KVKK Disclosure

1. Data controller

This notice is prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (the “Law”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

Data controller: Upvera — Tuna Akgün (sole proprietorship)

Location: İstanbul, Türkiye · Contact: destek@upvera.co

2. Categories of personal data processed

• Identity: username, display name
• Contact: e-mail address
• Customer transactions: account activity, in-platform UPV transactions, backing records, subscription and purchase status
• Transaction security: password hash, two-factor key, session records, error and security logs, device and app version, notification token
• Visual records: profile image and content images you upload
• Other — user-generated data: posts, comments, notes, messages, behavior signals and the interest profile derived from them; data you authorize from connected third-party sources; your conversations with AI features

Special categories of personal data (health, biometrics, religion, political opinion, etc.) are not requested and not knowingly processed. No profiling for marketing purposes is performed today; if such processing is ever introduced, this notice is updated in advance and your explicit consent is obtained where required.

3. Purposes of processing

• Creating your membership, authenticating you and providing the service
• Operating content sharing, messaging, notification and interaction functions
• Running content recommendation and ranking functions
• Operating the in-platform economy, purchases and the evidence layer
• Ensuring information security; preventing abuse, spam and manipulation
• Detecting and fixing errors; resolving support requests and complaints
• Conducting activities in compliance with legislation and answering requests of competent authorities

4. Legal bases

Your personal data is processed on the following legal bases in Article 5 of the Law:

• Establishment or performance of a contract (Art. 5/2-c) — membership, content, messaging, notifications, recommendation and ranking, economy and purchase functions
• Legitimate interest of the data controller (Art. 5/2-f) — security, abuse detection, debugging and service improvement
• Compliance with a legal obligation (Art. 5/2-ç) — record retention and requests of competent authorities
• Establishment, exercise or protection of a right (Art. 5/2-e) — dispute and claim processes
• Explicit consent (Art. 5/1) — only in cases not covered above where your consent is separately requested

5. Method of collection

Personal data is collected electronically, by automated or partly automated means, through the mobile application, the website and the desktop client — from the information you enter directly and the records generated as you use the service. From third-party services you connect (for example GitHub), only the data you authorize is received.

6. Transfers

Your personal data is transferred, only to the extent the service requires, to the suppliers from which we receive hosting, database, authentication, file storage, e-mail delivery, push notification, error monitoring, purchase verification and AI services (the current supplier list is in Section 5 of the Privacy Policy). Data may also be transferred to competent public institutions where required by legislation.

Where suppliers’ servers are located abroad, transfers are carried out within the procedures set out in Article 9 of the Law (adequacy decisions, appropriate safeguards or the exceptions in that article).

7. Retention period

Personal data is kept for as long as your membership continues. When you delete your account, your data is permanently deleted; transaction records that must be kept for the integrity of the platform economy are retained in anonymized form with their link to you severed. Security and traffic logs, and records for which legislation prescribes longer periods, are kept for the applicable statutory periods.

8. Your rights (Article 11)

Under Article 11 of the Law, by applying to the data controller you have the right to:

• Learn whether your personal data is processed
• Request information if it has been processed
• Learn the purpose of processing and whether the data is used in line with that purpose
• Know the third parties to whom it is transferred, in Türkiye or abroad
• Request correction if it is incomplete or inaccurate
• Request deletion or destruction within the conditions set out in the Law
• Request that corrections, deletions and destructions be notified to third parties to whom the data was transferred
• Object to a result arising against you from analysis performed exclusively by automated systems
• Claim compensation if you suffer damage due to unlawful processing

9. How to apply

You can send your requests to destek@upvera.co; to verify your identity, you may be asked to apply from the e-mail address registered to your account. If you wish to apply in writing, the postal address is shared through the same channel. Applications are concluded free of charge within thirty days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

You can also carry out deletion yourself, without an application: Settings → Delete account.