1. Scope of this policy
The policy covers the web application at warmbreak.com and the iOS and Android apps. The data controller is Cekci Lab Teknoloji Limited Şirketi; its identity and contact details are in the first section of the Personal Data Protection Notice.
2. What we collect
- Account: full name, e-mail address, profile photo, language and time zone preference.
- Business card: phone number, job title, company, industry, seniority, bio, website, LinkedIn / X / GitHub address and education details (school, field, graduation year). All of it is optional and you decide what to fill in.
- Events: the events you register for and QR based check-in records.
- Networking: encounter records, private notes you write about people, meeting request messages.
- Recommendations: the event and people recommendations shown to you and what became of them (seen, opened, turned into a registration). Totals with no identity in them are collected from everyone, a record tied to your account is kept only if you have given usage analytics consent.
- Technical: session records, browser and device information, a hashed digest of your IP address.
- Notifications: a device push token, created only if you grant permission.
3. How we use it
- So you can see who is coming before an event and arrange meetings.
- To run check-in, the agenda and QR based introductions during the event.
- To keep your card wallet and the record of the people you met after the event.
- To recommend events and people based on your attendance history. You can switch this feature off.
- To measure and improve how accurate recommendations are. Totals with no identity in them are enough for that, a record tied to your account is kept only with your consent.
- For security, abuse detection and our legal obligations.
Marketing e-mail and usage analytics only run where you have given separate, explicit consent. Usage analytics consent also covers the record, tied to your account, of what became of the recommendations shown to you. Transactional e-mail (sign-in codes, meeting request notifications, event changes) is independent of marketing consent and continues even if you withdraw it.
4. Who can see what, and when
| Data | Who can see it | Condition |
|---|---|---|
| Your name, title, organisation and profile photo in the attendee list | Only other people registered for that event | When you register for the event. To leave the list you cancel your registration |
| Your business card | Only the person you exchange cards with | Only when both sides approve |
| Your notes about people | Only you | Never shown to the other person under any circumstance |
| Your meeting request message | The person you sent it to | Only when you send it |
| Your check-in record | The organiser of that event | When you register for the event |
5. Service providers
We rely on a small set of providers to keep the product running. The database, cache and backups live on Amazon Web Services servers in Istanbul. The images you upload are also stored in Amazon Web Services storage in Istanbul and delivered to your device from there through a short-lived link. We send transactional e-mail with Amazon SES (Frankfurt, Germany). Mobile notifications are delivered through Google Firebase Cloud Messaging and, on iOS devices, also through the Apple Push Notification service. The country of each provider and the data it receives are listed in the transfer table of the Personal Data Protection Notice.
Some of these providers process data outside Türkiye. International transfer is presented for your approval in the Explicit Consent Statement; if you decline, the related feature (for example mobile notifications) does not run, while the rest of the product continues to work.
6. How we protect it
- Your password is stored irreversibly; nobody can read it, not even us.
- Security logs keep a hashed digest of your IP address rather than the address itself.
- Every authorisation check runs on the server; nobody can reach another user’s card, wallet or meeting request.
- Uploaded files live in a separate object store, never on the application server’s disk.
- Administrative actions are written to an audit log that is not erased.
In the event of a data breach we notify the Board and the affected users within the period required by law.
7. Retention and deletion
We keep your data for as long as your account is open. When you ask to delete it, the process runs in three steps: the account is suspended immediately, you can change your mind and cancel for 14 days, and once that window closes the data is irreversibly deleted or anonymised.
- Deleted: your account details, business cards, uploaded images, notes about people, meeting requests, sessions, push tokens and recommendation records tied to your account.
- Anonymised: attendance counts, encounter statistics and the actions in audit records. The link to your identity is severed.
- Retained: consent records (burden of proof), invoicing records if any (5 years) and traffic logs (2 years).
Recommendation record totals with no identity in them are deleted automatically after 730 days, the ones tied to your account after 180 days. When you withdraw consent no new record tied to your account is created, and the existing ones drop off when their period expires.
8. Your rights and controls
- Export your data as CSV and vCard. Recommendation records tied to your account are part of that file. Settings › Your data and account.
- See, read the history of and withdraw your consents. Settings › My consents.
- To leave an event’s attendee list, cancel your registration for that event. There is no separate visibility setting. How the list works is explained under Settings › Privacy.
- Control what the recommendation engine is fed. You can edit your interest tags on your profile.
- Delete your account. Settings › Your data and account.
Consents are recorded with a version and a timestamp; the My consents screen shows which version of which document you approved, when and through which channel, and lets you export that record. For your statutory rights, use the data subject request form.
9. Changes to this policy
When the policy changes its version number increases and the badge at the top of the page shows the new value. You are informed in the app for material changes, and where a change requires consent we ask for it again. Consent you gave to an earlier version is not erased; it stays in the ledger.
Write to support@warmbreak.com with questions, or to support@warmbreak.com for personal data requests.