Privacy Policy

1. Controller

The controller within the meaning of the GDPR is the provider named in the Legal Notice:

OpSolid - Hasan Dönmez (Inhaber, Einzelunternehmen)
Stolte Ley 12, 59759 Arnsberg, Deutschland
Contact: info@opsolid.de

We have not appointed a data protection officer under the GDPR; for contacts under the law of other countries, see section 12. Please direct privacy questions and requests to exercise your rights to info@opsolid.de.

Where you use OpSo for business and store third parties’ personal data in it (for example contacts you meet at a trade fair), you decide the purposes and means of that processing and are responsible for it yourself; we provide the technical platform and process the data on your behalf in that respect. If you need a data processing agreement under Article 28 GDPR, please contact us.

2. Overview: what we process

We process only the data a given feature needs. We do not sell data, show advertising, use advertising networks, data brokers or tracking cookies, and we use no third-party web analytics or crash-reporting services. The exceptions are the technical diagnostic data of the Google components in the Android and iPhone apps described in section 3.12 and the information on failed starts and updates that the update function sends to Expo (section 3.21). The sections below state purpose, data, legal basis, retention and recipients for each processing activity.

3. Processing in detail

3.1 Visiting our websites (server log files). When card.opsolid.de, opso.cc or a card page is requested, our server technically needs and processes your IP address, date and time, requested URL, status code, data volume, referrer and user agent. Purpose: delivering the page, security, error analysis and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Retention: short-term only, usually 14 days. Recipient: our hosting provider (section 4).

3.2 Account and email-code sign-in. To create and use an account we process your email address. There is no password: we send a six-digit one-time code to your address; only a short-lived keyed verification value is stored and the request expires after 15 minutes. For sign-in security we store active sessions with device type, IP address and expiry; you can end sessions in the app, and a session ends at the latest 180 days after sign-in. A security log records sign-ins (with the method), ended sessions, a reused sign-in token and deletion requests, each with time, IP address and device type. To limit how many codes are mailed to one address, a code request is stored with a keyed hash of the requesting network (not the IP address itself). You may optionally add a name, phone number, avatar and language. Legal basis: Art. 6(1)(b) GDPR (usage contract) and (f) (security). Retention: the account until deletion (section 6); expired or ended sessions are cleaned up regularly; security-log entries are deleted after 90 days and code requests after 2 days. Recipients: hosting provider and email delivery service (section 4).

3.3 Sign-in with Google and Apple. If you choose “Sign in with Google”, Google confirms your identity; we receive a verified email address and possibly your profile name and verify the sign-in token on our server. Legal basis: Art. 6(1)(b) GDPR. Google processes your data as an independent controller under its own privacy policy (policies.google.com/privacy). Google sign-in is optional; email sign-in is equally available.

Sign in with Apple. If you choose “Sign in with Apple”, Apple confirms your identity; we receive Apple’s stable user identifier, a verified email address (your real one or an Apple private-relay address, as you choose) and, on first sign-in, the name you share. We verify the sign-in token on our server. We also store whether the address is a private-relay address, and we use the name as your account name only if the sign-in creates a new account. Legal basis: Art. 6(1)(b) GDPR. Apple processes your data as an independent controller under its own privacy policy (apple.com/legal/privacy). Apple sign-in is optional; email sign-in is equally available.

3.4 Your digital card. We store the content you enter on your card (name, role, company, email, phone, bio, profile photo, links, gallery, design) to provide the card. You control whether a card is public, unlisted, private or event-only and whether email and phone are shown. A public card is intentionally available to anyone with the link; search engines, recipients and other platforms may make copies that we cannot recall. Legal basis: Art. 6(1)(b) GDPR. Retention: until the card or account is deleted. When an account is deleted, only the link name (slug) of each card that was ever published is held for 90 days, with no reference to you, so that nobody else can take over QR codes or NFC tags printed with it; a link name can contain your name. Legal basis for this hold: Art. 6(1)(f) GDPR (preventing impersonation).

3.5 Card views. When a public card is opened we store an event with time, referrer, user agent and a truncated IP address (IPv4: last octet set to 0, IPv6: first 48 bits only) so the card owner can see view counts. The full IP address is not stored here; for short-term abuse limiting (request limits) it is held only transiently in memory, never in the database. Legal basis: Art. 6(1)(f) GDPR. Retention: until the card or account is deleted; previously stored full addresses have been truncated. Server log files (section 3.1) are separate and are deleted after 14 days at the latest. You may object under section 7.

3.6 Contacts, business-card scanning and notes (mini-CRM). When you save someone you met, we store what you enter: name, email, phone, company, role, notes, tags, pipeline stage, an optional value and attached photos. Recognising text, codes and faces while scanning runs on your device (section 3.12); only what you accept is stored. You are responsible for the lawfulness of storing these contacts (see section 1 and the Terms of Use). Our legal basis: Art. 6(1)(b) GDPR (operating the service you use). Retention: until you delete the contact or your account. Exports as CSV or vCard are available in the app. You can set a follow-up reminder date on a contact; it is stored with the contact and deleted with it, and the reminder itself is a notification scheduled on your device. If you tap “Save to phone”, the app asks for access to your phone’s address book and uses it only on your device: it looks for an existing entry with the same phone number or e-mail and then creates or updates that entry. Your address book is not uploaded to or stored by OpSo; you can withdraw the permission in your phone’s settings at any time.

3.7 Contact form on a public card. When a visitor enters their details there (name, email, phone, company, message), we store them and pass them on to authorised members of the card owner’s workspace. As evidence we record the version and hash of the notice shown, the language, the time and the recipient scope; no IP address or device fingerprint is stored for this. Legal basis: consent, Art. 6(1)(a) GDPR, tied to the exact notice shown. You can withdraw consent at any time with effect for the future (info@opsolid.de); we coordinate erasure with the workspace that received the data. Retention: until withdrawal or until the card owner deletes the contact.

3.8 Connections, messages and online status. If you accept a connection request, the published profile card may be filed as a contact in the other person’s workspace; pending requests do not disclose private email and phone fields. We store messages (text, images, videos, documents, cards) so both participants can read them across devices, including participant and connection identifiers, timestamps, delivery and read status and reactions. Online status and last activity are recorded only while you have enabled status sharing and are shown only reciprocally; switching it off stops recording and deletes the value. Legal basis: Art. 6(1)(b) GDPR. Retention: while the account and connection exist; an individually deleted message is hidden and removed at the next account or cleanup deletion. The recipient may save or share what they receive.

3.9 Uploaded media. We store images and videos (profile photo, gallery, meeting photos, message attachments) privately in Cloudflare object storage (R2) and deliver them through an access-checked address. Legal basis: Art. 6(1)(b) GDPR. Retention: until the item or account is deleted. Archiving or deleting a card blocks further retrieval from us; we cannot reach copies already downloaded.

3.10 Push notifications. If you allow notifications, we store the push token issued by your device and send notices about new contacts, connection requests and messages through the Expo push service (and from there, depending on your device, Google Firebase Cloud Messaging on Android or the Apple Push Notification service on iPhone). Transmitted are the token, sender name, a shortened preview or a media/card indicator and the conversation identifier. Legal basis: consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG (system prompt); you can withdraw it at any time in device settings or in the app. Retention: until withdrawal, sign-out, the end of the session (also when ended from another device) or account deletion.

3.11 Email delivery. We send sign-in codes and notices through an email delivery service (section 4). Processed are the recipient address, sender name, content and delivery metadata. Legal basis: Art. 6(1)(b) GDPR. We do not send marketing emails.

3.12 Scan features and technical diagnostics (Android and iPhone). Scanning codes, text, faces and documents uses Google ML Kit (on Android also Play services). Recognition runs on your device. However, the SDKs transmit device and app details, installation identifiers, feature events, error codes and performance measurements to Google for diagnostics and usage statistics. In the Android app they additionally contact Google for updates, and notification delivery uses Firebase installation identifiers. This is technical data, separate from the scanned content. Google processes it under its own privacy policy (ML Kit Android, ML Kit iPhone, Firebase, Android). Legal basis: Art. 6(1)(b) and (f) GDPR; device access under § 25(2) no. 2 TDDDG where strictly necessary to provide the service you requested.

3.13 Safety, blocks, reports and moderation. If you block or report users, cards or messages, we process the identifiers involved, report reason and details, status, times, actions and internal notes to enforce boundaries, investigate abuse and document decisions. We also store acceptance of the Terms of Use (account, document type, version, SHA-256 checksum, language, time, app version) as contract evidence, without IP address. Legal basis: Art. 6(1)(b) and (f) GDPR, in individual cases (c) or establishing, exercising or defending legal claims. Retention: as long as needed for enforcement, documentation, an appeal or legal duties; acceptance records until final account deletion.

3.14 Trade fairs and events. The fair catalogue (name, date, place, organiser) contains no personal data. If you follow fairs or assign contacts to them, we store that link in your account. If you join a participant list, your participation and profile details (name, role, company, avatar, card link) are visible to other signed-in participants until you leave the list. Legal basis: Art. 6(1)(b) GDPR.

3.15 Embedded media on cards. A card owner may embed a YouTube or Vimeo video or an externally hosted image. Videos load only after you click “Load video”: until then there is no connection to YouTube or Vimeo. After the click your browser connects to the provider (YouTube via youtube-nocookie.com, Vimeo via player.vimeo.com with the Do-Not-Track parameter), which receives IP address, user agent and the requested address. Externally hosted images, by contrast, are loaded directly from their server when the card opens. Legal basis: for videos your consent by clicking, Art. 6(1)(a) GDPR and § 25(1) TDDDG; for images Art. 6(1)(f) GDPR. The card owner is responsible for the embedding. The providers process the data under their own privacy policies.

3.16 Custom domain. If you connect your own domain to your card, we process the hostname, ownership check and DNS/TLS status. Certificates are issued by the certificate authority Let’s Encrypt (Internet Security Research Group, USA), which receives the hostname. Legal basis: Art. 6(1)(b) GDPR.

3.17 NFC card waitlist. We are planning a physical OpSo NFC card. It is not available and nothing is charged; the waitlist only records interest. We store your wishes (material, logo yes/no, quantity, note), language and date; on the web also the email address you enter and your consent, in the app the link to your account. Purpose: informing you about availability and pre-order and estimating demand. Legal basis: consent, Art. 6(1)(a) GDPR. Deletion: after the launch mailing, at the latest 12 months after the entry; in-app entries also with the account. Withdraw at any time by email to info@opsolid.de.

3.18 Backups. To recover from failures we back up the database and media daily. Backups are encrypted on our side and stored with a separate provider in Germany (section 4); 14 daily recovery points are kept, plus two write-protected daily copies. Legal basis: Art. 6(1)(f) GDPR (availability and recoverability, Art. 32 GDPR). Deleted data can therefore remain in access-restricted backups for up to 14 days after final deletion; on a restore we re-apply deletions.

3.19 AI features. The server contains optional text suggestions (bio, SEO text, follow-up draft) using an external AI provider. These features are currently not enabled; no data is sent to an AI provider. We will update this policy before enabling them.

3.20 Purchases and subscriptions (if offered). No purchase is possible today. If a subscription is offered through Google Play and bought, we send Google an opaque account identifier and transmit the purchase token over HTTPS to our server, which verifies it with Google. We store the token encrypted (and its hash), product and plan, status, acknowledgement, renewal flag, verification times and access dates, linked to your workspace. Purpose: grant access, restore purchases, reconcile changes and prevent fraud; no advertising. Legal basis: Art. 6(1)(b) GDPR and (f) (fraud prevention). Retention: while the workspace exists; when a sole-member workspace is deleted the data is deleted with it, while for a surviving shared workspace it remains for the remaining members; statutory retention duties remain unaffected. We receive no payment card or bank details; Google processes payment data as an independent controller. Account deletion does not cancel a store subscription.

3.21 App updates. In app versions with the update function, the app asks Expo (650 Industries, Inc., USA; “Expo Update” service, formerly EAS Update) at start whether a newer version of the app code is available and downloads it. We use this route only for bug fixes, corrections of texts and translations and minor interface corrections; new features reach you only through an App Store or Google Play update. With these requests the app sends Expo: the platform (Android or iOS), the runtime version (an identifier of the installed app build), the update channel, the identifiers of the running, the embedded and the requested update and of recently failed updates, a randomly generated identifier of this installation (client ID) and, where applicable, technical values that Expo previously gave the app for a staged rollout. Usual connection data is added: IP address and User-Agent, on iPhone including the app build and operating-system version. If the app crashes at start or an update cannot be loaded, the app may keep a technical error message (up to 1024 characters) on the device until the next request and then send it once; it may contain free text. We deliberately do not send account, contact or card content in this process. Purposes and roles: Expo delivers the updates on our behalf, uses the client ID to release them first to only part of the installations, and counts installations and failed installations per update for our update overview, so that we can detect faulty updates and withdraw them. In this respect Expo is our processor (data processing terms in Expo’s Terms of Service, including the EU Standard Contractual Clauses). Expo also uses the request data to measure usage of its service (the basis of its billing to us) and processes data for its own purposes as described in its privacy policy, for example in aggregated form to improve its services; Expo is responsible for that itself (expo.dev/privacy). Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering bug and security fixes quickly, in stages and with the ability to withdraw them, and being able to use Expo’s service for this. Your right to object under section 7 is unaffected. Transfer to the USA: Expo is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); in addition, the EU Standard Contractual Clauses in Expo’s Terms of Service apply (Art. 46(2)(c) GDPR). Retention: Expo stores the client ID and the IP address with each request. According to Expo, it keeps the error message only in raw request logs, which are deleted after three days. Expo has not published a fixed period for the other request data; according to Expo, it keeps it only as long as necessary for the purposes named. If we stop using Expo Update, Expo must delete or return the data processed on our behalf under the Standard Contractual Clauses. On your device the client ID and the app code files remain until you delete the app or clear its data; the app removes updates it no longer needs, and the error message is deleted after it has been sent. On iPhone the client ID can be carried over to a new device with a device backup. We ourselves cannot link the client ID to an account or a person (Art. 11 GDPR). This check is independent of push notifications (section 3.10) and also runs if you have not allowed notifications.

4. Recipients and processors

We use the following service providers where the respective feature is used. Processors are bound by agreements under Art. 28 GDPR.

• Hostinger International Ltd. – server (VPS) with application and database; location Vilnius, Lithuania (EU).
• Cloudflare, Inc. (USA, with an EU entity) – private R2 object storage for media and delivery; the storage location is determined by Cloudflare.
• Oracle Cloud Infrastructure – encrypted backups, region Germany Central (Frankfurt). We encrypt the content before transfer; the provider only sees encrypted data.
• Brevo (Sendinblue SAS, France) – sending of sign-in codes and notices by email. If we switch service (for example to an SMTP provider), we will update this policy.
• Expo (650 Industries, Inc., USA) and Google (Firebase Cloud Messaging) – delivery of push notifications; Expo also delivery of app updates (section 3.21).
• Google (Google Ireland Ltd. / Google LLC) – Google sign-in, scan components (ML Kit; Android and iPhone), Play services (Android). For a subscription also Google Play (purchase verification).
• Apple (Apple Distribution International Ltd., Ireland; it may transfer data to Apple Inc., USA, under Standard Contractual Clauses) – Sign in with Apple; on iPhone also delivery of push notifications through the Apple Push Notification service (APNs).
• Let’s Encrypt (ISRG, USA) – TLS certificates for our domains and, if used, your own domain.
• YouTube / Vimeo – only if a card owner embeds a video (section 3.15).

Data also goes to other users where you cause it (public card, accepted connection, message, participant list) and to authorities or courts where we are legally obliged or it is necessary to establish, exercise or defend legal claims.

Third-country transfers. Where recipients process data outside the EEA (in particular USA: Cloudflare, Expo (push delivery and app updates), Google, Let’s Encrypt, and Apple Inc. via Apple Distribution International), this relies on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can get a copy of the safeguards on request at info@opsolid.de. For people outside the EU, the EEA, the UK and Switzerland, section 12 also applies.

5. Device access, cookies and local storage (§ 25 TDDDG)

• Websites: We set no cookies for analytics, advertising or tracking and use no fingerprinting. On the start page only your chosen language is kept in your browser’s local storage. This is permitted without consent under § 25(2) no. 2 TDDDG, which is why we show no cookie banner. Fonts are served by us, not by Google Fonts.
• App: We store session data in the device’s secure storage as well as display and language settings. This is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG). We request camera, photo and notification access through system dialogs; we use the camera only for scanning and photos, and you can withdraw permission at any time in system settings. For app updates (section 3.21) the app also stores the downloaded app code files, an internal list of updates and their launch status and, after a failed start, a technical error message until the next check; this is strictly necessary to provide the app you use (§ 25(2) no. 2 TDDDG). It also stores a randomly generated identifier (client ID), which is sent to Expo with the update check so that updates can be released in stages and counted per update (section 3.21).
• Embedded content from third parties (section 3.15) may trigger its own access to your device when loaded; the respective provider or card owner is responsible for that.

6. Retention and deleting your account

We keep data while your account exists and beyond that only where laws require it or it is necessary to defend legal claims. Individual periods are stated with the processing activities above.

You can end your account at any time in the app under Settings → Delete account (instructions and a request without the app: Delete account). The account is deactivated immediately, all devices are signed out, public cards are switched off, and account, cards, contacts, connection-related messages and uploaded media are permanently deleted within 30 days; only the link names of published cards are held for 90 days (section 3.4). Afterwards data remains at most in the encrypted backups (section 3.18) and until statutory retention periods end. Reports about other accounts may be affected by deletion or de-identified; records needed for a legal duty or claim are kept only for that purpose. Deletion does not cancel any store subscription (section 3.20); no purchase is possible today.

Sign-in codes expire after 15 minutes. The NFC waitlist has its own periods (section 3.17).

7. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can get a machine-readable export in the app under Settings → “Download my data”; it contains your own messages and reactions but not the other party’s private content.
• Objection (Art. 21): Where we process data based on legitimate interests (Art. 6(1)(f) GDPR) you may object at any time on grounds relating to your particular situation. We then stop processing unless we show compelling legitimate grounds that override your interests or the processing serves establishing, exercising or defending legal claims.
• Withdrawal of consent (Art. 7(3)) with effect for the future; processing carried out until then remains lawful.
• Complaint to a supervisory authority (Art. 77), in particular in the Member State of your residence or workplace. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (ldi.nrw.de). The authorities of the countries named in section 12 are listed there.

To exercise your rights, write to info@opsolid.de. We answer within the statutory period, usually one month. To prevent misuse we may ask you to confirm your identity.

8. Obligation to provide data, automated decisions

An email address is required for an account; without it we cannot provide the service. All other details are voluntary. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

9. Children

OpSo is aimed at professionals and business owners. We do not knowingly collect data from anyone under 16.

10. Note for users in Türkiye (KVKK)

For people in Türkiye the Turkish Personal Data Protection Law No. 6698 (KVKK) also applies. The information under Art. 10 KVKK (Aydınlatma Metni) is in the Turkish version of this policy (Türkçe).

11. Changes

We update this policy when features, providers or the law change. The version published at the time applies, with the date stated above. For material changes we notify you in the app.

12. Users outside the EU/EEA, the UK and Switzerland

This section supplements the other sections for users and other people outside the EU, the EEA, the United Kingdom and Switzerland, in particular in Australia, New Zealand, Singapore, Israel, South Africa, the United Arab Emirates and Hong Kong; the other sections apply to you as well. Because we are established in Germany, the GDPR applies to all our processing, including your data (Art. 3(1) GDPR), and you have the same rights as users in the EU. Where the law of your country gives you further rights, you can also exercise them with us, to the extent that law applies to us. For people in Türkiye, section 10 also applies; information on transfers abroad under the Turkish data protection law (KVKK) is in section 10, not in this section.

Where your data goes. When you use OpSo from outside the EU, your data is transferred to the EU: the server and database are in Lithuania, the encrypted backups are in Germany, and emails are sent by a provider based in France. The providers named in section 4 also receive data where you use the relevant feature. They include recipients in the USA (Cloudflare, Expo, Google, Apple, Let’s Encrypt) and in Ireland (Google, Apple). Cloudflare decides where media are stored (section 4). Other users receive data only where you initiate it (section 4).

Safeguards for transfers. Your data gets the same protection as the data of users in the EU. Our processors are bound by agreements under Art. 28 GDPR and, where they act as processors, may use the data only on our instructions. For recipients in the USA, the safeguards in section 4 also apply: the EU-US Data Privacy Framework where the recipient is certified, and otherwise the EU Standard Contractual Clauses. Google, Apple and Expo process certain data partly as independent controllers (sections 3.3, 3.12 and 3.21). Where the law of your country applies to us and requires information on transfers abroad or on the safeguards for them, you will find that information in this section and in section 4.

Privacy contact. The person responsible for privacy, and the contact for all requests under this section, is the owner named in section 1. The owner is also the Data Protection Officer under section 11 PDPA (Singapore) and the privacy officer under section 201 of the Privacy Act 2020 (New Zealand), and can be reached at info@opsolid.de. Requests under POPIA (South Africa) also go to the owner. This does not appoint a data protection officer under the GDPR (section 1).

Access and correction. You can ask for access to your data and for its correction under section 7 and, where the law of your country applies to us, under that law too. Write to info@opsolid.de. Requests are free of charge, and we may ask you to confirm your identity. We answer within the statutory period, usually one month (section 7). We meet the time limits of your country’s law: in New Zealand we tell you our decision within 20 working days. In Singapore we answer within 30 days, or within that period we tell you in writing when we will answer.

Data breaches. If the security of your data is breached, we inform you and the competent authority where the applicable law requires it, within the time it sets. Our duties under Articles 33 and 34 GDPR remain unaffected.

Complaints. You can send complaints about how we handle your data to info@opsolid.de; we look into them and usually reply in writing within one month. You can contact the German authority named in section 7 at any time. You can also contact the data protection authority of your country; whether and how it acts depends on the law there, and some authorities, for example in Australia and Singapore, expect you to contact us first. The authorities and the relevant laws:

• Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au – Privacy Act 1988, APP 12 and 13, to the extent the Privacy Act applies to us.
• New Zealand: Office of the Privacy Commissioner, privacy.org.nz – Privacy Act 2020, IPP 6 and 7.
• Singapore: Personal Data Protection Commission (PDPC), pdpc.gov.sg – Personal Data Protection Act 2012, sections 21 and 22.
• Israel: Privacy Protection Authority, gov.il – Protection of Privacy Law 5741-1981, sections 13 and 14.
• South Africa: Information Regulator, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191, POPIAComplaints@inforegulator.org.za, inforegulator.org.za – Protection of Personal Information Act 4 of 2013 (POPIA), sections 23 and 24.
• United Arab Emirates: the federal authority competent under the PDPL (the official government portal currently names the UAE Data Office), u.ae – Federal Decree-Law No. 45 of 2021 (PDPL).
• Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD), pcpd.org.hk – Personal Data (Privacy) Ordinance (Cap. 486, PDPO), sections 18 and 22.

Contacts saved by other users. If another user saves your details as a contact, for example by scanning your business card (section 3.6), that user decides about it and is responsible for it. This includes informing you where the applicable law requires it (for example IPP 3A in New Zealand). We store this data to provide the service to that user; where the user uses OpSo for business, we process it on that user’s behalf (section 1). You can exercise your rights against that user. If you write to us, we will help them respond; where we are responsible for the data ourselves, we will answer you directly.