Privacy Policy

1. Controller

The controller within the meaning of the GDPR is the provider named in the Legal Notice:

OpSolid - Hasan Dönmez (Inhaber, Einzelunternehmen)
Stolte Ley 12, 59759 Arnsberg, Deutschland
Contact: info@opsolid.de

We have not appointed a data protection officer. Please direct privacy questions and requests to exercise your rights to info@opsolid.de.

Where you use OpSo for business and store third parties’ personal data in it (for example contacts you meet at a trade fair), you decide the purposes and means of that processing and are responsible for it yourself; we provide the technical platform and process the data on your behalf in that respect. If you need a data processing agreement under Article 28 GDPR, please contact us.

2. Overview: what we process

We process only the data a given feature needs. We do not sell data, show advertising, use advertising networks, data brokers or tracking cookies, and we use no third-party web analytics or crash-reporting services. The exception is the technical diagnostic data of the Google components in the Android app described in section 3.12. The sections below state purpose, data, legal basis, retention and recipients for each processing activity.

3. Processing in detail

3.1 Visiting our websites (server log files). When card.opsolid.de, opso.cc or a card page is requested, our server technically needs and processes your IP address, date and time, requested URL, status code, data volume, referrer and user agent. Purpose: delivering the page, security, error analysis and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Retention: short-term only, usually 14 days. Recipient: our hosting provider (section 4).

3.2 Account and email-code sign-in. To create and use an account we process your email address. There is no password: we send a six-digit one-time code to your address; only a short-lived keyed verification value is stored and the request expires after 15 minutes. For sign-in security we store active sessions with device type, IP address and expiry; you can end sessions in the app. You may optionally add a name, phone number, avatar and language. Legal basis: Art. 6(1)(b) GDPR (usage contract) and (f) (security). Retention: the account until deletion (section 6); expired or ended sessions are cleaned up regularly. Recipients: hosting provider and email delivery service (section 4).

3.3 Sign-in with Google. If you choose “Sign in with Google”, Google confirms your identity; we receive a verified email address and possibly your profile name and verify the sign-in token on our server. Legal basis: Art. 6(1)(b) GDPR. Google processes your data as an independent controller under its own privacy policy (policies.google.com/privacy). Google sign-in is optional; email sign-in is equally available.

3.4 Your digital card. We store the content you enter on your card (name, role, company, email, phone, bio, profile photo, links, gallery, design) to provide the card. You control whether a card is public, unlisted, private or event-only and whether email and phone are shown. A public card is intentionally available to anyone with the link; search engines, recipients and other platforms may make copies that we cannot recall. Legal basis: Art. 6(1)(b) GDPR. Retention: until the card or account is deleted.

3.5 Card views. When a public card is opened we store an event with time, referrer, user agent and a truncated IP address (IPv4: last octet set to 0, IPv6: first 48 bits only) so the card owner can see view counts. The full IP address is not stored here; for short-term abuse limiting (request limits) it is held only transiently in memory, never in the database. Legal basis: Art. 6(1)(f) GDPR. Retention: until the card or account is deleted; previously stored full addresses have been truncated. Server log files (section 3.1) are separate and are deleted after 14 days at the latest. You may object under section 7.

3.6 Contacts, business-card scanning and notes (mini-CRM). When you save someone you met, we store what you enter: name, email, phone, company, role, notes, tags, pipeline stage, an optional value and attached photos. Recognising text, codes and faces while scanning runs on your device (section 3.12); only what you accept is stored. You are responsible for the lawfulness of storing these contacts (see section 1 and the Terms of Use). Our legal basis: Art. 6(1)(b) GDPR (operating the service you use). Retention: until you delete the contact or your account. Exports as CSV or vCard are available in the app.

3.7 Contact form on a public card. When a visitor enters their details there (name, email, phone, company, message), we store them and pass them on to authorised members of the card owner’s workspace. As evidence we record the version and hash of the notice shown, the language, the time and the recipient scope; no IP address or device fingerprint is stored for this. Legal basis: consent, Art. 6(1)(a) GDPR, tied to the exact notice shown. You can withdraw consent at any time with effect for the future (info@opsolid.de); we coordinate erasure with the workspace that received the data. Retention: until withdrawal or until the card owner deletes the contact.

3.8 Connections, messages and online status. If you accept a connection request, the published profile card may be filed as a contact in the other person’s workspace; pending requests do not disclose private email and phone fields. We store messages (text, images, videos, documents, cards) so both participants can read them across devices, including participant and connection identifiers, timestamps, delivery and read status and reactions. Online status and last activity are recorded only while you have enabled status sharing and are shown only reciprocally; switching it off stops recording and deletes the value. Legal basis: Art. 6(1)(b) GDPR. Retention: while the account and connection exist; an individually deleted message is hidden and removed at the next account or cleanup deletion. The recipient may save or share what they receive.

3.9 Uploaded media. We store images and videos (profile photo, gallery, meeting photos, message attachments) privately in Cloudflare object storage (R2) and deliver them through an access-checked address. Legal basis: Art. 6(1)(b) GDPR. Retention: until the item or account is deleted. Archiving or deleting a card blocks further retrieval from us; we cannot reach copies already downloaded.

3.10 Push notifications. If you allow notifications, we store the push token issued by your device and send notices about new contacts, connection requests and messages through the Expo push service (and from there Google Firebase Cloud Messaging). Transmitted are the token, sender name, a shortened preview or a media/card indicator and the conversation identifier. Legal basis: consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG (system prompt); you can withdraw it at any time in device settings or in the app. Retention: until withdrawal, sign-out or account deletion.

3.11 Email delivery. We send sign-in codes and notices through an email delivery service (section 4). Processed are the recipient address, sender name, content and delivery metadata. Legal basis: Art. 6(1)(b) GDPR. We do not send marketing emails.

3.12 Scan features and technical diagnostics (Android). Scanning codes, text, faces and documents uses Google ML Kit and Play services. Recognition runs on your device. However, the SDKs contact Google for updates and transmit device and app details, installation identifiers, feature events, error codes and performance measurements for diagnostics and usage statistics; notification delivery also uses Firebase installation identifiers. This is technical data, separate from the scanned content. Google processes it under its own privacy policy (ML Kit, Firebase). Legal basis: Art. 6(1)(b) and (f) GDPR; device access under § 25(2) no. 2 TDDDG where strictly necessary to provide the service you requested.

3.13 Safety, blocks, reports and moderation. If you block or report users, cards or messages, we process the identifiers involved, report reason and details, status, times, actions and internal notes to enforce boundaries, investigate abuse and document decisions. We also store acceptance of the Terms of Use (account, document type, version, SHA-256 checksum, language, time, app version) as contract evidence, without IP address. Legal basis: Art. 6(1)(b) and (f) GDPR, in individual cases (c) or establishing, exercising or defending legal claims. Retention: as long as needed for enforcement, documentation, an appeal or legal duties; acceptance records until final account deletion.

3.14 Trade fairs and events. The fair catalogue (name, date, place, organiser) contains no personal data. If you follow fairs or assign contacts to them, we store that link in your account. If you join a participant list, your participation and profile details (name, role, company, avatar, card link) are visible to other signed-in participants until you leave the list. Legal basis: Art. 6(1)(b) GDPR.

3.15 Embedded media on cards. A card owner may embed a YouTube or Vimeo video or an externally hosted image. Videos load only after you click “Load video”: until then there is no connection to YouTube or Vimeo. After the click your browser connects to the provider (YouTube via youtube-nocookie.com, Vimeo via player.vimeo.com with the Do-Not-Track parameter), which receives IP address, user agent and the requested address. Externally hosted images, by contrast, are loaded directly from their server when the card opens. Legal basis: for videos your consent by clicking, Art. 6(1)(a) GDPR and § 25(1) TDDDG; for images Art. 6(1)(f) GDPR. The card owner is responsible for the embedding. The providers process the data under their own privacy policies.

3.16 Custom domain. If you connect your own domain to your card, we process the hostname, ownership check and DNS/TLS status. Certificates are issued by the certificate authority Let’s Encrypt (Internet Security Research Group, USA), which receives the hostname. Legal basis: Art. 6(1)(b) GDPR.

3.17 NFC card waitlist. We are planning a physical OpSo NFC card. It is not available and nothing is charged; the waitlist only records interest. We store your wishes (material, logo yes/no, quantity, note), language and date; on the web also the email address you enter and your consent, in the app the link to your account. Purpose: informing you about availability and pre-order and estimating demand. Legal basis: consent, Art. 6(1)(a) GDPR. Deletion: after the launch mailing, at the latest 12 months after the entry; in-app entries also with the account. Withdraw at any time by email to info@opsolid.de.

3.18 Backups. To recover from failures we back up the database and media daily. Backups are encrypted on our side and stored with a separate provider in Germany (section 4); 14 daily recovery points are kept, plus two write-protected daily copies. Legal basis: Art. 6(1)(f) GDPR (availability and recoverability, Art. 32 GDPR). Deleted data can therefore remain in access-restricted backups for up to 14 days after final deletion; on a restore we re-apply deletions.

3.19 AI features. The server contains optional text suggestions (bio, SEO text, follow-up draft) using an external AI provider. These features are currently not enabled; no data is sent to an AI provider. We will update this policy before enabling them.

3.20 Purchases and subscriptions (if offered). No purchase is possible today. If a subscription is offered through Google Play and bought, we send Google an opaque account identifier and transmit the purchase token over HTTPS to our server, which verifies it with Google. We store the token encrypted (and its hash), product and plan, status, acknowledgement, renewal flag, verification times and access dates, linked to your workspace. Purpose: grant access, restore purchases, reconcile changes and prevent fraud; no advertising. Legal basis: Art. 6(1)(b) GDPR and (f) (fraud prevention). Retention: while the workspace exists; when a sole-member workspace is deleted the data is deleted with it, while for a surviving shared workspace it remains for the remaining members; statutory retention duties remain unaffected. We receive no payment card or bank details; Google processes payment data as an independent controller. Account deletion does not cancel a store subscription.

4. Recipients and processors

We use the following service providers where the respective feature is used. Processors are bound by agreements under Art. 28 GDPR.

• Hostinger International Ltd. – server (VPS) with application and database; location Vilnius, Lithuania (EU).
• Cloudflare, Inc. (USA, with an EU entity) – private R2 object storage for media and delivery; the storage location is determined by Cloudflare.
• Oracle Cloud Infrastructure – encrypted backups, region Germany Central (Frankfurt). We encrypt the content before transfer; the provider only sees encrypted data.
• Brevo (Sendinblue SAS, France) – sending of sign-in codes and notices by email. If we switch service (for example to an SMTP provider), we will update this policy.
• Expo (650 Industries, Inc., USA) and Google (Firebase Cloud Messaging) – delivery of push notifications.
• Google (Google Ireland Ltd. / Google LLC) – Google sign-in, Android scan components (ML Kit), Play services. For a subscription also Google Play (purchase verification).
• Let’s Encrypt (ISRG, USA) – TLS certificates for our domains and, if used, your own domain.
• YouTube / Vimeo – only if a card owner embeds a video (section 3.15).

Data also goes to other users where you cause it (public card, accepted connection, message, participant list) and to authorities or courts where we are legally obliged or it is necessary to establish, exercise or defend legal claims.

Third-country transfers. Where recipients process data outside the EEA (in particular USA: Cloudflare, Expo, Google, Let’s Encrypt), this relies on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can get a copy of the safeguards on request at info@opsolid.de.

5. Device access, cookies and local storage (§ 25 TDDDG)

• Websites: We set no cookies for analytics, advertising or tracking and use no fingerprinting. On the start page only your chosen language is kept in your browser’s local storage. This is permitted without consent under § 25(2) no. 2 TDDDG, which is why we show no cookie banner. Fonts are served by us, not by Google Fonts.
• App: We store session data in the device’s secure storage as well as display and language settings. This is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG). We request camera, photo and notification access through system dialogs; we use the camera only for scanning and photos, and you can withdraw permission at any time in system settings.
• Embedded content from third parties (section 3.15) may trigger its own access to your device when loaded; the respective provider or card owner is responsible for that.

6. Retention and deleting your account

We keep data while your account exists and beyond that only where laws require it or it is necessary to defend legal claims. Individual periods are stated with the processing activities above.

You can end your account at any time in the app under Settings → Delete account (instructions and a request without the app: Delete account). The account is deactivated immediately, all devices are signed out, public cards are switched off, and account, cards, contacts, connection-related messages and uploaded media are permanently deleted within 30 days. Afterwards data remains at most in the encrypted backups (section 3.18) and until statutory retention periods end. Reports about other accounts may be affected by deletion or de-identified; records needed for a legal duty or claim are kept only for that purpose. Deletion does not cancel any store subscription (section 3.20); no purchase is possible today.

Sign-in codes expire after 15 minutes. The NFC waitlist has its own periods (section 3.17).

7. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can get a machine-readable export in the app under Settings → “Download my data”; it contains your own messages and reactions but not the other party’s private content.
• Objection (Art. 21): Where we process data based on legitimate interests (Art. 6(1)(f) GDPR) you may object at any time on grounds relating to your particular situation. We then stop processing unless we show compelling legitimate grounds that override your interests or the processing serves establishing, exercising or defending legal claims.
• Withdrawal of consent (Art. 7(3)) with effect for the future; processing carried out until then remains lawful.
• Complaint to a supervisory authority (Art. 77), in particular in the Member State of your residence or workplace. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (ldi.nrw.de).

To exercise your rights, write to info@opsolid.de. We answer within the statutory period, usually one month. To prevent misuse we may ask you to confirm your identity.

8. Obligation to provide data, automated decisions

An email address is required for an account; without it we cannot provide the service. All other details are voluntary. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

9. Children

OpSo is aimed at professionals and business owners. We do not knowingly collect data from anyone under 16.

10. Note for users in Türkiye (KVKK)

For people in Türkiye the Turkish Personal Data Protection Law No. 6698 (KVKK) also applies. The information under Art. 10 KVKK (Aydınlatma Metni) is in the Turkish version of this policy (Türkçe).

11. Changes

We update this policy when features, providers or the law change. The version published at the time applies, with the date stated above. For material changes we notify you in the app.