KVKK Notice (Personal Data)
Last updated: 18 August 2026
Note: This is a draft; data controller details must be filled in and reviewed by a lawyer. In case of any discrepancy, the Turkish version prevails.
Prepared as data controller under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).
1. Data controller
[Company name] · [Address] · Email: dk.cosar@gmail.com
2. Personal data processed
| Data | Why it is processed |
|---|---|
| Email address, name, profile picture link | Creating and identifying the account |
| Subscription and usage records | Tracking plan and monthly allowance |
| Payment transaction record (amount, date, reference) | Legal retention and accounting. Card details are not processed. |
| Search sentence | Answering the search. Not linked to identity. |
| Text extracted from photos (only if backup is on) | Restoring after a device change. Stored encrypted. |
| Advertising identifier | Showing ads on the free plan |
Your photos themselves are not processed or stored. On-device analysis does not constitute a data transfer under KVKK; the data does not leave your device.
3. Purposes and legal grounds
- Formation and performance of the contract (art. 5/2-c): account, subscription, allowance, payment.
- Legal obligation (art. 5/2-ç): retention of invoice and accounting records.
- Legitimate interest (art. 5/2-f): security, abuse prevention, service quality.
- Explicit consent (art. 5/1): AI processing and scan backup — both are off by default and you turn them on.
4. Transfers
Your personal data is shared, strictly as needed to provide the service, with the following providers:
- Supabase — database and authentication infrastructure
- Google — sign-in (Google Sign-In), advertising (AdMob), distribution (Play)
- OpenAI — only for AI operations you choose, and only the relevant content
- iyzico — payment processing (card details go directly to iyzico)
- RevenueCat — verification of store subscriptions
Some of these providers are located abroad; transfers are made under KVKK art. 9, based on your explicit consent or on the performance of the contract.
5. Retention periods
- Account data: until the account is deleted.
- Payment and invoice records: for the period required by applicable legislation (10 years under Turkish tax law).
- Scan backup: until you delete it; deleted automatically after two months of inactivity.
6. Your rights (KVKK art. 11)
You have the right to learn whether your personal data is processed, request information if it is, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction if incomplete or incorrect, request erasure or destruction, object to a result against you produced solely by automated analysis, and claim compensation if you suffer damage.
You can send your requests to dk.cosar@gmail.com; your application is concluded within 30 days. For account and data deletion, see the data deletion request page.