Privacy Policy

Last updated: May 4, 2026

1. Who We Are

Gezana Connection ("we", "us") is operated by Goitom Connections, a company registered in Switzerland. We provide the Gezana Connection mobile application and related international calling services.
Data Controller: Goitom Connections
Contact: contact@goitom-connections.ch

2. Data We Collect

• Phone number (E.164 format) — used as your account identifier for authentication, call routing, and payment processing.
• One-time verification codes — temporary codes sent to your phone to verify your identity at login. Stored for a maximum of 5 minutes and deleted immediately upon successful verification or expiry.
• Call records — destination number, duration, cost, and timestamps.
• Payment records — payment provider, amount, and external transaction ID. We do not store card numbers, bank account details, or CVV codes.
• Payment method preference — your selected top-up currency (USD, EUR, or CHF).
• Usage logs — login timestamps and payment events, used solely for fraud prevention and service security.

3. Why We Collect It

• To verify your identity using Firebase phone authentication, operated by Google LLC.
• To route and bill VoIP calls through our calling infrastructure. Per-minute rates may change; current rates are always displayed in the app before a call is placed.
• To process top-up payments via Stripe (card, Apple Pay, Google Pay, and Twint for Swiss users) and PayPal.
• To calculate and collect VAT for users in EU member states, applied via Stripe Tax prior to payment confirmation, in addition to the top-up value.
• To detect and prevent fraud and abuse.
• To comply with applicable legal and tax obligations.

4. Legal Basis (GDPR)

• Contract performance (Art. 6(1)(b)) — your phone number is required to authenticate your account, route calls, and process payments.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, rate limiting, and service security.
• Legal obligation (Art. 6(1)(c)) — financial transaction records are retained to comply with Swiss tax law.
• Legal obligation — VAT (Art. 6(1)(c)) — for EU-based users, VAT is calculated and collected as required under the EU One-Stop-Shop (OSS) regime.

5. Data Sharing

We share data only as needed to operate the service:

• IDT Express and DIDWW (call routing)
• Firebase (Google LLC) (SMS OTP)
• Stripe (card, wallet, and PayPal payments)
• Neon and Render (infrastructure hosting; data is stored in Germany)

We do not sell your data to third parties.

6. Data Retention

• Active accounts: data retained while your account is open.
• Deactivated accounts: personal data is scheduled for anonymisation 30 days after deactivation.
• Financial records: retained for 7 years to comply with Swiss tax law, after which they are anonymised.

6a. No-Refund Policy on Deactivation

Credit balances are non-refundable. If you deactivate your account, any remaining credit is permanently forfeited and will not be returned.

We recommend using your full balance before requesting account deactivation.

6b. Account Deletion (Deactivate Account)

The deactivation option is available in the app side menu under Deactivate Account. When selected, a two-step confirmation dialog appears and warns that deactivation is permanent and that any remaining balance will be forfeited.

Upon final confirmation:

• The account status is set to deactivated.
• All active sessions (including JWT tokens) are immediately revoked.
• The remaining credit balance is forfeited (no refund).
• The user is logged out immediately and cannot log back in.
• A GDPR erasure date is scheduled for 30 days after deactivation.

After 30 days, personal data is anonymised or purged in compliance with GDPR Article 17 (Right to Erasure), including profile data, call logs, transaction history, payment receipts, and audit logs. Financial records are retained for 7 years to comply with Swiss tax law requirements, but are anonymised.

Before deactivating, users can export their personal data via Settings → Export My Data. This GDPR Data Export provides a structured JSON file containing full profile data, call history, transactions, and payment receipts (GDPR Articles 15 and 20). Exports are limited to 3 requests per 24-hour period.

7. Your Rights (GDPR)

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erasure ("right to be forgotten") — see section 6b for the account deactivation and anonymisation process.
• Data portability — export your personal data directly within the app via Settings → Export My Data (structured JSON file; GDPR Articles 15 and 20).
• Object to processing based on legitimate interests.

To exercise any right, email contact@goitom-connections.ch. We will respond within 30 days.

8. Security

All data transmitted between your device and our servers — including VoIP call traffic — is encrypted in transit using Transport Layer Security (TLS). Authentication relies exclusively on one-time SMS codes; no passwords are stored or required. Payment details are handled entirely by PCI-DSS certified providers (Stripe and PayPal) and are never stored on our servers.

9. Cookies & Tracking

The Gezana Connection mobile app does not use cookies or third-party analytics SDKs.

Your IP address is processed by our servers solely for rate limiting and abuse prevention. It is not stored in our database and is not associated with your account.

10. Changes to This Policy

We will notify you of material changes via an in-app notice at least 14 days before they take effect. Continued use of the app after that date constitutes acceptance of the revised policy.

11. Contact