Privacy Policy

1. Who is responsible

Ortama is operated by Parsius Bilişim. For data protection questions and requests: hello@ortama.app

The service is offered to users in Türkiye and the European Union; the Turkish Personal Data Protection Law (KVKK) and the GDPR both apply.

2. Data we process

We collect only what the service needs to work:

• Account: e-mail address, date of birth (used only to check that you are 18+), account type (personal or business), account status.
• Profile: display name, short about text, profile photo, interests, languages you speak, neighbourhood label and approximate area.
• Tables and events: tables you host or apply to, meeting time, approximate meeting point, table note, application statuses.
• Communication: table chat and one-to-one messages, in-app notifications.
• Trust and safety: ratings, reports, blocks, moderation decisions and appeals.
• Consent records: when and which version of the terms and privacy policy you accepted, and your analytics choice.
• Business accounts: business name, category, address, opening hours, VAT country and number, VIES check result, campaigns and redemption counters, subscription records.
• Technical: session data, device and browser type, error logs, IP address (for security and abuse prevention, kept briefly).

3. Data we do not collect

• No special category data: we never ask for political opinions, religion or belief, health, sexual orientation, ethnic origin or trade union membership.
• No face recognition and no biometric analysis. A profile photo exists only so people can recognise each other.
• No location history. We store only the approximate area you last provided; tables are shown at neighbourhood level and the exact address is something the host shares in chat.
• Card details never reach us; business subscription payments are taken on the payment provider's own page.
• We do not profile you for advertising and we never sell personal data.

4. Purposes and legal bases

• Performance of a contract: creating your account, showing tables, running applications and chat, providing business subscriptions.
• Consent: profile photo, analytics measurement, optional notification preferences. You can withdraw consent at any time in settings.
• Legitimate interests: preventing abuse, handling reports and moderation, service security, debugging.
• Legal obligation: invoices and tax records, requests from competent authorities.

5. Retention

• Table chats are deleted automatically 30 days after the event ends.
• When you request deletion, a 14-day cooling period starts and you can cancel by signing in again. After that the account and personal data are permanently deleted and your name is anonymised in messages.
• Report and sanction records are kept anonymised for as long as the law requires, to prevent repeated abuse.
• Invoice and subscription records are kept for the period required by tax law.
• Technical error logs are kept for at most 90 days.

6. Who we share data with

We do not sell data. A small number of processors help us run the service; each is bound by a data processing agreement and servers are located in the European Union:

• Supabase — database, authentication and file storage (EU region).
• Hetzner Online GmbH — application hosting (Germany).
• Resend — delivery of sign-in codes and service e-mails.
• PostHog — product usage measurement, only if you consent; Sentry — error reports.
• OpenFreeMap / OpenStreetMap — map imagery (your position is not sent to them; only the map tiles being displayed are requested).
• iyzico (Türkiye) and Paddle (European Union) — payment processing for business subscriptions only.

7. What other users can see

• Your profile photo, display name, about text, interests and neighbourhood label are visible on tables and in Discover.
• The category, time, approximate location and note of a table you host are public.
• Your average rating and the number of tables you completed are shown as trust signals; individual ratings are never attributed.
• Your e-mail address, date of birth and precise location are never shown to other users.

8. Your rights

Under the GDPR and KVKK you have the right to access, rectify, erase, restrict and object to processing, and to data portability.

For access and portability, use the data download feature in settings; for erasure, start the account deletion flow. For anything else write to hello@ortama.app and we will respond within 30 days at the latest.

You may also lodge a complaint with the data protection authority of your country in the European Union, or with the Personal Data Protection Authority in Türkiye.

9. Security

• All traffic travels over encrypted connections; profile photos are held in a private bucket and served only to authorised requests.
• The database enforces row level access rules: each user can read only the records they are entitled to see.
• Chats are not end-to-end encrypted; if a message is reported, the moderation team may review it. You accept this when you create an account.
• Administrator actions are written to an audit log.

10. Children

Ortama is not intended for anyone under 18. Age is checked at sign-up using the date of birth, and accounts found to belong to minors are closed.

11. Changes

If we update this policy we change the date above and announce significant changes in the app. The current version is always on this page.