KVKK & GDPR disclosure.

• Identity — name, surname, username, date of birth range (age gate only), avatar.
• Contact — email address, optional E.164 phone number, country and city.
• Customer transaction — subscription tier, invoices, Polar/Stripe customer ID (no card data).
• Professional & networking — headline, bio, role, expertise, projects, links, event intents, connections, encounters, notes.
• Communication — messages, group chat activity, message attachments, support tickets.
• Transaction security — IP address, session tokens, user-agent, device type, timestamps, security logs.
• Marketing preferences — cookie choices, notification opt-ins, language.
• Audio/visual — profile and banner images you upload; message attachments you share.

• Creating and maintaining your MeetWho account and profile.
• Delivering the core recommendation, messaging, scheduling and calendar features.
• Operating events, RSVPs, check-ins, guest lists and group chats.
• Processing subscriptions and invoicing via Polar/Stripe.
• Sending transactional notifications you have signed up for (introductions, requests, meeting reminders, support replies).
• Ensuring the security, integrity and continuity of the platform, and preventing fraud, abuse and unauthorised access.
• Complying with legal obligations (tax, accounting, lawful requests from authorities).
• Aggregated, non-identifying analytics to improve the product (Google Analytics 4, Hotjar) — only with your consent.

• Performance of the contract you enter into by creating an account and using paid features — KVKK 5(2)(c) / GDPR 6(1)(b).
• Compliance with a legal obligation to which the controller is subject — KVKK 5(2)(a) / GDPR 6(1)(c).
• Legitimate interests of the controller, provided your rights are not overridden — KVKK 5(2)(f) / GDPR 6(1)(f). We rely on this for security, fraud prevention, aggregated analytics and low-volume service communication.
• Explicit consent — KVKK 5(1) / GDPR 6(1)(a) — for optional cookies, browser/PWA push notifications, marketing emails, and any voluntary sensitive data.

Personal data is collected (i) directly from you when you register, complete onboarding, edit your profile, host or attend events, send messages or contact support; (ii) automatically from your device when you use the service (technical logs, cookies, push tokens); and (iii) from federated identity providers (Google, Apple) when you choose to sign in with them.

We share personal data with the following categories of recipients under contracts that require confidentiality and equivalent safeguards:

• Infrastructure processors: Supabase (managed Postgres, auth, storage, realtime) and Cloudflare (edge compute, CDN, WAF, DDoS protection).
• Email delivery: Resend.
• Push delivery: Google (FCM / Web Push) and Apple (APNs).
• Payments: Polar and Stripe.
• Federated sign-in: Google and Apple.
• Analytics & product research: Google Analytics 4 and Hotjar — only with your consent.
• Legal counsel: Genç Partners, where advice is necessary.
• Competent public authorities, only where required by law and to the minimum extent necessary.

International transfer. Certain processors are established outside Türkiye and the EU/EEA (including in the United States). Transfers rely on: (a) the KVKB explicit-consent regime under KVKK Art. 9(1) or the safeguards permitted under Art. 9(2); (b) EU Commission adequacy decisions where available; and (c) the EU Standard Contractual Clauses (2021/914) and, for UK data, the UK IDTA / Addendum.

• Account and profile data — while the account is active; erased or anonymised within 30 days of deletion.
• Messages — until you or your counterpart delete them, or until account deletion.
• Event data — six months after the event ends, then anonymised except where actively referenced.
• Support tickets — 24 months after resolution.
• Invoices and tax records — 10 years (Turkish Tax Procedure Law No. 213).
• Security and access logs — up to 12 months.
• Encrypted backups — up to 35 days residual copy, then rotated out.

You have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used consistently with that purpose;
• know the third parties, in Türkiye or abroad, to whom your data is transferred;
• request rectification of inaccurate or incomplete data;
• request erasure or destruction of your data under KVKK Art. 7 / GDPR Art. 17;
• request that any rectification, erasure or destruction be notified to third parties to whom the data was transferred;
• object to results generated solely by automated processing that produce a legal or similarly significant effect on you (MeetWho does not carry out such processing);
• claim compensation for damages arising from unlawful processing;
• withdraw any consent you have given, without affecting past lawful processing;
• lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr) or your competent EU/UK supervisory authority.

Submit your request in writing, in Turkish or English, together with information that lets us verify your identity:

• By email to privacy@meetwho.app from the email address associated with your account.
• By registered mail (iadeli taahhütlü) to: ROLF 360 Dijital Pazarlama ve Yazılım Ajansı Ltd. Şti., Levent, Karanfil Sokağı No:13, 34330 Beşiktaş / Istanbul, Türkiye.
• By KEP (Registered Electronic Mail) or notary channel, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

We respond within 30 days at no cost. If your request requires additional operational effort, we may charge the fee set by the KVKK Authority. See also the general Privacy Policy and Cookie Policy.

We update this notice when our processing changes materially. The current version is always available at meetwho.app/data-processing and its Turkish counterpart at meetwho.app/tr/kvkk.