Privacy Policy and KVKK Information Notice

This English version is a courtesy translation. In case of any discrepancy, the Turkish version prevails.

This notice explains how your personal data is processed when you use the Yanko mobile application and the related web pages (together, the “Service”). The information notice prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) also forms part of this document.

1. Data controller
2. Personal data processed
3. Purposes of processing
4. Legal grounds and method of collection
5. What other users can see
6. Transfer of data and transfers abroad
7. Retention periods
8. Security
9. Age limit of 18
10. Your rights under KVKK Art. 11
11. How to submit a request
12. Cookies and tracking
13. Changes

1.Data controller

Your personal data is processed by Yanko (“Yanko”, “we”) in its capacity as data controller.

• Address: İstanbul, Türkiye
• Contact: support@yanko.live

2.Personal data processed

The Service does not ask you for special categories of personal data such as health, religion, political opinion or sex life. Please do not share such information on your profile or in Moments; if you do, this information may be deemed to have been made public by you.

3.Purposes of processing

• To create your account, verify your login and manage your account,
• To show your profile to other users; to provide the discover, nearby and search features,
• To operate messaging, following, Moments and similar social features between users,
• To enforce the age limit of 18 and to prevent fake accounts, fraud, harassment and abuse,
• To review reports, perform content moderation (photos and voice introductions you upload publicly may be reviewed by our team after they are published; content that violates the rules is removed and you are notified), and to suspend or close accounts that violate the rules,
• To prevent multiple accounts and cheating: to limit, using the hash of the device ID, the number of accounts that can be opened on a device, to grant new member and invitation rewards once per device, not to grant rewards on emulators and to block access from devices that violate the rules,
• To ensure information security (e.g. limiting brute-force login attempts) and to detect and fix errors,
• To verify coin purchases via Google Play, to run balances and gift transactions, to review and pay withdrawal requests, and to prevent payment fraud,
• To set up one-to-one voice/video calls, calculate the unit price and earnings, and show call history; in paid messaging, to calculate the message fee, earnings shares and the intimacy level between two people (from the numbers of messages, gifts and calls); to calculate task progress (for female users’ messaging tasks, per-chat counts of paid messages are used to prevent cheating),
• To carry out optional real-person verification (to prevent fake profiles) and to display the verified badge,
• To respond to your support requests and to carry out operations such as password resets,
• To fulfil our legal obligations and respond to requests from competent authorities,
• To protect our rights in the event of disputes.

Your personal data is not sold or rented to third parties for advertising purposes.

4.Legal grounds and method of collection

Your data is collected electronically, through the information you enter via the app and web pages and through records generated automatically while you use the Service. The legal grounds we rely on (KVKK Art. 5):

• Establishment and performance of a contract (Art. 5/2-c): providing the account, profile, messaging and social features,
• Legal obligation (Art. 5/2-ç): record-keeping and reporting obligations under Law No. 5651 and related legislation, retention of financial records as required by tax and commercial legislation, requests from competent authorities,
• Establishment, exercise or protection of a right (Art. 5/2-e): report and moderation records, disputes,
• Legitimate interest (Art. 5/2-f): security, prevention of fraud and abuse, improvement of the service,
• Data made public by the data subject (Art. 5/2-d): information you share publicly on your profile,
• Explicit consent (Art. 5/1): only for the processing of your approximate location and for cases where a transfer abroad is based on explicit consent. You can withdraw location permission at any time in your device settings; in that case the “Nearby” feature will not work.

5.What other users can see

Your nickname, user number, age (not your date of birth), gender, the fields you have filled in on your profile, your public photos, your Moments posts, your online/last seen status and your approximate distance from them (in km) are shown to other users. Your email address and your exact location are never shown to other users. Only the person you are talking to can see your messages; however, reported messages may be reviewed by our moderation team. People you have blocked cannot see you, and you do not see them.

6.Transfer of data and transfers abroad

Your personal data is shared only with the following recipients and only to the extent of the stated purpose:

• Hosting and infrastructure service providers: Our servers and database run on rented cloud/server providers. These servers may be located outside Türkiye (e.g. in European Union countries). Transfers abroad are made in accordance with KVKK Art. 9 by providing appropriate safeguards (e.g. standard contracts notified to the Board); where this is not possible, they are based on the conditions for incidental transfers or on your explicit consent.
• App store: Your download of the app via Google Play and in-app purchases are subject to Google’s own privacy policy. To verify a purchase, the purchase token is sent to the Google Play Developer API.
• Banks and payment institutions: To pay your withdrawal request, your full name, IBAN and the amount are shared with the bank or payment institution making the payment.
• Authorised public institutions and organisations and judicial authorities: Upon the request of authorities empowered by law or in the case of a legal obligation.
• Professional advisers: Lawyers and auditors, under a duty of confidentiality and to the extent necessary.

7.Retention periods

• Account and content data: Stored for as long as your account remains open. When you delete your account, your profile, photos, messages, Moments posts, comments/likes, and your follow, visit, block and report records are deleted immediately and permanently; the files you uploaded are removed from the server.
• Financial records: Purchase, withdrawal (full name, IBAN, amount) and gift records are retained, even if your account is deleted, for the statutory period (generally 10 years) required by tax and commercial legislation (e.g. Tax Procedure Law No. 213, Turkish Commercial Code No. 6102), with their link to your account removed; they are deleted at the end of that period.
• Verification selfies: Deleted immediately once the review (approval or rejection) is completed; a selfie awaiting review is deleted together with your account if you delete it. The outcome of the request (date, pose, decision, reason for rejection) is stored for as long as your account remains open.
• Call records: Audio and video are never recorded. Because the call record (parties, time, duration, fee) is a financial record, when your account is deleted it is retained for the same period as financial records, with its link to you removed.
• Device records: The link between the device ID hash and your account is stored for as long as your account remains open; this link is deleted when you delete your account. So that rewards are granted only once per device and banned devices are blocked, the device hash, the information that the new member/invitation reward has been used on that device and the ban status may be retained for up to 2 years after the account is deleted (the hash does not identify a person on its own).
• Backups: Deleted data is also deleted from backups within the regular backup cycle, within 30 days at the latest.
• Traffic and access logs (IP, time, etc.): Retained for the period required under Law No. 5651 and its secondary legislation (at least 1 and at most 2 years), and deleted or anonymised at the end of that period.
• Suspended accounts: Records of accounts suspended for violating the rules may be retained for the relevant limitation periods in order to prevent repeated abuse and for possible legal proceedings.

8.Security

We take reasonable technical and administrative measures to protect your data: connections are encrypted with HTTPS, passwords are stored with a strong hashing algorithm (bcrypt), login attempts are limited, all metadata (EXIF) including GPS location is removed from uploaded photos, location is stored approximately and access to data is limited to authorised personnel. Nevertheless, please remember that no transmission over the internet is completely secure; do not share your password with anyone.

9.Age limit of 18

The Service is intended only for people who have reached the age of 18. We close accounts that we determine, or are notified, to belong to persons under 18 and delete the related data. If you believe a child is using the Service, please report it from within the app or write to support@yanko.live.

10.Your rights under KVKK Art. 11

By applying to the data controller, you have the right to:

1. Learn whether your personal data is processed,
2. Request information about it if it has been processed,
3. Learn the purpose of processing and whether the data is used in line with that purpose,
4. Know the third parties in Türkiye or abroad to whom it has been transferred,
5. Request its rectification if it has been processed incompletely or inaccurately,
6. Request its erasure or destruction within the framework of the conditions in KVKK Art. 7,
7. Request that the operations under (5) and (6) be notified to the third parties to whom the data has been transferred,
8. Object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems,
9. Claim compensation for damage if you suffer damage due to unlawful processing.

You can correct your profile information yourself within the app and delete your account from within the app or on the web.

11.How to submit a request

You can submit your requests regarding your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• By sending an email to support@yanko.live from the email address registered to your account,
• Via registered electronic mail (KEP), secure electronic signature or mobile signature,
• With a wet-signed petition delivered to İstanbul, Türkiye in person or through a notary public.

Your request must include your full name, your user number or registered email, your request and your contact information. We may ask for additional information to verify your identity. Your requests will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, the tariff determined by the Board may apply. If your request is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board (KVKK Art. 14).

12.Cookies and tracking

The mobile app does not use advertising tracking or third-party analytics SDKs. These legal pages do not use cookies. Your session is maintained with an access key (token) stored securely on your device.

13.Changes

We may update this notice in line with changes in legislation or in the Service. We announce significant changes within the app. The current version is always published at this address.