top of page

Privacy and Policy

1. Controller, representatives and scope
 Raviosoft OÜ is the controller of the personal data processed in TamNerede. This policy explains what data we collect and why, who we share it with, how long we keep it and what your rights are. It is also the information notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Scope. This policy applies to the TamNerede mobile app, the [tamnerede.app] website and our support channels. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act, KVKK, the UK GDPR, US federal and state privacy laws (for example COPPA and the California CCPA/CPRA) and the laws of the other countries where we operate.

What this policy does not cover. When an employer or organisation uses TamNerede to track its staff, the organisation is the controller of that data (see section 5) and its own privacy notice applies.

2. Personal data we collect
We collect only the data needed for the Service to work and the data of features you actively choose. Location data is TamNerede's core function and our most sensitive data category.

  • Identity and contact: Name, username, phone number, email, profile photo, language

  • Account and security: Password (hashed), session logs, two-factor authentication data

  • Precise location: GPS coordinates, speed, heading, accuracy, location history, frequently visited places

  • ​Safe Zones: Zone names (e.g. “Home”, “School”), coordinates, arrival and departure logs

  • Group information: ​Group members, roles, invitations, parent–child relationship

  • Emergency and crash detection: SOS logs, emergency contacts, accelerometer and gyroscope data, driving events (hard braking, acceleration), crash alerts

  • Optional health information: Blood type, allergies, medication you choose to add to your emergency card

  • ​Chat: Messages, photos, shared locations, read receipts

 

  • Device and technical data: Device model, operating system, app version, battery level, network type, IP address, crash logs, push tokens

 

  • Advertising identifiers: IDFA (iOS) / Advertising ID (Android), ad interactions

 

  • Usage data: Features used, screen views, session length

 

  • Subscription: Plan, purchase date, transaction ID, country (not card details)

 

  • Business accounts: Organisation name, employee role, working-hours settings


What we do not collect. We do not upload your entire address book to our servers; when you invite someone, only the number you select is used. The microphone, camera and photos are accessed only when you use that feature. We do not process your card details.

Information you give us about others. When you enter other people's details as emergency contacts or invitees, you should let them know.

3. Purposes and legal bases
Every processing activity is tied to a specific purpose and legal basis. Where processing relies on consent, you can withdraw it at any time in the app settings; withdrawal does not affect the lawfulness of earlier processing.

Automated decision-making. Crash detection runs on an algorithm, but it only sends an alert to your Groupand has no legal or similarly significant effect on you. We do not carry out automated decision-making within the meaning of GDPR Art. 22, and we do not produce insurance scores from driving behaviour.

4. Children's personal data
We process children's data only through Child Accounts created or approved by a parent or legal guardian, and with that parent's consent. If we learn that data was collected from a child without parental consent, we delete it promptly.

Obtaining parental consent. When a Child Account is created, we verify the parent's identity and authority through [verification method, e.g. a small store transaction, identity verification or the Apple/Google family group]. For children under 13 in the US, this is verifiable parental consent under COPPA.

Data we collect from children. Name or nickname, age range, device location, Safe Zone logs, SOS logs, battery level and chat messages with Circle members approved by the parent. We do not ask children for an email address or phone number; where one is necessary, we obtain it only with the parent's approval.

Extra protections for children's data

  • Child Accounts are never shown ads; no advertising ID is collected and no profiling or behavioural analysis is carried out.

  • Children's data is never sold or shared with third parties for marketing.

  • Crash detection and driving events are off by default in Child Accounts.

  • The child's device shows an indicator, which cannot be hidden, that location sharing is on.

  • Child Account location history is kept for no longer than [30] days.
     

Parental rights. A parent can view, correct and export their child's data, ask for it to be deleted or for processing to stop, and withdraw consent at any time. Use the Child Account settings in the app or write to [privacy@tamnerede.app]. Children also have rights over their own data and may exercise them directly as their maturity allows.

5. Team tracking: the employer is the controller, Raviosoft is the processor
When a company or organisation uses TamNerede to manage its team's location, that organisation is the controller of employee data. Raviosoft OÜ processes that data only on the organisation's instructions and under our Data Processing Agreement (GDPR Art. 28).
 

  • What is processed: location during working hours, arrivals and departures at work Safe Zones, team messages, SOS logs and the working-hours settings defined by the organisation.

  • What is not processed: location outside working hours and during leave (where the organisation uses this feature), and the employee's personal Family Circle data. Personal and work Circles are technically separate; the employer cannot see your family data.

  • Transparency: employees can always see in the app when location sharing is on.

  • Your rights: send requests about your work account data to your employer. We forward requests we receive to the organisation without delay and give it technical support to respond.

  • Our own processing: for business accounts, Raviosoft OÜ acts as controller only for billing, service security, abuse prevention and aggregated, anonymous statistics used to improve the Service.
     

6. Who we share your data with
We do not sell your location data. We do not sell, rent or share your precise location, location history or driving data with data brokers, ad networks, insurers or any other third party for that purpose.

7. International transfers
Your data is stored mainly on servers in the European Union [e.g. Frankfurt, Germany]. Some of our service providers may process data outside the EU, in particular in the US.
For users in the EU/EEA and UK. We transfer data outside the EU/EEA only under one of the following safeguards:
 

  • An adequacy decision of the European Commission (for example US companies certified under the EU–US Data Privacy Framework)

  • The European Commission's Standard Contractual Clauses (SCCs)and, for the UK, the International Data Transfer Addendum, with a transfer impact assessment and supplementary technical measures (for example encryption) where needed.
     

For users in Türkiye (KVKK Art. 9). Because Raviosoft OÜ is established in Estonia, the data of users in Türkiye is processed abroad. For these transfers we rely on the following, in order:

  1. Transfer to countries covered by an adequacy decision of the Turkish Personal Data Protection Board

  2. Where there is no adequacy decision, signing the standard contracts published by the Board and notifying the Personal Data Protection Authority within five business days of signature

  3. Where neither is possible, and only for occasional (non-regular) transfers, the exceptions listed in the Law, such as your explicit consent
     

Other countries. Data of users in other countries is also processed on EU servers and receives the level of protection described in this policy. You can ask for a copy of the safeguards we use at [support@raviosoft.com].

8. Retention periods
We keep data only as long as needed for its purpose and then delete it automatically or irreversibly anonymise it. Deleted data is removed from backups within [35] days at the latest.

9. Your rights
You can exercise most of your rights directly in the app: under “Settings > Privacy” you can download your data, delete your location history, manage your consents and close your account. For other requests write to [privacy@tamnerede.app]. We may need to verify your identity before responding.

EU/EEA and UK (GDPR)
You have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest and withdrawal of consent. We respond within one month; for complex requests this may be extended by two further months, and we will tell you.

Türkiye (KVKK Art. 11)
You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether data is used in line with it; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under Article 7 and notification of these actions to third parties; to object to an outcome against you arising from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing.
You can submit your application under the Communiqué on the Procedures and Principles of Application to the Data Controller in writing to [address], by registered electronic mail (KEP) to [KEP address], or from the email address registered with us to [support@raviosoft.com]. We conclude requests free of charge within 30 days at the latest.

US states (California CCPA/CPRA, Virginia, Colorado, Connecticut, Texas and similar laws)

  • You have the right to know about and access, correct and delete the personal information we collect.

  • Sale and sharing: we do not sell your personal information for money. Sharing advertising IDs with ad networks for personalised ads may count as “sharing” or “targeted advertising” under some state laws. You can opt out using the “Do Not Sell or Share My Information” option in the app; we also honour Global Privacy Control (GPC) signals as an opt-out.

  • Sensitive personal information: we use precise geolocation only to provide the Service; we do not use it for profiling or advertising.

  • We will not discriminate against you for exercising your rights. If we deny your request you can appeal, and you can contact your state attorney general about the outcome of the appeal.

  • You may also submit requests through an authorised agent.
     

Other countries. Users in Brazil (LGPD), Canada, Switzerland and other countries can exercise the rights granted by their local law through the same channels.

Stopping location access. You can turn off location sharing at any time in the app or in your device settings. Your Circle members will then see that your last location is out of date, and Safe Zone and crash detection features will not work.

10. Cookie Policy: cookies, SDKs and advertising identifiers
We use cookies on our website and, in the mobile app, software development kits (SDKs), local storage and device identifiers that serve a similar function. All technologies other than strictly necessary ones run only after you consent on the permissions screen shown at first launch.

Managing your consent

  • In the app: turn each category on or off under “Settings > Privacy > Ads and analytics preferences”.

  • EU/EEA and UK: we collect consent through an IAB TCF-compliant consent management platform (CMP) [e.g. Google UMP].

  • iOS: withdraw permission under “Settings > Privacy & Security > Tracking”.

  • Android: delete or reset your advertising ID under “Settings > Privacy > Ads”.

  • Web: use the “Cookie preferences” link at the bottom of the site or your browser settings. GPC signals are supported.
     

In Child Accounts, analytics, advertising and marketing attribution SDKs are disabled; only strictly necessary technologies and crash reporting run. 

11. Changes, contact and the right to complain
Changes. We update this policy when needed. We announce material changes by in-app notice and email before they take effect. If a new purpose requires consent, we will ask for it separately. 

Contact us

Right to complain. We ask that you contact us first; we will do our best to resolve your concern. You can, however, complain to a supervisory authority at any time:

  • Estonia (our lead authority): Andmekaitse Inspektsioon (Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia — aki.ee, info@aki.ee

  • Other EU/EEA countries: the data protection authority of the country where you live, work or where the infringement took place

  • Türkiye: Personal Data Protection Board — kvkk.gov.tr. Under KVKK Art. 14 you must apply to us first; if your application is rejected, you find the answer insufficient or you receive no answer within 30 days, you can complain to the Board within 30 days of learning of our answer and in any case within 60 days of your application.

  • United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk

  • US: your state attorney general or the Federal Trade Commission (FTC)

bottom of page