KVKK Privacy Notice

Version 1.0 · Effective date: [EFFECTIVE DATE]

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), [COMPANY / DEVELOPER NAME] ("EMUFIT"), as data controller, processes your personal data as described below. The Turkish version of this notice prevails.

1. Data controller

[COMPANY / DEVELOPER NAME]

Address: [ADDRESS]

Email: [CONTACT EMAIL]

Registered e-mail (KEP): [KEP ADDRESS]

2. Categories of personal data

• Identity: Full name
• Contact: Email address, phone number (optional)
• Customer transactions: Membership tier, purchase and promo code records, usage and quota records
• Transaction security: Hashed password, session records, account status
• Visual records: Profile photo, food and nutrition label photos, files sent in chat
• Health data (special category): Height, weight, target weight, health conditions, meal and nutrition logs, sleep, step, appetite and workout data, data read from Apple Health / Health Connect, health information shared with a dietitian
• Other: Age, gender, fitness goals, EMUFIT Assistant questions, chat messages, reports, advertising ID

3. Purposes and legal grounds

• Creating your account, authentication, managing memberships and purchases: Performance of a contract (Art. 5/2-c)
• Information security, preventing abuse and inappropriate content: Legitimate interest (Art. 5/2-f)
• Legal retention and notification obligations, requests from authorities: Legal obligation (Art. 5/2-ç)
• Protecting rights in case of a dispute: Establishment, exercise or protection of a right (Art. 5/2-e)
• Calculating calorie and nutrient targets, food analysis, personalizing nutrition and workout plans, sleep and step tracking, dietitian counseling: Explicit consent for health data (Art. 6/2)
• Transfer to service providers' servers abroad: Explicit consent (Art. 9/1) and the other transfer mechanisms listed in Art. 9

Your health data is processed only on the basis of the separate explicit consent you give, and only for the purposes above.

4. Transfers of personal data

Your personal data may be transferred, limited to the purposes above, to:

• Hosting and infrastructure providers: Supabase (database, authentication, file storage)
• AI providers: OpenAI (food photo analysis, assistant answers), Google (product research with Gemini)
• Sign-in and payment providers: Google and Apple (account sign-in, store payments, Apple Health / Health Connect)
• Ad provider: Google AdMob (only when you watch a rewarded ad)
• Email provider: Resend (verification and password reset emails)
• Dietitians: your assigned dietitian, if you use the dietitian service
• Authorized public bodies: when required by law

These providers' servers may be located outside Türkiye, mainly in the European Union and the United States. International transfers are made under Article 9 of the KVKK, based on your explicit consent or on standard contracts announced by the Board.

Only barcode numbers and product names are sent to barcode databases and web search services (Open Food Facts, Camgöz, Serper); these contain no personal data.

5. Method of collection

Your personal data is collected electronically, by automated or partly automated means, through the sign-up form, in-app forms, camera and gallery, chat, Google and Apple sign-in, Apple Health / Health Connect (to the extent you allow) and your use of the App.

6. Retention

Your personal data is kept while your account is open. When you delete your account, the data is deleted or anonymized. Records that must be kept by law are destroyed at the end of the required period.

7. Your rights under Article 11 of the KVKK

By applying to the data controller, you may:

• Learn whether your personal data is processed,
• Request information about the processing,
• Learn the purpose of processing and whether data is used accordingly,
• Know the third parties in Türkiye or abroad to whom data is transferred,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction under the conditions in Article 7 of the KVKK,
• Request that corrections, deletions and destructions be notified to the third parties the data was transferred to,
• Object to an outcome against you that results solely from automated analysis,
• Claim compensation for damage caused by unlawful processing.

8. How to apply

Send your request, with information that verifies your identity, to [CONTACT EMAIL], by registered e-mail (KEP) to [KEP ADDRESS], or in writing to [ADDRESS]. Requests are resolved free of charge within 30 days at the latest, as required by the Communiqué on the Procedures and Principles of Application to the Data Controller.