Language. During the protected pilot this notice is maintained in English; translations follow with the pilot-region legal entity. If a translation ever conflicts with the English text, the English version prevails. Interim privacy contact: support@goodnessbridge.org (a formal DPO is designated together with the pilot entity).
1. Our privacy philosophy
We collect the minimum needed, seal what is sensitive, and open identity only with consent. Privacy is a design constraint, not a policy paragraph.
2. What we collect and why
| Data | Purpose | Lawful basis (GDPR) |
|---|---|---|
| Email, auth identifier | Account, login (passwordless) | Contract (Art. 6(1)(b)) |
| Role, onboarding intent | Route you to the right experience | Contract |
| K1 rumored profile (nickname, age band, region, short story) | Enable dignified matching | Consent (Art. 6(1)(a)); moderated |
| K2 identity + address | Fulfillment of a specific good | Consent + Contract; time-limited |
| Verification data (liveness, ID match, documents) | Prevent fraud, protect the shelf | Legal obligation / legitimate interest / consent, per tier |
| Payment metadata (not card data) | Process contributions | Contract; card data handled by Stripe |
| Device/risk signals | Fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Support/emergency case data | Deliver the outcome | Consent; special-category data under Art. 9 where applicable, with explicit consent |
3. Special-category & sensitive data
Emergency cases may reveal health or hardship data (special category under GDPR Art. 9 / sensitive under KVKK). We process it only with explicit consent, store it sealed (K3), share the minimum with a provider to pay a bill, and never publish it.
4. Minors
We do not knowingly hold accounts for people under 18. Where a minor is helped through an institution/guardian bridge, identity/visibility layers stay closed and safeguarding rules apply.
5. Who sees what (Graduated Visibility)
- •K0 (public): only a need/product card — never a person.
- •K1: rumored profile, to verified Givers, only if the person opens it.
- •K2 (identity + address): only the single Giver fulfilling that good, on mutual consent, time-limited, logged; auto-closes on delivery. Screenshotting is warned against and access is contractually bound.
- •K3 (sealed): documents/risk data — staff/moderation only, never any user.
6. Sharing & processors
We use processors under data-processing agreements: Supabase (database/auth, EU region), Vercel (web hosting and privacy-preserving aggregate analytics), Stripe (payments), Google Maps (map tiles on the explore page, when the map layer is enabled), [EMAIL/SMS PROVIDER] (notifications), and affiliate networks (Lane E — SubIDs carry a one-way hashed pseudonym, never PII). We do not sell personal data. We disclose to authorities only when legally required.
7. International transfers
Our databases run in EU regions (EEA). Where a processor moves data outside the EEA, we rely on adequacy decisions or Standard Contractual Clauses / equivalent KVKK safeguards.
8. Retention
We keep data only as long as needed for the purpose or as required by law. Inactive need-profiles sleep after 6 months (data minimization); K2 grants expire with the delivery; verification documents are held for the minimum retention required, then deleted.
9. Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (KVKK Art. 11 / GDPR Arts. 15–22). Most of these work self-service today: signed-in users can file one-tap export and delete requests and withdraw marketing consentwith one tap in the panel's verification center — withdrawing is as easy as granting (GDPR Art. 7(3)), and every change is recorded in a versioned consent ledger. You can also write to support@goodnessbridge.org and complain to your supervisory authority (KVKK Kurumu in Türkiye; your national DPA in the EU).
10. Security
Row-level security, sealed identity tables, least-privilege access, encrypted transport, audit logs, and a breach-notification process consistent with KVKK/GDPR timelines.
11. Cookies & tracking
We set essential cookies for login (Supabase session) and two preference cookies — gb-locale (language) and gb-theme(appearance) — which store your choice and nothing else. Site measurement uses Vercel's cookieless, aggregate analytics (no cross-site identifiers, no advertising profiles), on the basis of legitimate interest. Affiliate links work without tracking cookies on our side: the outbound redirect carries a one-way hashed pseudonym in the SubID and no PII ever leaves the platform. We run no third-party advertising trackers.