until your account is erased; ask us if you need something removed sooner. Blog posts, blog comments, portfolio projects and images, and service listings are removed from our database as soon as you delete them, but the files uploaded with them stay in storage until we remove them at your request or your account is erased. You cannot currently delete direct messages yourself. They are visible to you and the other person and are kept until either account is erased. We do not read direct messages in the ordinary course of running Quelper, but our administrators can sign in to any account, which shows them its messages (section 11).
Basis: contract.
When you join a community we record your membership: the plan, how you joined (paid, free invitation, guest or lifetime), the relevant dates, and when you were last active in it.
Member map (optional). If you press “Set my location” (or “Update location”) on a community’s map, or switch on “Visible on map” before you have a location, your browser asks for your location. Your browser sends that exact position to Mapbox, which tells it the town you are in, its country and the towns within 50 km of you. The exact position is not sent to us and is not saved. We save the town, the country and its flag, and a point rounded to about 10 km and shifted by a small random amount, and show you on the map. You can then pick one of those nearby towns instead, and we save that town, its country and flag, and a point rounded and shifted in the same way around it. Members who are on that community’s map themselves, and the creator, see your name, photo and pin at roughly 10 km precision; members who are not see only how many members are in your city. Basis: consent, which you give by pressing the button and letting your browser share your location. If you refuse your browser’s request, nothing is looked up or saved. If you had no location yet, you are not shown on the map; a location saved earlier stays until you press “Remove location”.
Until 5 October 2026, refusing the browser’s request made the page estimate your location from your IP address through the service ipapi.co (run by Kloudend, Inc. in the United States) and save it. It no longer does this. If you think a location was saved for you that way, press “Remove location” on that community’s map: that deletes it.
Hiding and deleting your location. Switching the map to “Hidden” takes you off that community’s map at once: Quelper no longer shows your city, country, flag or pin to anyone else there, the creator included — not on the map or in its city counts, not in the member list, on your card or in its search, and not in Quelper Bot posts, including posts that introduced you earlier. While you are hidden, you too see only how many members are in each city, and no other member’s city in the member list. We keep what we saved, so that switching back to “Visible on map” shows the same town again with one click, without setting your location anew. “Remove location” withdraws your consent: it deletes the city, country, flag and point we saved for you in that community and takes you off the map; to appear on the map again, set your location anew. When the policy dated 7 October 2026 first took effect, we deleted the locations still stored for members who were hidden at that time. A short note next to the map’s buttons says what is sent to Mapbox, what we save, who sees it and how to hide or delete it.
Creators and Quelper. Inside a community, the creator and Quelper decide together how some of your data is used: the creator decides who may join and switches features such as Quelper Bot and the leaderboard on or off, and Quelper decides how those features work. For this we are joint controllers (Article 26 GDPR). Under our arrangement with creators (Terms of Use, section C7), Quelper gives you the information in this policy, answers your requests about your rights and handles security incidents on the platform; you can also send a request to the creator, who will pass it to us. What a creator does outside Quelper with what they see — for example copying member details or contacting members elsewhere — is the creator’s own responsibility as an independent controller, and our Terms of Use allow it only for running their community and in line with data protection law. People a creator invites to their team act under the creator’s authority (Article 29 GDPR; section 2.19).
Basis: contract, except where stated above.
Paying. Checkout happens on Stripe’s own payment page. You enter your card details there; we never see or store them. Stripe creates a customer record for you. When you look at a subscription on Quelper, we fetch the card brand and its last four digits from Stripe to show you, without storing them.
What we send to Stripe: your account’s email address; the item, with its title, description, image and price; reference numbers for your account, the creator, the item and any referrer or scout involved; for services, the booking date and package and, if you ask for the service to start within your 14-day withdrawal period, the time of that request; and, for a tip, the message you write, which also becomes the item description on Stripe’s page.
What we keep: an order record: what you bought, from whom and when, the amount, fees and commissions, the currency, the status (paid, refunded or disputed) and Stripe’s reference numbers. It also holds, for a tip, the message you wrote; for a service, the date and package you chose, the reason for any discount and, if you asked for it to start within your withdrawal period, when you asked; for a physical product, the delivery name and address you gave on Stripe’s page; and, if you bought for someone else, that person’s account.
Who receives the payment depends on where the creator’s Stripe account is:
If the creator has no Stripe account yet that can accept payments, Quelper receives the whole payment and pays the creator later (section 2.7). In every case the creator sees on Quelper your name or username, what you bought, the amount and the fees and, for a physical product, the delivery name and address. Who settles the card payment does not change who you contract with: memberships, courses, digital products and other digital access are sold by Quelper LLC, and services and physical products come from the creator (Terms of Use, section A2).
Physical products. For a physical product, Stripe’s payment page asks for the name and address to deliver it to, and Stripe gives them to us with the payment. We keep them with the order record; the creator sees them on Quelper with your order and uses them only to send you the item and handle a return. We do not ask for a phone number.
Basis: contract for the purchase; legal obligation for keeping order records for tax and accounting; legitimate interest for fraud checks and our internal revenue reports. Stripe also uses payment data for its own purposes, such as fraud prevention and its legal duties, under the Stripe Privacy Policy.
If you deactivate your Quelper account or ask us to erase it, we cancel your running memberships (Terms of Use, section B3); your Stripe customer record stays with Stripe.
Through Stripe. When you set up payouts, we open a Stripe Connect Express account for you and give Stripe your email address, your country and your display name (your full name, or your username if no name is set). Stripe collects your identity documents, date of birth, address, bank account and tax details directly from you, under the Stripe Connected Account Agreement and Stripe’s privacy policy; we never receive them. We keep only your Stripe account ID and whether Stripe has enabled payments and payouts for it. If your Stripe account has no business name when a buyer first pays you, we fill in your Quelper display name, because Stripe shows that name to buyers. Closing your Quelper account does not close your Stripe account; you close it with Stripe. If you do not give Stripe what it asks for, it does not enable payouts, and you cannot be paid through Stripe.
Payouts we make ourselves. Some money reaches you from us rather than through Stripe: sales whose payment went to Quelper instead of directly to you (for example because your Stripe account was not set up yet), and referral and scout commissions, which we release by hand when you ask. If your Stripe account is in the United States, Canada, the United Kingdom, the European Economic Area or Switzerland, we can pay these as a transfer to it through Stripe, which needs nothing more from you. Otherwise we pay them by bank transfer from Quelper’s account at Mercury, a US financial technology company, through its partner banks. For a bank transfer we ask you for your full name, IBAN or account number, SWIFT/BIC code and postal address. We currently collect these from you in a private chat and save them as a payee at Mercury. Quelper’s own systems do not store bank details: on our side we record only that a payout was made, with its transfer reference, date and amounts. Without these details we cannot send the transfer, so we cannot pay you this way.
Basis: contract (the programme terms and the discount you were offered); legitimate interest in preventing abuse of the programme.
We do not send direct messages, community posts or payment details to OpenAI. Basis: legitimate interest in a marketplace whose search and translations work; for creators, also contract.
Basis: contract; legitimate interest for the activity score (our interest: knowing how Quelper is used) and for admin records (our interest: giving support and acting on abuse).
We record successful and failed sign-ins: the time, your IP address, your browser’s identification string (“user agent”), the country your IP address belongs to (supplied by our hosting provider), and for failed attempts the reason and a salted one-way hash of the email address that was tried, never the address itself. They show who signed in to an account, when and from where. These records are kept for ten years and then deleted automatically, so that they are still there if a claim about an account, content or a payment on Quelper is brought years later: ten years is the ordinary limitation period in some of the countries whose law can apply (for example Italy, article 2946 of the Italian Civil Code). After the first 12 months we use these records only to establish, exercise or defend legal claims: not for the block list below and not to link visits (section 2.13). Erasing your account does not delete them: they keep your account’s ID until they are ten years old, and from the erasure we use them only to establish, exercise or defend legal claims (Article 17(3)(e) GDPR).
When we ban an account for abuse, we may add an IP address linked to it, from its sign-in or consent records (section 2.12), to a block list, and refuse requests from that address, whoever sends them. Entries are deleted automatically 12 months after they are added, or sooner if we remove them, for example when a ban is lifted.
Bot check. When you create an account, sign in, ask for a password reset or for a new confirmation email, or sign up as a Homingway author, the form first runs Cloudflare Turnstile, a check that tells people from automated programs. It is there so that nobody can create accounts in other people’s names, have our emails sent to people who never asked for them, or try one password after another. Your browser loads the check from Cloudflare, Inc., which receives your IP address, your browser’s user agent and technical signals from your browser and device; it does not read what you type into the form. The check gives the form a one-time code that is sent with your request, and our sign-in provider, Supabase, confirms the code with Cloudflare before it goes on; we do not keep the code or the result. Turnstile sets no cookies on quelper.com. Cloudflare runs the check on our instructions, and also uses these signals to improve its bot detection, for which it decides itself, under its Turnstile Privacy Addendum; it uses them only to detect bots, not to identify, profile or target anyone. Running the check in your browser needs no consent: it is strictly necessary for the account service you ask for (article 22.2 of Spain’s Law 34/2002, the LSSI).
Basis: legitimate interest (Art 6(1)(f) GDPR) in keeping accounts and the platform safe and our emails from being sent to people who did not ask for them, as recognised by the EU Court of Justice in Breyer (C-582/14), and in being able to establish, exercise or defend legal claims. The cookie banner does not affect this. You can object under Article 21 GDPR, and we will stop unless we have compelling grounds to continue or need the records to establish, exercise or defend legal claims (Articles 17(3)(e) and 21(1) GDPR).
When you answer the cookie banner, create an account, accept the creator terms or add yourself to the specialists map, we keep a record of what you chose, which version of which document it referred to, the time, and your account if you are signed in. Except when you only refuse optional cookies, the record also holds your IP address and your browser’s user agent, and your browser keeps a random ID (see the Cookie Policy) that is sent with the record, so that a choice made before you signed up can be linked to the account you then create. A record of a refusal holds no IP address, user agent or browser ID. The sign-up record is the only place where the IP address you signed up from is kept. Acceptance of the creator terms is also logged in an older, second table, with your browser’s user agent. The records of the specialists map hold, instead of your IP address, a salted one-way hash of it, and no browser ID: what you accepted or chose, the card, the time and your browser’s user agent (section 2.21(a)).
Why: to be able to show what you agreed to and when. As section 2.11 explains, the IP address in these records is also used when we ban an account.
Basis, by type of record:
How long: cookie-banner records are deleted automatically ten years after they are made. Sign-up and creator-terms records are kept while your account exists; once it has been erased, they are deleted automatically when ten years have passed since the record was made. The records of the specialists map are deleted automatically ten years after they are made, or, for a card linked to your account, kept like sign-up records; those of a card whose email address is never confirmed are deleted with the card (section 2.21(g)). Until then, after erasure, the records in our main consent table no longer point to your account but keep the IP address, user agent and random ID. Your rows in the older table of creator-terms acceptances stay as they are, with your account’s ID and your browser’s user agent, and from the erasure we use them only to establish, exercise or defend legal claims (Article 17(3)(e) GDPR). Ten years for the same reason as sign-in records (section 2.11), so that we can show what you agreed to or chose if a claim or complaint about it is brought years later. Keeping the records that long rests on our legitimate interest in being able to establish, exercise or defend legal claims (Art 6(1)(f) GDPR).
Our own counter. For every page view by every visitor we record the page path (without anything after a “?”), the interface language, the country supplied by our hosting provider, the domain of the site you came from, whether the visit looks like a bot or a browser, the browser, operating system and device type, and a visitor code. The visitor code is a hash of a fixed secret, the date, your IP address and your user agent, so the same browser gets a different code each day. Your IP address and full user agent are not stored with it, and nothing is written to your device. But we keep the secret and it does not change, so for any day on which we know your IP address and user agent we can recompute your code. We hold IP addresses and user agents linked to accounts in our sign-in and consent records (sections 2.11 and 2.12), so we could link visits on different days to each other and to an account. This data is therefore pseudonymous, not anonymous.
We use it for traffic statistics in our admin area, including daily counts of unique visitors to each creator’s profile pages (quelper.com/pro/username and every page under it, their community included), which we use to follow how a community launch is going. Basis: legitimate interest in knowing how Quelper is used. The counter runs whatever you choose in the cookie banner and whether or not your browser sends Global Privacy Control. You can object, or ask for a copy or erasure of your rows, by writing to us: if you tell us the IP address and the browser’s user-agent string you used and the dates, we can recompute your codes and find or delete those rows. How long: rows are deleted automatically 13 months after they are recorded. The counter has been running since 27 August 2026. The rows it recorded before this version of the policy took effect are kept and used in the same way and on the same basis as the rows it records now.
Google Analytics. It loads only after you allow analytics in the cookie banner, wherever you are. Until you choose, it is off. Google receives your IP address, information about your device and the pages you view, and sets its own cookies. Basis: consent.
Choices saved before 7 October 2026. A saved choice that switched Analytics or Maps on before this date is no longer used: some of those saved before 5 October 2026 were saved without a click on that switch, and they cannot be told apart from the others, so the cookie banner asks everyone who saved such a choice again, with everything off until they answer. Refusals saved before then still apply (Cookie Policy, section 3).
These providers may collect information about your activity across different websites under their own privacy policies.
Basis. Maps: consent. Video: storing and reading data in your browser so that a video can play needs no consent, because the video is part of the content you asked to see (article 22.2 of Spain’s Law 34/2002, the LSSI); sending your IP address and browser data to YouTube or Vimeo when a player loads is based on our legitimate interest in showing the videos creators and community members publish on Quelper (Art 6(1)(f) GDPR), with the privacy-enhanced players described above to limit what YouTube and Vimeo collect. There is no cookie-banner setting for video. Lookups you start: contract. Images from other sites: legitimate interest in showing a picture for every account and the images creators choose, without copying them to our own servers.
Sentry. When a page or one of our servers fails, an error report goes to Sentry: technical details of the error, your browser and operating system, and the page address with sign-in codes removed. For one page load in ten, timing data is sent as well. Reports contain no cookies, request headers or session recordings, and our setup tells Sentry not to record your IP address. Only reports about problems with payments, subscriptions and creators’ Stripe accounts include account IDs, together with Stripe reference numbers and amounts. Reports go to Sentry’s EU data region in Germany, and Sentry deletes them after at most 90 days.
Vercel hosts Quelper; our server code runs in Vercel’s region in Washington, D.C., in the United States. Vercel receives every request, with your IP address, user agent and the address requested. Its request and server logs stay available to us for one day. A few of our own server log lines contain IP addresses (in some security events) or account and order reference numbers.
Basis: legitimate interest in running a working, secure service.
We contact creators who we think might want to run a community on Quelper, through channels where they present themselves publicly, such as Instagram, Facebook, LinkedIn, Telegram, WhatsApp or email. For this we keep a record of the person’s name, links to their public profiles and website, their handles, the email address or phone number they published, their city, country, language and field, their follower count, our estimate of what they charge, where we found them, and notes on our conversations. We also record where we stand with them (the stage of the conversation, its outcome, and why they declined or paused, if they did), the date they announce their community, and our forecast of its income. If they later open a Quelper account, the record is linked to it, and our internal launch reports then compare that forecast with their community’s actual members, sales and visits.
Source: their public profiles and websites, and what they tell us. Basis: legitimate interest in offering our service to creators. Your right to object: you can object to this at any time: reply to our message or write to s.alekhin@quelper.com, and we will stop contacting you. We then delete our record about you, except your name, the link to the public profile where we found you and a note not to contact you again, which we keep so that we do not contact you again by mistake. How long: we review these records by hand every three months and delete the record of anyone who has not joined Quelper two years after our last contact with them.
Creators’ launch waitlists. Until 5 October 2026, a creator’s page could ask visitors for their email address to put them on the waitlist for a launch. Quelper no longer runs these launch waitlists. If you left your address on one, we keep it, with which launch it was for and any referral code, only until it is deleted: we do not use it to contact you or for anything else, and Quelper does not show it to the creator. Basis: steps you asked us to take (Art 6(1)(b)). How long: your address is deleted automatically 12 months after you joined the list; ask us and we will remove it at once.
Homingway. Homingway, our paper-letter service, runs waitlists for readers who want letters from a post office or an author before subscriptions open. Section 2.20 describes them.
What: each time a creator publishes their creator page (and with it their community), a course, a product or a service, switches on a community plan, publishes one of these again after taking it down, or changes the listed price of one of these while it is on sale, we ask them to tick a confirmation that they hold the rights to the material (or the right holder’s permission), that they are responsible for its content and for the accuracy of what they state, and that only they or a member of their team publish it, and that they are responsible for that person’s actions too (Terms of Use, section C6). When a member of a creator’s team publishes the creator’s course (section 2.19), that team member ticks a different confirmation: that they publish it on the creator’s behalf as a member of the creator’s team, that the creator has confirmed being responsible for their actions, and that they are not aware of the material infringing anyone’s rights. We keep a record of each confirmation: the account that ticked it and, for a team member, the creator whose item it is, which of the two wordings was shown, the item (its kind, its title and the price shown, and its ID if it already exists), whether it was a first publication, a publication after taking the item down or a price change, the exact wording shown and its version, the language of the page, the time, the IP address the request came from and the browser’s user agent. When the publication or the new price is then saved, we add a second record, linked to the first, with the item’s ID and the title and price actually saved. Each confirmation covers one publication or one price change.
Why: to be able to show, if a rights holder, a buyer or an authority complains about something a creator published, that the creator confirmed it, when and from where, and to establish, exercise or defend legal claims. We use these records for nothing else: not for the block list in section 2.11 and not to contact anyone. Basis: legitimate interest in being able to prove what was confirmed and to defend legal claims (Art 6(1)(f) GDPR). You can object under Article 21 GDPR; we keep a record that we need to establish, exercise or defend legal claims, which that article allows. How long: ten years from the confirmation, because claims about published material, such as copyright claims, can be brought years later. The records cannot be changed, only our administrators can read them, and they are kept, with the account ID, after an account is erased: the GDPR allows this for the establishment, exercise or defence of legal claims (Article 17(3)(e)).
What: a creator can invite people to their team on Studio’s Team page, so that they help with the creator’s content and community (Terms of Use, sections A3 and C6). Each team member works from their own Quelper account, in the roles the creator chose. We keep the address the invitation was sent to; the roles; when the invitation was sent, accepted, declined, cancelled or expired, and when the membership ended; the confirmation the creator gives at every invitation and the one the team member gives on joining, each with the exact wording shown, the time, the IP address and the browser’s user agent; and a log of the team’s work on the creator’s content: what was created, edited, published, taken down, deleted, restored, sent to the creator for launch or proposed for removal, by whom and when. For an edit, the log names the fields that changed, never what was written in them. The creator gets a notification when a team member publishes something, takes it down or deletes it, asks for a launch or proposes a removal, and the team member when the creator approves the launch.
Who sees what: the creator sees their team — the team members’ names, photos, the addresses the invitations were sent to and their roles — and the log, without IP addresses and user agents. A team member sees the teams they are on. A team member in the editor role has access to the creator’s content they work on, drafts included, and to whether a course has ever been bought; they do not see the creator’s earnings or payouts, who bought anything, or the creator’s members, students or messages, and being on a team does not make them a member of the creator’s community. Where a community shows its team, its members see a team member’s name, photo and role.
Acting for the creator: team members act under the creator’s authority (Article 29 GDPR): they may use what they get access to only for the work the creator gives them, and the creator is responsible for what they do on Quelper as if the creator had done it (Terms of Use, section C6). If a creator invites someone who lives outside the European Economic Area, the United Kingdom, Switzerland and the other countries the European Commission recognises as protecting personal data adequately, giving that person access is the creator’s own transfer, and the creator is responsible for it.
Basis: contract — with the creator, to provide the team they use, and with the team member, who joined it (Art 6(1)(b) GDPR); for the log, the notifications and the confirmations, also the legitimate interest, ours and the creator’s, in knowing who did what to the creator’s content and being able to prove it (Art 6(1)(f)). How long: a membership while both accounts exist; the log and the confirmations ten years, also after an account is erased, like the publication confirmations in 2.18 (Article 17(3)(e) GDPR). Nobody can change the log. Our administrators can read all of it, and the creator can read it without IP addresses and user agents; nobody else can.
Homingway is Quelper’s service for letters on paper: each author writes from one post office, in one language, and readers who subscribe receive the letters by post. Each author sells their own letters. Subscriptions open on 1 November 2026; until then, readers can join a waitlist, and we do not ask readers for a postal address or keep one. Homingway works in the United States, Canada, Europe, Japan and Australia.
(a) Becoming an author. An author signs up with a Quelper account, as in section 2.1, and we keep the records of what they accepted, as in section 2.12: the Terms of Use, with their confirmation that they have read this policy, the creator terms, the Homingway author rules with their parts on subscribers’ data and on who answers for it, and that they are 18 or older. With the account we keep an application: your name and email address; the post office you chose (its OpenStreetMap id, name and address, and its position — the post office’s, not yours — rounded to 5 decimal places) and the town and country of the place you searched, or the address you wrote for a post office that is not on the map; the language you will write in; the campaign tag of the link you came from, if it had one; the language of the page; that you confirmed you are 18 or older; a salted one-way hash of your IP address, never the address itself, to spot floods of sign-ups; when you sent it and sent it again, and when its status last changed; and its status. When you change your post office or language in your workspace, we store the new choice as a new application and set the earlier one aside; both are deleted on the schedule in (e). We read each application and decide on it by hand. What you write and upload on your Homingway page is public, like everything creators publish (section 2.3). Your page may show a pen name, but because you sell your letters, before subscriptions to your letters open we ask you for your legal or trading name and your postal address, keep them with your application, and from 1 November 2026 show readers who subscribe to you that name. We also ask you which country you live in, because the author rules depend on it (section 5). Basis: contract (Art 6(1)(b)); for the hash of your IP address, legitimate interest in keeping the forms free of abuse (Art 6(1)(f), as in section 2.11).
Quelper news (optional). If you tick “Send me Quelper news” when you sign up as an author, we record that consent and keep the record like the sign-up record (section 2.12), and we may then write to you with news about Quelper. Basis: consent (Art 6(1)(a)); you can withdraw it at any time by writing to us.
(b) Readers’ waitlist. When you ask for letters from a post office or an author, we keep your email address (when you join with one click on an author’s page, the confirmed address of your account); the post office, as in (a), and the town and country of the place you searched; the language of the letters; the campaign tag; the language of the page; your account, when you are signed in; the salted hash of your IP address, as in (a), when you use the form; and when you joined and when you asked again. We use them only to write to you about letters from that post office or author, for example when subscriptions open. These emails are delivered by our email provider, Resend (section 4). Basis: steps you asked us to take (Art 6(1)(b)); for the hash, legitimate interest, as in (a).
(c) From 1 November 2026: the name on your envelope, your postal address and who receives them. Saving an address opens together with subscriptions, on 1 November 2026; until then we do not ask for a postal address or keep one. From then, in “My letters” you tell us the name to put on the envelope and where to post your letters (street address, town, postal code, region and country), and you confirm that you are 18 or older and that the letters are addressed to you; we keep that confirmation with your address. Each author’s letter is the same for every subscriber and greets no one by name: only the envelope window shows your name and address. The address does not have to be your home: a post office box or a poste restante address (in Spain, Lista de Correos) works too. The name on the envelope must be yours or one you use. Homingway letters are for adults: you must be 18 or older to subscribe or to receive letters, letters are never addressed to a child, and the recipient of a gift enters their own address in their own account.
We keep these details and, each month, put them into the print file of each author whose letters you subscribe to: one page for each subscriber, numbered. No other member, no other author and no one in the public sees them, and an author’s workspace shows no list of names or addresses. When your author downloads the print file, they receive your name for the envelope, postal address, the copy number and their author code. We do not give them your email address, your account or your payment details; if the author’s own Stripe account settles your card payment, Stripe may show the author the payment details it holds (section 2.6). The author prints, signs and posts your letter from their post office. Postal operators, such as Correos or USPS, see the envelope and deliver it under their own rules.
You buy your letters from the author. The author is the seller of your subscription, and from the moment they download the print file, the author is a controller of that copy and responsible for it. The Homingway author rules (Part B) let the author use it only to post your letters, forbid them to pass it on or publish it, require them to keep it secure and to destroy it once the letters are posted, and require them to tell us within 24 hours if anything goes wrong. We are responsible for collecting and keeping your details and for making the print file available only to your author, securely. Basis: contract (Art 6(1)(b)): our contract with you to run Homingway and handle your subscription, and your contract with the author, which cannot be carried out without your address.
Your author and your address (Article 14 GDPR). When you subscribe, you see the author’s legal or trading name, their post office and the country where they live. In short, for the copy your author receives:
Your point of contact. Quelper is your point of contact for everything about Homingway, including the copy your author holds: write to us and we answer or pass your request on. For the step in which we make the print file available to your author, the author rules say who does what: we give you this information, answer your requests and keep the platform and the print file secure until the author downloads it; the author downloads it only to their own device and is responsible for their copy from then on. You can exercise your rights, and claim compensation, against Quelper, the author or both; a court or an authority decides who is responsible.
(d) Finding a post office. When you search for a post office on Homingway’s pages, our server, not your browser, asks other services, so they receive our server’s IP address, not yours:
We do not keep what you type. The post offices found around a rounded point are kept in a cache for up to six hours, so that the same search does not ask again. An author’s application keeps only the town and country of the place searched (a). The interactive map on Homingway’s pages is Mapbox’s and loads only once you allow maps (section 2.14). Basis: steps you ask us to take (Art 6(1)(b)).
(e) How long. An author’s application that is not accepted, including an earlier choice set aside, is deleted 12 months after its last change; an accepted application is kept until your account is erased, and goes with it. A waitlist entry is deleted 12 months after subscriptions open if you have not subscribed by then, and at once if you ask us. From 1 November 2026, your name for the envelope and postal address are kept while you have an active subscription and for 3 months after your last letter was posted, for returned letters, refunds and questions; then they are deleted, unless you subscribe again. If you saved them but did not subscribe, they are deleted 60 days after subscriptions open to the authors you were waiting for, and in any case by 30 June 2027; we email you first. You can change them in “My letters” at any time, and ask us to delete them when you have no active subscription (section 7).
(f) Print files and their log. From the first print files, at the end of November 2026, we make an author’s print file for each download and do not keep it. Each time an author downloads one, we record which account downloaded it, when, from which IP address and browser, for which month, which subscribers it held (by our internal reference, not by name or address), the file’s fingerprint and the confirmation the author gave. This lets us keep the files secure and show who received what if something goes wrong. We keep the log for 5 years after the month concerned, the time within which a claim between Quelper and an author can be brought (Spanish Civil Code, art. 1964.2). Basis: legitimate interest in the security of subscribers’ details and in establishing or defending legal claims (Art 6(1)(f)). The log holds no names or addresses, and only we see it.
(g) Blocked copies. From 1 November 2026, when we delete or correct your name for the envelope or postal address, Spanish law requires us to keep the earlier version blocked: locked away, used for nothing, and available only to courts, prosecutors and authorities, including data protection authorities, for possible claims arising from the processing. We keep it for 3 years, the longest period within which an infringement of Spain’s data protection law can be pursued (article 78 of Organic Law 3/2018), and then destroy it (article 32 of the same law).
The specialists map (quelper.com/ru/map) is a free directory of people who offer their services, mostly in Russian, in a city or online. Specialists add themselves; we never put anyone on the map ourselves. Clients contact them directly on the social network they list: Quelper is not part of any agreement between them and takes no commission.
(a) Adding yourself. When you add yourself we keep: the service you chose from our list, or the words you wrote under “Other”; whether you work in person, online or both; the city you chose from our list, and its centre — the city’s, never your address — which places your point on the map; the name you show (your first name and the first letter of your surname); one username on Instagram, Telegram, Facebook, TikTok, YouTube or LinkedIn; your email address; the campaign tag of the link you came from, if it had one, and the card of the person who invited you, if you came by their invitation link; the language of the page; when you sent it; and a salted one-way hash of your IP address, never the address itself, to limit how many cards and reports can come from one address (we delete the hash from your card 30 days after you send it). We also keep a record that you accepted our terms: which versions, when, the same hash and your browser’s user agent. Later, if you add them: up to four more usernames on those networks (one per network), a short description (we remove links and phone numbers from it), the languages you work in, and, for psychologists, lawyers and doctors, the registration number and the body that holds the register. If you are signed in to Quelper with the same confirmed email address, we link the card to your account. Basis: contract (Art 6(1)(b)); for the hash and the record of acceptance, legitimate interest in keeping the map free of abuse and in being able to show what you accepted (Art 6(1)(f), as in section 2.11).
(b) Who sees what. You see your card at once, in the browser you used, through a cookie that holds only a signed reference to your card (see our Cookie Policy). Everyone else sees it only after you confirm your email address and, while we check new cards before they appear, after we have checked it. The public card, on the map and on its own page, shows your name, service, city or “online”, the usernames a person has approved, your description and languages, the month you joined, and whether we checked each profile and your registration number, with the number of followers we recorded for a profile we checked (d); where we have not checked, the card says so. A card marked “Quelper author” also shows the photo of your Quelper profile (d). A username you add later appears only after a person has approved it. We never show your email address, your registration number or who invited you. The pages of the map are not offered to search engines; if we change that, we will update this section first. When a visitor presses your username, your social network receives that visit under its own terms.
(c) Emails about your card. We write to you to confirm your address, to send you a link to change or delete your card, to tell you if someone tries to add a second card with your address, to tell you about decisions on your card and why (e), once every six months to ask whether you still take clients, and about changes to the terms of the map. These emails are part of the service, not marketing, and are delivered by our email provider, Resend (section 4). To stop these emails being misused, we keep a log of the emails we sent for 90 days, with a salted hash of the recipient’s address and of the address that asked for the email. Basis: contract (Art 6(1)(b)); for the log, legitimate interest (Art 6(1)(f)).
Quelper news and invitations (optional). If you tick “Send me Quelper news and invitations”, we keep a record of the exact words you saw, their version, the time, a salted hash of your IP address and your browser, and, once you have confirmed your email address, may write to you about Quelper, including an invitation to open your own community. If you tell us on your card that you want your own community, we write to you about it because you asked. We do not send such invitations to anyone else, by email or by message on their social network. Basis: consent (Art 6(1)(a)); you can withdraw it at any time on your card or by writing to us.
(d) Checks and badges. “Verified” next to a username means we saw a code we gave you in the public description of that social profile, so we know the profile is yours. We look at the public profile by hand and keep the date and the method. When we look, we may also write down the number of followers the profile shows; we show it next to that username, rounded down, with the month we checked it, and we update it only by looking again. We never show a number of followers you give us yourself. A new username is a new profile: its check and its number start again. “Registration checked” means we found your name and number in the public register you named; we keep the number, the register and the date. “Quelper author” means you run a community on Quelper: we link your card to your Quelper profile by hand, and only after asking you. The card then also shows the photo of that profile, the one already public on your Quelper page (section 2.2), and only while that page is published: when you change or remove the photo there, the card changes with it, and when we remove the badge, which we do whenever you ask, the photo goes with it. The map shows no other photo, and you cannot add one to a card. These badges and numbers do not change where your card appears (Terms of Use, A10). Basis: contract (Art 6(1)(b)).
(e) Moderation and reports. Anyone can report a card with the “Report” button on it («Пожаловаться»). A report keeps the card, the reason, the explanation, the reporter’s name and email address if they give them, a salted hash of their IP address and the time; we keep the decision and its reasons. If the reporter gives an email address, we send them a confirmation of receipt with a button to confirm the report. A card with no verified profile and no checked registration is hidden automatically until a person decides when three different people who confirmed their email addresses, from three different addresses, report it within 30 days as fake, as impersonating someone or as offering illegal services (five, if a person has already decided on reports about that card); any other card is checked by a person first. This is the only automated step, and we tell you about it and why. We tell you about every decision on your card and why, and you can challenge it (Terms of Use, A6). We do not tell the specialist who reported their card, unless the law requires it. Basis: legal obligation (Regulation (EU) 2022/2065, Art 16 and 17; Art 6(1)(c)) and legitimate interest in a map people can trust (Art 6(1)(f)).
(f) The example card. At the top of the map page we may show one card, marked as an example, that we choose by hand; currently it is the card of Quelper’s founder. We only choose a public card with a verified profile, and if we ever choose another specialist’s card, we ask them first. Being the example does not change where the card appears in the list (Terms of Use, A10).
(g) How long. A card whose address is never confirmed is deleted 7 days after the last confirmation email we sent (30 days while we check who owns its username), with the record of what was accepted, also when we delete it ourselves: nobody confirmed that address, so no decision of ours was sent to it. If you do not answer our six-monthly question within 30 days, your card is hidden; if it stays hidden for 180 days, it is deleted. When you delete your card, it disappears from the map at once and its data is deleted 30 days later; until then you can restore it, from any device: ask for a link to your card on the map’s page and we email it to you. A card we refused is deleted 30 days after our decision. When we delete a card whose address was confirmed (including a refused one), it disappears at once and its data is deleted 200 days later: that is the six months to challenge our decision (Terms of Use, A6) and two more weeks to answer a challenge sent on their last day, and it lets us recognise the card if it is added again. A username you remove from your card is deleted at once; one we refused is deleted 200 days after our decision, for the same reasons. A reporter’s name, email address, account, hash and explanation are deleted 6 months after the report, and the rest of the report — the reason and our decision — after 3 years. Records of decisions are kept for 3 years, to answer challenges and claims; the log of emails we sent for 90 days; the count of attempts to send the form from one address for 7 days. The records of what you accepted are kept as section 2.12 says.
(h) Blocked copy. When we delete a card whose email address was confirmed, Spanish law requires us to keep a blocked copy of your name, usernames, email address and the card’s dates: locked away, used for nothing, and available only to courts, prosecutors and authorities, including data protection authorities. We keep it for 3 years (article 78 of Organic Law 3/2018) and then destroy it (article 32 of the same law).
It comes up in several places, on different bases:
We do not use any service of our own to locate you from your IP address, and we do not try to locate you more precisely than your country. If you allow analytics, Google Analytics estimates your city from your IP address for its reports.
We do not sell personal data, including sensitive personal data, and we never have. We do not share it for advertising either. (Some US state laws, including those of Texas and Nebraska, ask us to say this explicitly.) We share personal data only as follows.
| Recipient | What and why | Where |
|---|---|---|
| Supabase | Everything in our database and file storage; sign-in, including preparing the confirmation and password-reset emails. | Switzerland (AWS Zurich region). Supabase Inc. is a US company. |
| Resend | Delivering our account and service emails, such as the address-confirmation and password-reset emails (2.1), our emails about Homingway (2.20) and the specialists map emails (2.21(c)). It receives your email address, the message and delivery details, such as when it was sent and whether it was delivered. Resend keeps its logs of our emails for up to 30 days. | United States, where Resend keeps its records of our emails; the emails are sent from Ireland. Resend, Inc. is a US company. |
| Vercel | Every request to the site, with IP address and user agent; our server logs. Hosting. | United States (server code runs in Washington, D.C.); pages and files are delivered from Vercel’s global network. Vercel Inc. is a US company. |
| Stripe | Payment data (2.6) and creators’ payout set-up (2.7). | United States |
| OpenAI | Search queries, published listing text, and community and blog page names and descriptions, for search and translation (2.9). | Ireland (OpenAI Ireland Limited) and the United States |
| Analytics (2.13); Maps on service pages and address search for creators (2.3, 2.14); YouTube players and preview images (2.14); our email (Google Workspace), where the messages you send to us arrive. | United States and Ireland | |
| Mapbox | Community maps, and your exact location, used to look up your town and the towns near you (2.5); the Homingway map, and, from our server, places typed into the Homingway post office search, and the rounded search point and the post offices found, for the map image (2.20); the specialists map (2.14, 2.21). | United States |
| komoot (Photon) | What you type into the Homingway post office search, sent by our server to find the place when Mapbox cannot answer or finds nothing (2.20). | Germany |
| FOSSGIS (Overpass) | The search point, rounded to about 100 m, sent by our server to find post offices near it (2.20). | Germany |
| Vimeo | Video players and preview images (2.14). | United States |
| Sentry | Error reports (2.15). | EU (Germany) region; US company |
| Cloudflare | The bot check on our sign-up, sign-in and password-reset forms: your IP address, user agent and technical signals from your browser and device (2.11). | Cloudflare’s global network, usually a data centre near you. Cloudflare, Inc. is a US company. |
| DiceBear, Unsplash, other image hosts | Your IP address; the username, for placeholder avatars (2.14). | Varies |
| Mercury and the banks involved | Payee details and amounts, for payouts we make ourselves (2.7). | United States, and the countries of the banks on the route |
| Messaging service | The private chat in which creators send us payout details (2.7). | Varies |
| Creators | What sections 2.4 to 2.8 say they see, and payments that the creator’s Stripe account settles (2.6). | Worldwide |
| A creator’s team | What section 2.19 says a team member sees: the creator’s content they work on, drafts included. They act under the creator’s authority. | Worldwide |
| Homingway authors | From 1 November 2026: the name on the envelope and postal address of their own subscribers, in that month’s print file. Each author sells their letters, is a controller of the copy they receive and may use it only to post your letters (2.20). | The country where the author lives, shown before you subscribe: the United States, Canada, Europe, Japan or Australia |
| Postal operators | What is on the envelope of a Homingway letter (2.20). | The countries your letter passes through |
| Other members and the public | What you publish, the community details in 2.5, and the cards on the specialists map (2.21(b)). | Worldwide |
| Authorities and advisers | Where the law requires it; our accountants and lawyers where needed. | As required |
Supabase, Vercel, Resend, OpenAI, Sentry, and Google for our email, handle data only on our instructions, as our processors. Cloudflare runs the bot check on our instructions too, and decides for itself how it uses the same signals to improve its bot detection (section 2.11). Stripe, Google for its other services, Mapbox, komoot, FOSSGIS, Vimeo, the image services, Mercury and the messaging service use what they receive at least partly for their own purposes, under their own privacy policies. Each Homingway author sells their letters and is a controller of the copy of their subscribers’ details they receive, which they may use only to post the letters (section 2.20). Creators decide some uses inside their community together with us, and are responsible on their own for what they do with your data outside Quelper (section 2.5).
Our database and files are stored in Switzerland, which the European Commission recognises as protecting personal data adequately. Several of the providers above are based in the United States. For those that handle data on our instructions:
Some recipients outside Europe decide for themselves what to do with what they receive. Stripe, Mapbox and Vimeo are certified under the EU–US Data Privacy Framework and its UK Extension. Creators who live outside the European Economic Area, the United Kingdom, Switzerland and the other countries the European Commission recognises as protecting personal data adequately, and who see details of their members and buyers (sections 2.5 and 2.6), are bound by the EU standard contractual clauses for transfers between controllers (Commission Decision (EU) 2021/914, Module 1), with the UK Addendum for data about people in the United Kingdom, which our Terms of Use include (section C7). For payouts through Mercury and the banks on the route, and for the chat in which you send payout details, we rely on Article 49(1)(b) GDPR: each transfer is needed to pay you under our contract with you. Mapbox, komoot and FOSSGIS receive the Homingway search from our server (section 2.20); komoot and FOSSGIS are in Germany. Services whose content your browser loads directly (section 2.14) receive what your browser sends them under their own policies. Every payout we make ourselves goes through Mercury in the United States, wherever the creator’s bank is, and from there to the country of the creator’s bank. When the creator’s Stripe account settles a payment (section 2.6), Stripe processes it in the creator’s country.
Homingway authors. From 1 November 2026, making subscribers’ details available to a Homingway author outside the European Economic Area is a transfer out of Europe, whoever the reader is. For authors who live in the United Kingdom, Switzerland, Andorra, Canada (authors covered by its federal private-sector law, PIPEDA) and Japan (authors covered by the APPI and the Supplementary Rules), the European Commission’s decision that the country protects personal data adequately covers it. For data about people in Switzerland going to an author in a country that Switzerland does not recognise as adequate, the EU standard contractual clauses with the Swiss adjustments apply, as part of the Homingway author rules (B10). Authors who live in the United States, Australia, Monaco, San Marino and Vatican City may write for Homingway, but for now readers who live in the European Economic Area, the United Kingdom or Switzerland cannot subscribe to them. For the readers who live elsewhere and subscribe to them, the EU standard contractual clauses for transfers between controllers (Commission Implementing Decision (EU) 2021/914, Module 1) apply, as part of the Homingway author rules (Part B and its Annex). The subscription screen shows the country where the author lives before you subscribe. If you live outside Europe, your details go only to the author you chose, and we do not sell them.
You can ask us for a copy of the safeguards we rely on, such as the standard contractual clauses, by writing to s.alekhin@quelper.com.
| Data | How long |
|---|---|
| Account and profile | Until your account is erased. Deactivating it only hides the profile. |
| Posts, comments, files and messages | Until your account is erased, including community posts, comments and library items you deleted. Blog posts, blog comments, portfolio items and listings you delete are removed straight away. Uploaded files: until we remove them at your request or your account is erased. |
| Admin notes and account status | Until your account is erased. |
| Order and payout records | Seven years after the end of the year of the order or payout, for tax and accounting; there is no automatic deletion yet. After erasure, they are kept without the link to your profile, which Article 17(3)(b) GDPR allows. |
| Sign-in records | Ten years, deleted automatically. Erasing the account does not delete them: they keep the account ID and are used only for legal claims (section 2.11). |
| IP block list | 12 months, deleted automatically; sooner if we remove the entry (section 2.11). |
| Consent and acceptance records | Cookie-banner choices: ten years, deleted automatically. Records of the specialists map: ten years, deleted automatically, or, for a card linked to an account, as sign-up records; with the card, if its address is never confirmed (section 2.21(g)). Sign-up and creator-terms records: while your account exists; after erasure, deleted automatically ten years after the record was made; in the older table of creator-terms acceptances they keep the account ID and are used only for legal claims (section 2.12). |
| Creators’ publish confirmations | Ten years from the confirmation, also after the account is erased; the records cannot be changed (section 2.18). |
| A creator’s team | The membership: while both accounts exist. The team log and the confirmations: ten years, also after an account is erased; they cannot be changed (section 2.19). |
| Records of administrator sign-ins | Ten years, also after the account is erased; the records cannot be changed (section 11). |
| Visit counter | 13 months, deleted automatically. |
| Search history (signed in) | 12 months, deleted automatically; sooner if your account is erased. |
| Referral code in your browser | 30 days; an expired code is ignored and removed the next time the site reads it. |
| Bank details for payouts | At Mercury: until we delete the payee, at the latest when your account is erased. In the chat: until one of us deletes the messages (section 2.7). |
| People we contact about joining | Two years after our last contact, if you have not joined; we review the records by hand every three months. If you object, only a do-not-contact note stays (section 2.16). |
| Creators’ launch waitlists (no longer run) | 12 months after you joined the list, deleted automatically; at once if you ask. |
| Homingway author applications | Not accepted, including earlier choices set aside: 12 months after the last change. Accepted: until your account is erased (section 2.20). |
| Homingway waitlist | 12 months after subscriptions open (November 2026) if you have not subscribed; at once if you ask (section 2.20). |
| Homingway name for the envelope and postal address (from 1 November 2026) | While you have an active subscription and 3 months after your last letter; if you never subscribed, 60 days after your authors’ subscriptions open and by 30 June 2027 at the latest; at once if you ask us to delete them; then blocked for 3 years (section 2.20(e), (g)). |
| Homingway print-file log (from the first print files) | 5 years after the month concerned (section 2.20(f)). |
| Cards on the specialists map | Address never confirmed: 7 days after the last confirmation email (30 days while we check who owns its username). Deleted by you: 30 days, during which you can restore it. Refused by us: deleted 30 days after our decision, then as a card we deleted. Deleted by us: 200 days (address never confirmed: as above). No answer to our six-monthly question: hidden after 30 days, deleted after 180 days hidden. A confirmed card then stays blocked for 3 years (section 2.21(g), (h)). |
| Usernames on a card of the specialists map | Removed by you: at once. Refused by us: 200 days after our decision (section 2.21(g)). |
| Hash of your IP address on a card of the specialists map | 30 days after you send the card (section 2.21(a)). |
| Reports about cards on the map | The reporter’s name, email address, account, hash and explanation: 6 months after the report. The reason and our decision: 3 years (section 2.21(g)). |
| Records of the specialists map: decisions, emails sent, attempts to send the form | Decisions: 3 years. The log of emails we sent: 90 days. Attempts to send the form from one address: 7 days (section 2.21(g)). |
| Error reports and hosting logs | Sentry: at most 90 days. Vercel request and server logs: one day. |
| Data held by other providers | Under their own retention rules. |
You can ask us for a copy of your data, to correct it, to erase it, to restrict how we use it, and to give it to you in a portable format, and you can object to any use based on legitimate interest. Where we rely on consent you can withdraw it at any time. That does not make what we did before unlawful, but we then stop and delete what has no other basis. For the copy of your Homingway details that an author holds, you can exercise these rights toward the author too, through us.
Write to s.alekhin@quelper.com. If you have an account, write from its email address so that we know the request is yours; if you have none, or no longer use that address, write from any address and we will ask only for what we need to confirm who you are. We answer within one month; if a request is complex we may extend this by up to two more months, and we tell you why within the first month. It costs nothing.
Erasure in practice. In Settings you can deactivate your account. This hides your profile and signs you out, but erases nothing. Full erasure is done by us on request. It covers your account and profile and what is attached to them, including community memberships, posts and comments, direct messages you sent or received (for both people in the conversation), notifications, points, search history and referral records, your Homingway applications, waitlist entries, name for the envelope and postal address, your cards on the specialists map (those linked to your account and, if your account’s email address was confirmed, those sent with that address), and the files you uploaded, which we remove by hand as part of the erasure. We keep order and payout records without the link to you (section 6), the records in our main consent table without the link to your account (section 2.12), the blocked copy of a card on the specialists map whose address was confirmed (section 2.21(h)), and, with your account ID, your sign-in records and your rows in the older table of creator-terms acceptances, which we then use only to establish, exercise or defend legal claims (sections 2.11 and 2.12), and the records described in sections 2.18, 2.19 and 11, for as long as those sections say. You can delete a card on the specialists map yourself at any time, without an account and without asking us (section 2.21(g)). If you run a community with paying members or sell courses that people still have access to, we will first agree with you how to wind them down. We cancel the memberships you still have as part of the erasure; your Stripe customer record or Stripe account stays with Stripe.
Export. There is no download button yet. Ask us and we will send you a copy of your data.
Complaints. You can complain to the AEPD at any time, without contacting us first, or to the data protection authority where you live or work; in the United Kingdom, that is the ICO.
United States. You can review and change most of your information in Settings, or ask us to. We will not treat you differently for using any of these rights. Nevada residents can send requests not to sell their information to the address above; we do not sell it, and we will confirm that within 60 days.
Our Cookie Policy lists every cookie and browser-storage item we use and explains how to change your choice. Analytics and maps are off for everyone until they are switched on, so if your browser sends Global Privacy Control, they stay off until you switch them on yourself on Quelper. GPC does not switch off our own visit counter, our security records or embedded videos (section 2.14). We do not respond to the older Do Not Track signal, which has no agreed meaning. You can change your cookie choice at any time here: .
We do not make decisions about you that are based only on automated processing and that have legal or similarly significant effects. Search results are ranked automatically, and the rule that referral commissions become payable after three different buyers is checked automatically. A card on the specialists map is hidden automatically after confirmed reports from three different people, until a person decides (section 2.21(e)).
Quelper is for adults: our Terms of Use, which you accept when you create an account, require you to be at least 18. If we learn that someone under 18 has an account, we will close it and erase their data. If you think a child is using Quelper, write to us. Homingway letters are for adults only. Do not enter a child’s name or address, and do not address letters to a child, including as a gift. If we learn that letters go to someone under 18, we stop them and delete the details. Only people aged 18 or over can add themselves to the specialists map; if we learn that a card belongs to someone younger, we delete it.
All traffic to Quelper is encrypted (HTTPS). Passwords are stored only as hashes by our sign-in provider. Access rules in the database limit each account to the data it is allowed to see, and only Quelper’s administrators can read security and consent records. Error reports are stripped of cookies and sign-in codes. If a breach puts your data at risk, we will tell the AEPD and, where the law requires, you.
Administrator access to accounts. To give support or investigate abuse, our administrators can sign in to any account. While signed in, they see everything that account can see, including its direct messages, orders and settings. Each such sign-in is recorded: which administrator signed in, to which account, the reason they gave and when, together with the changes sent through our server while they were signed in (what kind of change and when, never its content). Only our administrators can read these records. They cannot be changed and are kept for ten years, also after the account is erased (Article 17(3)(e) GDPR). Basis: legitimate interest in giving support, keeping Quelper safe and being able to show what was done in an account.
When this policy changes in a way that matters, we give it a new version, keep the previous text, and tell everyone who has an account, by email or with a notice on Quelper or a message to their Quelper inbox. We do not apply a new use to data we collected under an earlier version without asking you first, except as this section says below: the ten-year periods, and keeping sign-in and creator-terms records after an account is erased, also apply to records we already hold, and you can object to that under Article 21 GDPR. Earlier versions: privacy@2026-10-22.2, privacy@2026-10-22, privacy@2026-10-15.2, privacy@2026-10-15, privacy@2026-10-07.2, privacy@2026-10-07, privacy@2026-10-06, privacy@2026-10-05, privacy@2026-10-03, privacy@2026-09-08 and privacy@2025-12-17; ask us for any of them.
What changed in this version. Compared with privacy@2026-10-22.2, our sign-up, sign-in and password-reset forms, the request for a new confirmation email and the Homingway author sign-up check that they are used by people, not bots, with Cloudflare Turnstile, so Cloudflare is a new recipient: it receives your IP address, your browser’s user agent and technical signals from your browser while the check runs (the summary at the top and sections 2.11, 3, 4 and 5). The check uses no data we collected before. Nothing else changed.
What changed in the versions before it. privacy@2026-10-22.2, compared with privacy@2026-10-22: a card on the specialists map marked “Quelper author” also shows the photo of the specialist’s Quelper profile, which is already public on their Quelper page, and we mark a card so only after asking its specialist (sections 2.2 and 2.21(b) and (d)).
privacy@2026-10-22, compared with privacy@2026-10-15.2: we added section 2.21, on the specialists map: adding yourself, who sees what, the emails about your card, checks and badges, reports and moderation, the example card, how long we keep what, and the blocked copy, with the points that go with it in the summary at the top and in sections 2.1, 2.10, 2.12, 2.14, 3, 4, 6, 7, 9 and 10. The specialists map is new: it uses no data we collected before, unless you add yourself to it.
privacy@2026-10-15.2, compared with privacy@2026-10-15: the Homingway post office search sends what you type to Mapbox first, and to Photon only when Mapbox cannot answer or finds nothing; before, it went to Photon first (sections 2.20 and 4).
privacy@2026-10-15, compared with privacy@2026-10-07.2: we keep sign-in records for ten years instead of 90 days, records of consent and acceptance for ten years instead of three, and the log of the day-to-day work of a creator’s team on the creator’s content for ten years instead of two, so that we can establish, exercise or defend legal claims (the summary at the top and sections 2.11, 2.12, 2.19, 3 and 6); after the first 12 months we use sign-in records only for that (section 2.11). Erasing an account no longer deletes its sign-in records or its rows in the older table of creator-terms acceptances: they keep the account ID for the rest of their ten years and are used only for legal claims (sections 2.11, 2.12, 6 and 7). These periods, and keeping these records after an erasure, also apply to the records of these kinds that we already hold, made under earlier versions of this policy. If you do not want your earlier records kept longer, write to s.alekhin@quelper.com and we will consider your objection under Article 21 GDPR. Section 7 now also names the sign-in and consent records that an erasure leaves in place. That version also added section 2.20, on Homingway, our paper-letter service: signing up as an author, the readers’ waitlist, the post office search and, from 1 November 2026, the name and postal address for letters and what Homingway authors receive, with the points that go with it in the summary at the top and in sections 2.1, 2.10, 2.14, 3, 4, 5, 6, 7 and 10. Section 2.17 now covers waitlists in general. Homingway is new: it uses no data we collected before, unless you sign up for it yourself. The address-confirmation and password-reset emails are now delivered by our email provider, Resend, which also delivers our emails about Homingway (the summary at the top and sections 2.1, 2.20, 4 and 5). privacy@2026-10-07.2 itself added section 2.19, on a creator’s team, and the record we keep each time an administrator signs in to an account (section 11).
We value your privacy
Quelper uses necessary cookies, and Google Analytics and maps (Google, Mapbox) only with your consent. Learn more ·