Privacy policy

1. Who is responsible

The person named above is solely responsible; no one else has a say in what happens to your data. Who apart from us gets to see any of it is set out in the section “Where the data is kept and who else sees it”.

We have not appointed a data protection officer under Art. 10 FADP.

2. The essentials in brief

• Searching, comparing and reading work without an account. We do not store what you search for – with three exceptions: if your search finds nothing, we record for 30 days what was searched for, so that we can find the error; and if you click on a listing, a house or another portal in the search, we record with that click which filters you searched with; and since 10.10.2026 we record every search with date and time, with its filters from our lists and the number of results – without you –, and delete that after 30 days. We count page views as daily totals. If you click on another portal, a third-party listing, a house’s page or a profile, we also record the date and time of that click, together with roughly whether it was a mobile or a desktop, the country and, if the click came from the search, its filters – without you: no IP address, no device identifier, no cookie – and delete this after 30 days. Since 29.9.2026 we have also counted how many different devices visited on a given day – by means of a check value whose key changes every night, and a cookie containing only the day of your last visit; beyond a single day we cannot recognise you with it, and you can decline it with a single click. Advertising only appears clearly labelled and sold directly by us – no ad networks, no advertising trackers, no third-party analytics services and no scripts or fonts from third-party servers. Profiles featured for payment carry “Featured · paid”.
• The data is kept on our own devices in Switzerland. No hosting provider, no cloud storage. The site is connected via Cloudflare, a company based in the USA; Cloudflare sees your IP address and which page you request.
• From listings on other portals we do not store any phone numbers in plain text, any photos, any ad texts or any street addresses. Working name, age and physical characteristics are kept only as long as the listing is online and are deleted seven days afterwards. You can search for the working name with us, subject to rate limits.
• Anyone who advertises there and does not want to appear here can object without an account, with a button on the card.
• If you advertise here, your profile is public and can be found by search engines. The email address of your account never will be – a contact address that you enter and release yourself will.
• We only look at an ID document if you choose to be verified. Until we have looked at it, your picture is stored with us in encrypted form; once the decision has been made, it is deleted, after three days at the latest.
• We do not sell any data about people. As soon as we offer market reports, we sell figures on supply, prices and demand – never below five listings per figure and never about a single person or a single listing. What they contain and who apart from us sees anything is set out in the section “Where the data is kept and who else sees it”.
• If you pay us for something, once paid offers exist, we keep the order, invoice and receipt for ten years, as the law requires. We do not store your IBAN or the name under which your bank pays (see “When you pay”).

3. When you visit the site

The application does not store your IP address. It counts page views as daily totals. It records three things individually, with date and time: clicks on another portal, a third-party listing, a house’s page or a profile – roughly with the type of device and the country and, if the click came from the search, with its filters, but without IP address, without device identifier and without cookie, for 30 days (see “Statistics: counting and recording without knowing who you are”) –, since 10.10.2026 every search – with its filters from fixed lists and the number of results, without any information about who you are, 30 days, in the same section under “Searches with date and time” –, and searches that found nothing (see “Searches without results: what was searched for”). It does not keep a log of who viewed what. When signing in, registering and reporting, we count attempts per sender address in memory, in order to curb abuse. This counter never goes into the database and is gone after a restart.

We do not store what you search for and which filters you set – neither linked to you nor as a history. What is counted, as a daily total for everyone together, is which types of searches and which filters were used and, since 4.10.2026, what was searched for – each value and each typed term on its own, with no link to you or to the other values of the same search; how exactly is set out under “Statistics: counting and recording without knowing who you are”.

There is one exception, and it is described in detail under “Searches without results: what was searched for”: if your search or your price comparison finds nothing, we record what was searched for – for 30 days, so that we can find the error. This entry is linked to nothing: no account, no session, no IP address, no cookie.

What you click on, we record if it is another portal, a third-party listing, a house’s page or a profile: with date and time, but not linked to you. The entry contains nothing by which we could recognise you or your device, and we do not keep a history per visitor. Since 5 October 2026 it has also recorded roughly whether it was a mobile or a desktop and which country the click came from. What exactly the entry contains, how long it is kept and what can nevertheless be read from it is set out under “Statistics: counting and recording without knowing who you are”.

If you search for a name, your browser does not send it in the address but once to our server. There it is held in memory under a random identifier for at most 20 minutes, so that you can page through the results. If the name search finds someone, since 29.9.2026 we have counted as a daily total how often this name was searched for – for 30 days, with no link to you (see “Statistics: counting and recording without knowing who you are”). If it finds no one, the name searched for goes into the diagnostic log below. Since 4.10.2026 we have also counted each name searched for as a daily total, with or without results, for 90 days and likewise with no link to you. The name search is throttled against mass queries, for all visitors together and without IP addresses.

The site sets at most nine cookies for you. Seven of them are only created if you do something to get them:

• sitzung – only if you sign in. A random key that keeps you signed in, unreadable for scripts, valid for at most 30 days.
• muster – only if you change the colour scheme. Keeps your choice for a year, in discreet mode only until you close the browser.
• diskret – only if you switch on discreet mode. Disappears when you close the browser.
• alter – only if you confirm on a profile that you are at least 18, in order to see the pictures behind the age check. It contains the fixed value “ab18” and nothing else: no name, no date of birth, no identifier. A year, in discreet mode only until you close the browser. We store nothing about this confirmation in our database.
• anmeldeweg – only if you press “Sign in with Google/Apple/Microsoft” or, on your account page, “Link …”. Holds for at most ten minutes which sign-in your browser has just started (three random values, the language and the page you want to return to afterwards; when linking, also the identifier of your account and a check value of your session, not its key), so that no one can slip you someone else’s sign-in. Applies only to addresses under /anmeldung/ and is deleted as soon as you return from the provider.
• eigenzugang – only if you sign in with the code you received when confirming a profile that someone created for you. A random key, unreadable for scripts, valid for at most 30 minutes and gone when you sign out.

Since 29 September 2026 there has been one more cookie that you do not request: besuch. It contains two things – the day of your last visit and a random value that we do not store anywhere. It does not contain what you do, search for or look at here. From it we count as a daily total how many devices are here for the first time and how many come back; there is no history about you. It lasts half a year. If your browser arrives signed in to an account with us, we delete the cookie immediately: it should never sit alongside your account.

You can decline it without having an account and without JavaScript: on the page “Discretion matters to us” (in the footer: “Discretion”) there is the switch “Do not count this browser”. It switches off not only this cookie but the entire counting for this browser. In discreet mode you do not get the visit cookie anyway. And in your browser’s private window it disappears with the window – there, every visit counts as a new one.

Since 4 October 2026 there has been a second one: zufallsmuster. If you have never chosen a colour scheme, on your first page view we randomly pick one of the seven and remember it in this cookie, so that it stays the same when reloading and on every further page. It contains only the name of the scheme – the same word on every device that drew the same one –, no identifier and nothing about what you do here. It disappears when you close the browser; next time we draw again. If you choose a colour scheme yourself, your choice applies and we delete zufallsmuster. You can decline it by having your browser refuse cookies from this site; each newly loaded page then shows a newly drawn scheme.

Apart from these, the site sets no cookie. That is why there is no consent banner either: Art. 45c TCA requires notice and the possibility to decline – both are provided here and on the page with the switch –, but no prior consent.

You get the cookie zaehlen if you choose “Do not count this browser” – on the page “Discretion matters to us” or, for ourselves, in the admin area. It contains only the word “nein”, is the same on every opted-out device and serves to leave you out, never to recognise you. One further cookie, luecken_meldung, exists only for ourselves and only in the admin area; for two minutes it records which feedback the last input triggered. Anyone who only visits the site never gets it.

Advertising only clearly labelled and sold directly by us – no ad networks, no advertising trackers, no third-party analytics services, no tracking pixels, no analysis of your behaviour. An ad on our site is a card that we draw ourselves from text, always labelled “Advertisement · Advertiser”; it appears on the home page, on place pages or in the search results, never on the page of a profile, and loads nothing from third-party servers (see “When you book advertising with us”). Profiles that someone has featured for payment appear only in a separate band above the list of search results and always carry the label “Featured · paid”; the band loads nothing from third-party servers. The site does not load any scripts, fonts, maps or videos from other companies. Every page sends the instruction “Referrer-Policy: same-origin”: if you move from here to another portal, it does not learn which of our pages you were on, what you searched for or which filters you set. As a result, no reference to our site goes outside; only our own server learns from which of our pages a click came.

Since 19.9.2026, however, the target portal does learn that the click came from rosalon. For this purpose, the address to which we forward you carries the addition “utm_source=rosalon”. It is the same for every visitor, every click and every listing: no number, no time, no marker for you. From it the portal can see how many people come from us – not who you are, and not whether you have been there before. If you do not want to pass on even that: the addition is visible in the address bar and can be deleted there, and extensions that remove such additions recognise it.

Links to third-party services. If you press Route, Timetable or Uber on a house page, the service of Google, SBB or Uber opens with the house’s address as the destination; what that service does with it is up to that service. We do not tell it where you came from. The link to Bolt only leads to Bolt’s page for the area, without a destination.

Starting point and travel times. If you search for houses near you, you enter a postcode or a place or let your browser determine your location – it asks you first. We round the point to about one kilometre before it leaves your browser, and once more on the server. It appears only in the page address, not in a cookie and not in the database; it therefore does appear in your browser history. If you want to avoid that, type a postcode. For the travel time by public transport our server queries opentransportdata.swiss, the timetable service of Swiss public transport: with the rounded starting point, the centre of the house’s locality and the time, without your IP address and without any information about your browser. Car, cycling and walking routes we calculate on our own device. We keep the results only in memory; for how long is stated in the table below.

Traffic reports and public transport disruptions. Our server fetches the traffic reports of the Federal Roads Office (FEDRO) for the whole of Switzerland and keeps them only in memory; FEDRO learns nothing in the process about you, your starting point or the house. Disruptions in public transport come with the response from opentransportdata.swiss, without any further request.

The quick exit on every page switches immediately to google.ch, replacing the entry in your history, clears this site’s browser storage and deletes the cookies muster and zufallsmuster, diskret and alter. What your browser otherwise stores or syncs with other devices cannot be deleted by any website.

4. Statistics: counting and recording without knowing who you are

We count page views as daily totals. Of a page view, all that remains in these counters is that on that day a counter goes up by one, separately for each of the following: the type of page (such as “profile page”, never its address with number or search terms), the language, whether mobile or desktop, the website you came from – only its main address, such as google.ch –, the country (further below), and for a house’s page, which house page it was. If you arrive via the QR code on one of our printed business cards or stickers, we only count which one it was – “business card” or “sticker” –, likewise as a daily total in a separate row and nothing else; we remove the addition used for this from the address straight away. For search engines and other programs we count their type and a short name. We also record four kinds of clicks individually, with date and time, roughly with the type of device and the country and with the filters of the search the click came from, but without any information about who you are – which ones is set out further below under “Clicks with date and time”.

Since 29.9.2026 we have also counted which country your page view came from, likewise as a daily total. Cloudflare, through which the site is connected, passes us the country as a code, such as “CH” – we do not read your IP address for this, and the code is in a separate row, never together with language, device or page. Anyone coming via the Tor network is counted without a country. For search engines and other programs we do not count a country. In rough terms – Switzerland, Germany, France, Italy, Austria, Liechtenstein or “other” – the country has also been recorded since 5 October 2026 with every click in the list further below (“Clicks with date and time”).

Not stored are: your IP address and your browser’s identifier – the counting reads both in order to leave out page views from our own network and to calculate the daily changing check value from them (further below), and forgets them at the same moment –, the full address including search terms, and the full address of the page you come from – if a click comes from our search, we take from its address only the filters clicked (further below, “Clicks with date and time”) and forget the rest. Of the only cookie created in the process, nothing is in our database: it sits on your device, and all that remains with us is a total. In the daily totals the attributes never appear together in one row: which language belonged to which origin is recorded nowhere. There is no per-person history in these statistics. Something is recorded individually in three places: clicks on a target, with date and time, roughly with the type of device and the country and with the filters of the preceding search, but without any information about who you are (further below, “Clicks with date and time”), since 10.10.2026 every search with date and time, its filters and the number of results, likewise without any information about who you are (further below, “Searches with date and time”), and searches without results (in the section “Searches without results: what was searched for”). Prefetching of pages, the advertiser area and the administration are not counted, nor are page views from our own network, from signed-in administrators and from devices expressly excluded with the cookie zaehlen – by you yourself or by us. Only we see the figures.

Since 1 October 2026 we have also compared your IP address in this process with the public lists in which Amazon Web Services, Google Cloud, Microsoft Azure, Oracle Cloud and DigitalOcean publish the addresses of their data centres, and with the address ranges of other data-centre operators such as OVHcloud, Hetzner or Contabo, which we take from the public routing data of the RIPE NCC: if a page view comes from there, we count it as a program and not as a human, and the daily total then only records which of these operators it came from – we do not store the address itself for this either.

Since 29 September 2026 we have also counted how many different devices visited on a given day. For this we calculate a check value from your IP address and your browser’s identifier – a hash from which neither the one nor the other can be recovered. The key for it changes every night: the same connection with the same browser yields a completely different value tomorrow, and the values cannot be matched with each other, not even by us. We still never store the IP address itself, not even temporarily. The master key is not in the database but only in the server’s environment.

These check values are kept for at most two days. As soon as a day has ended, all that remains of it is the bare number – “on this day there were so many devices” –, and the values themselves are deleted. They would be of no use for longer anyway: with yesterday’s key nothing from today can be compared.

From the cookie besuch (see above) we count two things, both only as a daily total: whether a device was here for the first time that day or came back, and how long ago the last visit was, in four rough groups – yesterday, 2 to 7 days ago, 8 to 30 days ago, longer. A device counts once a day, not once per page. What you looked at or searched for on a given day is in none of these rows; they only say that someone was here.

What these figures cannot do, and that belongs here too: one person with a mobile and a laptop is two devices. Two people on the same Wi-Fi with the same browser are one. In a private window every visit counts as a new one. It is an estimate of how many people are here, not a count of people – and it is deliberately so rough that it says nothing about you.

These daily totals are not kept forever either: after 24 months we delete them. The figures about all visitors do not concern any person; deleting them is a commitment on our part and not a statutory obligation. The figures per profile, on the other hand, are linked to an ad: the same time limit applies to them, and they also disappear with the ad or the account. Two years are enough for a comparison with the previous year; we do not need more.

We likewise count clicks to the outside as a daily total. A link to a listing on another portal, to a house’s website or to a house’s entry on a portal goes through a redirect of our own. There a counter for the target’s main address goes up by one – such as xdate.ch –, and the browser moves on. It is only counted when a human clicks, not for search engines and other programs; the redirect happens in every case. From which page is recorded nowhere; when the click happened, roughly with what type of device and from which country and – if the click came from the search – with which filters the search was made, we record in the list further below (“Clicks with date and time”). The link in the search passes the filters to our redirect; the other portal does not learn them. We only redirect to addresses that actually appear on our site. The target address carries the addition “utm_source=rosalon” – the same for all visitors; what it is and what it is not is set out above under “When you visit the site”.

Which third-party listing it was, we have counted since 29.9.2026 in a separate row alongside: for each clicked listing a counter goes up by one, with an internal identifier and nothing else – never the working name, never a phone number, never the address of the listing, never the portal in the same row, and never together with language, device or origin. Only we see this number, in the admin area; it appears on no public page and not in the market figures. This row is kept for 30 days and not, like the other daily totals, two years: a listing belongs to a person, and a longer series would be a time series about that person. Whoever runs the listing can object to it as before with the button on the card; this row can then no longer be attributed either. When a listing was clicked is also recorded in the list further below (“Clicks with date and time”), under the same identifier and there roughly with device and country and the filters of the preceding search.

We also count which house page you look at: for each house a separate counter goes up by one, with the house’s number and nothing else – it is in a separate row and never together with language, device or origin. It is only counted if the house exists with us, and not for search engines and other programs. A house is a business; who you are is not contained in this number. When a house page was viewed we also record in the list further below (“Clicks with date and time”), there roughly with device and country and the filters of the preceding search.

We count the same for listings: which profile page it was. For each profile a separate counter goes up by one, with the profile’s identifier and nothing else, in a separate row – never together with language, device or origin. A second counter records that a contact button was pressed. It is only counted if the profile exists with us, and not for search engines and other programs. These figures are seen by the person who runs the listing, and only for their own listings. If they delete a listing or their account, we delete the figures with it. Since 10.10.2026 we also see these figures, in the admin area and there only with admin rights, per listing and added up: for running the site, to detect abuse and to be able to advise the people who advertise with us – for example when a listing is hardly seen. They appear on no public page and not in the market figures. When a profile page was viewed we also record in the list further below (“Clicks with date and time”), there roughly with device and country and the filters of the preceding search; we see this list, in the admin area, and we also delete its rows together with the listing.

With such a click it is also recorded which of the seven buttons it was – phone, SMS, WhatsApp, Telegram, email, contact form or website. What is counted is the type of button, never the target behind it: not the number that was called, not the address that was written to, not the username. This too is a daily total per listing, without time, without sequence and without a single piece of information about you; seven clicks become the number seven and not a path through the site. How often which contact method is used across the whole platform we do not count separately. In the admin area we add up the figures of the individual listings for this; this total appears on no public page and is not shown to the person who runs a listing.

Clicks that stay on our site we do not otherwise count separately; they are page views like any other. So we do not learn whether a click on a profile or a house came from the price comparison or from the search, and we do not want to: that would be a piece of a path instead of a number.

Clicks with date and time. Four things we record not only as a daily total but additionally individually, in a list: the click on another portal or on a house’s website, which third-party listing was clicked in the process, the viewing of a house’s page and the viewing of a profile. Each row contains six items and no seventh: date and time, to the second; the type of click; the target – the main address of the portal or website, the internal identifier of the listing, the number of the house or the identifier of the profile –; roughly the type of device – mobile or desktop, as in the daily totals; a tablet usually counts as a desktop –; roughly the country that Cloudflare reports for your connection – Switzerland, Germany, France, Italy, Austria or Liechtenstein, otherwise only “other”, and “unknown” if none is known; and, if the click came from our search, the filters of that search. Rows from before 5 October 2026 have no device and no country; nothing is added retrospectively. The filters are only what you clicked from fixed lists in the search: canton, radius in kilometres, category, gender, services, “Mother and daughter”, “Sisters”, “Twins”, “Person with albinism”, “Person of short stature” and “Braces”, who the offer is for, contact method, age group, self-description, language, country of origin, physical characteristics, price and height in bands, “Verified only”, “Protected only” and “Hide profiles with no answer”. Never included are what you type (the name search, the services search field), your postcode, a place or location, ethnicity, “pregnant” and the page number. For a house page and a profile we read them from the address of the search page, which your browser sends along with a click within our site; for a click on another portal the link passes them to our redirect, and the other portal does not learn them. We do not store the address itself. If the click did not come from the search, nothing is recorded there; rows from before 6 October 2026 have no filters. A click on a third-party listing results in two rows with the same time: the portal and the listing’s identifier.

This list contains nothing by which we could recognise you: no IP address, no identifier of your device or browser and no check value derived from them, no cookie, not your browser and not your operating system, not the page you came from, not your language, no place, nothing you typed into a search field, no account and no sequential number. There is no key by which two rows could be attributed to the same visitor, and we do not keep a history per visitor. What can nevertheless be read from it, we say openly: each row is a small profile of the preferences of one visit. If only a few visitors are here on a given day, the order of the clicks shows what someone clicked on one after the other – first this house, then that listing –, and with the filters alongside it is possible to piece together what someone searched for and clicked on. Device and country make this sequence easier to read: if on a quiet day only a single mobile from Germany is here, its clicks can be strung together in the list. Not who it was. The same applies to a search without results, which we record with its time (next section): if it is close in time to a click, it is likely that both come from the same person.

Only we see the list, in the admin area; it appears on no public page and not in the market figures. We delete each row after 30 days, in the nightly run; the daily totals remain as described above. If a listing with us or the account behind it is deleted, we delete the rows for that profile at the same moment. If a third-party listing or a house disappears from our records, the row remains until the 30 days have expired. Something is only recorded when a human clicks – not for search engines and other programs, not from our own network, not for signed-in administrators and not for devices excluded with the cookie zaehlen. The click on a contact button is not in this list; it remains a daily total without time.

Searches with date and time. Since 10.10.2026 we also record every search, every price comparison and every entry in the free-text field individually, in a separate list, so that we can see what is searched for and clicked one after the other on the site – what, never who. Each row contains: date and time, to the second; the kind (search, price comparison or free text); the language of the page; for a search and a price comparison the filters set, only values from our fixed lists – the same as for the clicks above, plus a city from our list, the first two digits of the postcode, the services and duration of the price comparison and whether a name was searched for –, and the number of results; for the free-text field, what the search recognised and, for a house, a place, a service, an attribute or “nothing found”, the word in the same simplified spelling as in the daily total. Never included: who you are – no IP address, no cookie, no session, no account, no device, no country –, a searched name, a phone number, an email, postal or web address, your full postcode, ethnicity and “pregnant”. The price is the same as for the clicks: with only a few visitors around, the order lets someone piece together what a person searched for and clicked one after the other – not who it was. Only we see the list, in the admin area and only with admin rights; we delete each row after 30 days, in the nightly run, and it does not go into the backup. It is recorded only when a person searches – with the same exceptions as for the clicks.

We likewise count searches and price comparisons as daily totals, and only when a human searches, not for search engines and other programs. With a search, a counter goes up for its type – by a name, by a place, with other filters or with none at all – and one counter each for the name of every filter set, such as “Canton” or “Hair colour”. With the price comparison, a counter goes up for its type – with selected services, only by the base price of a duration, or without a selection –, one for each selected service, as a number from our fixed list of services, and one for the chosen duration, such as “60 minutes” or “Night”. If you page further through the results, that does not count again.

In these counters the rule is: what is counted is the name of a filter, never its value – that a search was made by canton or by postcode, not by which canton and not by which postcode. What you type into a search field we do not count here – only that the field was used. For a name search these counters only record that there was one: not the name, not its identifier, not its length. The only values we count in these counters are the service and the duration in the price comparison, and both come from our own fixed lists, not from your input. How often a name was searched for (since 29.9.2026) and what is searched for – including which canton and what was typed (since 4.10.2026) – we count separately from this; the paragraphs on this are further below. These counters too are each in a separate row: which filter was set together with which other, which search it belonged to, in which language, with which device, from which website or at what time the search was made is recorded nowhere.

Since 22.9.2026 we have also counted whether a search or a price comparison found nothing, likewise as a daily total and only when a human searches. Only the type of query without results is counted – a search by a name, by a place, with other filters or with none at all, or a price comparison –, such as “a place search found nothing”. Never which place, which filters or which name, and this counter too is in a separate row, without language, device or time. If you page further, that does not count again. This applies to this number; what was searched for we have recorded separately since 27.9.2026 – the section below explains how.

Since 29.9.2026 we have also counted how often a name was searched for – as a daily total per name, in a separate table, and only if the search found someone. With us you search by the working name, the fantasy name under which someone advertises; what finds something is therefore the beginning of a name that is shown openly on a card with us anyway. What finds nothing – a number, a sentence, a name under which no one advertises – does not go into this number. The row contains the name and the number, nothing else: no session, no IP address, no cookie, no device, no language, no reference to the result. This row is kept for 30 days, like the diagnostic log, and for the same reason: the search field accepts free text. Only we see these figures.

Since 4.10.2026 we have also counted what is searched for – as a daily total per value, in a separate table, and only when a human searches. What is counted are values from our fixed lists – the canton, the category, a service, an attribute such as “Hair colour: blonde” – and what you type into a search field: into the services search, into the search field of the price comparison and into the name search, even if the search finds nothing, even with typos. A typed term is stored in lower case and shortened to at most 100 characters; a phone number, an email address or a link in it is replaced beforehand – “Lara 079 …” becomes “lara [phone number]” –, and we never store the number, the address or the link itself. For each value we only record whether the search found something. Each value is in a separate row: with which other value it was searched for together, by whom, with which device, from which country or at what time is recorded nowhere. Postcodes, municipalities, ethnicity and “pregnant” we do not count as values. Typed terms are kept for 90 days, the values from fixed lists, like the other daily totals, for 24 months. If you page further through the results, that does not count again. Only we see these figures.

Since 8.10.2026 there has been a field at the top of the search into which you type freely – a name, a house, a place, a service. The text does not go into the address but once to our server; what the search made of it is held there in memory under a random identifier for at most 20 minutes. As a daily total we count what was searched for: what the search recognised – a house, a place or a postcode, a service, an attribute, a name or nothing – and the term with it, written in lower case and without accents, shortened to at most 40 characters. We do not search for phone numbers, email addresses, or addresses or web addresses of third-party listings; if you type something like that, we only count that it occurred and do not store it. Each term is in a separate row, with no link to you or to the other terms: no session, no IP address, no cookie, no device, no language, no time. These rows are kept for 30 days. Only we see these figures. What the search recognised has also been recorded since 10.10.2026 with the time in a separate list – for a name, without the name (further above, “Searches with date and time”).

As soon as we offer market reports (see “Where the data is kept and who else sees it”), two kinds of these figures go into them, and only as monthly totals: how often a canton, a category and a service were searched for, and terms from the free-text field that correspond to a service, a place, a characteristic from our lists or a house listed with us – each term only from five searches a month upwards. They never contain a searched-for name, a phone number, an email, street or web address, or anything from a single visit. “Only we see these figures” applies to the daily rows above; we form the monthly totals before the daily rows are deleted at the end of their period, and these periods do not change.

Since 29.9.2026 we have also counted how an error report turned out: sent, failed during sending or rejected by the form. Three counters, each in a separate row, containing nothing but one of these three words – not your text, not the address for a follow-up question, not the page you reported, not your language and not the time. Why: without these figures no one notices when the reporting channel is stuck; a report lost during sending would otherwise vanish without a trace. What was evidently not triggered by a human is not counted. What is in the report itself never goes into the database – that is set out under “When you report an error to us”.

5. Searches without results: what was searched for

If a search or a price comparison finds nothing, since 27.9.2026 we have recorded what was searched for. What is stored: the time, the type of query and the inputs – the filters set with their values and, for a name search, the name searched for. For a search with results, none of this is recorded.

Why. So that we can find errors in the search. “Today twelve searches found nothing” does not say whether a name was processed incorrectly, whether a filter removes too much or whether the offer really is missing. This very distinction is the purpose, and there is no other: we do not analyse it, we do not produce figures from it and we do not pass it on to anyone.

How long. 30 days. After that the row is deleted, in the following night, without anyone having to do anything.

What it is NOT linked to, and this is the core: nothing. No session, no IP address, no cookie, no characteristic of your device, no language, no reference to the page you come from, and no link to your account, if you have one. Nor are the rows kept alongside the daily totals of the statistics, and there is no key by which the one could be put next to the other. Two rows from the same minute do not mean that it was the same person – we cannot know that and do not want to.

Who sees it. Only we, in the admin area, and there only with admin rights.

Not recorded: paging through a result (that is the same search), a query from a search engine or another program, the prefetching of a page by your browser – and nothing that comes from our own network, from a signed-in administrator or from a device that we have excluded. These are the same exceptions as for the statistics.

Why there is a time limit even though the name searched for is shown on every card with us. Because a search field accepts free text. Usually someone types a working name, a place or a word for a service; occasionally someone types more than they mean to. The time limit works against that, the fact that these rows stand on their own works against it, and so does the fact that they are kept in a separate table and not with the figures.

6. When you create an account

You open an account either for searching or for advertising. With an account for searching you can review houses. Any account can keep a wishlist and save listings and houses as favourites. For searching, comparing and reading you do not need one.

On your account page you can later tick that you also offer sex, run a house or rent out premises, and remove these ticks again as long as nothing depends on them any more. The tick “I want to rent out rooms” grants exactly one right: to enter rooms that you rent out (see “When you offer rooms”) – no listing and no house. Reviewing and offering are mutually exclusive: as soon as your account offers something or rents out rooms, it no longer reviews houses, and that does not come back even if you remove the tick again. Your wishlist and your favourites remain. If you submit a house application or a house is assigned to you, we set the tick “I run a house” for you. What happens to your previous reviews in that case you decide beforehand – see “Reviews of houses”.

What is stored: your email address, your password as a scrypt hash (not the password itself) and whether you set it yourself, what you opened the account for – this remains stored as it is, even if you later set other ticks –, what you have ticked on the account page, your language, when you created and confirmed it, when you last signed in and – should it come to that – that it was blocked and why.

Registration. The screen always shows the same sentence, whether or not the address already has an account; what applies is stated in an email. Until you confirm the link in it, we hold a pending registration: address, password hash, language, type of account and the link’s key as a hash. The pending registration becomes invalid after 24 hours and is deleted the next time someone creates an account after that. Only with your confirmation is the account created.

Why so cumbersome: otherwise someone could find out with a single request whether a particular address has an account here. In this industry, that question is asked by ex-partners, relatives and employers.

Staying signed in. When you sign in, a session is created for at most 30 days; we store only a hash of its key. When you sign out, it is gone. If you change your password, all your sessions end, including on other devices.

Forgotten password. You receive a link that is valid for 60 minutes; we store only its hash. If the address has no account, no email is sent.

Signing in with Google, Apple or Microsoft. Instead of using email and password, you can sign in via your account with Google, Apple or Microsoft. The provider then learns that you have an account with rosalon and lists us as an app you have used. From the provider we take over only your email address – and only if the provider shows it as verified – as well as the identifier under which the provider knows you. If an account already exists for this address, we link it; otherwise we create one, with a password that no one knows – you can set one on your account page under “Ways to sign in” or via “Forgot your password?”, both times through a link sent to your address. When you are signed in, you can also link your account to one of these providers there yourself, even to an account that has a different email address with the provider; we then do not take over that address. If your account with the provider already belongs to another account with us, we do not link it. What is stored per link: the provider, its identifier for you and when the link was made. No access keys (tokens), no name, no picture, no time of your sign-ins. You can remove the link on your account page, as long as a way into your account remains afterwards – a password you know or another provider; it is deleted together with your account. After every linking and every removal of a link we send you an email. With Microsoft we accept only personal accounts, no work or school accounts.

7. Wishlist: a saved search

With an account you can save a search – as a wishlist, in the search with “Subscribe to this search” or on the page “Wishlists”. What is stored: the name you give it, the language of the email, when you created it and last used it, whether it should send emails, and the filters you have chosen: location (cantons, towns or a postcode with radius – never your current location), category, gender, age group, languages, origin and ethnicity, physical characteristics (body type, height, bust, intimate area, hair colour, hair length, eye colour, tattoos, piercings, smoker), services, contact methods, self-description, price per hour, “protected only”, “Service for” and special preferences: “pregnant”, “Mother and daughter”, “Sisters”, “Twins”, “Person with albinism”, “Person of short stature” and “Braces”.

This information says something about you: what you are looking for – and, with the special preferences, ethnicity and physical characteristics, something from your intimate sphere. That is why it is kept only in your account, no one but you sees it, and no email mentions it. A search for a name never goes into a wishlist.

A wishlist is voluntary, and you set every filter in it yourself. Information about your preferences may be sensitive personal data; we use it only to show you matching listings and to send you the email about them, and we pass it on to no one.

Every night we compare the newly recorded listings with your filters, using the same rules as the search. If something matches, we send at most one email per night and wishlist. It contains the name you gave the wishlist, the number of new matches, until when it runs, and links – no listing and no attribute. The name is therefore also visible to your email provider and to ours (see “Emails from us”): choose it so that it does not give you away if someone else sees your emails. You can unsubscribe with one click in your email program or via the link in the email; the wishlist then remains but no longer sends anything. So that no listing is sent to you two times, we only remember when we last wrote to you – not which listings it was. Via the link in the email you see the new listings; we calculate them anew each time you open it.

We delete a wishlist automatically 90 days after it was last used. Use means opening or changing it or clicking “Keep” in an email. You can delete it yourself at any time, and it goes with the account in any case.

8. Emails from us

We only send emails that belong to your account, and only six kinds that concern the account itself: the confirmation of a registration, the notice that an account already exists for the address, the link for resetting the password (also for setting it for the first time), the message that your password has been changed, the message that your account has been linked to Google, Apple or Microsoft, and the one that such a link has been removed – both with a link to your account page in case it was not you. No advertising, no newsletter. In addition there are seven more, each only if you have switched on or submitted the corresponding thing yourself: the message that someone writes to you via the contact form (see “The contact form”); the decision on an event you submitted yourself – approved or rejected, with reasons in the case of a rejection; the decision on your listing once we have checked it – approved or rejected, and the reasons for a rejection are not in the email but in your account; the decision on your ID verification, if you sent an ID for a profile that is not currently submitted for checking – only that we have decided, without the outcome: whether passed or not and the reason for a rejection you can read in your account; an email when someone sends an enquiry about your room offer via the contact form – with the type and municipality of the offer, so that you know which one is meant (see “When you offer rooms”); a decision on your room offer when we have approved or rejected it – without content, with a link to the sign-in, behind which the reasons are shown in the case of a rejection; and – if you keep a wishlist – the nightly message that new listings match it. It contains the name you gave your wishlist, the number of new matches, until when it runs, and links – no listing and no attribute. Choose the name so that it does not give you away if someone else sees your emails (see “Wishlist: a saved search”).

As soon as we open paid offers, emails about your orders are added, only if you have ordered something: the notice that an invoice or receipt is in your account, and a reminder before a term ends – with no attachment and without saying what for. If you order a market report without an account, we send you the invoice and, after payment, the link to the report (see “When you pay”).

The subject line simply reads “Your account” and does not mention rosalon. The sender is rosalon, address [email protected].

For an email to arrive, it goes through an email provider: green.ch AG, Industriestrasse 33, 5242 Lupfig, Switzerland. The provider sees your address and therefore that you are dealing with us. Our mailbox is also with this provider: what you write to us at [email protected] is stored there. We remove the address from error messages of the sending process before they are stored anywhere.

9. Reports on emails sent in our name

Large email providers such as Google send us a daily aggregate report on the emails that arrived with them bearing our sender domain – including ones that do not come from us at all. This is a widely used procedure against forged senders (DMARC), and we have switched it on for our domain. Such a report does not contain a single email: no recipient, no subject, no text, no attachment. It names the mail servers that delivered, the number of emails and whether the checks passed.

What we store from it: for each report and delivering mail server, its IP address, the number of emails and both check results – whether the server is entered in our DNS as a sender for our domain and whether the emails carried our digital signature; in addition, which provider the report comes from and which day it covers. Such an address as a rule belongs to a data centre, such as our own email provider; occasionally it may be the server of an individual person, for example if someone has their mail forwarded automatically. For each retrieval we also record when it ran, how many reports it found and whether it succeeded.

What for: to notice when someone misuses our name as a sender, for instance for spam or fraudulent emails, and to see whether our own emails arrive with a valid signature. Both require a comparison with the preceding weeks: whether a server is new or whether our signature is suddenly missing can only be seen from what came before.

How long: 90 days. After that we delete the reports together with the addresses in the nightly run, without anyone having to do anything.

The addresses appear on no page of rosalon, and we pass them on to no one. If something stands out – a server we do not know is sending emails in our name –, we ourselves receive a warning by email in which that address appears. This email goes to our own address and, like all our emails, via our email provider (see “Emails from us”), and to no one else.

10. When you advertise: your profile

What you enter: display name, type (commercial or private), category, gender, canton, place, postcode, phone number, languages, attributes, services, a self-description (such as “New in the area”), title and description, prices and pictures, and which of them is your cover photo. In addition, voluntarily and individually: through which channels you can be reached, and for email, website or Telegram the corresponding address. An account can keep up to five profiles; with the tick “I act as an intermediary for others”, without an upper limit. In addition the system stores when you created, changed and submitted a profile, what verification level it has and which version of the terms you accepted and when.

What becomes public as soon as your profile is active: everything except postcode, timestamps and verification notes – that is, including your phone number. Without sign-in, under a fixed address, and findable by search engines: your profile is in our sitemap. A switch with which you can turn this off for each profile has been decided but not yet built.

We only show an email address, a website and a Telegram name if you enter them yourself and expressly agree next to them that they will be shown publicly – separately for each field. Without this tick we do not store the information. A website that you have entered is not told by us where you come from. If you empty a field, the information is gone, together with the consent.

Your ethnicity. Voluntarily, you can state which of seven groups you assign yourself to: European, Latin American, Asian, Black, Arab, Indian or mixed. This is sensitive personal data (Art. 5 let. c FADP), and we process it only with your express consent (Art. 6 para. 7 let. a FADP) – with a separate tick, only for this information, not together with the terms. Without this tick we do not store it. What for: we show it on your profile, and anyone who filters for this ethnicity in the search finds your profile. With the information we record when you consented and to which version of the consent text, in which language. You can withdraw your consent at any time by removing the tick and saving: we then delete the information and the consent immediately, without any note that they existed. Ethnicity is not your nationality; that is a separate item, and we never derive the one from the other. We do not take over any ethnicity from an imported listing.

Tell yourself this before submitting: what appears here can be found via a search engine by someone searching for your display name or your number. What search engines have once copied, we cannot retrieve. If you delete a profile, its address then responds with “no longer exists”, so that search engines forget it faster; we cannot force that.

So that search engines find new or changed public pages faster, we notify Microsoft Bing and other search engines of the address of such pages via the IndexNow protocol – including the address of your public profile. Only the address of the page is transmitted, no further information and no data about visitors. The notification goes to a shared receiving endpoint of the protocol, which passes it on to all participating search engines. Today these are Microsoft Bing (Microsoft Corporation, based in the USA), Amazon (Amazon.com, Inc., based in the USA), Yandex (Yandex LLC, based in Russia), Seznam (Seznam.cz, a.s., based in the Czech Republic), Naver (NAVER Corporation, based in South Korea) and Yep (Ahrefs Pte. Ltd., based in Singapore); the address of your profile therefore goes to these countries. According to the Federal Council’s list, the Czech Republic has adequate data protection, the USA only for companies certified under the Swiss-US Data Privacy Framework, such as Microsoft. Russia, South Korea and Singapore do not have adequate data protection. We disclose the address to these countries and to Amazon because you have yourself made it generally accessible with your public profile (Art. 17 para. 1 let. e FADP). So that we do not report anything twice, we record for each reported address a hash and the state of the page. For pages with no link to a person – places, cantons, market figures, houses – the address itself is stored alongside; we never store the address of a profile for this, only its hash. If an address is no longer in our sitemap, we report it one last time, so that the search engines see that something has changed there, and delete the entry. If you pause your profile or it is blocked, this happens in the next run, usually the following night. If you delete your profile, we delete the hash immediately and report the address one last time to the same search engines at the same moment; the page then responds with “no longer exists”. When a search engine removes the entry is up to that search engine. If this one notification fails, the search engine notices on its next visit.

If you do not want us to report the address of your profile, untick the box “Tell search engines about your profile” in your profile; it is ticked from the start. From the next run onwards we no longer report any address of this profile, in any language, and we also forget its hash. Without the tick we also do not report when you pause or delete your profile. Your profile nevertheless remains public and continues to appear in our directory and our sitemap; search engines can find it there, even without our notification. Anyone who does not want that either pauses their profile – it is then no longer public. An address we have already reported is not withdrawn by unticking the box: the protocol has no revocation, and what a search engine has already learned, it knows.

Not public are your email address, your postcode, your drafts, the time of your last sign-in and everything relating to verification except the badge. Drafts and paused, blocked and deleted profiles cannot be retrieved via their address either.

Importing your own listing. You can enter the address of your listing on another portal. We retrieve it once, respecting the portal’s robots.txt, and show you a preview. Only when you confirm do we take over basic data, attributes, title, description, prices and services into your profile, and on request also up to twelve pictures. Of the origin we store only the name of the portal, not the address of the listing. An imported profile appears after 48 hours at the earliest, only with a confirmed account, and not in search engines until it has been checked.

We machine-translate title and description into the four languages of the site, on our own device. No text leaves our device for this, and no third-party service sees it. Sentences on protection, practices or prices we do not translate; they appear in the original within the translation. On your profile page the translation is marked as “machine-translated”, with your original always next to it. If you change your text, we delete the old translations immediately and translate anew; if you delete the text or your profile, they are gone with it. In the profile you can switch off “Translate text automatically” – we then delete the existing translations, and no new ones are created. This is built but not yet switched on: the switch is in your profile form, but today we translate nothing, and your profile page shows only your original. Before we switch it on, this will be stated here with a date.

Information in a listing for erotic services concerns the intimate sphere and is sensitive personal data (Art. 5 let. c FADP). We process it because you expressly consent and because you enter into a contract with us about the listing. You can withdraw your consent at any time by deleting the profile.

11. When someone creates a profile for you – or you for others

Anyone who advertises for others on rosalon – as a manager, an agency or a house – first gives us a name or company and a phone number, and optionally the company’s UID. We also store when and in which version the terms for representatives were accepted. None of this is public, not even on the profile. We need these details to reach this person if something about their account catches our attention. They remain until they are changed or deleted together with the account.

If someone creates a profile for you, they entered the details on it and are responsible for them; otherwise, everything in the previous section applies to your profile. It only becomes visible once you confirm it yourself, through your own link. Of the link we store only a hash, not the link itself, along with when it was generated, until when it is valid and in which language it opens. When you open it, we take the key out of the address and put it for at most 20 minutes into a cookie zustimmung that only the server can read. The link works once and for at most seven days.

If you confirm, we store when, to which wording of the confirmation (version) and in which language, and that you declared that you are at least 18 years old. We do not store from which device or from which network you confirmed. So that we still notice when many confirmations for the same account come from the same network, we form a check value from your IP address in memory, using a key that is created anew every day and stored nowhere. In the database there is then at most a note on the account of the person who advertises for you, without the address and without the check value. After a restart of our server, the check value is gone.

If you untick services on this page, we delete them from the profile. If you tap “No, this is not me”, “The prices are wrong” or “I need help”, we store only the time; the profile then does not appear, and with “I need help” a person on our team looks at it. To the person who advertises for you, in all these cases we show only “Not confirmed” or “Waiting for review”, as with any other reason.

With the confirmation you receive your own code. We show it only once and store it only as a hash. With it and the name on your profile you sign in without an account, see your profile’s figures, switch it off or back on, or delete it – the person who advertises for you cannot undo that. There you also show your ID, if you want the sign “ID seen” or your name or a title sounds very young; everything under “Verification and badge” applies, with two differences: we send you no email about it, you read the decision in your access. And the person who advertises for you never sees the image or a reason, only whether your ID is waiting for review or has been seen. The sign-in lasts at most 30 minutes, in a cookie eigenzugang that only the server can read; when you sign out, it is gone. If you renew the code, the old one no longer works.

Your confirmation is your express consent (Art. 6 para. 7 let. a FADP) to the processing of the details and pictures on this profile. You withdraw it by deleting the profile with your code or by pressing “This is me – please remove it” on the profile page; with the button, the profile disappears immediately until we have looked into the matter. The record of your confirmation, the hash of your code and the times of your answers remain as long as the profile exists and are deleted with it.

For your profile, you and the person who advertises for you see the same figures: views and clicks on the contact options, per day, never who looked. We also see the same figures, in the admin area and there only with admin rights.

12. Pictures

Every picture that you upload or import from your listing we re-encode, and we discard the original. In the process all metadata is lost, including camera, time and place of capture; the software then checks that none is left.

For each picture we store a checksum and an image fingerprint that recognises similar pictures. It describes the whole picture, not a face. This makes pictures stand out that are already on another profile: we hold those back until we have looked at them. Before a profile appears for the first time, someone from our team looks at it, with all details and pictures. Pictures and changes after that appear without a new check, even if you make your profile visible again after a pause; we can check and remove them at any time.

A picture is delivered publicly only while your profile is active; a picture behind the age check with the instruction to search engines not to index it. The files are kept on our device under random names, unencrypted there; since 7 October 2026 they have been backed up every night, in encrypted form only (see “Security and backups”). If you delete a picture, a profile or your account, we delete the files with it; they remain in the backups until these are overwritten, at most about two weeks.

Pictures fine to show openly, and the cover photo. If a picture shows neither genitals nor sexual acts – for example clothed, in lingerie, including see-through, or from behind –, someone from our side can rate it as fine to show openly. It then appears without an age check on your profile and as a small preview in your tile in the search, visible to everyone, and search engines may index it – unless your profile itself is not in search engines, for example an imported profile until it has been checked. What a search engine has indexed once, a deletion on our side does not reliably remove. Every other picture we show only after confirmation of being at least 18, including every picture nobody has rated yet; without this confirmation we do not deliver it, not even to search engines. We can change the rating at any time; a picture you upload anew or whose file changes is at first not rated. As your cover photo you choose one of your pictures: if it is rated fine to show openly, it comes first in your tile, otherwise the first picture of your profile that is fine to show openly; if your profile has none, the tile shows the note “18+ photos in profile” instead of a picture. For every picture we store our rating – fine to show openly or not, when and by whom –, in the case of a no for the cover photo the reason you read in your area, for other pictures a reason only if we give one; and whether and when you chose a picture as the cover photo. All of this disappears with the picture, the profile or the account. Cloudflare may cache a picture that is fine to show openly for up to five minutes; for that long it may still be retrievable there after you have deleted it, paused or deleted your profile, or we have rated it differently. A picture behind the age check we never release to Cloudflare for caching. Our robots.txt now blocks only the addresses of the cover photos.

13. The contact form

If you advertise, you can switch on a contact form – for everyone who would like to write to you without WhatsApp or phone. For this you provide an email address to which we forward messages. This address never becomes public – it is not on your profile, not in the forwarded email and not in any view that anyone can call up. You can switch the form off at any time, and we then delete the address too.

Anyone who writes to you provides a name or a pseudonym, a reply address (email or phone number) and the text. This becomes a single email to you, with the reply address as “Reply-To”. After that the text is gone: we do not store it – not in the database, not in a log, nowhere. This one email is the only copy. There is no inbox on rosalon and no message history.

What remains is a number: how many messages your profile received on a given day – so that no one can flood a mailbox. In addition we count in memory how many messages come from a sender address on a given day – under a value that is destroyed at midnight together with its key. No address from this goes into the database, not even as a hash.

So that the form does not become a channel for sending advertising, it is throttled – without any third-party service and without information about you.

14. When you offer rooms

If you offer rooms, we store type, municipality, rent, availability, your description and the address to which we forward enquiries, together with when you agreed to receive enquiries via the form. We do not accept a street, a house number or a phone number. After our check, type, municipality and thus the canton, rent, availability and description appear publicly – never your address and never which account the offer belongs to.

If someone writes to you via the contact form, we forward the message to you by email and do not store its text; all that remains is a number per offer and day. Whoever writes provides the same information for this as with a profile’s contact form (see “The contact form”), and their reply address is in the email to you.

We store your confirmation regarding the cantonal obligations with a timestamp, as well as when you accepted the terms on submission and in which version, and who checked your offer and with what reasons. If you change the type, municipality, description or the address for enquiries, we check the offer again, and your confirmation regarding the obligations lapses until you give it again for the new version. If you delete an offer or your account, everything is gone; it remains in the backups until they are overwritten (see “Security and backups”).

15. When you pay

Paid offers exist only once we open them; we announce this in the terms for advertisers and by email. For every order, what is set out here then applies.

What we store: the order – what you ordered, for which profile, which business or which room offer, for a featured placement for which canton, which category and which weeks, plus term, amount and time –, the invoice and the receipt with their number, your customer number, the amount, the date, the payment method (bank or TWINT) and the payment reference with which we match a payment to your invoice. Name and address appear on a receipt only if you provide them yourself; otherwise only your customer number appears there.

What we never store: your IBAN, the name and address under which your bank sends the payment, a card number and your TWINT number. The credit advice from our bank contains some of this; the program that reads it discards it before anything is stored. These details nevertheless appear on our bank’s account statement, and we keep that as an accounting record, separately from the other data of rosalon.

What appears on the receipt: our company name, your customer number, a neutral description of the service, the period and the amount – no profile name, no category, no place. On your bank statement and in the TWINT app, our company name, in which rosalon does not appear, is shown as the recipient, and “Online-Dienst” (online service) with the receipt number as the message; what your bank displays of this is up to your bank.

Invoice and receipt are in your account, to view and print. By email we only send a notice about this, with no attachment (see “Emails from us”).

Who sees it: our bank, through which your payment runs, and, if you pay in the TWINT app, TWINT Acquiring AG, which handles the payment as a separate controller, under its own privacy policy. Both learn that you are paying us, how much and with which reference – not what for.

How long: we keep invoices, receipts and incoming payments for ten years after the end of the financial year, as well as the account statements; the law requires this for accounting records (Art. 958f CO), and here it takes precedence over your wish for deletion. Orders are kept as long as their receipt. If a profile, a room offer or a business is deleted, the link to it is removed from the orders. If you delete your account, the link between it and your orders and receipts is removed; after that only the customer number remains, and we can no longer match it to anyone. Name and address that you had put on a receipt remain on it for the ten years.

A featured placement is public: anyone who sees the band in the search sees that this profile was paid for – not by whom and not how much. If someone runs your profile as a representative, you see every featured placement of your profile in your own access, and you agree to it or end it there. The record of a featured placement is deleted with the profile; order and receipt remain as above.

If you order a market report without an account, we need only an email address, and we use it for two things: the invoice and the link to the report, which we send after payment has been received and which expires after a set period. We delete the email address after delivery or, if the order lapses unpaid, at that point; the receipt shows only a customer number.

16. When you book advertising with us

On the page “Advertise” you can ask us about an ad. What you enter there – the company or name you advertise under, a contact person, your email address, optionally a phone number, sector, desired space, place, period and your message – we store in order to answer you and agree an ad with you. Only we can see it, in the admin area; the email that tells us about a new enquiry names only the sector and the space. We do not send you advertising and pass your details on to no one.

How long: we delete the enquiry two years after it arrived; if an ad came out of it, two years after that ad ended. If you want it gone earlier, write to us – then we delete it immediately. The ad itself – the name you advertise under, title, sentence, link, space, period and what we agreed – we keep for ten years after it ends, as a record of what was agreed and delivered. If it is paid, what is said under “When you pay” applies to the invoice and receipt.

Only the ad itself is public, for as long as it runs: the name you advertise under, title, sentence and link, always with the label “Advertisement · Name”. It appears on the home page, on place pages or in the search results, never on the page of a profile.

What we count about an ad: how often it was shown and how often it was clicked, per ad and day as a total – no more. For this we set no cookie and record neither IP address nor device, country, time of day or page, not even about the people who see or click an ad. Robots are not counted, and neither is anyone who has chosen “Do not count this browser”. A click on an ad goes through an address of ours that counts it and then forwards to the website without a referrer; the website does not learn which of our pages you came from. We see these figures, and on request the advertiser sees those of their own ad.

17. When you report an error to us

At the top of every page there is “Report an error”. The form behind it sends us a single email: your text, the page you were on, and its language. An address for a follow-up question is voluntary – you can report just as well without it.

Of the page, only the path is sent, never the part after the question mark: so we do not learn what you searched for or filtered. No IP address, no device characteristic, no cookie.

Nothing from your report goes into the database – no text, no address, not the page you were on. This one email is the only copy.

What remains is a daily total of how a report turned out: sent, failed during sending or rejected by the form. That number contains nothing more – none of the three words says anything about you or about the content of your report. Since 29.9.2026, and for one reason: before that, it was impossible to tell whether a report ever arrived. If sending goes wrong, the report would otherwise vanish without a trace – no one notices, neither we nor you. How counting works is set out under “Statistics: counting and recording without knowing who you are”. That the page “Report an error” was viewed, we count as for every page.

This form too is throttled – without any third-party service and without information about you.

18. Verification and badge

When we verify your ID, we look at it by hand and compare it with a selfie that you show us: whether the person is of age, whether the document looks genuine and whether it is the same person.

What is stored: which profile, which method (phone, ID or video), when, by whom, passed or not, and a short note without longer sequences of digits. After a passed ID or video verification, also the day on which being of age was confirmed – not your date of birth.

How your ID reaches us: you photograph it and send it via your advertiser area. If someone runs your profile for you, you send it yourself, through your own access with your code – never through the account of the person who advertises for you. We accept it only with your express consent, and only for this one verification. We do not accept any ID via a messenger or by email.

While your picture is with us: encrypted, separate from your profile pictures, under no address that anyone can guess, and in no backup. Only those who are allowed to verify can view it. The key is not kept with the file – but on the same device; anyone who had the entire device would have both. Hence the short time limit.

When: together with your listing, when you submit it for checking – or at any time on its own, including for a profile that is already visible or paused. Your profile stays as it is; the verification only changes the mark “ID seen”.

How long: until the decision – with a listing, approved or rejected; on its own, passed or rejected – and in any case at most three days. The time limit expires automatically, even if no one has looked at it, and it cannot be extended. You can withdraw the picture yourself at any time; it is then deleted immediately.

What remains afterwards: only the entry above – checked on, by whom, with which method, passed or not. Not stored, anywhere: the picture, the ID number, your date of birth, your name from the document, an extract from it or an image fingerprint with which the photo could be found again.

Approval. If you submit a profile, a moderator from our team looks at it – with all details and pictures, while it is waiting to be checked – and approves or rejects it. What is recorded is which account decided, when, and in the case of a rejection the reason. The same applies to an ID verification on its own: passed or rejected, by whom, when, in the case of a rejection the reason; for this purpose the person checking also sees the pictures of your profile while the ID is waiting to be checked. These entries disappear with the profile; if the account of the person checking is deleted, they remain without any link to that person.

19. Reviews of houses

With an account for searching you can review a house: stars from 1 to 5 and, if you wish, a text. What is stored: house, account, stars, text, language and timestamps. Your review carries only these two references – to the house and to your account –, no device identifier and no link to what you searched for.

If you tick on the account page that you offer sex, run a house or rent out premises, and you have already written reviews, we ask you beforehand what should happen to them. You choose one or the other:

• Delete beforehand: your reviews are deleted immediately, with stars, text and the houses’ replies to them.
• Leave them standing: the reviews remain with house, stars, text, language and timestamps and continue to count. Only the reference to your account is deleted – we call this: the review is detached. We do not create any note of when or from which account a review was detached. In our database nothing from such a review leads to you afterwards; it no longer appears in your account, you can neither change nor delete it, and it does not go with your account but expires after twelve months like any other. What you wrote in the text remains as we approved it.

The choice is final: a detached review does not get an account back, and your account can no longer review afterwards, even if you remove the tick again. In the backups made before your choice, the reviews still appear with the reference to your account until those snapshots are overwritten – at most about two weeks (see “Security and backups”).

The review appears publicly without your email address. The stars count immediately; the text only appears once we have approved it. We show a rating only from five reviews onwards, and never for a business that is in fact run by a single individual. Houses are reviewed, not people.

Anyone who writes about a house thereby says that they were there. This is the most sensitive information about you that can arise on rosalon. That is why it is time-limited: after twelve months a review no longer appears and is deleted in the next nightly run. Earlier, if you delete your account or write to us, as long as it is attached to your account; a detached review is no longer attached to any account and expires after the twelve months.

There are no bookings and no payments on rosalon. We have never seen a card number. Messages between clients and advertisers exist only as a one-time forwarding via the contact form (see above) – no inbox, no history.

20. Reports

Reporting works without an account. What is stored: what was reported (a profile, a card for a third-party listing, a review or a woman on a house’s page), the reason, your description and a contact detail if you leave one, the language and the time. The description is voluntary, unless you report coercion or choose “Other reason”: we then need it, because we cannot decide without specific indications. We do not link the report to an account.

We take a reported profile offline immediately – unless the report concerns coercion, fraud or a business posing as private, or it states “Other reason”; then we look first, and the profile remains visible until we have decided. A reported review we hide immediately. A decision is made within 48 hours.

If a woman removes herself from a house’s page (“That’s me, please remove”), there is no reason to choose, no description and no contact detail; the report names the house, not the woman. So that no one can empty a house page, this route too is throttled; if the limit takes effect, the page says so. Counting for this happens only in memory, under a value that is destroyed at midnight, not in the database.

The contact detail is stored in plain text with the report, so that we can reach you. It is deleted 90 days after processing has been completed, and only it: the report itself – what was reported, the reason, your description and our decision – remains as evidence, even if the reported profile or the reported review is deleted.

If minority or coercion is suspected, a report may go to an authority or a specialist service. How this works in detail we will determine together with a specialist service and then set out here.

21. If your listing is on another portal

This section concerns people who do not have an account here. We read publicly accessible listings on other portals in order to measure the Swiss market and to link to the originals in the search and in combined entries.

What we store from a third-party listing:

• portal, address of the listing, canton, place and municipality, the cantons it names as its service area, category, type, gender, languages, price and surcharges for individual services, whether the portal lists it as verified, and when we first and last saw it;
• the services that the portal lists or that appear in the ad text, translated into the identifiers of our vocabulary, without the text;
• the contact methods – only whether phone, SMS, WhatsApp, Telegram, email or a form is offered, never the number or address;
• the working name that the portal shows as the name, cleaned up: only letters, no digits, no @;
• the age from the portal’s age field as a number, and the attributes that the portal shows as a field or category, such as height, body type, hair and eye colour, country of origin or whether someone smokes;
• two items of information that are sensitive (Art. 5 let. c FADP), from the portal’s category or from the ad text (only the item is stored, never the text): whether the listing describes someone as pregnant – this is information about health and is deleted no later than 180 days after it was first seen, even if the listing remains online – and whether it states “protected only”, information about sex life. “Pregnant” appears on the card only if the search is filtered for it, and if the card combines several listings, then with a note of which of them it appears in; the search can be filtered for both, and for “pregnant” a separate page counts how many listings state it per canton – never which;
• whether the listing calls itself “Mother and daughter”, “Sisters” or “Twins”, from the ad text or from the title as it appears in the address of the listing: only this word is stored, never the text – we do not check any family relationship. It appears on the card only if the search is filtered for it, and if the card combines several listings, then with a note of which of them it appears in; the search can be filtered for it, and separate pages count how many listings call themselves this per canton;
• whether the listing describes itself as a person with albinism or as a person of short stature or states that it wears braces – items of information about health that are sensitive (Art. 5 let. c FADP) –, from a field of the portal or from the ad text: only “albino”, “short stature” or “braces” is stored, never the text; we derive nothing from a height, and the information is not checked. It appears on the card only if the search is filtered for it, and if the card combines several listings, then with a note of which of them it appears in; the search can be filtered for it, and separate pages count how many listings state it per canton – never which;
• instead of an age, an age range if the portal only gives a range, such as “27–30”;
• where the portal shows a view count on the listing (“viewed 123 times”), this number and when we read it – at most one per day, with no text. We evaluate it only in aggregate, per portal, canton and category, never for an individual listing, and do not show it publicly anywhere;
• from the phone number a contact key (see below), plus the country and whether it is a mobile or landline number;
• whether the listing belongs to a house that we list, and to which one (see “Assignment to a house”);
• for a listing in which someone rents out a room for sex work: the type of room (room, studio, place in a salon or flat), the rent per day, week or month, from when it is available and what we recognised it as a room listing by – never the address of the room.

What we never store: the phone number in plain text, photos, ad texts, street and house number. We read the ad text only to extract services, price and surcharges and, for room listings, type, rent and from when the room is available, as well as the items “pregnant” and “protected only” and whether the listing calls itself “Mother and daughter”, “Sisters” or “Twins” describes itself as a person with albinism or of short stature or states that it wears braces; it remains in memory until that has been extracted and is then discarded.

What of this appears publicly: place, category, gender, languages, price, the working name, the age group or the range that the listing states – never an age as a number –, the services and contact methods according to the portal, for escort listings the service area, the physical characteristics that the portal itself shows as a field, the link to the original and, if the listing belongs to a house, a button to that house’s page. Each of these items carries the addition “according to the listing”; we do not show empty fields. Only prices and services come from the ad text: services that appear only in the text we show separately and with the addition “from the text”, and in the price comparison every figure states its source, including “from the listing text”. We never supplement names, age or physical characteristics from the ad text. We never derive country of origin and ethnicity from each other. The search can be filtered by the attributes and by the working name. We do not show listings with an age under 18, nor any other listings with the same number. The search and the list of listings can be picked up by search engines, with working name, age group and attributes. If you object, the card disappears from our site at once; from a search engine only once it reads the page again – we notify it. What it has already copied we cannot delete ourselves. The name appears in no address and in no page title, and how long our server holds a name searched for is set out under “When you visit the site”.

Room listings. A listing in which someone rents out a room for sex work does not appear as a card but in our overview of rooms: with portal, link to the original, canton, municipality, type of room, rent and from when it is available. No name, no text, no address of the room.

The phone number. So that the same person is not counted several times across several portals, when reading it in we convert the number with a secret key into a non-reversible value (HMAC) and then discard it; it never reaches the database. Anyone who had the key could try out numbers. That is why the key is kept separately from the database and in no backup, and that is why we do not treat the data set as anonymous but as personal data.

Assignment to a house. We assign a listing to a house that we list only if it certainly belongs to exactly that house; if any doubt remains, we do not assign it. All that is stored is which house the listing belongs to – never the address from the listing, not even as a hash. Each new reading of the listing replaces the assignment; there is no history.

How long. We delete working name, age and physical characteristics as soon as we have not seen the listing for seven days, in the next nightly run after that; on the site, an item that the portal no longer shows may remain until that run. These three items go into no time series and no backup. We delete the view counts 400 days after they were read. We keep the other information without time limit, because the value of a market measurement lies in the time series; if the listing is no longer active, it appears only as part of counts, such as on the place pages and in the market figures – where every number appears, even a small one such as 1 or 2.

Objection without an account. Every card has a button for objecting. As a rule the card is then hidden immediately, with name, age group and attributes. The objection becomes final after 24 hours: we then block the contact key – listings with this number are no longer included from other portals either –, and in the next nightly run the information is deleted from the database. If the listing has no number, we block only its address; we then do not recognise a new listing under a different address. So that no one can empty other people’s entries, there are rate limits; if one takes effect, the card remains until we have looked at the objection, and the site tells you so. The block list contains only hashes. If someone has saved your card with us as a favourite, we also delete that entry as soon as the objection is final – in the next nightly run. A backup of the market data may still contain a listing that was objected to until the backup is overwritten; name, age and attributes are never in it.

How we retrieve. What a portal’s robots.txt blocks, we do not retrieve. We do not fake any browser identifier, do not rotate addresses, do not solve CAPTCHAs and do not access anything behind a sign-in or paywall. An age gate that is passed with one click and without any information, we pass. Our crawler identifies itself as “rosalon-marktanalyse” and carries a contact address.

Why we do not inform you individually: we have no way of reaching you – precisely because we do not store your number. That is why it is set out here, publicly and in full.

The women on the houses’ websites. From the page of a house on which it presents its ladies, we store name, age group and services. No age as a number, no physical characteristics, no photos, no descriptions, no times of presence. Only as long as she is listed there: if she is missing on the next visit, after seven days at the latest, the entry is deleted, without history and in no backup. Name, age group and services are published on a separate subpage of the house that search engines do not index; the house page itself names no name. Next to each woman there is a separate button “That’s me, please remove”. Without an account, without proof and without any information, she is thereby as a rule hidden immediately; the entry is finally deleted and blocked after 24 hours. If the button exceptionally does not work, the page says so – then a message to [email protected] suffices. So that she does not come back, we keep a hash and the day for this purpose, nothing else.

The events calendar. From the houses’ websites and from the party sections of some portals we read events: type, date or weekday, time, number of women, price, canton or region, the house and the link to the source. We read title and text only to extract this information, and do not store them. If an event appears in the listing of an individual person, it appears only with a fixed date, without name and without title; the link leads to her listing. We do not take over names of women taking part in an event. How long an entry remains is stated in the table below.

Businesses. For studios, salons, clubs, walk-in houses and agencies we keep the business details they publish themselves: name, type, address, phone, WhatsApp, Telegram, email, website and opening hours. For Telegram this is the business’s username; we take it only from a link to its account on the house’s own website, and only if we find exactly one there, or we enter it by hand – never from a portal or listing. Publicly we show of this the name, type, place, address, contact, opening hours and prices from the house’s own website – each with source and date. In addition we link to the business’s entry on each of the portals on which we last saw it – the address of the entry, no number from there. For a business that, according to our measurement, may be run by a single individual, we show less. No opening hours, because they would be her times of presence; the page says why. No Telegram account, because it would be her personal account. Phone, WhatsApp and email appear there only if the business states them on its own website or we have checked them and entered them by hand. A number or email address that we know only from its entry on a portal we do not show for such a business, and we delete it in the next nightly run; of the number, only the contact key remains (see above). The link to its entry on the portal appears even for such a business: it leads to the page on which the business publishes its contact details itself. We read opening hours only where they apply to the entire business; we never read a weekly, daily or duty schedule of individual women. We also use phone and email to approach businesses about rosalon; we do not write to anyone unsolicited by SMS or messenger. If you run a sole proprietorship and the entry concerns you personally, write to us, and it will disappear.

When visiting the websites of businesses we additionally record whether a website advertises recognition by health insurers and – for businesses listed on an erotic portal – whether it speaks of medicine, therapy or wellness without erotic terms: the keyword, the page and the date, no text. This information is visible internally only and is deleted 30 days after it was last seen; the second item sooner, as soon as a visit finds an erotic word on the website or the business is no longer listed on any erotic portal.

Taxi companies. Where neither Uber nor Bolt operates, a house page shows the three nearest taxi companies. We take name, phone number, postcode and place from the directory taksi.ch; entries that look like an individual person with a mobile number we do not take over. An entry remains until taksi.ch no longer lists it; only what we have seen there in the last 90 days is displayed.

22. Where the data is kept and who else sees it

The data is kept on devices in Switzerland that we operate ourselves. No hosting provider, no cloud storage, no service provider that looks into the database.

In the database there is no link between your account and the market measurement, and the web interface cannot access the market measurement at all.

If you sign in with Google, Apple or Microsoft, our server communicates directly with the provider to confirm the sign-in; what the provider records in the process is governed by its own privacy policy. Anyone who does not press any of these buttons has nothing to do with any of these providers – the site does not load anything from them.

Who apart from us sees anything:

• the email provider through which our emails are sent: green.ch AG, Industriestrasse 33, 5242 Lupfig, Switzerland (see “Emails from us”);
• Cloudflare, Inc., based in the USA: the site is connected to the internet via a tunnel from Cloudflare, and soon the name resolution (DNS) of our address will also run via Cloudflare. Cloudflare forwards your browser’s requests to our device and in doing so sees your IP address and your request, i.e. which page you are requesting. Cloudflare operates data centres in over 100 countries, including Switzerland; according to Cloudflare, data is stored mainly in the USA and in the European Economic Area. According to the Federal Council’s list, the states of the European Economic Area have adequate data protection, the USA only for companies certified under the Swiss-US Data Privacy Framework; Cloudflare, Inc. states that it is so certified. In case the certification lapses, Cloudflare’s contractual terms provide for standard data protection clauses adapted to Swiss law (Art. 16 para. 2 let. d FADP). What Cloudflare records of this and for how long, we are still examining. Cloudflare also counts the requests to our site itself; we fetch these totals – per day the number of requests, page views and visitors, and per day and country the number of requests – from Cloudflare every night and keep them without time limit, as evidence of how much the site is visited. They contain no IP address, no page, no time and no individual request;
• Google, Apple or Microsoft, only if you sign in with an account with one of them: the provider learns that you have an account with rosalon and confirms your email address to us. It is itself responsible for this, under its own privacy policy; depending on the provider, the responsible company is based in the USA or in Ireland. According to the Federal Council’s list, Ireland has adequate data protection, the USA only for companies certified under the Swiss-US Data Privacy Framework. Anyone who does not press any of these buttons has nothing to do with any of these providers;
• a trusted person who stands in for us in checking if we are unavailable; this person sees only what is needed for the decision: submitted profiles with all details and pictures, the proof for the age verification until its deletion, pictures uploaded later, submitted room offers including the address for enquiries, as well as objections and reports including contact details. This person does not see houses, reviews, statistics, account administration or the market measurement, and has no access to our devices;
• search engines based in the USA, Russia, the Czech Republic, South Korea and Singapore, to which we report via IndexNow the addresses of new, changed or removed public pages – only the address; which search engine is based where, and on what basis, is set out under “When you advertise: your profile”;
• opentransportdata.swiss, operated by SBB AG on behalf of the Federal Office of Transport, in Switzerland, when a house page queries a public transport connection: only two rounded points and the time, nothing about you (see “When you visit the site”);
• as soon as we open paid offers, our bank in Switzerland, through which invoices are paid: the bank sees who pays us, with amount, date and reference (see “When you pay”);
• TWINT Acquiring AG in Switzerland, if you pay an invoice in the TWINT app: it handles the payment as a separate controller, under its own privacy policy, and learns that you are paying us and how much – not what for;
• anyone who buys a market report: only figures, never anything about a person (paragraph below);
• if minority or coercion is suspected, possibly an authority or a specialist service (see “Reports”);
• an authority or a court, if we are obliged to hand over data.

We do not sell any data about people. What we sell, as soon as we open paid offers, are market reports: figures on supply, prices and demand, never below five listings per figure, never about a single person or a single listing. From your visit, they contain only what is absorbed into totals: how often people searched by canton, category and service, and typed search terms that correspond to a service, a place, a characteristic or a house listed with us, as monthly totals from five searches upwards – never a searched-for name, never a number, an email or street address, or anything from a single visit (see “Statistics: counting and recording without knowing who you are”).

23. Security and backups

What is in place: passwords only as a scrypt hash, session and link keys only as a hash; every query in the advertiser area checks whether the profile belongs to your account; a lock against trying out passwords; sign-in and registration do not reveal whether an address has an account.

What is missing, and we say so: the database and the pictures are not stored in encrypted form on the device itself.

Backups are made every night. The backups are kept on the device itself and additionally on a second device that we likewise operate ourselves, in Switzerland and in the same building – it protects against the failure of a device, not against fire, water or theft. On each of the devices 14 snapshots are kept, i.e. about two weeks. We back up the market measurement without names, ages and attributes, unencrypted. Accounts, profiles, reviews, favourites, reports and the other entries created here we have backed up only in encrypted form since 26 September 2026, and the pictures of profiles and houses likewise since 7 October 2026; neither device can decrypt them, and the key for this is on neither of them. Not included in this backup are the cards for third-party listings, the women on the houses’ websites, the picture of your ID, the list of searches with date and time, ongoing sign-ins and the list of clicks with date and time.

What you delete is therefore not gone everywhere at the same moment: it remains in the backups until the last snapshot from before the deletion is overwritten, at most about two weeks. The same applies if you leave your reviews standing without any link to you: the reference to your account remains in the earlier snapshots until they are overwritten. We only use these to restore after a failure.

If something does happen: if a breach of data security is likely to result in a high risk for you, we report it as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC) and inform you if this is necessary for your protection (Art. 24 FADP).

24. How long we keep what

Art. 6 para. 4 FADP requires personal data to be destroyed or anonymised as soon as it is no longer needed for the purpose. Where a time limit is still missing above, we will set it and enter it here.

25. Your rights

You exercise all your rights with a message to [email protected].

• Access (Art. 25 FADP): whether and which data we process about you, for what purpose, for how long, where it comes from and to whom it goes. Free of charge, as a rule within 30 days. Detached reviews cannot be included: the database no longer records which account they are from.
• Rectification and deletion (Art. 32 FADP): what you entered yourself you change or delete yourself in the advertiser area – a profile or your entire account with one button, immediately and without further questions. An account that does not offer anything you delete on the account page. For everything else, write to us.
• Data portability (Art. 28 FADP): the data you gave us, in a common electronic format.
• Objection: against a card for a third-party listing with the button on the card, otherwise by message.
• Complaint: to the Federal Data Protection and Information Commissioner (FDPIC).

How we recognise you. We do not confirm to anyone whether a particular email address has an account here unless the person asking shows that they have access to that mailbox. So write from your account’s address. If that is no longer possible, get in touch anyway; we will find another way.

If a third-party listing concerns you, we cannot match anything to a contact key without the number. Give us the number: we use it for the search and do not store it.

26. Changes

This policy changes when the software changes, and each version bears a date. If a change concerns something you consented to, we will ask you again.