Privacy Policy

Last updated: 11 October 2026

1. Data controller

SMARTIA OOD (СМАРТИЯ ООД) · Burgas, Bulgaria (EU). The data controller is established in Bulgaria (EU); the General Data Protection Regulation (GDPR, (EU) 2016/679) and the Bulgarian Personal Data Protection Act (ЗЗЛД) apply. Contact:

2. What data we process and why

Vote record — the brand you picked, the opposing brand, the time of the vote and the two-letter country code provided by the Vercel infrastructure (e.g. TR). Purpose: to calculate the ranking and to prevent the same pair being voted on twice. A vote is linked not directly to you but to a hash made with a server secret. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — keeping the vote fair.
SocialID account (only if you sign in) — your SocialID number and display name. Purpose: to tie your votes to your account rather than your device. Information in your SocialID account other than your display name (for example your email address) stays with SocialID and is not stored on this site. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Takedown request — the description you write, the brand concerned and (optionally) your email address. Purpose: to review a trademark/copyright complaint and reply to you if needed. Legal basis: legal obligation (GDPR Art. 6(1)(c); notice-and-action mechanism under Art. 16 of the EU Digital Services Act).

Your IP address is not stored in any table. No advertising ID is used, no data is passed to ad networks, your data is not sold, no profiling takes place and no automated decisions are made.

3. Cookies

bro_oy — a random ID set when you vote; 365 days. Only its hash, not the raw value, is kept in the database. Its only job is to stop the same pair being voted on twice.
sid_app_session — only if you sign in with SocialID; keeps you signed in, 30 days. A short-lived verification cookie is also used during sign-in for security: sid_oauth_state (10 minutes; deleted once sign-in completes).
bro_yas16 — only if you sign in: records that you confirmed you are 16 or older (signed, tied to your SocialID number); 1 year. Deleted when you sign out.

These cookies are strictly necessary for the service you ask for (voting, sign-in) to work; no tracking, analytics or advertising cookies are used. You can delete cookies in your browser; if the guest cookie is deleted, your earlier votes are no longer matched to your device.

On the website only, cookie-free aggregate visitor and speed measurement (Vercel Web Analytics and Speed Insights; details in the international transfers section below) is loaded only if you allow it in the banner at the bottom of the page; you can withdraw consent at any time via the "Cookie preferences" link. Your consent choice is stored in your browser's local storage.

4. Who we share data with

SocialID — our shared sign-in infrastructure; only if you sign in.
Neon — database hosting, Frankfurt (EU) region.
Vercel Inc. — hosting of the site. It is a US-based provider; a transfer outside the EU may occur while your request is processed.

Apart from these, no data is passed to third parties. If a legal obligation arises, only what is strictly required is given to the competent authority. Rankings and vote counts are published only in aggregate; who voted for what is never published.

SocialID — a separate controller

Sign-in is provided by SocialID. SocialID's controller is SOSYAL TURİZM BİLİŞİM REKLAM TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ, a separate, independent controller from Brandorama, established in Türkiye. Your SocialID account data such as e-mail, password and phone number is processed under SocialID's responsibility; for its infrastructure providers and the database region, see SocialID's privacy policy: www.socialid.me/gizlilik. Brandorama receives only your SocialID number and display name from SocialID.

SocialID keeps a record of which platforms you have signed in to (including Brandorama) until you delete your SocialID account; deleting your account inside Brandorama does not remove this record — you can delete it from SocialID's account deletion page: www.socialid.me/hesap/sil.

Even if you delete your SocialID account, SocialID keeps your identity and sign-in records (name, e-mail, phone, platform memberships, sign-in dates and IP addresses) in an encrypted, offline archive for 5 years for legal claims in case of fraud or crime (GDPR Art. 17(3)(e), Art. 6(1)(f)); this archive is accessed only upon a legal request or an order from an authority. Recent sign-ins are shown in the SocialID panel for 90 days.

International transfers

Our hosting provider, Vercel Inc. (United States), may process technical data such as your IP address when delivering the service. Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)) contained in the provider's data processing addendum: vercel.com/legal/dpa The providers below (all headquartered in the United States) also receive limited data when the relevant feature is used; for each, our basis for transfers outside the EEA is the European Commission's Standard Contractual Clauses in the provider's published data processing addendum (GDPR Art. 46(2)(c)):

Vercel Web Analytics and Speed Insights (Vercel Inc., United States) — visitor and page-speed measurement, web only: technical data such as the page visited, referring address, browser/device type, country and page load times is collected without setting cookies and turned into aggregate statistics. The legal basis is your consent (GDPR Art. 6(1)(a); ePrivacy Art. 5(3)): the tool is loaded only if you allow it in the banner at the bottom of the page, and you can withdraw consent at any time via the "Cookie preferences" link in the same place. The data may be transferred to the United States; the transfer mechanism is the European Commission's Standard Contractual Clauses in the provider's data processing addendum (GDPR Art. 46(2)(c)). vercel.com/legal/dpa

KVKK Art. 9 requires an adequacy decision or appropriate safeguards for transfers abroad; the standard contract announced by the Turkish Authority and the notification to the Authority fall within it. The hosting provider's (Vercel Inc., United States) published data processing addendum contains the EU standard contractual clauses (GDPR Art. 46(2)(c)); whether those clauses satisfy KVKK Art. 9 (the Authority's standard contract and notification duty) is subject to legal review. For users in the EU the basis is GDPR Art. 46.

Whether providing data is required

You are not legally obliged to provide personal data. The data requested to open an account and use features that require sign-in is necessary to enter into and perform the contract; if you do not provide it, you simply cannot use those features. Technical data sent by your browser or device when you view pages (e.g. your IP address) is necessary to deliver the service technically.

5. How long we keep data

Vote records are kept for as long as the service runs, because they are the basis of the ranking. Your account record is kept until you delete your account on the My account page; when it is deleted, your votes are not removed but are unlinked from you (the vote key is replaced with a random value). Takedown requests are kept for as long as needed to conclude the review and as evidence in a possible dispute.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, objection and data portability. Write to ; you will receive a reply within 30 days at the latest. A signed-in user's votes can be found by their account; guest votes, however, are kept under a hash that matches nobody and so cannot be singled out per person. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (КЗЛД).

Once signed in, you can download a copy of your data yourself with the download link on https://www.brandorama.app/hesap; the data linked to your account is delivered as a machine-readable JSON file (access, Art. 15; portability, Art. 20).

7. Children's data (GDPR Art. 8)

Brandorama is not offered to anyone under 16; this is our own minimum age of use (a product decision). On the age of digital consent, GDPR Art. 8 sets the EU-level default at 16; Member States may set a lower age in their own law, and Bulgaria, where the controller is established, has set it below 16 (ЗЗЛД Art. 25в). Because this service is not offered to anyone under 16, there is no parental-consent route and we do not knowingly collect personal data from anyone under 16.

If we learn that someone under 16 has opened an account, we delete the account and its data and do not collect extra data for that purpose. A parent or guardian who notices a child's account can write to us through our contact page; the request is handled without undue delay.

8. App (iOS)

This section covers the Brandorama iOS app on the App Store. None of the website processing described in sections 2–5 above takes place in the app: no vote record, no SocialID sign-in, no takedown request, no advertising or tracking cookies, no consent-based visit measurement, no IP address processing, no sharing and no retention. Sections 1 (data controller) and 6 (rights) apply to the app as well.

No data collected — the app does not connect to the internet; the brand list is built into the app. Your votes and preferences are not sent to us or to anyone else; we do not receive, store or share any personal data about you through the app.
No account — there is no sign-in screen, registration or user account; there is no advertising, visitor measurement or tracking library.
Data that stays on your device — your votes, the personal Elo ranking calculated from them, your language preference and, if you turn it on, the daily reminder setting (on/off and time) are kept only in the app's storage on this device (iOS UserDefaults); the display settings you choose in the header (colour theme, accent colour, text size) and the language stay in the app's web view storage (localStorage). Never sent anywhere: a functional cookie named locale also keeps the language choice inside the app. You can delete your votes on the My ranking screen in the app; deleting the app removes all of this data from the device. If device backup (e.g. iCloud) is on, this data may be included in that backup.
Daily reminder and share image (optional) — if you turn on the daily reminder, your phone asks for notification permission and a local notification is scheduled on this device at the time you choose; no push service is used and nothing is sent to us. When you tap “Share my ranking”, an image of your top 5 is created on the device, written temporarily to the app's cache folder and handed to the iOS share sheet; it goes only where you choose to send it.

9. Changes

If this text changes, the date at the top changes. If the types of data collected change, this page is updated at the same time.