PRIVACY NOTICE
Last Updated: [DATE]
This Privacy Notice explains how Bartra ("we", "us", "our") collects, uses, stores and shares personal data when you use the Bartra website and mobile apps ("Platform"). For users in Türkiye it also serves as the information notice required by the Law on the Protection of Personal Data No. 6698 ("KVKK"). The data controller is [COMPANY NAME], [COMPANY ADDRESS].
1. What we collect
Account and profile. Email address, password (stored only as a hash by our authentication provider), display name, username, optional photo, bio, country, city or district and, if you pick a place from the list, its coordinates; language; the date and version of the Terms you accepted.
Sign-in with Google or Apple. The name, email address and profile picture the provider shares with us. We never see your Google or Apple password.
Listings and swaps. Listing titles, descriptions, categories, photos and location; proposals you send or receive; messages in proposal chats; reviews you give and receive; reports you file.
Technical data. Device type and operating system, app version, IP address and approximate region derived from it, crash and error logs, and timestamps of requests. We do not use advertising trackers.
What we do not collect. Precise GPS location (only the city or district you choose), payment details (there are no payments), or contacts from your phone.
2. Why we use it and on what legal basis
| Purpose | Data | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|---|
| Creating and operating your account, showing your listings and profile to other users | Account, profile, listings | Performance of the contract (the Terms) |
| Matching, proposals, chat and completion of swaps | Proposals, messages, reviews | Performance of the contract |
| Sending sign-up confirmation, password reset and swap notifications | Email, device push token | Performance of the contract; legitimate interest in keeping you informed |
| Keeping the Platform safe: preventing fraud, abuse and illegal listings, handling reports | Reports, listings, messages, technical data | Legitimate interest; legal obligation |
| Improving the Platform, fixing errors | Technical data, aggregated usage | Legitimate interest |
| Responding to legal requests | Any of the above | Legal obligation |
We do not sell personal data and we do not use it for profiling or automated decisions with legal effects.
3. Who can see what
- Other users see your display name, username, photo, bio, city or district, rating and reviews, and your active listings. They see your email only if you share it yourself.
- The other party in a proposal sees the messages you send in that chat.
- We can see all data to operate the Platform and investigate reports.
4. Processors and transfers
We use service providers that process data on our behalf under written agreements:
- Supabase (database, authentication, file storage, realtime messaging) — servers in Frankfurt, Germany (AWS eu-central-1).
- Vercel (website hosting) — global edge network with EU regions.
- Expo / EAS (mobile builds and push notifications) — USA.
- Apple and Google (app distribution, sign-in, push delivery) — USA.
- [EMAIL PROVIDER] (transactional email) — [REGION].
Some of these providers are outside Türkiye and the EU. Transfers rely on the providers' standard contractual clauses and, for Türkiye, on your explicit consent where KVKK Art. 9 requires it, which you give when you accept this Notice at sign-up. You can withdraw consent at any time by deleting your account.
5. Retention
- Account and profile data: for as long as your account exists, then deleted within 30 days of account deletion.
- Listings, proposals, messages and reviews: while your account exists. Reviews about you may remain visible in anonymised form after deletion to protect other users.
- Reports: up to 2 years after resolution.
- Technical logs: up to 90 days.
- Legal records (e.g. Terms acceptance): as long as required by law, typically 10 years.
6. Your rights
Under KVKK Art. 11 and, where applicable, the GDPR you may: learn whether we process your data and request information about it; request correction, deletion or restriction; object to processing based on legitimate interest; receive your data in a portable format; and complain to the Personal Data Protection Authority (KVKK Kurumu) or your local supervisory authority.
To exercise a right, email [LEGAL EMAIL] from the address on your account or use the account settings in the app. We answer within 30 days.
7. Account deletion
You can delete your account from the app's profile settings or by emailing [LEGAL EMAIL]. Deletion removes your profile, listings, proposals and messages as described in section 5.
8. Security
Data is encrypted in transit (TLS) and at rest by our providers. Access to production data is restricted to people who need it to operate the Platform. Row-level access rules ensure users can only read data they are allowed to see. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.
9. Cookies and local storage
The website uses only strictly necessary cookies (your session and language preference). The mobile app stores your session on the device. We do not use advertising or cross-site tracking cookies.
10. Children
The Platform is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
11. Changes
We may update this Notice. Material changes are announced in the app or by email. The date at the top shows the current version.
12. Contact
[COMPANY NAME] [COMPANY ADDRESS] Email: [LEGAL EMAIL] Website: [WEBSITE]