EloX — Effective date: 2026-08-29
This Privacy Policy explains how Bhan AS (“we”, “us”, or “our”) collects, uses, stores, and shares personal data when you use the EloX mobile application (“the App”). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.
The data controller for the purposes of GDPR is Bhan AS, Norway. Contact: support@bhan.no.
The App requests camera access only to scan match QR codes. QR scanning happens on your device, and we do not store or upload camera images or video.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Providing and operating the App (accounts, match logging, ratings, leaderboards) | Account data, match & rating data | Performance of a contract (Art. 6(1)(b)) |
| Creating and operating groups, memberships, invitations, and group leaderboards | Profile data, group data, group match & rating data | Performance of a contract (Art. 6(1)(b)) |
| Displaying your profile, confirmed match history, suggestions, and rating to other signed-in users | Username, rating, match data, suggestion data, optional location label | Performance of a contract (Art. 6(1)(b)) |
| Sending optional notifications when a match needs your action and maintaining the App icon badge | Push token, platform, match ID, group and activity names, action-required count | Legitimate interests (Art. 6(1)(f)) — helping users complete matches; notifications can be disabled in device settings |
| Improving and operating the App (analytics and operational logs) | Usage events and diagnostic logs | Legitimate interests (Art. 6(1)(f)) — improving reliability and quality |
| Responding to support requests | Email address, relevant account data | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | As required by law | Legal obligation (Art. 6(1)(c)) |
The App is built on Google Firebase (Cloud Firestore, Firebase Authentication, Cloud Functions, Analytics, and Cloud Messaging). Primary Firestore data and Cloud Functions are configured in the European Union (region: europe-west1). Firebase Authentication, Analytics, Cloud Messaging, and related support systems may process data through Google’s global infrastructure. Google acts as a data processor on our behalf under Google’s standard Data Processing Addendum.
Where enabled, analytics data is processed by Google Analytics for Firebase (GA4), which may process data across Google’s global infrastructure. Where data is transferred outside the EEA, Google relies on Standard Contractual Clauses (SCCs) as a transfer mechanism.
For more information on Google’s data practices, see Google’s Privacy Policy and Firebase’s Privacy and Security.
We may retain certain data for longer where required by law or for legitimate business purposes (e.g., fraud prevention), but only to the extent necessary.
Operational logs are retained only as long as necessary for debugging and operational purposes.
We share your data only with the following categories of third parties:
We do not sell your personal data. We do not share your data with advertisers or data brokers.
If you are located in the EU/EEA (including Norway and Sweden), you have the following rights regarding your personal data:
Push notifications are optional. You can disable or change notification and lock-screen preview permissions at any time in your device settings without losing access to the App.
To exercise any of these rights, contact us at support@bhan.no. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g., Datatilsynet in Norway, IMY in Sweden).
You can delete your account at any time. To delete your account:
Alternatively, contact us at support@bhan.no with the subject line “Account Deletion Request”. We will delete your account and associated personal data within 30 days.
Note: Match and group records involving other users may be retained in an anonymised form (i.e., without identifying you) where necessary to preserve their match history, ratings, or group records. Suggestions may remain without a link to your deleted account so existing votes and moderation history remain consistent.
Certain records may be retained where required by applicable law or to prevent fraud and abuse.
The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you become aware that a child under 13 has provided us with personal data, please contact us and we will take steps to delete it. For users between 13 and 16 in the EU/EEA, parental consent may be required depending on applicable national law.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or disclosure. These include encryption in transit (TLS), Firebase security rules restricting data access, and server-side-only rating computations. However, no system is completely secure, and we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the App, by email, or by another appropriate method, and provide advance notice where required by law. We may require you to acknowledge the updated policy before continuing to use the App. The “Effective date” at the top of this page reflects the latest revision.
For privacy-related questions, requests, or complaints, contact us at:
Bhan AS, Norway
Email: support@bhan.no