Privacy Policy: Social Media, Messaging and AI

This policy covers how we process personal data when you contact us on Instagram, Facebook or WhatsApp, chat with our AI assistants, join one of our trips or our community, book a call with us, or work with us as a business. For our website, see our general privacy policy at https://cocotrips.co/privacy.

1. Controller and contact

The controller responsible for processing personal data in connection with the brands Cocoholics, CocoTrips and Coco Creator Community and the Instagram accounts @cocoholics.co, @cocotrips.co and @tomnkorn is:

Tom Korn Am Grauenberg 15 63571 Gelnhausen, Germany Email: info@cocoholics.co

We have not appointed a data protection officer because the legal requirements for doing so are not met.

2. Instagram, Facebook and WhatsApp

Direct messages and comments. When you send us a message on Instagram or Facebook, comment on one of our posts, or contact us on WhatsApp, we process your username, display name, public profile picture, the content of your messages or comments and the time they were sent. On WhatsApp we also process your phone number. We receive this data through Meta's official interfaces and store it in our internal system to answer your request, assign it to a topic (for example trip, community or collaboration) and, where needed, pass it to the right person on our team.

If you comment on a post with a specific keyword (for example "COCO"), we send you one direct message with the information you asked for.

The legal basis is Art. 6(1)(b) GDPR where your request relates to a booking, participation or membership, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to answer requests quickly and completely.

Statistics. For our own posts we retrieve aggregated statistics (for example views, reach, likes and saves). Meta provides this data only in aggregated form, not linked to individual people. For the statistics of our pages we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR); the corresponding agreement is provided by Meta: https://www.facebook.com/legal/terms/page_controller_addendum

Team groups on WhatsApp. Our internal team groups run on a WhatsApp Business number and are mirrored into our internal system. Only team members are affected.

Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Meta's privacy policy: https://www.facebook.com/privacy/policy/

3. AI assistants

To answer requests quickly, we use AI-based assistants. They read your message history, assign your request to a topic and draft replies. If you ask whether you are chatting with an AI assistant or a person, we always answer honestly. You can ask to speak to a person from our team at any time.

The AI does not make decisions that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). Bookings, contracts, prices and collaborations are always decided by people on our team.

We use AI services from Anthropic, OpenAI and Google (see section 7) and share only the content needed to answer your request. Under these providers' terms for business customers, the data is not used to train their models.

The legal basis is Art. 6(1)(b) GDPR for requests about bookings or membership, and otherwise Art. 6(1)(f) GDPR (handling a large number of requests quickly).

4. Bookings, calls, community and payments

Booking calls (Calendly). When you book a call with us, we process your name, email address, Instagram username, the appointment and your answers in the booking form, in order to hold the call and link it to your earlier request. Provider: Calendly LLC, USA. Legal basis: Art. 6(1)(b) GDPR.

Video calls (Zoom) and webinars. We use Zoom for calls and webinars. We process your name, email address and, if you switch them on, your video and audio. Provider: Zoom Communications Inc., USA. Legal basis: Art. 6(1)(b) GDPR.

Recording and summaries (Fathom). Some calls are recorded so they can be summarised automatically and turned into tasks for our team. We only record if you agree at the start of the call. Legal basis: Art. 6(1)(a) GDPR. Provider: Fathom Video Inc., USA.

Community and payments (Whop). Our Coco Creator Community and payments for memberships and deposits run on Whop. Whop processes your account and payment details; we receive your name, email address, the product purchased, the amount and the time. We do not see payment details such as card numbers. Provider: Whop Inc., USA. Legal basis: Art. 6(1)(b) GDPR.

5. Trips: contracts, photos and face recognition

Participation. To take part in our trips, we process the details in your contract: name, contact details, trip and dates, people travelling with you and payment status. Signed contracts that you send us via WhatsApp are read by our system to add you to the participant list; a person on our team confirms the entry. Legal basis: Art. 6(1)(b) GDPR.

Photos and videos. Photos and videos are taken during our trips. We only use footage in which you can be recognised on our channels if you have consented to this in your contract. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.

Face recognition. To organise our photo archive, we automatically match photos to people. This only applies to people who have given explicit consent and provided a reference photo. Biometric data is processed for this purpose. Legal basis: Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. Face matching runs on Amazon Rekognition (Amazon Web Services, EU region, see section 10); the biometric features are processed only for this purpose and are not shared with anyone else. Faces of other people are neither stored nor matched. People under 18 are not included. If you withdraw your consent, we delete your reference photo and all matches.

6. Business contacts and email

When we work with businesses or approach them about a collaboration (for example brands, hotels, resorts, villas or restaurants), we process name, role, business contact details and the history of our communication. The legal basis is Art. 6(1)(b) GDPR for existing business relationships and otherwise Art. 6(1)(f) GDPR (initiating collaborations). You can object to this processing at any time, and we will then stop contacting you.

When you email us, we process your details to answer your request. Legal basis: Art. 6(1)(b) or (f) GDPR.

7. Service providers, international transfers and retention

Service providers. We use service providers who process data on our behalf. Data processing agreements under Art. 28 GDPR are in place with them.

Transfers outside the EU. Some providers are based in the USA. Where a provider is certified under the EU-US Data Privacy Framework, transfers are based on the European Commission's adequacy decision (Art. 45 GDPR); otherwise on standard contractual clauses (Art. 46(2)(c) GDPR).

Retention.

8. Use of AI services

To answer messages on Instagram and WhatsApp, we use AI models from Anthropic PBC (USA). In doing so, we process the content of your messages, your profile name and public profile details such as your follower count. To create graphics for our social media posts, we use image models from OpenAI (USA) and Google (Gemini, USA). We do not pass on any messages or photos of people to these services. Transfers to the USA are based on the EU-US Data Privacy Framework or on EU standard contractual clauses.

9. Hosting and storage

Our internal team system runs on Cloudflare, Inc. The data is stored in data centres in the EU. Voice messages are converted into text via Cloudflare Workers AI.

10. Photos and face recognition

To manage our photo and video footage from trips, we use Google Drive and Amazon Rekognition (Amazon Web Services, EU region). Faces are only matched if the person concerned has given explicit consent in advance (Art. 9(2)(a) GDPR). Faces of people who have not given consent are not stored; they are only counted and deleted immediately. Consent can be withdrawn at any time.

11. Your rights, data deletion and complaints

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)).

Deleting your data. If you want us to delete all data we have received about you via Instagram, Facebook or WhatsApp, send a message with the word "Delete" to info@cocoholics.co or as a direct message to the account you contacted us through. Please include your username or phone number. We will delete the data within 30 days and confirm this to you, unless statutory retention obligations apply.

Complaints. You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

Last updated: October 8, 2026