2HOT 2PAY · Privacy

Privacy at 2HOT 2PAY

Last updated: 14 October 2026

This notice explains what information we process on the website and in the 2HOT 2PAY app, why, and for how long. It applies to Creators, guests, promoters and Partners.

1. Who is responsible

The controller is 2h2p UG (haftungsbeschränkt), Marienstraße 10, 40212 Düsseldorf, Germany, represented by its managing director Michael Huss and registered with the Düsseldorf Local Court under HRB 78654. For data protection questions and to exercise your rights, contact us at info@2hot2pay.com or by post at this address.

2. Website, app and technical operation

When you open the website or the app, our servers process your IP address, details of your browser and device, the time, the page requested and, in the app, your session. We need this to deliver the pages, secure logins, find errors and fend off attacks (Article 6(1)(b) and (f) GDPR). Fonts, images, maps and scripts are loaded from our own servers. The App Store or Google Play is responsible for downloads and updates; from the store we only receive aggregated statistics and, if you allow it on your device, crash reports. Links to other providers are ordinary links. On our server we also count how often each of our links is opened per day, as a daily total only and without any reference to you (Article 6(1)(f) GDPR).

Without consent we only store in your browser what is needed to use the service (section 25(2) no. 2 TDDDG): your login, protection against forged requests, your language, your own display settings and, for seven days, an invitation code from a link.

With your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR) we also count how the website and app are used: pages viewed, clicks, the page you came from, campaign tags, browser, operating system, device type, screen size, language, approximate location and time on page, using our own software on our own server in Germany, without cookies and separate from your account; we use your IP address only briefly for the location and a rotating identifier. Also with consent, we remember for up to 30 days which campaign link or promoter brought you here and store this with your account when you register. You can change both at any time at the bottom of every website page or in the app's cookie settings.

3. Account and profile review

For a Creator account we process name, date of birth, email address, mobile number, profile photo, city, Instagram name and follower count, optionally further photos and details, plus account ID, settings, the status of your review and your consents. Mandatory fields are marked; without them we cannot create an account. If you set up a passkey, its secret key stays on your device; we hold only the public key, an identifier and the device name. We receive no biometric data.

Before approval we check that you are at least 18, that your Instagram profile is genuine and yours, and that you exist only once: your mobile number with a code by messenger, your profile with a screenshot and a code by Instagram message. If you used to sign in with Instagram, the account ID, account type and follower count from then stay with your account.

Guests of promoters provide first name, email address, Instagram name and confirmation that they are of legal age. Promoters provide name, email address, password (stored only in protected form), photo, Instagram name and a short bio; their card is public, and their figures (invitations, RSVPs, guests who arrived) are seen by the club and its Head Promoter.

The legal basis is the user agreement (Article 6(1)(b)); for the check for fake and duplicate accounts, manipulated redemptions and attacks also our interest in a genuine community and a secure service (Article 6(1)(f)). For this we analyse account, device and usage data and document specific suspected cases. After an account is deleted we keep a hash of your mobile number, from which the number cannot be read, so that a suspended account cannot simply be recreated.

4. Offers, check-in, Partners and promoters

Which offers you see depends on city, categories, level, approvals and what you have already used (profiling, necessary to show suitable offers, Article 6(1)(b)). The app does not request your device location. When you register, check in or redeem, we store who used which offer when (Article 6(1)(b)). When you scan a QR code, only the recognised code is sent to us, not the camera image.

Partners see at check-in and on the guest list your display name, profile photo, Instagram name, follower count, level, whether a special rating exists, the status of the offer and, for a table invitation, the inviting promoter. They do not see your surname, contact details, date of birth or your visits to other Partners. If an event needs more, such as your full name for a ticket, this is stated in the offer before you register.

Promoters see for their invitations and events your first name, last-name initial, profile photo, Instagram name, level and badge, your RSVP, whether you arrived, your note to them and how often you came to them, for example "7 of 9". This figure is an estimate of your reliability (profiling); it applies only to that promoter, does not change your level, cancellations never count against you, and you can see it yourself. If you agree to be one of a promoter's guests, they see you even without an event, can give you their own labels and a short note that nobody else sees, and, if you choose to tell us, whether you live here or until when you are visiting; from this the app estimates whether you are around right now. Notes are included in your data export and are deleted as soon as you leave the promoter, which you can do at any time. We store with your account which promoter brought you to us.

Legal basis: for invitations and guest lists the user agreement (Article 6(1)(b)), for your information about your stay your consent (Article 6(1)(a), changeable at any time), for the figure, the estimate, labels, notes and attribution our, the club's and the promoter's interest in a guest list they can plan (Article 6(1)(f), objection see section 10).

5. Activity, points and statistics

Your account holds your history: check-ins, redemptions, event sign-ups and cancellations, invitations, saved places and events, points, badges and level. We award points under the rules in the app, on your birthday based on your date of birth. Your level and an internal rating are set by a person on our team, who records the reason; your appearance plays no part.

An offer usually comes with a story. We check random samples of what is visible on Instagram; Partners can tell us whether the story reached them, and after an event we may ask you whether it took place. A person on our team always decides on consequences such as point deductions or restrictions, and you receive an explanation.

If you refer a friend or a location to us, we store the link, your confirmation, the reward and, for a payout, name, address and IBAN.

From usage and history we compile statistics. Partners see only aggregated figures for their locations, such as visits, redemptions and the combined follower count; third parties such as investors or cooperation partners see aggregated figures without Creators' names, and figures of an individual location only investors and advisers in confidence.

The legal basis is the user agreement (Article 6(1)(b)); for story checks, feedback and statistics our interest in reliable offers, fair points and a better service (Article 6(1)(f)); for payouts also tax obligations (Article 6(1)(c)).

6. Messages, support and help chat

If you write to us through the form, by email or in the app, we process your message and your contact details to reply (Article 6(1)(b), (f)). Messages about your account, review, booking, invitation or redemption and security notices, for example when someone signs in from a new device, are sent by email or in the app (Article 6(1)(b), (f)). By messenger we send only your confirmation code, anything more only if you agree.

Event registration: If we provide an organiser with an event page and registration form, the organiser alone is responsible for the registrations. We only run the page and forward your registration to the organiser by email on their behalf (Article 28 GDPR); we keep no copy. We forward your name, email address, number of guests, optional details such as a preferred time and a message, and the channel you came through, for example Instagram or our newsletter. For Art & Aperitivo on 29 November 2026 the organiser is Babedesign (Jessica Walter, jessy@babedesign.de). She uses the registrations only for the guest list of this event and deletes them no later than 30 days afterwards (Article 6(1)(b) GDPR). You exercise your rights with her; any requests that reach us are passed on to her.

Marketing, the weekly email, email invitations from a promoter and push notifications are sent only with your consent (Article 6(1)(a), section 25(1) TDDDG); you can unsubscribe at any time in the message, in the app or in your device settings. For push notifications we store a device identifier, the app version and when we sent which type of notification, without its text. They are delivered through Apple or Google, which receive the device identifier and the short text without your name.

Help chat

Questions to our AI assistant Mia are sent via our server to an AI provider that generates the answer on our behalf. It receives the text of your question, up to two previous questions and answers, and the page, language and area, not your name, account details or IP address; we replace email addresses, phone numbers, IBANs, links and @-names with placeholders beforehand. Please still do not type personal details. To improve Mia and detect misuse, we store question, answer and your rating in masked form, without any link to your account, device or IP address, for 30 days; only our team sees this. Use is voluntary. The legal basis is our interest in correct answers and a protected chat (Article 6(1)(f)).

7. Partners and business contacts

For Partner accounts we process company details, contact persons, logins and roles, and contract, invoicing and payment data (Article 6(1)(b); for invoices and records, statutory retention, Article 6(1)(c)). Payments run through our payment provider; you enter bank and card details only there, and we hold the payment status, mandate reference and truncated details such as the last four digits. Texts about locations, events and vouchers are translated into the languages of the app by an AI provider; it receives only those texts, without contact details and social media names. The address lookup when creating a location is sent to a map service.

We also obtain contact details of businesses and their contact persons from public sources such as a website or Instagram profile, or through referrals from our community, to present 2HOT 2PAY. Businesses that are not Partners are shown in the app as a tip with public details such as name, address and category. The legal basis is our interest in making contact and in good recommendations (Article 6(1)(f)); a business can object at any time, and we then remove the tip.

8. Who receives information

Within our team, only the people who need information for their task see it. In addition, information is received by:

• Partners, clubs and promoters: the details in section 4, only for the visit or the invitation, not for marketing and not to pass on. If someone contacts you unsolicited anyway, please report it to fraud@2hot2pay.com.
• Service providers that work on our behalf and are bound by contract (Article 28 GDPR): hosting and backups in Germany, email and messenger delivery, AI services for translation and the help chat, and the map lookup. The AI services do not use your content for training and delete it after a short time.
• Instagram for profile review, Apple and Google for push notifications, our payment provider and banks.
• Authorities, tax and legal advisers and courts, where a legal obligation or a specific legal case requires it (Article 6(1)(c), (f)).

We do not sell data.

Outside Europe: Instagram, the messenger service, Apple, Google, our payment provider, the AI services and the map service may also process data in the USA. This relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses; you can obtain a copy of the safeguards via info@2hot2pay.com.

9. How long we keep information

We keep information for as long as we need it for the respective purpose. Fixed periods:

• Account and profile: until deletion, then deleted or anonymised within 30 days; profile review evidence at most 90 days.
• Check-ins, redemptions, sign-ups, invitations and our team's logs: three years, without your name after the account is deleted; story feedback and closed reports twelve months after the decision.
• Event registrations through an event page on our website: we keep no copy; the organiser deletes them no later than 30 days after the event.
• Hash of the mobile number: twelve months after account deletion.
• Notifications in the app, push log and help chat: 30 to 90 days.
• Guest accounts: 24 months after last use.
• Enquiries, referrals and business contacts without a cooperation: twelve months after the last contact; Partner accounts three years after the contract ends.
• Invoices and accounting records: eight years from the end of the year (legal obligation).
• Usage counting: 14 months; server logs and IP address hashes only a few days.

Information is kept longer only where a legal obligation or a specific legal or misuse case requires it. Backups are overwritten in a fixed cycle.

10. Your rights, complaints and changes

You can request access to and a copy of your information, its correction, deletion or restriction, and its transfer in a common format, and withdraw any consent at any time with effect for the future. Much of this works directly in the app, such as editing your profile, exporting your data or deleting your account; otherwise write to info@2hot2pay.com. We reply within one month.

Complaint: you can complain to any data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de.

Automated decisions: which offers you see, points bookings and the check for benefits already used run automatically. A person always decides on the rejection or suspension of an account and on your rating. We do not make decisions under Article 22 GDPR.

Changes: if our processing or the law changes, we update this notice; the date is shown above. We point out material changes in the app or by email.