Privacy policy

The controller within the meaning of Art. 4(7) GDPR and Art. 5(j) of the Swiss Federal Act on Data Protection (FADP) is: John Dieter Jöhr, Im Lägi 2, 8700 Küsnacht, Switzerland. Email: support@consation.com. We process personal data in accordance with the FADP and, where it applies to visitors from the EU and EEA, the GDPR.

You can reach us about any privacy question at the email address above or, if you have an account, through the contact form. Please do not send sensitive details by email if you can avoid it.

The website consists of static files served by our web host GoDaddy. Whenever your browser requests a page, the web server automatically processes technical data that browsers send with every request and stores it in standard server log files.

Purpose: delivering the website, keeping it stable and secure, and investigating misuse or attacks. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a reliable and secure website. We do not combine log data with other data. The logs are kept for at most 30 days and then deleted or overwritten by the host.

To understand which pages are useful, every page view sends a small record to our database: the page path (for example /safety/), the language version, the host name of the referring website (for example a search engine, without the full address) and the time. Nothing is stored in your browser for this, and no IP address, device fingerprint or user identifier is saved with the record. We cannot recognize returning visitors or link page views to an account.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the content in a privacy-friendly way. Because the request reaches the servers of our database provider Supabase, its systems technically process connection data such as your IP address to answer the request (see section 9). The page counts themselves are kept as statistics.

Purpose: creating and running your account and the features you use. Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for). Our authentication provider sends emails that are needed for your account, such as confirming your address or resetting your password.

Some information you can store on Consation reveals details about your sex life or sexual orientation, for example orientation in your profile, preference test results, the kinks and practices in your library, agreements, session plans and reviews. This is a special category of personal data under Art. 9 GDPR.

We process this data only because and as far as you enter it yourself, on the basis of your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Entering it is always voluntary; the site works without it. You can withdraw your consent at any time by deleting the information or your whole account. Withdrawal does not affect processing that happened before.

Purpose: providing the features you choose to use. Legal basis: Art. 6(1)(b) GDPR, and for sensitive content Art. 9(2)(a) GDPR as described in section 5.

A few things are visible beyond your account because of how the features work: profile photos are kept in a publicly readable storage area, so anyone who has the exact image link can open it. If you make your user manual public, anyone with its link can read it. If you pass on a certificate number, anyone who enters it can check the certificate together with your display name, test and score.

Each account has a share code. A signed-in person who knows your code can see your username, display name, profile photo and role and can send you a partner request. Nothing else is shared until you accept.

Once both of you have accepted, a partner can see your profile and, depending on your sharing settings and the visibility you set for each item, your library, your test results and your user manual. Agreements, sessions, date nights, files and chat messages are visible to the partners they belong to. You can change your sharing settings or end a partner connection at any time.

Legal basis: Art. 6(1)(b) GDPR and, for sensitive content, your consent under Art. 9(2)(a) GDPR, which you give by choosing to share.

Signed-in users can send us a message with a subject, the message text and a priority. The message is stored together with your account so that we can answer it and you can read our reply on the contact page.

Legal basis: Art. 6(1)(b) GDPR where your message concerns your account or the service, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries). We keep messages for as long as we need them to deal with your request and possible follow-up questions, at most 12 months after your request has been closed.

Fonts are hosted on our own server, so loading a page makes no requests to Google Fonts or other font services. We do not use advertising networks, social media plugins or external analytics tools, and we do not sell personal data.

We disclose data to authorities only where we are legally required to do so.

Our database is located in Switzerland and our web server in France (EU). The European Commission has recognized that Switzerland provides an adequate level of data protection (Art. 45 GDPR), and the Swiss Federal Council recognizes the EU and EEA states as providing adequate protection (Art. 16(1) FADP), so no additional safeguards are required for storing data in these locations.

Supabase, Inc. is based in the USA. Where Supabase or its sub-processors access data from countries without an adequacy decision, for example for support or operations, this is covered by Supabase's data processing agreement, which includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The same applies to our web host GoDaddy as far as data is processed outside the EU or EEA.

Consation does not set cookies. To make certain features work, the site saves a few entries in your browser's local storage. They stay on your device, are not used for tracking and are only read by the site itself.

These entries are strictly necessary for features you actively use, so no consent is required (Art. 5(3) of the EU ePrivacy Directive as implemented in national law, for example Section 25(2) no. 2 TDDDG in Germany; Art. 45c of the Swiss Telecommunications Act). Legal basis for any related processing of personal data: Art. 6(1)(b) and (f) GDPR. You can delete them at any time in your browser settings; you will then be signed out and your settings reset.

Most data can be viewed, changed and deleted directly in your account. Under Profile, "Your data" lets you download a complete copy of your account data at any time as a machine-readable JSON file (Art. 15 and 20 GDPR). If you need anything else, send us a request through the contact form or by email.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for us is the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, www.edoeb.admin.ch.

Access to stored data is controlled by rules in the database itself: every request is checked against your login, so you can only read your own data and what partners have shared with you. Uploaded agreement files are kept in private storage. No system is completely safe, so please use a strong password that you do not use elsewhere, and consider turning on two-step login in your profile.

Consation is intended for people aged 18 and over. Sign-up requires a date of birth showing that you are at least 18. If we learn that an account belongs to a minor, we delete it.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The results of the preference test are a self-reflection aid for you and are not used to evaluate you.

We update this policy when the website, our providers or the law change. The current version is always available on this page; the date of the last update is shown at the top.