Privacy notice (KVKK)

2.Personal data we process

Identity and contact: your full name, username, e-mail address, profile photo, short bio and the neighbourhood you choose.

Account and transaction security: an irreversible hash of your password, your two-step verification secret (encrypted), session information (device and browser name, IP address, date and time) and, if you signed in with Google or Apple, that account’s ID and e-mail address. For business verification, an SMS or a voice call goes to the number already listed for the place, or a code is sent to an address on the place’s website domain; only a hash of the number and of the code is kept. That message is not a commercial message and is not used to collect marketing consent.

Traffic data: the IP address, date and time, account and type of action for sign-ins, session renewals and actions that create, change or delete content (required by Law No. 5651).

User content: check-ins, reviews, ratings, photos, replies to reviews, lists, messages and meet-up plans.

Location: when you check in and only if you allow it, to verify your visit; your exact location is not stored with the check-in, only your distance from the place and the accuracy margin. If “Nearby sharing” is on and you have allowed location access, your approximate location (rounded to about 100 metres) is kept for at most 2 hours while you use the app, only to put you first in your friends’ “Who are you with?” list when they check in nearby and to send you nearby-friends alerts (and, if you turn them on, alerts about very busy places near you); nobody sees it, and turning the setting off deletes it at once. You can turn these alerts off in the app in My account › Notifications, or on the web in Settings › Notifications. If you send your location in a chat with “Location”, your exact location at that moment (coordinates, accuracy margin and the street and neighbourhood your phone found) is stored as a message and shown only to the people in that chat; when you delete your account, the location in your messages is deleted too.

Link previews: the title, description and image of a link you write in a message are fetched from that page by Puanca’s servers and stored with the message; the page is not opened from your device or the readers’ devices. No preview is fetched for links that look one-time or private (such as sign-in, verification or password reset links).

Preferences and social connections: the cuisines you like, your budget range, language, notification and privacy settings; the people you follow and block; and, if you joined through an invite link, the person who invited you.

Device and notifications: in the mobile app, your device’s notification token (Firebase Cloud Messaging) and platform (iOS/Android), so you can receive notifications.

App error and crash reports: when the mobile app crashes or hits an error, the device model, operating system and app version, the technical details of the error, the names of the screens you opened before it and your account’s ID number (never your name, username, e-mail address or message content).

Business accounts: the locations you manage on Google Business Profile and your role.

Support and reports: the information you provide in support requests, content reports and appeals.

Analytics (only if you consent): on the website, page views and usage statistics through cookies (see the Cookie policy); in the mobile app, which screens and features are used, app sessions, device model, operating system and app version, an approximate location derived from the IP address (country/city) and a random ID for this installation of the app (Google Analytics for Firebase). In Google Analytics this data is not tied to your account and no advertising ID is collected; you can withdraw your consent in the app any time in My account › Privacy › Usage statistics.

Puanca does not ask for special categories of personal data (health, religion, political opinion, biometric data, etc.). We recommend that you don’t share such information in reviews and messages; if you do, it is shown only as content you made public yourself and only with the visibility you choose.

3.How we collect it

Your personal data is collected electronically, by partly or fully automated means: through the sign-up, profile, check-in, review, message and support forms on the Puanca website and app; from Google or Apple when you choose to sign in with them; from Google Business Profile when you claim a business; from your device’s location service when you allow it; and through server logs, the mobile app’s error and crash reports, usage statistics if you consent, and cookies.

4.Purposes and legal grounds

Creating your account, signing you in and providing the service, verifying check-ins and calculating scores: necessary to conclude and perform the contract (KVKK Art. 5(2)(c)).

Account and transaction security, preventing abuse and fake or incentivised reviews, moderation, finding and fixing app errors and crashes, and personalising the Discover ranking and follow suggestions: our legitimate interest, provided your fundamental rights and freedoms are not harmed (Art. 5(2)(f)).

Keeping traffic data, answering requests from competent authorities and our obligations regarding unlawful content: expressly provided for by law and necessary for our legal obligations (Art. 5(2)(a) and 5(2)(ç); Law No. 5651).

Establishing, exercising or defending rights in disputes (Art. 5(2)(e)).

Showing your content to other users according to the visibility you choose (everyone, friends, only me): performance of the contract (Art. 5(2)(c)) and, for content you share publicly, the fact that you made it public yourself (Art. 5(2)(d)).

Showing posts you share with “Everyone” visibility from a public account to users who don’t follow you, as “Suggested for you” in their feed, and ranking the suggestions in your feed by the cuisines, budget range and area you chose: performance of the contract (Art. 5(2)(c)) and our legitimate interest (Art. 5(2)(f)). You can stop your posts being suggested in Settings › Privacy › “Show in suggestions”. Private accounts, posts in which you tag other people and stories are never suggested; check-ins become suggestions no sooner than 3 hours later.

Venue screens: a business on Puanca can show a “Here now” screen on the TV at its venue. Your public, location-checked check-in only adds to the head count there. Your shortened name (e.g. “Elif K.”) and profile photo are shown only if you give your explicit consent at puanca.com › Settings › Privacy › “Show my name on venue screens”, only on the screen of the venue you checked in at and for at most 2 hours after the check-in (Art. 5(1)). Your username, surname, visit history and other places are never shown. You can withdraw your consent in the same setting at any time; open screens update at once. The business can also take you off its own screen.

Service notifications and e-mails (security alerts, verification, follow and reply notifications): performance of the contract (Art. 5(2)(c)). Promotional commercial electronic messages: only with the approval you give under Law No. 6563.

Analytics cookies and usage statistics in the mobile app: only with your explicit consent (Art. 5(1)); you can withdraw it at any time.

5.Transfers within Türkiye

Your personal data is shared, only for the purposes and on the legal grounds above, with our hosting infrastructure provider in Türkiye (Huawei Cloud, Istanbul region); on request, with competent public authorities (courts, public prosecutors, the Information and Communication Technologies Authority, the Ministry of Trade, the Personal Data Protection Board and similar); with other users according to the visibility you choose; and with the owner of a business you review (your review and username). Your personal data is never sold or shared for advertising.

6.Transfers abroad

Some of the providers that make the service work are abroad: Cloudflare, Inc. (USA; content delivery, attack protection and photo storage, stored in Europe), Google LLC and its affiliates (USA/Ireland; sign-in with Google, Google Maps and Places information, Google Business Profile, Firebase Cloud Messaging notifications, Firebase Crashlytics crash reports and, only if you consent, Google Analytics), Apple Inc. (USA; sign-in with Apple), Sendinblue SAS / Brevo (France; sending e-mail) and Functional Software, Inc. / Sentry (error tracking; data on servers in Germany).

These transfers are made under KVKK Art. 9: with one of the appropriate safeguards listed in Art. 9(4), such as the standard contracts published by the Board (which are notified to the Board within 5 business days of signing), or, where that is not possible, under the conditions for occasional transfers in Art. 9(6) (for example, where the transfer is necessary to perform the contract, or with your explicit consent).

7.Retention

Account and content data: for as long as your account is open. When you delete your account, a 30-day waiting period begins; if you sign in during that time, the deletion is cancelled. Once it ends, your account, content and photos are permanently deleted (the other person’s copy of your messages remains, under the name “Deleted user”).

Traffic data: 13 months, as Law No. 5651 requires at least one year and at most two; it is kept for that period even if your account is deleted.

Sessions are valid for at most 30 days and are deleted 7 days after they end. Records of sent e-mails are kept for 30 days, unsent messages and the earlier versions of edited messages for 30 days, read notifications for 90 days and unread ones for 1 year. Data archive links are valid for 7 days, sign-in and verification links for at most 24 hours and a business verification code for 10 minutes; the code itself and the full number are not stored. App crash and error reports are kept for 90 days. Usage statistics collected with your consent are kept in Google Analytics for 2 months at event level and for 14 months after your last activity at user level. Database backups are deleted on a 7-day cycle.

Moderation decisions, reports and audit records: for the general limitation period for possible appeals and disputes, at most 10 years.

Data whose period has ended is deleted or anonymised by automated jobs, at intervals of no more than 6 months, in line with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

8.Automated processing

Place scores, the “Visit verified” label and the Discover ranking are calculated automatically; how they are calculated is explained in the Review and rating policy. Suggested posts in the feed are ranked automatically too: by how recent a post is, the likes and comments it has, whether it has photos, and how well the place suits the cuisines, budget and area you chose; your likes and browsing history are not used. “Not interested” on a suggestion stops that person’s posts being suggested to you, and you can hide suggestions for 30 days. If you think an outcome based solely on automated processing is against you, you can object (Art. 11(1)(g)).

9.Your rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether it is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for it to be corrected if it is incomplete or wrong; to ask for it to be deleted or destroyed under the conditions in KVKK Art. 7; to ask for corrections and deletions to be notified to the third parties it was transferred to; to object to an outcome against you that results from analysis solely by automated systems; and to claim compensation if you suffer damage because of unlawful processing.

You can download a copy of your data from Settings › My data and KVKK, and delete your account from Settings › Delete account.

10.How to apply

Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send requests about your rights in a written petition stating your identity and your request, in person or through a notary to Siteler Mahallesi, 07070 Konyaaltı/Antalya; with a secure electronic or mobile signature; or to [email protected] from the e-mail address registered to your Puanca account.

Your request will be concluded free of charge within 30 days at the latest; if it involves an additional cost, the fee in the Board’s tariff may be charged. If your request is rejected, you find the answer insufficient or it is not answered in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer and, in any case, within 60 days of your request (Art. 14).

11.Age limit and changes

Puanca is for people aged 18 and over; we close accounts we find to belong to someone under 18 and delete their data.

We may update this notice to reflect changes in the law or the service. We announce significant changes by e-mail or in the app before they take effect; the current version is always on this page.