1. Who are we?
The WeRoom mobile app, weroom.app website, and related services are provided by Loryana LLC, the controller responsible for your personal data for these services. Company address: 1209 MOUNTAIN ROAD PL NE, STE N, ALBUQUERQUE, NM 87110, New Mexico, USA. Contact hello@weroom.app for privacy and data-rights requests and legal@weroop.app for legal correspondence.
2. What data do we process?
- Account and profile: Phone number, name, username, profile photo and photo history, biography, an email address you choose to add, and verification information.
- Community and content: Follow relationships, club and event memberships, room participation information, messages, and shared photos, audio, and video.
- Live room data: Microphone and camera streams, recordings when room recording is enabled, transcripts created from speech, and moderation results.
- Device and security: IP address, a one-way hash of the device identifier, platform, device model, operating system and app version, session data, and security logs.
- Communications and notifications: Notification preferences, push-notification tokens, and your support requests.
- Contact matching: Only when you choose to continue, phone numbers are converted into one-way SHA-256 hashes on your device. Those hashes are sent to our server solely to return matching WeRoom accounts and are not retained. Contact names and plain phone numbers are never uploaded for this purpose.
3. Why do we use data, and on what legal basis?
| Purpose | Data | Legal basis |
|---|---|---|
| Create accounts, authenticate users, and provide the service | Phone, profile, session, and usage data | Entering into or performing a contract |
| Operate rooms, calls, messages, clubs, and events | Content, live room, participation, and communication data | Performance of a contract |
| Prevent fraud, abuse, and community violations | Device, IP, transcript, and moderation records | Legitimate interests, provided your fundamental rights and freedoms are not harmed; legal obligation where required |
| Enable camera, microphone, speech recognition, photo library, contacts, and notification features | Data accessed under the relevant permission | Performance of a contract where needed to provide the feature you request; explicit consent for optional access |
| Respond to legal requests and protect our rights | Account, content, and transaction records required by the request | Legal obligation; establishment, exercise, or protection of a legal right |
You can withdraw device permissions at any time in your device settings. The related feature may stop working when permission is withdrawn, but you can continue using core account features.
4. Automated moderation and speech transcripts
Conversations in live rooms may be transcribed for room previews and community safety. If profanity or severe abusive language is detected, the system may automatically ban the account. Room titles containing profanity or abusive language may be detected automatically and the room may be closed.
These processes may use speech transcripts, matched expressions, room and device information, and decision records. Automated systems can make mistakes. If you believe a decision is wrong, email hello@weroom.app with your username and a short explanation; your request will be reviewed by a person.
5. Who do we share data with?
We do not sell your data. We may share it only to the extent needed to provide the service with the following categories of recipients:
- Other users: Your profile, public rooms, club and event information, and content you choose to share.
- Infrastructure providers: Hosting and databases, live audio/video (LiveKit), file storage (Cloudflare R2), phone verification (Twilio), and notifications (Firebase/APNs).
- Moderation providers: Artificial intelligence services that review room titles for safety; only the limited content needed for the review is shared.
- Public authorities: Judicial and administrative authorities when disclosure is required by law.
Some service providers may be located outside Türkiye. When an international data transfer is necessary, we use the appropriate safeguards under Article 9 of Law No. 6698 and other applicable legal transfer mechanisms.
6. How long do we retain data?
We retain data for as long as needed to provide the relevant feature and fulfill the purposes described in this policy. You can deactivate your account from Profile details → Settings → “Deactivate Account”. Account data is permanently deleted within 90 days unless you reactivate the account. Signing in with the same phone number during that period reactivates the account and cancels account deletion.
This deactivation period is not the response deadline for statutory erasure or other data-rights requests. Those requests are separately assessed within applicable legal deadlines and conditions. Security, enforcement, transaction, or legal records may be retained only to the extent there is a valid legal basis. We consider other people’s rights and legal obligations; backup copies are removed through the normal deletion cycle.
7. Security
We apply appropriate technical and organizational measures, including transport security, access restrictions, secure session tokens, hashing of device information, and logging. No system can provide absolute security. To protect your account, never share your verification code with anyone.
8. Your rights under the KVKK
Under Article 11 of Law No. 6698, you have the right to:
- learn whether your personal data is processed and request information if it is,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties to whom data is transferred in Türkiye or abroad,
- request correction of incomplete or inaccurate data,
- request deletion or destruction when the legal requirements are met and ask that these actions be communicated to third parties to whom the data was transferred,
- object to a result produced exclusively through automated analysis when it is against your interests, and
- claim compensation if you suffer damage because of unlawful processing.
You can submit a request, together with information that helps us verify your identity, to hello@weroom.app. We respond within the period set by law and, as a rule, free of charge.
9. Children’s privacy
WeRoom is not intended for children who cannot provide valid consent on their own under applicable law. If you believe we have processed data belonging to such a child, please contact us so we can investigate and take the necessary deletion steps.
10. Changes and contact
We may update this policy when the service or applicable law changes. We will announce material changes in the app or through another appropriate channel. For questions, email hello@weroom.app.
11. Managing your information and requests
You can edit supported profile fields in the app, manage messaging and notification preferences in Settings, and control camera, microphone, contacts, and photo access in your phone permissions. Deactivating an account is different from uninstalling the app.
For access, copies, correction, or erasure, send a request identifying your account and what you need to hello@weroom.app. Account ownership may need verification; do not send sign-in codes. Applicable rights to appeal or contact a competent data protection authority remain available. Requests under Türkiye’s KVKK are assessed using the required procedure and within its maximum 30-day response period.
12. Public content, recordings, and personalization
Public profile, room, club, or sharing links may be visible to other users and people who open the link. Participants may record or take screenshots outside the app; we cannot fully prevent this technically. Recording and participation data in rooms with replay enabled may be processed according to access settings.
Follow relationships, club connections, app interactions, and usage such as searches may support content and people suggestions. Hiding a suggestion does not block that person. Section 4 explains moderation decisions and appeals.
13. Payment and support transactions
The website’s “Buy us a coffee” feature uses Stripe for payment processing. Transaction identifiers, amount, currency, and payment status may be processed to confirm completion and provide support. Enter card details on the payment provider’s screen; do not send card numbers or security codes in support messages.
14. Regional rights and official requests
Depending on your residence and applicable law, you may have rights of access, correction, erasure, restriction, portability, or objection. Their scope and exceptions depend on the relevant law. If a request cannot be made through ordinary app settings, you can still contact us.
Official requests are assessed for the authority, legal basis, and scope of the request. Only existing information that can lawfully be disclosed may be provided. User notification depends on legal restrictions and safety considerations. See Legal information for request procedures.