Privacy notice

Who we are

MeetUp Business Club is an invitation-only business network with a members' lounge in Istanbul. The data controller is MeetUp Business Club, ⁨SKYLAND B BLOK — Giriş katı, Huzur, Azerbaycan Cd. No:4, 34415 Sarıyer/İstanbul⁩. For any privacy question, write to ⁨privacy@meetupbusinessclub.com⁩.

The club's Turkish company registration is not yet complete; once it is, the registered trade name and address will be published in a new version of this notice. We are not subject to VERBİS registration. The legal detail is in the KVKK disclosure notice.

What we collect

We process only what the service needs:

• Identity: full name, title, preferred language and, if you add one, a profile photo.
• Contact: mobile number and email address. They are stored apart from your profile and are not shown to other members.
• Company: the companies you work with, your role, city and country.
• Needs and offers: what you are looking for, what you can offer and the topics you choose.
• Event attendance: registrations, invitations and QR check-ins at events and the lounge.
• Membership application: what you write on the application form and the invitation that brought you.
• Account and security: how you sign in (phone code or Google), sign-in codes and an append-only audit record of sensitive actions.
• Premises security: lounge entry and exit records and lounge closed-circuit television (CCTV) footage.

Where it comes from

From you, through the application form, your profile and your settings. From the member who invited you, who confirms that they know you. From business cards and event lists that staff import: every imported person must have a recorded legal basis, otherwise the import is refused. From the public forms on the site, such as the lounge visit form, from paper forms and face-to-face conversations at the lounge, and by post and courier. And from the AI-assisted processing described below.

A member on a paid tier may also have recorded your name and your business field as one of their own relationships. Only that member and system management can see it; it is never shown to you or to any other member, and recommendations built from it never name you. It is erased on your request.

Contact details only after mutual consent

Another member never sees your phone number or email until both of you accept an introduction. Until then, conversation stays inside the platform. No report, export or API response bypasses this rule.

Staff can read contact details only through a dedicated path: every read is written to the audit log with who read whose record and when, and the number of reads per hour is limited.

Check-in by QR code only, no biometrics

Entry to events and the lounge uses a short-lived QR code shown in the member app. It is valid for about 90 seconds and for a single entry. We do not collect fingerprints, face scans or any other biometric data.

The lounge has cameras, and entry has no biometrics

The Istanbul lounge is monitored by closed-circuit television (CCTV) for the security of the premises. Footage is kept for at most 30 days and is then overwritten; only staff with security and lounge-management rights can reach it, and camera footage is never used for matchmaking, scoring or marketing in any form.

No face recognition or any other biometric data is produced from the footage. Attendance is recorded by QR code only, and that rule stands independently of the cameras. A camera notice is also displayed at the lounge entrance.

AI-derived information

Some information is produced by an AI model: reading an uploaded business card, summarising a company's public information, explaining a match suggestion, translating chat messages, and — only with your separate consent — your CV, voice message, its transcript and your intake answers. The processor is Google (Gemini API) or Anthropic (Claude API) — whichever is active in the system settings — and both process outside Türkiye; voice is kept only until it is transcribed, and no biometric data is produced or stored. The full account is in the AI processing text.

AI-derived information is stored with its origin, shown separately under the label “Public inference” and never mixed with information you or staff have confirmed. Behavioural flags proposed by AI have no effect until a staff member reviews them. Membership decisions and introductions are approved by people, not by the model.

Marketing messages only with your opt-in

Transactional messages such as sign-in codes, bookings, invitations you asked for and security notices are always sent. News and offers are sent only on the channels you turn on in the member app settings, and every channel is off by default. Turning a channel off applies immediately, including to messages already waiting to be sent, and every change is recorded.

Why we process it

Consent is recorded, not assumed. When an invitation is accepted, the legal basis is stored together with the name of the member who introduced you. Each bulk import stores a legal basis for every person. Every marketing opt-in and opt-out is stored with its time.

• Reviewing applications and running your membership (performance of a contract).
• Making introductions and matching you with relevant members, tables and events (legitimate interest, and your consent where required).
• Running events and the lounge, security and preventing misuse (legitimate interest and legal obligations).
• Sending news and offers (your explicit consent).
• Meeting legal obligations and answering competent authorities.

Who we share it with

We do not sell personal data. We share it only with providers that run the service for us, and only as far as each task requires:

• Database, storage and sign-in: Supabase, hosted in Frankfurt, Germany (EU).
• AI processing: Google (Gemini API) or Anthropic (Claude API), both outside Türkiye — for card reading, company summaries, match explanations and translation. Which one is active is recorded in the system’s AI settings, and no processing happens until a key is configured.
• Sign-in codes and messages: Brevo (France, EU) for email and UltraMsg for WhatsApp. No SMS provider has been chosen yet, and until one is, no SMS is sent.
• Google, only if you choose to sign in with Google.
• Service partners (advisors) see only the brief of a session you requested. They do not see your contact details or the member pool.
• Our independent auditor, tax adviser and lawyers: only as far as meeting legal obligations and defending our rights requires.

Transfers outside Türkiye

Our database is in the European Union, in Frankfurt. AI processing happens in the United States, and the email and WhatsApp services are outside Türkiye as well. These transfers are made under article 9 of the KVKK; the full list of recipients and the basis for each is in the cross-border transfer text.

How long we keep it

• Sign-in codes: at most 24 hours.
• Check-in QR codes: about 90 seconds; a used code cannot be used again.
• Lounge CCTV footage: at most 30 days, then overwritten.
• In-app notifications: 90 days after they are read, 365 days if unread.
• Raw contact details from public forms: erased once linked to your record, or after 90 days at the latest.
• Profile, company, needs and attendance: for the duration of membership and 10 years after it ends (article 146 of the Turkish Code of Obligations).
• Audit log: 10 years. Append-only; nobody can edit or delete it.
• Financial records: 10 years (article 82 of the Turkish Commercial Code).

Your rights

You can ask whether we process your data, get a copy, have it corrected or erased, object to processing and more. The full list under article 11 of KVKK is in the KVKK disclosure. Write to ⁨privacy@meetupbusinessclub.com⁩; we reply within 30 days at the latest.

In the member app you can already turn marketing channels on or off yourself, under Settings.

How we protect it

Access rules are enforced inside the database itself, not only in the app. Members read only their own data and what mutual consent has opened. Staff access is limited by role and branch, and sensitive reads are logged.

Changes to this notice

The version of this notice in force and its effective date are written in the version bar at the top of this page, and every earlier version stays in the version history. A published version is never altered: a correction means a new version. We announce material changes in the app, and if a change asks something of you, it reaches you both as a notification and as a dialog in front of you.

Event registration

To register you for an event we collect your name, company, role, city, working languages, the need you state and one contact detail for verification. The raw contact detail is erased once it is linked to your record or when it expires.

If another company runs the event, your details reach them only with your explicit consent; without it they see only the number of attendees. If the organiser is outside Türkiye, that sharing is also an article 9 cross-border transfer. The full terms are in the event registration terms.

Corporate membership and payment

In a corporate membership the account manager sees the seat list, the status of invitations and credit usage — not a colleague's profile, messages, introductions or confidential needs. The invited email address is never shown to the account manager either.

Payment runs through the Trawili gateway and your card or account number never reaches us; we keep only the order number, amount, currency and status. Financial records are kept for ten years, as Turkish law requires.

The more detailed texts

This page is the overview. There is also a separate text for each subject: explicit consent, AI processing, cross-border transfer, the data-retention schedule, your rights, event registration terms, corporate membership terms, payment terms and marketing consent. They are listed in the side column of this page.