KVKK Disclosure Notice
Under article 10 of Law No. 6698, this notice states activity by activity why your personal data is processed, which processing condition is relied on, and who it is transferred to. Data controller: Burak Altıntaş.
Identity of the data controller
The data controller for personal data processed on this platform is Burak Altıntaş, a natural person. Application and contact address: info@bosagezme.com
The controller is a natural person rather than a company. This does not narrow the scope of responsibility; all obligations under the Law apply.
Processing conditions, activity by activity
Each row names the processing condition actually relied on for that activity.
| Activity | Data | Purpose | Legal ground (KVKK) |
|---|---|---|---|
| Account creation and sign-in | Email address, non-public technical account identifier, display name | Creating the account and verifying identity | art. 5/2-c — necessary for the performance of a contract |
| Email one-time code | Email, hash of the code, hash of the request IP, attempt count | Sign-in security and abuse prevention | art. 5/2-f — legitimate interest (account security) |
| Google sign-in | Identifier and email provided by Google | Authentication | art. 5/2-c — performance of a contract |
| Session management | Hash of the refresh token, client type, device metadata | Maintaining the session and detecting stolen tokens | art. 5/2-f — legitimate interest (security) |
| Reviews, comments, likes, follows, favourites | The content you write and your interactions | Providing the core function of the service | art. 5/2-c — performance of a contract |
| Visit verification | Distance to the store and the accuracy your device reported (no coordinates stored) | Keeping reviews to people who genuinely visited | art. 5/2-c — performance of a contract |
| Search | Query text, coarsened coordinates, result and click records | Ordering results by distance and improving the service | art. 5/2-f — legitimate interest |
| Saved discovery location | Full-precision location, label, address | Not asking for a location on every search | art. 5/1 — explicit consent (you choose to save it) |
| Private profile details | Relationship status, children’s age ranges, housing status, occupation, age range, interests | Personalising recommendations | art. 5/1 — explicit consent (entirely optional) |
| Media upload | Images you upload and their technical metadata | Publishing your content | art. 5/2-c — performance of a contract |
| Visitor session | Anonymous session identifier | Browsing without signing in | art. 5/2-f — legitimate interest |
| Sending feedback | Your message and, if you ask for a reply, the email address you give | Improving the product and being able to answer you | Art. 5/2-f — legitimate interest (improving the product) |
| Security and operational logs | Request identifier, error and access logs | System security and legal obligations | art. 5/2-ç — legal obligation, and art. 5/2-f |
The two activities based on explicit consent (saved location and private profile details) are not a condition of using the service. You can use the platform without giving them, and you can withdraw consent at any time afterwards.
Method of collection
Data is collected electronically: directly from you when you create an account and use the platform, from the location your browser provides with your permission, and through Google Identity Services if you choose to sign in with Google.
Recipients and purpose of transfer
| Recipient | Data transferred | Purpose |
|---|---|---|
| Google Identity Services | Authentication data | Signing in with Google |
| Google (Gmail API) | Email address and message content | Delivering verification and notice emails |
| Cloud storage provider | Images you upload | Storing and serving images |
| OpenAI | Your search query text and language preference; the explanations you write in reviews | Interpreting what your search means; checking, before a review is published, whether it contains an insult, a threat, an accusation of a crime or personal data |
No location, user identifier or email address is sent to OpenAI. The only things sent are the search text you typed, your language preference and the explanations you write in reviews; review text is sent without anything that identifies you.
These services may operate servers outside Türkiye, in which case a transfer abroad under article 9 of the Law arises. The mechanism relied on for that transfer is under legal review.
No advertising network, analytics provider or marketing system is used on this platform. Your data is not transferred to third parties for those purposes.
Retention periods
| Data | Period |
|---|---|
| Search records | 365 days |
| Location within a search | Deleted after 30 days |
| Visitor sessions | 180 days |
| Email verification codes | 30 days |
| Session records | 30 days after expiry or revocation |
| Visit verifications | 30 days after expiry or use |
| Sent email records | 90 days |
Reviews, comments, favourites and images you upload are kept until you delete them or close your account.
Your rights under article 11
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose and whether it is used in accordance with that purpose
- To know the third parties to whom it is transferred, in Türkiye or abroad
- To request correction if it is incomplete or inaccurate
- To request erasure or destruction within the conditions of the Law
- To request that correction, erasure and destruction be notified to third parties it was transferred to
- To object to a result against you arising from analysis solely by automated systems
- To claim compensation for damage arising from unlawful processing
To exercise these rights, apply to info@bosagezme.com. The application methods and how the process works are set out on the KVKK application page.
Relevant legislation
The text of the Law is available at mevzuat.gov.tr, and Board decisions and guidance at kvkk.gov.tr.