Privacy Policy and KVKK Disclosure Notice

Last updated: 25 September 2026

This is an English translation provided for convenience. If it differs from the Turkish original, the Turkish version prevails.

1. Data controller

The data controller for personal data processed in the Yine Gel app and on yinegel.org is Cevdet Aslan (Pendik V.D. 0870214606), registered at Kurtköy Mah. Ankara Cad. Yelken Plaza No: 289 İç Kapı No: 21, Pendik / İstanbul. For any request: info@yinegel.org

2. What data do we process?

Account information

Your email address, your name and — if you have one — your profile photo. Our authentication is provided by Clerk; your password is not stored on our servers.

Location

When you receive a stamp, your phone's location is read to confirm that you are near the shop at that moment. This is the one mechanism that prevents stamp fraud. Your location is not stored as a trail; it is used at the moment of the check and is not written to the stamp record. Your location is never read while you are not using the app.

Stamp and reward records

Which shop you received stamps from, when and how many, which reward you used and when, and the badges you earned from them are recorded. This record is both your card and the shop's own ledger.

Notifications

If you allow notifications, your phone's notification key (push token) and device type are stored. Whether the messages in your in-app inbox have been read is recorded too.

Follow reward and link clicks

When you receive a bonus stamp for following a shop on social media, we record at which location and for which channel you received it. When you tap a shop's social media link in the app, we record which channel you tapped and when, and the shop can see this with your name. Taps on the Google review link are kept only as a count, without recording who made them.

Business owners and staff

At signup, business owners provide their full name, phone number, business type, optionally their gender and how they heard about us; for invoicing, their trade name, tax office and tax number (for a sole proprietorship this may be their Turkish ID number), trade registry number, billing address and billing email; and the delivery address the stamper kit is shipped to. Staff are recorded with the name the owner typed when inviting them and with their email address; QR actions a staff member performs are marked with their name.

Payment information

Subscription payments are made on PayTR's payment page. Your card details never reach our servers; we store only the result of the payment and the card reference PayTR provides for renewals.

Technical data collected automatically

Request logs contain standard technical data such as IP address and device/browser information. These are used for security and debugging.

3. Why do we process it?

To run your loyalty card and count your rewards correctly (performance of a contract).
To prevent stamp fraud (legitimate interest).
To give the shop aggregate statistics and a weekly summary about its own shop (legitimate interest).
To invoice and collect the subscription and ship the stamper kit (performance of a contract).
To meet legal retention and accounting obligations (legal obligation).
To transfer data to infrastructure providers abroad (your explicit consent — see section 4).
To send push notifications (if you allow them — you can turn them off at any time in your phone's notification settings).

4. Who do we share it with?

The shop where you receive stamps sees your card and stamp history at that shop. Shops cannot see each other's customers.

The providers we work with to deliver the service:

Clerk — authentication and account management.
Neon — database (PostgreSQL).
Vercel — application hosting and storage of shop logos.
Expo — delivering push notifications to your phone.
PayTR — subscription payments (businesses only).
Resend — emails to businesses (invitations, payments and the weekly summary).
Meta (WhatsApp) — the weekly summary message to business owners.
Google Places — when a business owner searches for their location; no customer data is sent.

The servers of every provider except PayTR are outside Turkey (mainly in the United States and the European Union), so your data is transferred abroad. This transfer is based on your explicit consent under Article 9 of KVKK (Turkey's Personal Data Protection Law No. 6698). You give that consent with a separate checkbox when you create your account, and the moment you give it is recorded on your account.

You can withdraw your consent at any time by writing to info@yinegel.org. Because the service cannot be provided without these providers, withdrawing consent results in your account being closed; transfers made before withdrawal are not affected. We do not sell, rent or pass on your personal data to anyone for advertising.

5. How long do we keep it?

Your data is kept for as long as your account is open. When you delete your account from the app's Profile screen, or by email as described on the Account Deletion page, your name, email address and notification keys are deleted; stamp and reward records stay in the shop's statistics in anonymized form, no longer linked to you. Invoice and payment records belonging to businesses are kept for the periods required by Turkey's Tax Procedure Law and Turkish Commercial Code.

6. Your rights under KVKK Article 11

You have the right to learn whether your personal data is processed; to request information about it if it is; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties in Turkey or abroad to whom it is transferred; to ask for it to be corrected if it is incomplete or wrong; to ask for it to be deleted or destroyed; to ask for those actions to be notified to the third parties it was transferred to; to object to an outcome against you that arises solely from analysis by automated systems; and to claim compensation if you suffer damage.

Send your requests from the email address registered to your account to info@yinegel.org, or in writing to our address above; they are answered within thirty days at the latest.

7. Children

This service is not designed for people under 18, and we do not knowingly collect data from children.

8. Changes

If we update this text we change the date above, and for material changes we notify you inside the app.