Little data, short time, clear reasons.

01

Controller

The controller is the company that runs the RichlyMe club. For any privacy question: door@richlyme.com. We apply Türkiye’s KVKK, the EU GDPR and the UAE data protection law together; where they differ, we follow the most protective.

02

Our promise, in short

Six things we hold to:

1. 01Your proof appears 24 hours later and at city level only; your exact location is never shown.
2. 02Nothing is shared publicly. Appearing in the List needs your separate consent.
3. 03We delete the raw location and the original photo 30 days after the decision.
4. 04We do not keep your ID document or liveness selfie; only the verification provider holds them, briefly.
5. 05We do not sell your data, use it for advertising or share it with brands.
6. 06Your messages are end-to-end encrypted; we cannot read them. We do know who talked to whom and when. Support conversations are not encrypted.

03

What we collect and why

Each item has a purpose and a legal basis:

1. 01Application (name, phone, email, city, profession, social link, “why you”, invitation code): committee review; entering into a contract.
2. 02Identity verification (document and liveness at the provider; with us only the result, age threshold, nationality and date): identity and “one person, one account”; explicit consent for biometrics.
3. 03Sanctions and reputation screening result: legal compliance and the safety of the club.
4. 04Profile and membership (display name, city, tier, sponsor, purchase record): providing the service and tax obligations.
5. 05Proof (photo, video, location, time, device integrity, receipt or boarding pass): verifying challenges and preventing fraud.
6. 06Health challenges (only a yes/no such as “appointment booked”): optional, with explicit consent.
7. 07Safety (reports, blocks, audit log, screenshot attempts): protection against harassment, leaks and fraud.
8. 08Technical (error logs, usage measurement with a random ID, notification token): keeping the service running.

04

What we do not collect

Proof of wealth, card details (they stay with Apple), your contacts, background location, face-recognition templates and medical documents.

05

Automated decisions and age

Low-risk everyday proofs may be approved by an AI-assisted system. Refusals, fraud decisions and all sanctions are made by people; you can challenge an automated decision and ask for human review. The app is closed to anyone under 18; the minimum age to apply to the club is 21, confirmed by identity verification.

06

Who we share with

Only with providers who help us run the service, and only what they need: hosting and database (Supabase, EU – Frankfurt), purchases and notifications (Apple, RevenueCat), the identity verification and screening provider, image analysis of proofs (no location or metadata; nothing kept, nothing used for training), website hosting, error logging and usage measurement (stripped of personal data), maps, SMS and email. Concierge partners handle what a booking needs under their own responsibility. Brand partners only ever receive anonymous totals.

07

International transfers

Your data is held mainly in the EU; transfers go to providers in the United States (Apple, RevenueCat). For members in Türkiye, regular transfers use the standard contract of the Personal Data Protection Board and are not based on consent. For members in the EU, EU standard contractual clauses or the EU–US Data Privacy Framework apply; for members in the UAE, the transfer rules of local law.

08

How long we keep it

An automatic job runs every night to delete what is due, including stored files.

1. 01Refused application: 12 months. A waitlisted file is reconsidered after six months.
2. 02ID document and liveness selfie: only at the verification provider, at most 30 days.
3. 03Raw location, original photo and metadata: 30 days after the decision; then only a city-level verification summary remains.
4. 04Evidence in a fraud or complaint case: until the case closes, at most a few years; kept even if the account is deleted.
5. 05Published copy of a proof: for the length of the membership; after it ends, 12 months in a hidden archive, then deleted.
6. 06Payment records: for the legal retention period.

09

Deleting your account

In the app: Settings → Your data → Delete account, or on the account deletion page of this website. The account closes at once, can be restored for 30 days and is then deleted for good. Your profile, proofs and files are deleted; records that are part of other people’s experience remain as “deleted member”; payment records, open fraud or complaint cases and expulsion records stay locked for the legal period. To prevent re-application, only an irreversible fingerprint of the email, phone and document number is kept.

10

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, to portability, to challenge automated decisions and to withdraw consent at any time (KVKK art. 11, GDPR arts. 15–22). In the app: Settings → Request my data, or door@richlyme.com. We reply within 30 days at the latest. You may also complain to the competent data protection authority.

11

Security

Proof originals sit in a separate store that only the verification service can read. The published copy is rebuilt without metadata; image links are short-lived and carry an invisible mark for each viewer. Reviewers see only the proofs assigned to them; raw coordinates open only with a second manager’s approval, and every access is logged. Lock-screen notifications carry no content by default. In a data breach we notify the authority within 72 hours and tell affected members without delay.

12

Cookies

The website uses no advertising or tracking cookies. There is one necessary cookie that remembers your language.

13

Authorities and changes

We answer only requests based on a valid legal order, as narrowly as possible, and tell you unless we are forbidden to. We announce material changes in the app at least 30 days in advance.