Privacy policy

1. Controller

The controller responsible for data processing on ZCROLL is:

Fruity Pages (Eenmanszaak), owner Michael Marco Geilenkirchen, Tentstraat 86, 6291 BJ Vaals, Niederlande, KvK 53664574 (Kamer van Koophandel), VAT ID NL002522680B64

Email for data protection questions: support@zcroll.com

We have not appointed a data protection officer.

For the data that customers of a business provide in a request, booking or order, the business is the controller; we process it on its behalf (section 12).

2. Visiting the website

When you open our website, your browser automatically sends information to our server. It is briefly stored in log files:

• IP address of the requesting device,
• date and time of access,
• name and URL of the file retrieved,
• website from which access is made (referrer),
• browser used and, if applicable, operating system.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website.

3. Account and sign-in

Registration: When you register, we process your name, email address, password (stored only as a hash), profile details (address of your profile, bio, avatar) and the time and version of your consent to the terms. The legal basis is Art. 6(1)(b) GDPR (contract).

Sign-in via other services: If you sign in via Google, Apple, Facebook, X or TikTok, we receive your name, your email address (if the service provides it) and possibly your profile picture from that service. The legal basis is Art. 6(1)(b) GDPR because the sign-in is your way into the account. These services are themselves responsible for the processing on their side.

4. Visits, clicks and recognition

When you open a profile, a link or a short link on ZCROLL, we process:

• the IP address; in the click statistics we only store it truncated (for IPv4 without the last group of digits, for IPv6 without the last 80 bits),
• time, the profile or link opened and the page you came from (referrer),
• browser and device identifier (user agent) and features derived from it (device type, indications of bots or automated browsers),
• approximate location (country, possibly city), derived from the IP address,
• a visitor ID: a hash value (sha256) that we calculate from the full IP address and user agent. We do not store the IP address itself for this. The ID is pseudonymous, not anonymous: anyone who knows the IP address and browser identifier can calculate the same hash value.

Purposes:

1. statistics for the profile owner (visits and clicks; visible for 7 days in Free, 12 months with ZCROLL+);
2. detecting duplicate clicks: the same visitor on the same link within 15 minutes only counts once;
3. preventing abuse, e.g. by bots, and protecting forms from spam;
4. showing ads no more often than intended (section 5) and reviewing ad views (section 7).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in offering profile owners statistics, preventing double counting and abuse, and settling ads fairly. For the profile owner we thereby also fulfil our contract (point (b)).

Location from the IP address: For country and city in the statistics we query a geolocation service (currently ip-api.com; as fallback ip2location.io, ipinfo.io or geoplugin.net). The IP address is transmitted to the service; it only returns country and city to us.

5. Ad pass: how often you see ads

On Free profiles and on profiles whose owners earn with ads, you briefly see an ad at the first action, in the "once per visitor" mode at most once in 30 minutes per profile. So that you do not see an ad again on every click, we remember that you have watched an ad in full ("ad pass"). After the ad we show you when the next one will appear at the earliest.

How: The ad pass is only stored on our server, in the cache. The key is the profile together with your visitor ID from section 4. The pass expires automatically after 30 minutes. We set no cookie for this and do not read anything from your device. We do not create a user profile and do not link the pass to other websites. That is why we do not ask for consent; the pass also applies if you decline in the cookie banner.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and yours: not showing ads more often than necessary and settling them fairly.

6. Ads without personal profiles

We select which ad you see based on context, not on your behaviour:

• industry and category of the profile you visit,
• language,
• country, derived from your IP address,
• the ad class (Standard, Dating, Erotic 18+) and which classes the owner allows,
• the owner's exclusions and blocks,
• competitor protection on business profiles,
• the spot length and the budget of the campaigns.

We do not build an advertising profile about you, do not use third-party ad networks, do not set advertising cookies and do not pass data on to advertisers. Under "Why am I seeing this?" we explain the selection.

For each ad shown we store which ad was shown where, when and via which route (link, widget, action, game, owner's website), whether it was watched in full, and the technical features from section 7.

If you click the button of an ad, we store the click for settlement and statistics and forward you to the advertiser's page. The advertiser's privacy policy applies there; for technical reasons the advertiser receives your IP address.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in suitable, non-personalised advertising with which we offer Free at no cost).

7. Review of valid ad views and fraud prevention

Advertisers pay and earners receive money only for valid views. We therefore review every ad shown for fraud and errors. The review does not run in real time but once a day for whole days, at the earliest two days after the day of the ad.

Data per ad:

• visitor ID (section 4),
• truncated IP address (IPv4 the first three groups of digits, IPv6 the first 48 bits),
• hash of the user agent,
• indications of data centres or automated browsers,
• channel (website or app),
• time of the ad and of the "viewed" confirmation,
• affected profile, link, widget or game.

Fraud prevention (without consent): To detect click fraud we additionally evaluate technical metrics of the respective visit, such as indications of automation software (e.g. WebDriver flag, bot-typical user agents) and of access from a data centre network. These metrics describe the course of a single visit and do not on their own allow your device to be recognised.

Device fingerprint (only with your consent): Only if you have consented to the "Statistics" category in the cookie banner do we additionally read information from your device and create a device fingerprint from it. It serves reach measurement (distinguishing repeat visits) and fraud detection. We collect: canvas and WebGL hash values, screen resolution, time zone, browser language, platform or operating system identifier and a flag whether automation software was detected. Reading this information is based on your consent under § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 11.7a of the Dutch Telecommunicatiewet; the subsequent processing is based on Art. 6(1)(a) GDPR. Without your consent no such reading takes place. You can withdraw your consent at any time via "Cookie settings" in the page footer.

How we review:

• Individual rules: duplicate views (same person on the same element within 15 minutes), views by the owner, bots, automated browsers, data centres, clicks classified as fraud, suspended or deleted accounts.
• Patterns per owner and day: conspicuous clusters from the same network or the same browser identifier and sudden increases.

A person reviews conspicuous days. We do not publish the exact thresholds so that they cannot be circumvented.

Who is affected: For you as a visitor the review has no consequences; you see the ad either way. For earners it decides whether a view is paid for, for advertisers whether it is charged. For earners this is an automated decision (section 15).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing fraud, cf. recital 47 GDPR); towards earners and advertisers also Art. 6(1)(b) GDPR (settlement of the contract).

8. ZCROLL+: subscription and payments

Purchase on the web: If you buy ZCROLL+ on zcroll.com, we process the payment via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe receives your billing details (section 9), your email address and your payment details and calculates VAT with Stripe Tax. We do not receive full card or account details. From Stripe we receive the payment method, card brand and last digits, the country of the card or account as well as payment status, invoices and refunds. More in Stripe's privacy policy.

We store for the subscription: plan, period, status (trial, active, payment due, cancelled, ended) and the subscription ID at Stripe; whether you have already used the trial (it is available only once per person, also across the App Store and Google Play); reminders we have sent you. When you buy, we also record that and when you requested immediate provision and confirmed the loss of the right of withdrawal, and which version of the terms applied.

Cancellation: If you cancel via "Cancel contracts here", we store your details (name, email address, contract, type of cancellation, reason if given, requested date), date and time of receipt, the confirmation by the account holder where applicable, and the outcome. We send you the confirmation of receipt by email; for an extraordinary cancellation without login we send the confirmation link to the account's email address. We use this as evidence.

Purchase in the apps: If you buy ZCROLL+ in our app, Apple (Apple Distribution International Ltd., Ireland) or Google (Google Commerce Ltd., Ireland) is responsible for payment, billing and refunds and processes your payment data under its own responsibility. We only receive which product you bought, the period, the status and the purchase ID so that ZCROLL+ applies to your account.

Legal basis: Art. 6(1)(b) GDPR (contract); for invoices and their retention Art. 6(1)(c) GDPR (tax obligations); for reminders before the end of the trial also point (f).

9. Billing details and tax evidence

Billing details: Before your first subscription, your first ad top-up or your business status application, you enter billing details: name, company if applicable, address and country, email address for invoices and, for businesses, optionally the VAT ID. We check a VAT ID via the EU's VIES system and store the result and the check number. We use the billing details for invoices and credit notes, as customer data at Stripe and as the advertiser's name in ads (section 11).

Tax evidence: For every payment (subscription, top-up) we record which country you buy from: country of the billing address, country of your IP address at purchase, country of the card or account, the VIES result and check number where applicable, and the time. We need this because VAT depends on the customer's country and we must document that country.

Legal basis: Art. 6(1)(b) GDPR (contract) and point (c) (VAT law, including Art. 24b of Implementing Regulation (EU) No 282/2011 and the record-keeping obligations of the OSS scheme).

10. Business status, identity verification, earning and payout

You need the business status if you want to earn with ads, run your own ad campaigns or receive payouts from us. For this we process:

• Identity verification (KYC): first and last name, date of birth, address, country, type of ID document, images of the front and back of the document and a selfie. A person on our team compares the images manually; we do not use facial recognition software.
• Tax and bank details: legal form, tax number, small business yes/no, VAT classification, account holder, IBAN, BIC.
• Sanctions check: We manually check name and address against the EU sanctions lists and store the date and result.

Purposes: to make sure we pay money to the right person; to prevent fraud and abuse, such as multiple accounts or stolen identities; to create credit notes correctly; to fulfil tax and sanctions obligations.

Storage: The document images are kept in non-public storage that only our review team can access. We delete rejected submissions as soon as you resubmit; approved document images remain stored until your account is deleted.

Earning: If you turn on earning, we additionally process your settings (ads on or off, frequency, maximum spot length, dating and erotic ads only with your express consent, excluded industries, blocked advertisers, settings per link and widget), your participation periods, the settlement (valid and invalid views per day, campaign, class, spot length, button and tier; days in detailed review; tier per month; confirmed earnings), notifications, payouts (amount, date, bank details, fee) and credit notes. We transfer payouts by SEPA from our business account; our bank receives the name, IBAN and amount. We may be obliged to report payouts to tax authorities. On request we send you a breakdown of your valid and invalid views by reason category for each month.

Legal basis: Art. 6(1)(b) GDPR (the business status is a requirement for earning, campaigns and payouts); Art. 6(1)(f) GDPR (protection against fraud and abuse); Art. 6(1)(c) GDPR where a law requires the verification, retention or reporting. Providing the details is voluntary; without them we cannot grant the business status. You can use ZCROLL without a business status.

10a. Referrals

When you visit a profile or short link: If you are not logged in and visit a member's profile or short link for the first time, we note in your session on our server who you came through: the owner's internal number, whether it was a profile or a link, its number and the time. We check whether the visit comes from a bot or from the owner's device; for this we compare your IP address with the IP addresses we know from the owner. We do not set an additional cookie for this; we use the session cookie from section 13, which exists anyway. The note expires when the session ends, after 30 days at the latest, and is deleted as soon as you log in or create an account.

With your consent to marketing cookies we additionally store the same note, encrypted, in the cookie zc_ref on your device for up to 30 days. This way the referral also counts if you come back later. If you withdraw your consent, we delete the cookie on your next visit.

When you create an account: If you create a new account on our website, we attribute it to the member you came through (the "referrer"). We store the attribution (referrer, your account, sequence number, entry point, time), the status (signed up, pending, completed, removed) and – if you pay for ZCROLL+ – for each payment the amount, currency, country, VAT, payment fee, net revenue as well as refunds and chargebacks. We use this to calculate the referrer's reward.

What the referrer sees: The referrer only sees you under a pseudonym, for example "Member 7 · Oct 2026", whether you came through their profile or a link, whether you have completed (first payment not refunded for 30 days) and, if they receive commission, the amounts they have received or that are pending for you. They do not see your name, your profile, your email address or details of your payments.

When you delete your account: We keep a check value of your email address (HMAC-SHA256 of the normalised address with a secret key) for 24 months. This lets us recognise whether someone signs up again with the same address to obtain a referral or a trial by deception; such a new account does not count for any referrer. The address cannot be derived from the check value. We delete it automatically after 24 months.

For referrers: We process your commission setting, your free months (banked, redeemed, how redeemed) and your commissions, offsets and credit notes in the same way as earnings from earning with ads (section 10).

Legal basis: Art. 6(1)(b) GDPR for the referrer's reward under our terms (§ 16a); Art. 6(1)(f) GDPR for attributing new accounts and preventing abuse (our interest and the referrers' interest in a fair reward); Art. 6(1)(a) GDPR and § 25(1) TDDDG for the cookie zc_ref; Art. 6(1)(c) GDPR for keeping credit notes and accounting records.

11. Running ads

If you run ads ("Promote profile" or your own campaigns), we process billing details (section 9), campaigns, creatives and target addresses, top-ups, invoices and credit, and your campaign statistics (valid views, spend, button clicks). You pay top-ups via Stripe (section 8) or by bank transfer to our business account.

Public information: In every ad we name the advertiser with the name or company from the billing details ("Ad by …"). This makes advertising transparent for visitors.

Political advertising: For every campaign we store your confirmation that it is not political advertising.

Legal basis: Art. 6(1)(b) GDPR (contract); point (c) (invoices, retention); point (f) (transparency of advertising, protection against abuse).

12. Data of businesses' customers

If you send a request to a business via a widget, book an appointment, order, register for an event, buy a voucher or request a ride or care, the business is the controller of your data. We process it on its behalf under a data processing agreement (Art. 28 GDPR): we store your details, send you the emails of the transaction (confirmation, reminder, customer link) and delete or anonymise the data after the period set by the business.

Direct questions about your data to the business; you find its imprint on its profile. We support it in this. We only pursue our own purposes with this data where the security of ZCROLL is concerned (e.g. spam protection via the visitor ID) or a law requires it.

13. Cookies and consent

Technically necessary cookies (without consent, Art. 6(1)(f) GDPR, § 25(2) TDDDG): session cookie for login and use, CSRF token to protect against attacks, cookie with your cookie settings.

Statistics (only with consent, § 25(1) TDDDG, Art. 6(1)(a) GDPR): controls the device fingerprint from section 7. Without your consent no such reading takes place.

Marketing (only with consent, § 25(1) TDDDG, Art. 6(1)(a) GDPR): attribution of referrals via the cookie zc_ref (up to 30 days, section 10a). We do not set any other marketing cookies and do not integrate third-party ad networks. The category remains inactive without your consent. Limiting how often you see ads happens on our server without a cookie (section 5).

On your first visit we ask you via a cookie banner. You can change your settings or withdraw your consent at any time via "Cookie settings" in the page footer (Art. 7(3) GDPR). Withdrawing is as easy as giving consent.

14. Recipients and service providers

We only pass on data if it is necessary for the respective purpose, you have consented or a law requires it. We use these service providers, or these bodies receive data:

Recipient	Purpose	Role
Our hosting provider	Server, database, storage, sending emails via our own mail server (mail.zcroll.com)	Processor
Stripe Payments Europe, Ltd., Ireland	Payments, subscriptions, tax calculation, invoices	Independent controller or processor depending on the processing
Our bank	Transfers (payouts, prepayment)	Independent controller
Apple Distribution International Ltd., Ireland	In-app purchase, Sign in with Apple, push notifications on iOS	Independent controller (purchase, sign-in); push as service provider
Google Ireland Ltd. or Google Commerce Ltd., Ireland	In-app purchase, Sign in with Google, push notifications on Android (Firebase Cloud Messaging)	as for Apple
Meta, X, TikTok	Sign-in with these services	Independent controllers
OpenStreetMap Foundation (Nominatim), United Kingdom	Converting addresses into coordinates (maps, delivery and service areas, ride requests)	Recipient of the address only
Geolocation service (section 4)	Country and city in the statistics	Recipient of the IP address
Real-time server (self-hosted)	Live notifications	–
Catalogue services (TMDB, IGDB, MusicBrainz, Open Library)	Search for films, games, music, books for profile widgets	Recipient of the search terms only

If we transfer data to countries outside the European Economic Area (e.g. for groups based in the USA), this is done on the basis of an adequacy decision of the EU Commission (e.g. EU-US Data Privacy Framework, United Kingdom) or standard contractual clauses.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves legal claims. This may be the case for the review of ad views and protection against abuse.

You can withdraw consents (e.g. statistics in the cookie banner, dating and erotic ads when earning, sensitive profile details) at any time with effect for the future.

Automated decision when earning (Art. 22 GDPR): Whether an ad view is valid and paid for is initially decided automatically by our daily review (section 7). A person reviews conspicuous days. You have the right to have a person review the decision, to express your point of view and to contest the decision. Write to support@zcroll.com or use the objection under the terms (§ 22). On request we explain which categories we used and send you a breakdown of valid and invalid views per month.

Complaint: You can lodge a complaint with a data protection supervisory authority, in particular in the state where you live or work. Our lead supervisory authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

For data you provided as a customer of a business, it is best to contact the business (section 12).

16. Retention periods

We only store data for as long as we need it for the purpose or a law requires it.

Data	Period
Ad pass	30 minutes (expires automatically)
Visitor ID, truncated IP and user-agent hash in ad views	90 days after the ad is settled
Click statistics and visitor ID	as long as the profile exists
Numbers of valid and invalid views without visitor reference	as invoices and credit notes
Billing details, invoices, credit notes, tax evidence	7 years, OSS records 10 years, each from the end of the year and also after account deletion
Cancellation declarations	3 years after the end of the contract
Identity verification document images	until account deletion
Handled reports	180 days after handling
Data of businesses' customers	after the period set by the business
First visit for referrals (session)	until the session ends, at most 30 days; deleted on login or account creation
Cookie zc_ref	30 days from the first visit; deleted on withdrawal, login or account creation
Attribution and status of a referral	as long as the referrer's account exists; payment and commission data related to credit notes as invoices and credit notes
Check value of the email address of deleted accounts	24 months from deletion
Other account data	deleted within 30 days of account deletion, except data subject to statutory retention

17. Apps

• Push notifications: If you allow push notifications, we store your device's identifier with the push service of Apple or Google and send notifications through it. Businesses also receive their customers' names, e.g. "Max requested an appointment". We remove devices we have not seen for 180 days. Legal basis: Art. 6(1)(b) GDPR; you give consent to push notifications on your device.
• Adult profiles: Whether you want to see adult profiles in the app is set on the website. We only store this setting.
• Purchases: section 8.

18. Data security

We transmit all data encrypted (TLS). We store passwords only as hashes. Only those who need access to personal data for their task have it.

19. Changes to this privacy policy

We update this privacy policy when our services or the legal situation change. The version published here applies.

20. Contact

Data protection questions: support@zcroll.com. You find all details about the provider in the imprint.