Privacy Notice
Last updated:
This text is a draft; a legal advisor will review it before the app is released.
This notice explains which personal data the iyisimi app processes, why and how, under the Turkish Personal Data Protection Law No. 6698 (KVKK). You do not need an account to browse; an account is only needed to add places, write reviews and keep favorites.
1. Data controller
Data controller: Onur Arda Buldağ. You can reach us about anything concerning your personal data at destek@iyisimi.app.
2. Data we process
- Account data: your email address, your password (stored only as a one-way hash), your display name, your language preference and, if you add one, your profile photo.
- Your contributions: places you add, reviews and ratings you write, your favorites and the reports you send.
- Location: only if you allow it and while the app is open. It is rounded to about 100 metres before it is sent and is not stored. When you add a place, your location rounded to about 1 kilometre is used once to check that the place is in the country you are in, and is not stored. Location is never tracked in the background.
- Technical logs: connection logs kept by our infrastructure provider for security (for example IP address and request time).
- Moderation records: a log of administrative actions such as content removal or role changes. If you delete your account, only a number that cannot be linked to you remains in it.
- Business claims: if you apply to verify that you own a place, the business name, your contact email, your role in the business and the documents you upload (for example a tax certificate).
- Premium: whether you have premium, when it ends and the name of the plan you bought. Payment details (card etc.) are handled by Google Play; we never see them.
- Ads: users without premium see ads through Google AdMob. We request non-personalized ads only; AdMob processes data such as device information and IP address to show the ad, limit how often the same ad appears and prevent fraud.
- Not collected: phone numbers, birth dates, gender, contacts, location history. We build no interest profile for ads and do no analytics tracking.
3. Purposes and legal bases
- Creating your account, signing you in and showing your contributions: performance of the service contract (KVKK Art. 5/2-c).
- Showing places near you: at your request and to provide the service (KVKK Art. 5/2-c).
- Verifying business ownership and preventing false claims: at your request, to set up the contract (KVKK Art. 5/2-c), and legitimate interest (KVKK Art. 5/2-f).
- Managing your Premium subscription: performance of the contract (KVKK Art. 5/2-c).
- Funding the free version with ads: legitimate interest (KVKK Art. 5/2-f); where the law requires consent (for example in the EU), we ask for it first.
- Preventing fake reviews and abuse, handling reports, keeping the service secure and recording administrative actions: legitimate interest (KVKK Art. 5/2-f).
- Meeting legal obligations and answering competent authorities: legal obligation (KVKK Art. 5/2-ç).
4. Who can see it, who receives it
- Public: your display name, your reviews and the places you add are visible to everyone using the app. Your email address is never shown.
- Businesses cannot edit, hide or delete your reviews.
- Business claims: only our administrators see your documents and contact email. If your claim is approved, everyone sees only that the place is a "Verified business".
- Hosting: our data is hosted by Supabase on servers in the European Union (Frankfurt, Germany). This is a transfer abroad under KVKK Art. 9 and is made under the standard contract set by the Board.
- Email: account confirmation and password reset emails are sent through Brevo (Sendinblue SAS).
- Map: map images are downloaded from OpenFreeMap servers, which receive your IP address in the process; your location is not sent.
- Purchases: subscriptions are made through Google Play and verified through RevenueCat (USA). RevenueCat receives only your account number and your purchase record.
- Ads: Google AdMob (Google Ireland Ltd. / Google LLC), only for users without premium.
- Authorities: only when the law requires it.
5. How long we keep it
- Account data and contributions: as long as your account exists.
- When you delete your account, your profile, reviews, favorites, open reports and business claims, with their documents, are deleted at once. Places you added stay, because others use them too, but they are no longer linked to you.
- Business claim documents: 90 days after the claim is decided (approved, rejected or withdrawn). The claim itself, as long as your account exists.
- Earlier versions of reviews: 12 months.
- Decided reports: 24 months (the reporter is removed when their account is deleted).
- Record of administrative actions: 36 months.
- Backups: deleted data leaves the backups within 7 days.
6. Your rights
Under KVKK Art. 11 you may learn whether your data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know who it is shared with, ask for incomplete or wrong data to be corrected, for data to be deleted or destroyed and for this to be passed on to recipients, object to a result against you produced solely by automated analysis, and claim compensation for damage.
Send your request to destek@iyisimi.app; we answer free of charge within 30 days. You can also delete your account yourself in the app under Settings → Delete my account.
7. Minimum age
You must be at least 18 years old to create an account.
8. Changes
If we change this notice, we update the date above and announce important changes in the app.