Privacy Policy

Last updated: April 2, 2026

1. Who We Are

Goitom Connections ("we", "us") operates the Gezana app and related international calling services.
Contact: contact@goitom-connections.ch

2. Data We Collect

• Phone number (E.164 format) — used as your account identifier.
• Call records — destination, duration, cost, and timestamps.
• Payment records — provider, amount, and external transaction ID (no card numbers stored by us).
• Usage logs — login timestamps and payment events for fraud prevention.

3. Why We Collect It

• To authenticate your account and keep it secure.
• To bill calls and process top-ups.
• To detect and prevent fraud and abuse.
• To comply with legal obligations.

4. Legal Basis (GDPR)

• Contract performance — billing and call routing require your phone number.
• Legitimate interests — fraud prevention and service security.
• Legal obligation — financial transaction records.

5. Data Sharing

We share data only as needed to operate the service:

• Twilio (call routing and SMS OTP)
• Stripe (card, wallet, and PayPal payments)
• Neon / Render (infrastructure hosting)

We do not sell your data to third parties.

6. Data Retention

• Active accounts: data retained while your account is open.
• Deactivated accounts: your data is scheduled for anonymization 30 days after deactivation.
• Financial records: retained for 7 years to comply with tax law.

6a. No-Refund Policy on Deactivation

Credit balances are non-refundable. If you deactivate your account, any remaining credit is permanently forfeited and will not be returned.

We recommend using your full balance before requesting account deactivation.

6b. Account Deletion (Deactivate Account)

The deactivation option is available in the app side menu under Deactivate Account. When selected, a two-step confirmation dialog appears and warns that deactivation is permanent and that any remaining balance will be forfeited.

Upon final confirmation:

• The account status is set to deactivated.
• All active sessions (including JWT tokens) are immediately revoked.
• The remaining credit balance is forfeited (no refund).
• The user is logged out immediately and cannot log back in.
• A GDPR erasure date is scheduled for 30 days after deactivation.

After 30 days, personal data is anonymized or purged in compliance with GDPR Article 17 (Right to Erasure), including profile data, call logs, transaction history, payment receipts, and audit logs. Financial records are retained for 7 years to comply with Swiss tax law requirements, but are anonymized.

Before deactivating, users can export their personal data via Settings → Export My Data. This GDPR Data Export provides a structured JSON file containing full profile data, call history, transactions, and payment receipts (GDPR Articles 15 and 20).

7. Your Rights (GDPR)

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure ("right to be forgotten").
• Data portability.
• Object to processing.

To exercise any right, email contact@goitom-connections.ch. We will respond within 30 days.

8. Security

All data is transmitted over TLS. Passwords are not stored — we use one-time SMS codes. Payment details are handled entirely by PCI-DSS certified providers (Stripe).

9. Cookies & Tracking

The Gezana mobile app does not use cookies or third-party analytics SDKs.

10. Changes to This Policy

We will notify you of material changes via the app. Continued use after changes means acceptance.

11. Contact