Nasip Privacy Policy and Disclosure Notice

This notice explains how your personal data is processed when you use the Nasip app, in line with Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Data controller

Data controller: Tuval Studio (Istanbul). For any question or request: [email protected]

What we process

• Account: your name, date of birth (only to calculate your age), gender, your email address or the address and user ID provided by Apple when you sign in with Apple.
• Profile: what you're looking for, your neighbourhood (mahalle), your profile photos, your draw preferences (age range; gender preference only with your separate explicit consent).
• Content: the wishes (niyet) you hang and their extras (song, note, photo), your replies, your chat messages, your reports and blocks.
• Security: sign-in records (IP address and time), session data, a device token for notifications, app version.
• Purchases: the product, transaction number, date and subscription period. Your card and payment details stay with Apple and never reach us.
• Location: used once, on your phone, to find your neighbourhood. Your precise location is never sent to our servers or stored; only your neighbourhood is saved.

Why, and on what legal basis

• Creating your account, showing your profile, hanging wishes on trees, the draw, replies and chat: performance of a contract (KVKK Art. 5/2-c).
• Verifying purchases and granting your rights: performance of a contract (Art. 5/2-c).
• Sending notifications (replies, messages, announcements): performance of a contract (Art. 5/2-c). You can turn each one off in Settings.
• Security, preventing abuse, moderating content and reviewing reports: legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç).
• Keeping sign-in records: legal obligation under Law No. 5651 (Art. 5/2-ç).
• Protecting rights in a dispute: establishment, exercise or protection of a right (Art. 5/2-e).
• Using your gender preference in the draw filter: since it may reveal sexual orientation, only with your separate explicit consent (Art. 6). Without consent the filter includes everyone; you can withdraw consent by selecting all three options.

Who sees what

• Someone who draws your wish sees only your name, age, neighbourhood and what you're looking for.
• Your photos are visible only if you choose to share them in a wish and they have passed review.
• Chat messages are visible only to the person you matched with.
• Your date of birth, email and draw preferences are never shown to anyone.
• Photos awaiting approval and reported content are reviewed manually by the data controller. No face recognition or automated profiling is used.

Who we share data with

• Supabase Inc. (database, file storage and sign-in infrastructure): your data is stored in a data centre in Germany (Frankfurt, European Union). We are carrying out the standard contract procedure under Article 9 of KVKK for this transfer abroad.
• Apple Inc.: Sign in with Apple, delivering notifications to your phone, and in-app purchases. Notification texts never include your name or message content.
• Authorised public authorities: only where required by law.

We do not sell your data. There is no advertising or tracking in the app.

How long we keep it

• Account, profile and content: while your account is open. When you delete your account, your profile, photos, wishes, replies and messages are permanently deleted.
• Wishes: stay on the tree for 24 hours (48 hours with Premium), then fade and remain visible only to you.
• Sign-in records: for the period required by Law No. 5651, then deleted.
• Purchase records: deleted together with your account; payment records are kept by Apple under Apple's rules.

Your rights

Under Article 11 of KVKK you may:

• learn whether your personal data is processed and request information about it,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties in Turkey or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate, request deletion or destruction under Article 7, and request that these be notified to third parties,
• object to a result against you arising solely from automated analysis,
• claim compensation for damage caused by unlawful processing.

How to apply: You can get a copy of your data in the app (Profile > Settings > Download my data) and delete your account in the app (Profile > Settings > Delete my account). For other requests, write to [email protected] from the email address registered to your account. We reply free of charge within 30 days at the latest. If you are not satisfied, you can complain to the Turkish Personal Data Protection Board.

Age limit

Nasip is for people aged 18 and over. Accounts we learn belong to someone under 18 are closed and their data deleted.

Security

Connections are encrypted (TLS). On the server each user can access only their own data, and every write goes through server rules. Photos are kept in private storage and shown only to permitted people through time-limited links.

This website

nasip.tuval.studio uses no cookies or analytics. Our infrastructure provider Cloudflare may set a strictly necessary security cookie to protect the site from attacks.

Changes

When we update this notice we change the date above, and we announce important changes in the app.