Privacy Policy

When you submit the contact form, the details you entered — name, email address, WhatsApp number, the jurisdiction and topic you selected and your message — are stored in our database at Supabase (servers in the EU, Ireland) and sent to us by email so that we can reply. The data is used only to handle your enquiry and is never passed to third parties for advertising. Where applicable, processing is based on Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). You can ask us to delete your enquiry at any time.

This website is hosted by Vercel Inc. and uses Vercel Web Analytics for anonymised, aggregated measurement of page views. According to the provider, the service works without tracking cookies and without building individual user profiles. Where applicable, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing and improving this site). In addition, we count page views ourselves, also without cookies: we store the page visited, the referring site (domain only), campaign parameters, country and device type. Instead of an IP address we store a daily value derived from IP, browser, date and a secret key, which can no longer be linked the next day. Raw data is deleted after 13 months. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

We do not set tracking or advertising cookies and we do not build profiles. When you sign in, the website sets technically necessary cookies that keep you signed in; they become invalid when you sign out. Two more cookies only remember your language and your chosen display (black, white or easy on the eyes). The app also keeps a few entries only on your device (local/session storage) so that features you use work: your language, that you have seen the privacy notice, which tips you have closed, your card draft while you have no account yet, meeting and check-in tickets after a scan, your lock-screen image choice, the last section you opened and a copy of your start page (per account, so the app loads instantly; deleted when you sign out). These entries do not leave your device for analytics or advertising and can be deleted at any time in your browser settings. No consent is required because they are strictly necessary for the features you asked for.

You have the right of access, rectification, erasure and restriction of processing, the right to object and the right to data portability. You can withdraw consent (e.g. for push notifications) at any time with effect for the future. Much of this you can do yourself: in the studio under “Me → Your data” you can download all data of your account as a file or delete your account with everything attached to it. For anything else, email us. You can also lodge a complaint with a data protection authority, in particular in the country where you live.

We keep your account, cards, contacts, events, posts and images until you delete them or delete your account; they are then removed immediately. Contact form enquiries and emails are kept as long as we need them to handle your request. Raw page-view counts are deleted after 13 months, crash reports after 90 days, card drafts that were never claimed (no account) after 30 days, sent push messages after 7 days. Push endpoints are deleted as soon as you switch push off or they are no longer reachable. Payment records are kept as long as tax and commercial law require.

For the members area we process your email address, the times you sign in and your progress in the learning section. You set a password that is only ever stored as a cryptographic hash, never in plain text. Confirmation and password resets use one-time links sent by email. Our technical provider is Supabase, whose database for this project runs in the EU (Ireland) and whose email infrastructure sends the sign-in links. Where applicable, processing is based on Art. 6(1)(b) GDPR (performance of the user relationship). You can delete your account yourself at any time in the studio (Me → Your data) or ask us to delete it by email.

When you build a digital card, we store what you enter — name, position, company, contact details, links, photo, logo, background image and your QR design — in our Supabase database and file storage in the EU (Ireland). While you have no account yet, your draft stays on your device or as an anonymous draft until you claim it. A published card is public by design: anyone with the link or QR code can view it and save it to their contacts; payment details you add (e.g. a wallet address or IBAN) are part of it. ORTAK Cards is invite-only: if you arrive via a card, an invite link or a gift code, we store how you arrived and review your application based on your card. Payments are processed by Stripe Payments Europe, Ltd.; we never see your card details and only store customer and subscription IDs. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Opening a card is not tracked: cards set no cookies and views and clicks are counted without IP addresses. If you leave your name, number or email and a message via “Exchange contact”, you share them voluntarily with the card owner; we keep them until the owner deletes them. For bookings via an invite link we store which card the booking came through; the referrer only sees that, and how much, they earned. Network and leaderboard: new cards appear in the network by default (visible only to signed-in members, with name, photo, company, industry, city and what you offer and look for) and on the leaderboard (first name, initial, company and points); you can switch both off in the studio at any time. Your tier is shown on your card from Chrome upwards. You become connected when someone scans your QR code or you accept a contact request; from the network this only works via a request, and the person asked sees your name, photo and company. If you open a card while signed in, the visit is counted for your account. In business statistics the owner only sees aggregate numbers (e.g. “27 regulars”). Under “Who’s looking” (see section 12) the owner sees visits from the last 7 days – with name and photo only if you are connected or share a community and you have not switched on “View anonymously”. After your card goes live we send you one welcome email. If you use “Find on Google automatically” for a business profile, we only send the company name and city to the Google Places API.

When you post, comment, vote or upload photos in a community, we store this content together with your card (name, photo) in our Supabase database and file storage in the EU (Ireland). It is only visible to signed-in ORTAK members. Photos are resized on your device before upload; metadata such as camera location is not carried over. Only upload photos you hold the rights to and that every recognisable person has agreed to have published. Reports are stored with your account so we can review abuse; after three reports content is hidden automatically. You can delete your own posts and comments at any time. Legal basis: Art. 6(1)(b) GDPR (providing the community features).

Push notifications are optional and only active if you turn them on in the studio and your browser or phone agrees. For this we store the endpoint created by your browser with two technical keys, your language and your account. Messages are delivered through the push service of your device or browser maker (e.g. Apple, Google, Mozilla, Microsoft), which only receives the encrypted message and the endpoint. Content includes new connections and contact requests, community replies, offers from businesses, RSVPs to your events, reminders before events and, after an event, a short thank-you or, for hosts, a summary — each with names and a short text excerpt. You can switch push off at any time in the studio (Me → Settings) or revoke it in your device settings; the endpoint is then deleted. The legal basis is your consent, Art. 6(1)(a) GDPR.

When you RSVP to an event or check in by scan, we store your RSVP and check-in time. Hosts see the guest list with the name, photo and company from your card and figures such as the show-up rate; they can export the guest list as a file (name, company, card link, RSVP, check-in, number of new connections — no email addresses or phone numbers). The live QR contains a code that changes every 30 seconds and only confirms that you met in person. If you visit a business while signed in, the visit is counted; the business can send you offers to your ORTAK inbox (no emails). You only receive offers from businesses in your city that you have never visited if you explicitly switch this on (Playground → Deals); the city comes from your card, and these offers only appear there, never on your start page. You can withdraw this consent at any time and mute individual businesses. If you collect stamps on a digital stamp card, we store stamps and redemptions with their time; the business only sees numbers (e.g. stamps given and redemptions). When you redeem an offer we store the time; the business only sees how often it was redeemed. The legal basis is Art. 6(1)(b) GDPR, and for offers from your city your consent, Art. 6(1)(a) GDPR. If you take part in a business's league (check-in via live QR on site), we store the day and time of each check-in, your ranking, challenges and prizes. Only participants of that league and the business see the ranking – with your card's name and photo or, if you choose, as “Anonymous”. Check-ins are deleted together with your account.

You put your start page together yourself; we store which widgets you chose, in which order and with which settings (e.g. city for the weather, your watchlist entries, news topic). We store reminders with their text and time so we can remind you by push; completed reminders are deleted after a day, all others at the latest 90 days after their date. If you use your location for the weather, your device rounds it to about 10 km before sending it to us; we only store the rounded value. Our server fetches weather, prices and headlines from the services listed in section 13; for headlines we only show the title, source and link – if you tap it, the news site's own privacy terms apply. The “line of the day” is picked on your device. “Who’s looking”: the owner of a card sees how often it was viewed in the last 7 days. Only signed-in visitors they are connected with or share a community with appear with name and photo; everyone else only counts as a number. With “View anonymously” (Me → Settings) you never appear with name and photo. We count your “real-life streak” from meetings by scan, event check-ins and stamps. The legal basis is Art. 6(1)(b) GDPR (the features you use), and for “Who’s looking” Art. 6(1)(f) GDPR (legitimate interest in a network of real encounters); you can object at any time by switching on “View anonymously”.

The journal and the spending tracker (subscriptions, expenses, habits) are only for you: we store the entries so you can see them on any device, but we show them to no one, do not analyse them and do not use them for advertising. You can delete any entry; they all disappear with your account and are included in your data export. Please don't write health data or data about others into them that you wouldn't share. In the games (Rock Paper Scissors, Market duel, Bets, Phones down) the people you play with see your name, picture, moves or tips and the result; leaderboards only show people you are connected with on ORTAK. For “Phones down” the app uses your phone's tilt sensor only on your device while the round is running – only whether and when you picked the phone up is sent. For the market duel we fetch public prices from CoinGecko or Coinbase once a day (with no link to you). In the network-wide predictions your individual forecast is visible to no one: only averages are shown, and breakdowns by city, industry, tier or contacts only from 3 votes (for this we use your card’s city and industry and your tier). The “Top forecasters” list shows name, picture and accuracy. We review questions you submit before publishing. Games are played only for Sparks (points with no cash value), never for money; legal basis is performance of the contract (Art. 6(1)(b) GDPR). Games are deleted after 90 days, Phones-down rounds after 3 days, market tips after 180 days. In Manhunt we only store your latest location during the round (no history); fellow players see it according to the game rules, and it is deleted when the round ends.

We work with these providers: Supabase (database, file storage, sign-in emails; servers in the EU, Ireland), Vercel Inc. (hosting and anonymous page statistics, USA), Stripe Payments Europe, Ltd. (payments, Ireland; Stripe may transfer data to Stripe, Inc. in the USA), Google (Places API, company name and city only; USA) and the push services of Apple, Google, Mozilla and Microsoft. For the widgets our server also queries MET Norway (weather, Norway), the OpenStreetMap Foundation/Nominatim (place search, UK), CoinGecko (crypto prices) and Finnhub (stock prices, USA) as well as public RSS feeds of news sites; they only receive place names, coordinates rounded to about 10 km or symbols such as “BTC” – never your name, account or IP address. ORTAK itself is a company based in the USA. Where data reaches the USA or other countries outside the EU as a result, we rely on the EU-US Data Privacy Framework where the recipient is certified, otherwise on the European Commission's standard contractual clauses (Art. 46 GDPR) provided for in these providers' terms. We do not sell data or pass it on for advertising.

ORTAK Cards is for people aged 16 and over. If you are younger, please do not use ORTAK. If we learn that an account belongs to a younger person, we delete it.

Sparks, tiers, the leaderboard and suggestions are calculated automatically from how you use ORTAK (e.g. connections and check-ins). They do not lead to decisions with legal or similarly significant effects for you, and we do not use them for advertising outside ORTAK. Crash reports (error message, page, browser identifier and, if signed in, account ID) are used solely to fix bugs. For our usage statistics we also store on which days you opened the app (date only, no time, no location) to calculate totals such as “active members per week”. These days are deleted after 25 months and are included in your data export. We only ever share such totals with investors, never names or contact details.