Turkish Data Protection Notice (KVKK)
This notice is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation. It is provided in English for users outside Türkiye; the Turkish text is the governing version for the purposes of Turkish law.
If you are in the EEA or the United Kingdom, the Privacy Policy — which sets out your rights under the GDPR — is the document most relevant to you. This notice describes the additional Turkish framework.
1. Identity of the data controller
- Name: Hülagühan Labs Yazılım Teknolojileri Ltd. Şti.
- Location: İstanbul, Türkiye
- Email: kvkk@hulaguhanlabs.com.tr
2. Categories of data subject
- Parent / guardian: the person who downloads the app, creates an account and uses the service
- Monitored child: the person whose device is paired to the parent's account with the guardian's explicit consent
3. Categories of personal data processed
| Category | Data | Data subject |
|---|---|---|
| Identity | Display name; optionally relationship to the family (Mother/Father/Guardian/Other) and avatar colour; nickname for the child device | Parent, child |
| Contact | Email address; optionally phone number | Parent |
| Location | Latitude, longitude, accuracy radius, altitude, speed and timestamp. Collected on SOS, while the app is open, and — if permission is granted — in the background. | Child |
| Transaction security | argon2id hash of the password, session tokens, security audit records, consent record and accepted policy version | Parent, child |
| Device information | Platform, model, operating system and app version, pairing and last-seen times, battery level, charging state, connection type, permission states | Child |
| Customer transaction | Family name, membership and role; subscription status, plan type and renewal date | Parent |
| Usage data (optional) | Application name and time spent in it, for the screen-time summary | Child |
4. Purposes of processing
- Account creation, sign-in, password reset and authentication
- Creating the family, managing multiple parents and pairing devices
- Delivering emergency (SOS) and “I'm safe” notifications, with location where available, to the family
- Location sharing while the app is open and, where permitted, in the background
- Sending low-battery and offline alerts
- Notifying the parent that setup is incomplete
- Producing the screen-time summary (only with explicit consent)
- Verifying the subscription and granting access to paid features
- Ensuring account security, detecting misuse and keeping audit records
- Providing information to competent public authorities where required by law
5. Legal grounds (KVKK Art. 5)
| Data | Legal ground |
|---|---|
| Account and family data | Directly related to the performance of a contract — Art. 5/2-c |
| Optional profile fields | Explicit consent — Art. 5/1 |
| Child device data | Directly related to the performance of a contract — Art. 5/2-c |
| Location data | Explicit consent — Art. 5/1 |
| Safety events and notifications | Performance of a contract and legitimate interests — Art. 5/2-c and 5/2-f |
| Subscription status | Directly related to the performance of a contract — Art. 5/2-c |
| Screen time (optional) | Explicit consent — Art. 5/1 |
Location data and device activity data are processed solely on the basis of the guardian's explicit consent. You may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing carried out beforehand. When consent is withdrawn, tracking stops. See the Explicit Consent Statement.
6. Method of collection
Data is collected through the in-app registration form, the device pairing flow and the location service running on the device, by partly automated means.
7. Transfers
Within the framework of KVKK Articles 8 and 9, data may be transferred to our hosting, notification and crash-reporting providers, and to competent public authorities where required by law. Location data is never transferred to third parties for marketing purposes and is never sold.
Where data is transferred abroad, the transfer is made on an appropriate legal basis under KVKK Art. 9 — a country offering adequate protection, standard contractual undertakings, or your explicit consent.
8. Retention periods
| Data | Retention |
|---|---|
| Account and family information | While the account is open |
| Location records | At most 30 days, then deleted automatically |
| Safety events (SOS, check-in) | At most 12 months |
| Audit records | At most 12 months |
| Deletion request records | At most 12 months, as evidence the request was fulfilled |
9. Your rights (KVKK Art. 11)
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose of processing and whether the data is used in line with that purpose
- To know the third parties to whom the data is transferred, in Türkiye or abroad
- To request correction if the data is incomplete or inaccurate
- To request erasure or destruction
- To request that correction and erasure be notified to third parties to whom the data was transferred
- To object to a result arising against you from analysis carried out exclusively by automated systems
- To claim compensation for damage suffered as a result of unlawful processing
10. How to make an application
Send your request from the email address registered in our system to kvkk@hulaguhanlabs.com.tr. Your application should clearly state your name and surname, identity or passport number, an email address for correspondence, and the subject of your request.
Your request is concluded free of charge as soon as possible and within thirty (30) days at the latest. If the application is refused or the response is found insufficient, you may lodge a complaint with the Turkish Personal Data Protection Board.
To delete your account and all data, you can also use the account and data deletion page.