Privacy Policy

Effective Date: April 17, 2026

1. Introduction

Off Record L.L.C. ("Off Record", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Off Record mobile application.

This Policy applies to users globally and is designed to comply with:

• The EU General Data Protection Regulation (GDPR) — for users in the European Economic Area;
• The Turkish Personal Data Protection Law (KVKK) — for users in Turkey;
• Applicable US state privacy laws.

If you are located in Turkey, Off Record acts as a "data controller" (veri sorumlusu) under KVKK. If you are in the EEA, Off Record acts as a data controller under GDPR.

2. Data We Collect

2.1 Information You Provide

• Email address (required for account registration and authentication);
• Professional information: employer / company name, job title, seniority level, department or function;
• Compensation information: salary, bonuses, and other compensation components you choose to submit;
• Content you post: reviews, comments, posts, and messages within the App.

2.2 Information Collected Automatically

• Device information: device type, operating system version, unique device identifiers;
• Usage data: features used, screens viewed, session duration, interaction logs;
• Push notification tokens (used only to deliver notifications to your device; revoked when you sign out);
• Crash reports and performance data;
• Approximate location derived from IP address (country/city level only — we do not collect precise GPS location).

2.3 Information We Do Not Collect

We do not collect your full legal name, phone number, government ID, precise GPS location, or payment card details.

Salary submissions are displayed only in aggregated, anonymized form. Individual submissions are linked to your account solely for duplicate prevention and to honour deletion requests; they are never shown publicly with information that identifies you.

3. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance — to provide the Service you have signed up for (email address, account management);
• Legitimate interests — to improve the Service, detect fraud, and ensure security;
• Consent — for analytics and other non-essential data processing. You may withdraw consent at any time;
• Legal obligation — to comply with applicable laws, court orders, or regulatory requirements.

Under KVKK, processing is additionally based on Article 5 of Law No. 6698, specifically the explicit consent of the data subject and the legitimate interests of the data controller where applicable.

4. How We Use Your Data

• Create and manage your Off Record account;
• Provide salary benchmarking and professional networking features;
• Display aggregated, anonymized salary and compensation insights;
• Send transactional emails (account verification, password reset, product updates);
• Send push notifications for activity relevant to you (replies, mentions, messages), which you can disable in settings;
• Automatically moderate user-generated content for compliance with our community guidelines (see Section 5.1 for the AI provider used). You may contest any automated moderation decision by contacting us;
• Monitor and improve app performance and fix bugs;
• Detect and prevent fraud, abuse, and violations of our Terms;
• Comply with applicable legal obligations.

5. Data Sharing & Third Parties

We do not sell your personal data, and we do not display third-party advertising. We share data only as described below.

5.1 Service Providers

We share data with trusted third-party service providers who process data on our behalf under data processing agreements:

• Google / Firebase — authentication, database (Cloud Firestore), cloud functions, hosting, and push notification delivery;
• Resend — transactional email delivery (your email address is shared solely to send account-related emails such as verification codes);
• Mixpanel — anonymized product analytics to help us understand feature usage. No email addresses, names, or post content are sent to Mixpanel;
• Anthropic (Claude) — automated moderation of user-generated content. Post and comment text is sent to Anthropic's API for classification. Anthropic does not train its models on this data under its commercial API terms;
• Logo.dev — company logo lookups by publicly resolvable email domain; no personal data is shared.

5.2 Legal Requirements

We may disclose your data if required by applicable law, court order, or governmental authority, including Turkish and EU data protection authorities, or to protect the rights, property, or safety of Off Record, our users, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data (email, authentication record, profile fields): deleted within 30 days of an account deletion request;
• User-generated content (posts, comments, messages): authorship and display fields are removed within 30 days of deletion; the content itself may remain visible to preserve community context, displayed without any link to you;
• Salary and company review submissions: anonymized within 30 days of deletion; the anonymized data you contributed may remain in aggregate statistical form indefinitely;
• Usage and analytics data: retained for up to 24 months in anonymized form;
• Legal hold: data may be retained longer if required by law or for dispute resolution.

You may delete your account at any time from Settings → Delete Account in the App. See Section 9 for your full rights.

7. International Data Transfers

Off Record L.L.C. is based in the United States. Your data may be transferred to and processed in the US and other countries where our service providers operate. For transfers from Turkey, we comply with KVKK requirements for international transfers, including relying on adequate protection mechanisms or your explicit consent. For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS) and at rest;
• Access controls limiting employee access to personal data;
• Regular security assessments and monitoring;
• Anonymization of salary and compensation data before display.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security and encourage you to use a strong, unique password for your account.

9. Your Rights

9.1 Rights Under GDPR (EEA Users)

If you are in the EEA, you have the right to:

• Access — obtain a copy of your personal data;
• Rectification — correct inaccurate or incomplete data;
• Erasure ("right to be forgotten") — request deletion of your data;
• Restriction — request that we limit processing of your data;
• Portability — receive your data in a machine-readable format;
• Object — object to processing based on legitimate interests or for direct marketing;
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

You can delete your account directly from Settings → Delete Account in the App. To exercise any other right, contact us at privacy@offrecord.space. We will respond to written requests within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9.2 Rights Under KVKK (Turkish Users)

Under Article 11 of KVKK, Turkish users have the right to:

• Learn whether your personal data is being processed;
• Request information about the purpose of processing and whether it is being used accordingly;
• Know the third parties to whom your data is transferred domestically or internationally;
• Request correction of incomplete or inaccurate data;
• Request deletion or destruction of data when the reasons for processing no longer exist;
• Object to any outcome that is detrimental to you resulting from automated processing;
• Claim compensation for damages caused by unlawful processing.

You may submit a KVKK request to kvkk@offrecord.space. You also have the right to file a complaint with the KVKK Authority at www.kvkk.gov.tr.

10. Children's Privacy

Off Record is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will delete it promptly. If you believe a minor has registered, please contact us at privacy@offrecord.space.

11. Cookies & Tracking

The Off Record App uses mobile analytics SDKs (Firebase and Mixpanel) and similar diagnostic technologies that operate analogously to cookies. These help us understand how the App is used and improve performance. You can limit certain tracking via your device's privacy settings. Off Record does not display third-party advertisements and does not share data with advertising networks.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Policy in the App and, where required by law, by sending you an email notification. Your continued use of the Service after the effective date of changes constitutes your acceptance of the revised Policy.

13. Contact Us

For privacy-related questions, requests, or complaints:

Off Record L.L.C.
General privacy: privacy@offrecord.space
KVKK requests: kvkk@offrecord.space
Legal: legal@offrecord.space

Last updated: April 17, 2026