Kafalama Privacy Notice

Version 1.0 - Effective date: [to be set at launch]

DRAFT FOR LEGAL REVIEW. Items in square brackets must be confirmed before publishing.

This notice explains how your personal data is processed when you use the Kafalama mobile app. It is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for users in the European Union, Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is [Full legal name], an individual based in Turkey.

Email: info@kafalama.com
Postal address: [to be confirmed with lawyer]

2. What we process and why

Data	Why we use it	Legal basis
Email address and password (stored only as a secure hash)	To create your account, sign you in and send important account messages	Performance of the contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b))
Display name, username, profile photo	To show who you are to other users	Performance of the contract
Location, bio and interests (all optional)	To complete your profile and help you discover events, only if you choose to add them	Performance of the contract
Date of birth	To confirm you are 18 or older. It is never shown on your profile	Performance of the contract
Language, appearance and privacy settings	To apply your choices	Performance of the contract
Events, join requests, questions, group memberships	To provide the core features of the app	Performance of the contract
Chat messages	To deliver group and event chats	Performance of the contract
Sign-in session data (stored only as a secure hash)	To keep you signed in safely	Performance of the contract; legitimate interest in security
Technical server logs (such as request time, address and result)	To keep the service secure, prevent abuse and fix errors	Legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); legal obligation where applicable (KVKK Art. 5(2)(ç))

We do not ask for your consent for any of the above, because none of it relies on consent. Using the app never depends on agreeing to optional processing.

We do not use advertising, tracking or analytics tools, we do not sell your data, and we do not make automated decisions that have legal or similarly significant effects on you.

The app does not currently access your device location, contacts, camera or photos. If a future feature needs any of these, the app will explain why and ask first, and you can say no and keep using the app.

3. How your data is collected

Your data is collected electronically through the app, from the information you enter and from your use of its features.

4. Who can see your data

Other users and visitors. Your display name, username, profile photo, location, bio, interests and (unless you turn it off in Settings) your recent event activity are public. [If anonymous profile access stays enabled: these can be viewed without signing in.]
Event participants. When you host or join an event, other participants can see that you take part. The exact event location is shown only to the host and to accepted participants.
Chat members. Messages you send in a chat are visible to the members of that chat.
Service providers (processors). Hetzner Online GmbH (Germany) hosts our servers. Google (Google Workspace) handles our email if you contact us. They process data only on our instructions.
Authorities. We share data with courts or public authorities only when the law requires it.

5. Transfers abroad

Our servers are located in Germany, and our email service is provided by Google. This means your data is transferred outside Turkey. These transfers rely on appropriate safeguards under KVKK Article 9, namely standard contracts notified to the Personal Data Protection Authority. [To be confirmed: standard contract status for each provider.]

6. How long we keep your data

Account and profile data: until you delete your account.
After you delete your account: your profile and account data are deleted. Upcoming events you host are canceled and groups you own are deleted. Messages you sent stay in their chats but show "Deleted user" instead of your name. [Backup purge period: to be confirmed, for example within 30 days.]
Sign-in session data: expires after at most 60 days.
Server logs: [retention period to be confirmed with lawyer, including any obligation under Law No. 5651].

7. Your rights

Under KVKK Article 11 you can:

learn whether your personal data is processed, and request information about it
learn the purpose of processing and whether data is used for that purpose
know the third parties in Turkey or abroad that receive your data
ask for incomplete or inaccurate data to be corrected
ask for your data to be deleted or destroyed under the conditions in KVKK Article 7
ask that third parties who received your data are told about a correction or deletion
object to a result against you that comes only from automated analysis
claim compensation if unlawful processing causes you harm

If you are in the EU, you also have the GDPR rights of access, rectification, erasure, restriction, data portability and objection, and the right to complain to your local data protection authority.

You can edit most of your data yourself in the app and delete your account in Settings. For any other request, email info@kafalama.com from the address registered to your account. We reply free of charge within 30 days. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

8. Age

Kafalama is only for people aged 18 or older. We do not knowingly process data of anyone younger. If you believe a minor has an account, contact us and we will delete it.

9. Security

Passwords and session data are stored only as secure hashes, and data is sent over encrypted connections. We limit access to personal data to what is needed to run the service.

10. Changes to this notice

If we change this notice, we will update the version and date above and show you the new version in the app before it applies to you.