Privacy Policy

Effective Date: March 31, 2026

1. Introduction

Off Record, Inc. ("Off Record", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Off Record mobile application.

This Policy applies to users globally and is designed to comply with:

• The EU General Data Protection Regulation (GDPR) — for users in the European Economic Area;
• The Turkish Personal Data Protection Law (KVKK) — for users in Turkey;
• Applicable US state privacy laws.

If you are located in Turkey, Off Record acts as a "data controller" (veri sorumlusu) under KVKK. If you are in the EEA, Off Record acts as a data controller under GDPR.

2. Data We Collect

2.1 Information You Provide

• Email address (required for account registration and authentication);
• Professional information: employer / company name, job title, seniority level, department or function;
• Compensation information: salary, bonuses, and other compensation components you choose to submit;
• Content you post: reviews, comments, posts, and messages within the App.

2.2 Information Collected Automatically

• Device information: device type, operating system version, unique device identifiers;
• Usage data: features used, screens viewed, session duration, interaction logs;
• Crash reports and performance data;
• Approximate location derived from IP address (country/city level only — we do not collect precise GPS location).

2.3 Information We Do Not Collect

We do not collect your full legal name, phone number, government ID, precise GPS location, or payment card details.

Your salary and professional data are stored in anonymized and aggregated form. They are never linked to your name or publicly identifiable information.

3. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance — to provide the Service you have signed up for (email address, account management);
• Legitimate interests — to improve the Service, detect fraud, and ensure security;
• Consent — for advertising, analytics, and non-essential data processing. You may withdraw consent at any time;
• Legal obligation — to comply with applicable laws, court orders, or regulatory requirements.

Under KVKK, processing is additionally based on Article 5 of Law No. 6698, specifically the explicit consent of the data subject and the legitimate interests of the data controller where applicable.

4. How We Use Your Data

• Create and manage your Off Record account;
• Provide salary benchmarking and professional networking features;
• Display aggregated, anonymized salary and compensation insights;
• Send transactional emails (account verification, password reset, product updates);
• Serve contextual, interest-based advertisements within the App;
• Monitor and improve app performance and fix bugs;
• Detect and prevent fraud, abuse, and violations of our Terms;
• Comply with applicable legal obligations.

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only as described below.

5.1 Service Providers

We share data with trusted third-party service providers who process data on our behalf under strict data processing agreements:

• Resend — transactional email delivery (your email address is shared solely to send account-related emails);
• Analytics & crash reporting providers (e.g., Firebase/Google Analytics, Mixpanel) — anonymized usage and diagnostic data to help us improve the App.

5.2 Advertising Partners

Off Record is ad-supported. We may share aggregated, non-identifiable professional context (e.g., industry segment, seniority tier) with advertising partners to enable relevant ad targeting. We do not share your email address, salary data, or any directly identifiable information with advertisers.

5.3 Legal Requirements

We may disclose your data if required by applicable law, court order, or governmental authority, including Turkish and EU data protection authorities, or to protect the rights, property, or safety of Off Record, our users, or the public.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data (email, professional info): retained for the duration of the account, plus 12 months after account deletion;
• Usage and analytics data: retained for up to 24 months in anonymized form;
• Legal hold: data may be retained longer if required by law or for dispute resolution.

You may request deletion of your data at any time. See Section 9 for your rights.

7. International Data Transfers

Off Record, Inc. is based in the United States. Your data may be transferred to and processed in the US and other countries where our service providers operate. For transfers from Turkey, we comply with KVKK requirements for international transfers, including relying on adequate protection mechanisms or your explicit consent. For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS) and at rest;
• Access controls limiting employee access to personal data;
• Regular security assessments and monitoring;
• Anonymization of salary and compensation data before display.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security and encourage you to use a strong, unique password for your account.

9. Your Rights

9.1 Rights Under GDPR (EEA Users)

If you are in the EEA, you have the right to:

• Access — obtain a copy of your personal data;
• Rectification — correct inaccurate or incomplete data;
• Erasure ("right to be forgotten") — request deletion of your data;
• Restriction — request that we limit processing of your data;
• Portability — receive your data in a machine-readable format;
• Object — object to processing based on legitimate interests or for direct marketing;
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at privacy@off-record.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9.2 Rights Under KVKK (Turkish Users)

Under Article 11 of KVKK, Turkish users have the right to:

• Learn whether your personal data is being processed;
• Request information about the purpose of processing and whether it is being used accordingly;
• Know the third parties to whom your data is transferred domestically or internationally;
• Request correction of incomplete or inaccurate data;
• Request deletion or destruction of data when the reasons for processing no longer exist;
• Object to any outcome that is detrimental to you resulting from automated processing;
• Claim compensation for damages caused by unlawful processing.

You may submit a KVKK request to kvkk@off-record.app. You also have the right to file a complaint with the KVKK Authority at www.kvkk.gov.tr.

10. Children's Privacy

Off Record is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will delete it promptly. If you believe a minor has registered, please contact us at privacy@off-record.app.

11. Cookies & Tracking

The Off Record App may use mobile analytics SDKs and similar tracking technologies that operate analogously to cookies. These help us understand how the App is used, improve performance, and serve relevant ads. You can limit certain tracking via your device's privacy settings (e.g., "Limit Ad Tracking" on iOS). Our advertising partners may also use tracking technologies subject to their own privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Policy in the App and, where required by law, by sending you an email notification. Your continued use of the Service after the effective date of changes constitutes your acceptance of the revised Policy.

13. Contact Us

For privacy-related questions, requests, or complaints:

Off Record, Inc.
General privacy: privacy@off-record.app
KVKK requests: kvkk@off-record.app
Legal: legal@off-record.app

Last updated: March 31, 2026