Privacy Notice on the Processing of Personal Data

Version 1.8

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform you about the personal data processed while you use the "Burada" mobile application (the "App").

1. Data controller

Burada App (Buğrahan Murat Taşlıçay), Kütahya Merkez, 43000 Kütahya, Türkiye, e-mail: destek@burada.app (the "Data Controller").

2. Personal data we process

• Instagram sign-in data: If you use "Connect with Instagram", we receive your Instagram user ID, username, name, profile photo and account type (business / creator) through Meta's official Instagram sign-in (Instagram API with Instagram Login, `instagram_business_basic` permission only). Your Instagram password is never shared with us. The access token issued by Instagram is stored encrypted and used only to keep your profile information up to date; we have no access to your posts, messages or followers.
• Verification-by-DM data: If you link a private or personal account with "Verify by DM", the message you send to the app's Instagram account is forwarded to us by Meta. Only the verification code is read from it; the message text is not stored. Your Instagram-scoped ID for this account, username, name and profile photo are obtained from Instagram's official messaging API. A short reply confirming the verification is sent.
• Age: Your date of birth is used only to check that you are 18 or older and is not stored. Only the fact that you are "over 18" is stored.
• Profile data: Your Instagram username, display name and profile photo, obtained only through Instagram's official sign-in, with your approval; the photo is stored on our own servers. Users near you see only your username and profile photo.
• Foreground location: Your device's current location while the App is open, used to find App users near you (about 100 meters). Your last location is kept in server memory for at most 30 minutes and deleted immediately when you close the App (unless "Stay visible when the screen is off" is on); it is not written to the database or logs and no location history is kept. Your exact location, distance or a map is never shown to any user; others only see a "very near" or "near" label.
• Background location (only if you turn these features on): Your device's location while the App is in the background or your screen is off, processed for the feature you turn on: (a) "Stay visible when the screen is off": to keep showing your Instagram username and photo in the lists of users near you, (b) "Let me know when people are nearby": to notify you when users are near you. It is updated about every 5 minutes or on noticeable movement, kept in memory for at most 30 minutes, not written to the database and no history is kept. Your exact location is never shown to anyone in this case either.
• Notification data: Your notification preference, quiet hours, time zone and your device's push token.
• Security data: Session records, consent records and a hashed IP address.
• Report and block records: Reports and blocks you make or that concern you.

3. Purposes

• Creating your account and verifying it with Instagram's official sign-in,
• Enforcing the 18+ age limit,
• Verifying that the Instagram account belongs to you and keeping your profile information (username, photo) up to date,
• Letting visible users near each other see each other when they open the App,
• (If you choose) keeping you in nearby users' lists while your screen is off, and notifying you when App users are near you,
• Preventing harassment and abuse and reviewing reports,
• Ensuring information security and complying with legal obligations.

4. Legal grounds

• Instagram sign-in data and the encrypted access token, age and session records: necessary for the establishment or performance of a contract (KVKK Art. 5/2-c) and legitimate interest (Art. 5/2-f).
• Showing your profile data to users near you: your explicit consent (Art. 5/1).
• Processing your foreground location to find people nearby: your explicit consent (Art. 5/1).
• Processing your background location to keep you visible with the screen off and for notifications: your separate and optional explicit consent (Art. 5/1).
• Report and security records: legal obligation (Art. 5/2-ç) and legitimate interest (Art. 5/2-f).

5. Transfers

Your personal data may be transferred, limited to the purposes above, to our cloud hosting providers, Meta Platforms for Instagram sign-in (only during sign-in and profile requests), the push notification infrastructure provider (Expo / Google Firebase / Apple; push token and notification text only) and the venue data provider (current coordinates only, not linked to your identity). Where these providers' servers are located abroad, transfers are made under KVKK Art. 9 based on your explicit consent or the other safeguards provided by law. Providers used: Oracle Cloud (Germany, Frankfurt) for servers and the database, Cloudflare R2 for profile photos and database backups (provider Cloudflare, Inc., USA; storage region Eastern Europe), and Expo, Google Firebase and Apple (USA) for notifications.

Data may be disclosed to competent public authorities where legally required.

6. Retention

• Foreground location: at most 30 minutes; deleted immediately when the App is closed.
• Background location: at most 30 minutes; deleted immediately when the feature is turned off or consent is withdrawn.
• Location history: not kept.
• Account, profile and notification preference data: until you delete your account. On deletion, all data is permanently erased.
• Instagram access token: until you disconnect Instagram, remove the app's access on Instagram or delete your account (the token is valid for at most 60 days and renewed before it expires). When you disconnect, the token and your profile photo are deleted immediately.
• Consent records: until your account is deleted (as proof of consent).
• Report records: until the review is completed and statutory periods expire.

7. Your rights (KVKK Art. 11)

You may apply to the Data Controller to learn whether your personal data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties to whom it is transferred, request correction of incomplete or inaccurate data, request deletion or destruction under Art. 7, request notification of these actions to third parties, object to results against you arising exclusively from automated analysis, and claim compensation for damages arising from unlawful processing.

In the App's Settings you can download your data, withdraw your consents, turn off notifications, disconnect Instagram and permanently delete your account.

If you remove the app's access in Instagram's "Apps and websites" settings or submit a data deletion request there, Meta notifies us: your access token is deleted, and on a deletion request your account is deleted with all its data.

8. How to apply

Send your requests by e-mail to destek@burada.app or in writing to the address above. Requests are answered free of charge within 30 days at the latest.

This app is not affiliated with Instagram or Meta.