Your personal data is processed by Yunus Emre Tugay, acting as data controller, within the scope of the Cala mobile application (formerly known as Kıyı Rehberi) (the "App") as explained below. Contact: emre@pimrobotics.com
| Data Category | Purpose of Processing | Legal Basis (KVKK Art. 5) |
|---|---|---|
| Identity and contact (name/display name, derived from your e-mail address if not provided; e-mail) | Account creation, authentication, storing favorites, communicating with you | Establishment and performance of a contract (Art. 5/2-c) |
| Location (momentary; approximate location when submitting a report) | Showing nearby beaches, distance calculation and personalized ranking; location verification of crowd reports | Explicit consent (device location permission; Art. 5/1); if you do not grant permission you can continue to use the App by selecting a region |
| Transaction security (device identifier, password hash, session data, registration timestamps) | Prevention of abuse (submission frequency limits), security and stability of the service. Crowd reports are not displayed together with your identity; as the device identifier is also used in account-linked features such as notification registration, it may be matched to your account on the server side | Legitimate interest (Art. 5/2-f) |
| Reviews and public profile (rating, review text, review photos, display name, username, profile photo, "about" text, contribution badges, likes, optional favorites sharing) | Providing the community feature; pre-moderation of content and, if approved, public publication within the App together with your public profile information; calculation of like and badge counters | Explicit consent (your submitting the content for publication; Art. 5/1) and the data having been made public by the data subject (Art. 5/2-d) |
| Notification data (notification token, device identifier, app language, time zone) | Sending the notifications you have allowed | Explicit consent (device notification permission; Art. 5/1); the record is deactivated when permission is revoked |
| Usage events (random device identifier, predefined event name, source screen, app version; no user identity) | Measuring how the App is used and product improvement; measuring the number of devices currently online using an irreversible digest of the device identifier, without keeping records | Legitimate interest (Art. 5/2-f); the records contain no identity data and are deleted after 90 days |
| User content (cove suggestions: name, location, description, photos; reward record) | Evaluation of the suggestion; private storage before approval, public publication within the App after approval; management of the contribution reward | Explicit consent (approval at the time of submission; Art. 5/1) |
| Business and change requests (name-surname, e-mail, phone — optional, request note, related cove) | Evaluation of the request and getting back to you | Legitimate interest (Art. 5/2-f); processing is based on this purpose as you submitted the request to us via the form |
| Customer transaction (subscription/purchase status) | Management of Premium access rights | Performance of a contract (Art. 5/2-c) |
Your payment card details are not processed by us; payments are handled by Apple.
Your data is transferred to service providers whose servers are located abroad (Supabase, RevenueCat, Apple, Resend) for the provision of hosting, authentication, subscription management, notification delivery and e-mail delivery services. Your user account identifier (user ID) is sent to RevenueCat so that your subscription status can be matched to your account. If you have granted notification permission, your notification token is processed through Apple's notification infrastructure (APNs) for the delivery of notifications. Your e-mail address and name are sent to our e-mail delivery provider Resend so that you can be e-mailed in cases such as the approval of your cove suggestion.
International transfers are carried out under KVKK Article 9: as no adequacy decision has been issued by the Turkish Personal Data Protection Board for the countries where these service providers are located, the transfer relies on the explicit consent obtained during sign-up. Data processed in flows that do not require an account (crowd reports, business/change requests) is either processed without directly identifying information (crowd reports; as explained above, indirect matching via the device identifier is possible on the server side) or transferred to these servers on the basis of the explicit consent you gave by submitting the relevant form. If you do not give explicit consent, features requiring an account cannot be used; you may continue to benefit from the parts of the App that can be used without an account.
Your personal data is collected by automated means during the sign-up and usage processes of the App, within the scope of the permissions granted by your device (location service, notification permission, photo library access) and through notifications received from purchase infrastructures.
Your data is retained for the period required by the processing purposes and the limitation periods stipulated in the applicable legislation; at the end of the period it is deleted, destroyed or anonymized. Retention conditions by data type:
| Data Type | When You Delete Your Account | Retention Period |
|---|---|---|
| Profile (identity, contact, consent record) | Deleted | As long as the account is active |
| Favorites | Deleted | As long as the account is active |
| Cove suggestions and photos | Published suggestions may remain as guide content; removed upon request | As long as published; deleted upon request (unpublished suggestions are deleted after evaluation or when the account is deleted) |
| Business and change requests | Not affected if not linked to an account; deleted upon request | At most 1 year after the request is concluded |
| Crowd reports (not linked to an account; contain a device identifier) | Not affected; report content is not displayed together with your identity | Deleted after 90 days |
| Reviews (rating, review text, photos) and likes | Deleted entirely (including published ones) | Until you delete them or your account is deleted |
| Public profile (display name, username, profile photo, about, favorites sharing preference) | Deleted | As long as the account is active |
| Notification data (notification token, device identifier, language, time zone) | Deleted | Deactivated when permission is revoked; deleted when the account is deleted |
| Usage events (random device identifier, event name, app version) | Not affected; contain no user identity | Deleted after 90 days (the installation record is retained for statistical purposes; it contains no identity information) |
| Purchase records (subscription status) | Deleted with the profile record; Apple/RevenueCat records are subject to their own policies | Deleted with the profile on the App side; payment/invoice records are retained by Apple for the periods required by the applicable financial legislation |
You can submit requests regarding your rights, in accordance with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller, through the following methods:
Your application is concluded free of charge within 30 days at the latest, depending on its nature.