Privacy and personal data notice

Data controller and contact

Ömür Turgut, operating FinCaffe under the developer name Omiron, is the data controller for the personal data described in this notice.

Contact: omur@fincaffe.com

This notice covers account, cafe discovery, Buddy, subscription and support services in the mobile app. Independent services you open from the app have their own privacy terms.

What data is processed?

The data processed depends on the features you use:

• Account and profile: email, display name, account identifier, sign-in method, language and photos you add.
• Cafe discovery: selected area, approximate or precise location you permit, preferences, filters, likes, favorites, collections, visits and journal notes.
• Buddy: age and community-rules confirmation; age, gender and pronoun preferences, school, work, city, interests and meetup preferences you share; profile photos, likes, matches, messages, cafe plans and ratings.
• Support and safety: support correspondence, reports, blocks and content related to a report.
• Usage and device: app activity, session, device and connection information, device identifiers used for notifications, permission choices and error records.
• Purchases and ads: purchase, subscription and feature-access information; in versions offering rewarded ads, ad choices, device information and ad interactions. Payment-card details are handled by the app store.

Please avoid adding sensitive information such as health, political opinions, beliefs or sex-life information to profiles, notes or messages. Sharing content does not give unrestricted permission for every use of that data.

How data is collected

Data is collected electronically from information you enter, content you upload, actions you take and permissions you grant on your device. Usage, connection and error information is generated automatically during operation.

Your sign-in provider supplies account information; app stores and purchase services provide transaction status. Reports submitted by other users may contain information about you. Support emails and in-app requests are also processed.

Purposes and lawful bases

• Information needed to create your account, save preferences and cafe records, and provide requested discovery, Buddy, messaging, notification and subscription services: entering into or performing a contract (KVKK Article 5(2)(c)).

• Usage, device and safety information needed to investigate reports, prevent unauthorised access and abuse, fix errors and assess service reliability: legitimate interests, provided your fundamental rights and freedoms are not harmed (Article 5(2)(f)).

• Information needed to respond to data-rights requests and binding official requests: compliance with a legal obligation (Article 5(2)(ç)). Transaction and correspondence records necessary for a dispute: establishing, exercising or protecting a right (Article 5(2)(e)).

• Transaction information necessary to show a requested rewarded ad and grant the reward: performance of the requested service (Article 5(2)(c)). Activities requiring explicit consent, such as ad personalisation where consent is required: consent for that specific purpose (Article 5(1)).

Processing that requires consent must be explained separately and consent obtained separately. Reading this notice or using the app does not by itself constitute explicit consent.

Who receives data and why?

Data needed for a feature is shared with these recipient groups:

• Account, hosting and storage providers: sign-in, storage and service operation.
• Map and place services: location-based cafes, distances and directions.
• Messaging and notification providers: delivery of messages and notifications you enable.
• App stores and subscription providers: purchase and access verification.
• AI service providers: generating explanations and recommendations from cafe information and the preference or request context needed for the feature.
• Ad providers: rewarded ads, reward verification and ad choices.
• Support and diagnostic services: responding to requests and resolving problems.

Other Buddy users can see the profile details and photos presented to them. Your matches receive the messages and plans you share. If you enable My Cafe World sharing, the relevant cafe-activity summaries are also shared. Recipients may save content you share with them.

Competent public authorities and authorised parties handling legal disputes may receive information necessary to meet a legal obligation or protect a right.

International transfers

Hosting, maps, messaging and notifications, purchases, ads and AI services may involve processing personal data by providers outside Türkiye. The data involved depends on the feature used and the categories described above.

These activities are subject to KVKK Article 9. Regular transfers require an applicable adequacy decision or appropriate safeguards provided for by law; exceptional transfer grounds are not a general authorisation for ongoing services. This notice, a device permission or use of the app cannot replace the required transfer safeguard.

You may request information about recipients, countries and the legal mechanism applied to your data by contacting omur@fincaffe.com.

Personalisation and AI

Cafe and Buddy recommendations may be personalised using your preferences, selected area and app interactions. Cafe explanations and AI features may send relevant cafe information and the preference or request context needed for that feature to the service provider.

Recommendations and generated text may be incomplete or incorrect; you make the choice. You may object to a result against your interests arising solely from automated analysis.

Permissions and your choices

Location permission supports nearby cafes, distances and relevant Buddy features; photo or camera access lets you add the image you choose; notification permission enables delivery of notifications. Change permissions in device settings. You can select an area instead of using location; some features may be limited without permission.

A device permission is not the same as explicit consent under KVKK. You can withdraw consent for consent-based processing through our contact address. Withdrawal does not affect earlier lawful processing.

The Data & Privacy Center lets you manage notifications and My Cafe World sharing, request a copy of your data, clear the cache or start account deletion. Clearing the cache, signing out or uninstalling the app does not delete your server-side account.

Retention and erasure

Account, profile and saved content are retained while needed for your account and the relevant service. Support, safety and transaction records depend on the status of a request or dispute, necessary legal periods and the purpose of the record. When the grounds for processing no longer apply, data is deleted, destroyed or anonymised.

Account deletion covers erasure or anonymisation of your account, profile and related cafe and Buddy records. Limited records needed by law or to protect a right may be retained only for that purpose and the necessary period. Independent services, such as app stores, retain their records under their own obligations.

Deleting your account does not automatically cancel an app-store subscription. Manage the subscription separately through the relevant store.

Data security

Protective measures such as access restrictions and secure connections are used to prevent unauthorised access to personal data. No online service can guarantee absolute security.

Contact support if you notice suspicious activity. Do not include passwords, verification codes or payment-card details in your messages.

Your rights under KVKK Article 11

You may apply to the data controller to:

• Learn whether your personal data is processed and request information about that processing.
• Learn its purposes and whether data is used in accordance with them.
• Learn which third parties receive your data in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction where the conditions in KVKK Article 7 are met.
• Request notification of correction, deletion or destruction to third parties who received the data.
• Object to a result against your interests arising solely from automated analysis.
• Seek compensation for damage caused by unlawful processing.

Requests and complaints

Send a request from the email address registered to your account to omur@fincaffe.com. You can also start data-copy and account-deletion requests in the Data & Privacy Center. Other application routes under the law and the relevant Communiqué remain available.

Explain your request clearly. Formal rights requests must include your name, notification address and, where available, reply email and phone number; Turkish citizens must provide their identity number, and foreign nationals their nationality and passport or other identity number, if any. Written applications require a signature. Do not send unrelated documents or an identity-card copy. Additional information may be requested only as needed to verify that the request concerns you.

Requests are resolved as soon as their nature permits and within 30 days at the latest. They are normally free; if additional costs arise, only the tariff set by the Board may apply. A refusal must include reasons.

If your request is refused, the response is inadequate or no timely response is received, you may complain to the Turkish Personal Data Protection Board within 30 days of learning of the response and, in all cases, within 60 days of your initial application. You must first apply to the data controller.

Age requirement

Buddy matching, chat and meetup features are for people aged 18 and over; these features request age confirmation and acceptance of community rules. If you identify a Buddy profile belonging to a minor or inappropriate data sharing, use the in-app reporting option or our contact address.

Updates to this notice

This notice is updated when the service or its data-processing practices change. The revision date appears below. Any information and, where necessary, explicit consent required for a new processing purpose must be handled separately; changing this notice does not itself establish consent.