Privacy Notice

Plekko is a small Dutch app for university students. We keep what we collect deliberately narrow: enough to run your account, your listings, your messages and your safety, and nothing beyond that.

• Your account, listings, photographs and messages are stored in the European Union, in Amazon Web Services' Frankfurt region (eu-central-1). Limited data leaves the EU for push delivery, app updates, and only when you deliberately open a Google Maps route. Section 5 explains each flow.
• We use no advertising trackers, behavioural analytics, session replay or third-party crash-reporting software. If the app catches a screen error, it sends Plekko a tightly limited stability signal; it does not send the error message, stack, user content or screenshot. There is nothing measuring what you look at.
• We do not ask for your date of birth, your precise location, your identity documents or any payment details. Plekko never handles money.
• We do not sell your data, and we never will.
• You can request a copy of everything we hold about you by emailing our privacy team from inside the app, or delete your account entirely in the app.

Things we deliberately do not collect

We do not ask you to provide, and we do not intentionally infer, your date of birth, precise or GPS location, health data, biometric identity, political or religious views, sexual orientation, government identity documents, payment or bank details, browsing history, contacts, or activity in other apps or websites. Free-text messages and uploaded images can nevertheless contain information you choose to include. Please do not include sensitive information that is unnecessary for the conversation, listing or housing search.

Some information never reaches us at all. Your room preferences and shared-home comparison are calculated on your own device from preferences held in encrypted storage there; no score, comparison or pairing is sent to Plekko. If you connect the university planner, your classes live in a separate Plekko calendar in your phone's own calendar app — we read only that calendar, and event details, imported .ics files and calendar links are never sent to us.

Providing your data

A verified university email address is a condition of using Plekko. Without it an account cannot be completed and the service cannot be used. Your name, study details, general profile photo, city, notification permission and classmate-directory visibility are optional for using Plekko generally. Individual features can require the information needed to publish them: a room-seeker request, for example, requires exactly two approved photos, a housing-search introduction and the practical search details listed in the table above.

For a prospective organisation partner, the organisation identity, registration reference, authority declaration, contact name and role, work email, application answers and at least one supporting evidence file are required so Plekko can assess the application. A phone number is optional. Without the required information, the application cannot be submitted or reviewed.

Every image uploaded to Plekko passes through an automated safety pipeline before it can be shown to anyone: a malware scan, removal of embedded metadata including any location data the camera recorded (EXIF), and automated content moderation. Images that fail are quarantined and are not included in a preview or published.

Room-seeker requests apply additional checks. Each of the exactly two room-seeker profile photos must contain one clear face and no other face; the check counts detectable faces but we do not identify or compare faces, infer identity or demographics, or create biometric templates. The introduction is checked for threats, abuse and housing-search relevance. Marketplace items above €30 receive a photo-to-description consistency check. Deterministic checks also validate required fields and permitted values.

These tools decide whether a draft is ready for publication; they do not make a legal or similarly significant decision about you. Ambiguous results can receive human review. If we restrict your content or account, we give you a statement of reasons and a way to challenge the decision — see our Terms, section 9.

We use a small number of service providers and platform operators. Amazon Web Services processes hosted application data on our instructions. Apple, Google and Expo also process technical data under their own terms where they provide app distribution, device notifications, update delivery or a route you deliberately open.

We do not share student personal data with advertisers, data brokers, analytics companies or partner organisations. If we ever introduce a feature that shares student data with a partner, we will ask for your explicit consent first, tell you exactly what would be shared and why, and update this notice before it starts.

Organisation application data is reviewed by Plekko for the applicant's requested partnership. Supporting evidence is private and is not published. If an application is approved, only the organisation content intended for publication — such as its name, website, deal or event details — may be shown to students. The applicant's private contact details and evidence are not shown to students.

We may disclose data where the law requires it — for example to comply with a valid order from a Dutch authority — or where we must report a suspected criminal offence involving a threat to someone's life or safety, as the Digital Services Act requires.

The data described in section 2 — your account, listings, photographs, messages, checklist, notifications and logs — is processed in AWS eu-central-1 in Frankfurt. Three flows leave the European Economic Area:

• when you enable notifications, your device token and the notification content are sent to Apple or Google in the United States so the notification can be delivered;
• app builds and updates are delivered through Expo in the United States, which processes technical delivery data including your IP address.
• when you deliberately tap Open directions on a room, the approximate postcode-area centre and the official campus coordinates are sent to Google Maps in the United States. We do not include your account identifier or a full address, and no route request is made before you tap.

These transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) together with a documented transfer risk assessment. You can request a copy of the safeguards by emailing privacy@plekko.eu.

We use no advertising network, no analytics service, no font or script delivered from a third-party network, and no other integration that would send your data outside the EEA without it being stated here.

The table in section 2 gives the period for each category. Two general rules apply on top of it.

If you delete your account, we remove your profile and personal details promptly, and a background process then deletes or anonymises the rest of your account data and files. Completion can take time. We keep only the minimal request, deletion and moderation evidence described in the table for its category-specific period so we can demonstrate compliance and establish or defend legal claims.

We keep your account and its data for as long as your account exists, because that is what the service needs in order to work. You can delete it yourself at any time from inside the app. We do not currently delete accounts automatically after a period of inactivity. If we introduce that, we will tell you before it starts and give you the chance to sign in first.

You can exercise any of these free of charge. We reply within one month, as Article 12(3) GDPR requires.

Two limits worth knowing. Your data export contains your conversations as you already see them in the app: the other person appears under the display name you already see, and we do not add their email address, account identifier or any other detail about them, because Articles 15(4) and 20(4) GDPR do not allow us to hand over information in a way that harms someone else's rights. After you delete your account, the minimal request, deletion and moderation evidence in section 2 remains for its stated period.

Plekko makes no decisions about you by automated means alone that produce legal effects or similarly significantly affect you.

If a personal data breach is likely to result in a risk to people's rights and freedoms, we notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours after becoming aware of it, as Article 33 GDPR requires. If it is likely to result in a high risk to you, we also tell you directly without undue delay, as Article 34 requires.

Plekko is for people aged 16 and over, and our Terms say so.

We want to be precise about what that means. We do not ask for your date of birth, and verifying a university email address does not verify your age — we do not claim otherwise. What it does do is limit Plekko to people who hold a mailbox at a participating university in the Netherlands, which in practice means our users are students rather than children.

If you believe we hold data about someone under 16, email privacy@plekko.eu and we will review and delete it promptly.

In the app there are no cookies. We store sign-in tokens in your device's secure keychain, along with the key protecting a small cache of public listings. Your account preferences are held in encrypted storage on the device. Directory search results, notifications, profile data and study-group details are held in memory only. The app contains no behavioural analytics and sends no analytics events. Its bounded stability signal is used only when a screen error is caught, as described in section 2.

On plekko.eu the public pages set no analytics, advertising or tracking cookies, and load no third-party scripts, fonts or images — which is why you see no cookie banner. The signed-in partner application uses strictly necessary first-party cookies, listed in our Cookie Policy. We provide separate privacy information directly to authorised administrators at sign-in for the restricted internal administration area. The public account-deletion page has no student sign-in, sets no cookies and only opens an email request. We never ask you to send a password or verification code by email.

Plekko is provided in English. This Privacy Notice, our Terms of Service and all communication about your account are in English, and English is the language of your agreement with us. For communications with regulators about content and moderation we also accept Dutch, as explained in our Imprint.

If we change how we handle your data in a way that matters, we will tell you in the app or by email before the change takes effect, and update the version and date at the top of this page. The current version is always at https://plekko.eu/en/legal/privacy.

Questions, requests or complaints about your data: privacy@plekko.eu

Reports about content, accounts or moderation: dsa@plekko.eu

Everything else: support@plekko.eu

Arkstasis, a Dutch sole proprietorship trading as Plekko. KvK 42057592. VAT NL005462594B13. Registered business address: Torenlaan 5, 1402 AT Bussum, the Netherlands.