1. Data controller
This notice is issued under Article 10 of Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
The data controller is BULLS DİJİTAL YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ (İstanbul, Türkiye). You can reach us at contact@bullsdigitalhouse.com for any question or request.
The controller is a limited liability company. When its MERSIS number and registered address are added to this section, the change will be reflected in the update date of this page.
2. Personal data we process
Identity and contact: name, username, date of birth/age, mobile phone number and email address.
Profile and user content: profile photos, bio, profile prompt answers, interests, occupation and education, chat messages, voice notes and other content you share.
Transaction security: IP address, device and operating system details, app version, push notification token, session and sign-in records, security logs.
Location: processed only if you grant permission in the app, and only to show distance. You can withdraw the permission at any time from your device settings.
Service usage: matching and voting records, notification preferences, blocking and report records, and your support requests.
Financial data: purchase and subscription status when you buy a premium subscription. Your card details never reach us; payment is handled entirely by the Apple App Store or Google Play.
3. Special categories of personal data
The following are special categories of personal data under Article 6 of the KVKK and are processed ONLY with your explicit consent:
Religion or belief: only if you choose to display it on your profile. It is optional; you may leave it blank or remove it later.
Data concerning sexual life: your gender identity, dating intent and matching preferences, processed so that matching can work.
Biometric data: the liveness verification selfie taken to verify your account. It is retained only while the verification review is pending and is DELETED once a final decision is made — this is why the decision cannot be reversed.
You may withdraw your explicit consent at any time. Processing then stops and the data is deleted; withdrawal does not affect processing lawfully carried out before that point.
4. Purposes of processing
Creating your membership, verifying your identity by phone or email, and keeping your account secure.
Providing app features such as matching, community voting, chat and profile viewing.
Sending notifications, handling your support requests and communicating with you.
Preventing fake accounts, fraud and abuse; reviewing reports, moderating content and enforcing community rules.
Validating premium subscriptions and granting subscription entitlements.
Operating the service, fixing errors and faults, meeting legal obligations and exercising the right of defence against legal claims.
Your data is used by automated systems to generate match suggestions. This does not produce a decision with legal effect about you; it only ranks the profiles shown to you.
5. Legal bases
Performance of a contract (KVKK art. 5/2-c): membership, matching, chat and subscription — processing the service directly requires.
Compliance with a legal obligation (art. 5/2-ç): responding to requests from competent authorities and statutory retention duties.
Establishment, exercise or protection of a right (art. 5/2-e): report and moderation records, and defence in legal disputes.
Legitimate interest (art. 5/2-f): preventing fraud and abuse and keeping the service secure, provided your fundamental rights and freedoms are not harmed.
Explicit consent (art. 5/1 and art. 6/2): the special categories in section 3, optional location sharing, and the international transfer described in section 8.
Processing that is strictly necessary for the service to work is based on the legal grounds above rather than on consent. Explicit consent for processing special-category data and for international transfer, both of which are core to matching, is taken at sign-up: the registration screen states what you are accepting and links to the full texts, and creating an account depends on giving these consents. You can withdraw your consents later from Privacy settings. Withdrawing the special-category consent deletes the field it covers (religion or belief) from the database. Withdrawing the international-transfer consent is recorded, and because the entire service runs on infrastructure located abroad your account is then reviewed manually by us.
6. Method of collection
Your personal data is collected by wholly or partly automated means through the information you enter in the mobile app, records generated automatically as you use it, and information returned by the sign-in method you choose, such as Sign in with Apple.
7. Recipients and purpose of transfer
We do not sell your personal data and we do not transfer it to third parties for marketing. It is shared only as far as running the service requires, with Hetzner Online GmbH (server hosting, Finland), Cloudflare R2 (photo and backup storage, EU region), RevenueCat (subscription validation, USA), Expo (app update infrastructure, USA), and Apple and Google (push notifications and store services, USA). These providers process your data solely within the scope of the service they provide to us and on our instructions.
Transfers may be made to public authorities and judicial bodies where legally required, limited to the scope requested.
Other users see the information you choose to display on your profile and the content you send them in chat. You can manage what is visible from the privacy settings in the app.
8. International transfer
Our entire infrastructure is located outside Türkiye. Our servers run on Hetzner Online GmbH infrastructure in Finland; your photos and backups are stored in the EU region of Cloudflare R2. Subscription validation runs through RevenueCat (USA), app update infrastructure through Expo (USA), and notification and store services through Apple and Google (USA).
Your personal data is therefore transferred abroad within the meaning of Article 9 of the KVKK. The transfer relies on the separate, explicit consent you give during registration.
If we move to one of the standard contract or undertaking mechanisms set out in Article 9 instead of explicit consent, this section will be updated.
9. Retention periods
While your account is open, the data relating to it continues to be processed.
When you delete your account, a 7-day grace period begins. If you sign in again within that period, the deletion request is cancelled. Once it expires, your account and content are deleted or irreversibly anonymised.
The verification selfie is deleted as soon as the verification decision is made.
Security logs, report and moderation records, and records we are legally required to keep are retained for the periods set out in the applicable legislation and are then deleted, destroyed or anonymised.
Messages you sent to other users are also their data, so they may remain in that user’s chat history even after you delete your account.
10. Your rights (KVKK art. 11)
To learn whether your personal data is processed and, if so, to request information about it.
To learn the purpose of processing and whether the data is used in line with that purpose.
To know the third parties to whom the data is transferred, in Türkiye or abroad.
To request correction if the data is incomplete or inaccurate.
To request erasure or destruction under the conditions in Article 7 of the KVKK.
To request that correction, erasure and destruction be notified to the third parties the data was transferred to.
To object to a result against you arising from analysis carried out solely by automated systems.
To claim compensation if you suffer damage due to unlawful processing.
You may also request a copy of your account and content data through the data download flow in the app, and delete your account from within the app.
11. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your requests by email to contact@bullsdigitalhouse.com or in writing to İstanbul, Türkiye.
Your application should state your name and surname, your signature if submitted in writing, your Turkish ID number (nationality and passport number for foreign nationals), your address for notification, your email address and phone number if any, and the subject of your request.
Applications are concluded within 30 days at the latest. If the process incurs an additional cost, a fee from the tariff set by the Board may be charged.
If your application is rejected, you find our response insufficient, or we fail to respond in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of the application date.