Privacy Policy
Türkçe: Gizlilik Politikası ve KVKK Aydınlatma Metni (the Turkish version prevails in case of conflict)
This policy explains how the Ben Geldim mobile app (the “App”) and the bengeldim.com website process personal data. It also serves as our privacy notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
1. Data controller
- Company: EPARAF Teknoloji ve Yazılım Hizmetleri Ltd. Şti. (a limited company registered in Türkiye)
- Address: 7 Eylül Yolu Caddesi No:35 İç Kapı No:301 Turgutlu / Manisa
- Trade registry (MERSİS) no: 0336133551200001
- Registered e-mail (KEP): eparafteknolojiveyazilimhizmetleri@hs01.kep.tr
- Privacy contact: iletisim@eparaf.com
2. Data we collect
| Category | Data |
|---|---|
| Identity | First name, last name, username, date of birth, gender |
| Contact | E-mail address or mobile phone number (whichever you sign up with) |
| Account verification | One-time login code (stored hashed, valid 5 minutes), attempt count, session tokens |
| App preferences | Door colour, mat and knocker choices; match preference (Premium Pro only: random / women / men); notification settings; records of your acceptance of the Terms |
| Friends and messages | Door (friend) requests sent and received, friend list, blocked users, text message content, read status and timestamps |
| Call metadata | Account IDs of the participants, knock/accept/decline events, call start and end time, duration and end reason. Video and audio content is never recorded (see section 3). |
| Reports and safety | Reports you file or that are filed about you (reason, comment, related messages and call metadata), moderation decisions, warnings and bans |
| Security and diagnostics | IP address, connection time, device model, OS and app version, error and access logs |
| Device push token | A device-specific token used to deliver push notifications |
| Purchases | Subscription status (Free / Plus / Pro), product, start/renewal/expiry dates and transaction identifiers provided by the App Store / Google Play via RevenueCat. We never receive your card or payment details; Apple or Google processes payment. |
| Support | Messages you send to our support team |
| Usage data (optional) | Only if you give explicit consent: screens and actions in the app (e.g. sign-up steps, match waiting time, viewing the Premium page), device type and app version, and the campaign that brought you to the app. Only your anonymous user number is sent with it — no name, email, phone, birth date or message content; IP addresses are not stored and no screen recording is made. |
We do not collect profile photos, contacts, location, advertising identifiers (IDFA/AAID) or biometric data. Some knocker designs show symbols (e.g. a cross, a Star of David, the crescent and star); these are purely decorative choices and are never treated or analysed as information about religion or belief. The Premium Pro match preference (women/men) is used only to make the current match, is never shown to other users, and no inference about sexual orientation or sex life is drawn from it.
3. About video calls
Video calls are established directly between the two devices (peer-to-peer) using WebRTC and are encrypted with DTLS-SRTP. When the devices cannot connect directly, the encrypted stream is relayed through managed TURN servers operated by Amazon Web Services in Frankfurt, which cannot decrypt or record it. We do not record, store or monitor the video or audio of any call. The camera and microphone are used only when you start or accept a call, with your device permission.
Because calls are not recorded, please use the Report button on the call screen immediately if something goes wrong. Reports are reviewed using call metadata, any chat messages and your description.
4. Purposes and legal bases (KVKK Art. 5)
| Purpose | Legal basis |
|---|---|
| Creating your account, code-based login, session management | Art. 5(2)(c) — performance of a contract |
| Enforcing the 18+ age requirement | Art. 5(2)(c); Art. 5(2)(f) — legitimate interest in protecting minors |
| Your door, matching, knocking, setting up video calls, the Pro gender preference | Art. 5(2)(c) |
| Door requests, friendships and messaging (showing your name and username to the other person after a call) | Art. 5(2)(c) |
| Push notifications | Art. 5(2)(c) — can be switched off in settings |
| Managing subscriptions and Premium features | Art. 5(2)(c); Art. 5(2)(ç) — commercial and tax law |
| Reviewing reports, moderation, blocking, banning abusive accounts and preventing re-registration | Art. 5(2)(f) — legitimate interest in user safety; Art. 5(2)(e) — establishing, exercising or defending legal claims |
| Information security, fraud and abuse prevention, debugging | Art. 5(2)(f); Art. 5(2)(ç) |
| Compliance with Law No. 5651 and requests from competent authorities and courts | Art. 5(2)(ç) — legal obligation; Art. 5(2)(a) — expressly provided by law |
| Answering support requests | Art. 5(2)(c); Art. 5(2)(f) |
| Measuring and improving how the app is used (product analytics) | Art. 5(1) — explicit consent; nothing is collected without it, and you can withdraw it any time in Settings > Privacy > "Kullanım verilerini paylaş" |
We do not use your data for advertising or marketing profiling and we do not sell it. The App contains no ads.
5. Sharing and international transfers (KVKK Art. 8 and 9)
Other users: Before a match, other users see only your door. When you send or accept a door request after a call, your first name, last name and username are shown to that user. During a call your camera image (if on) is sent only to the person you are talking to.
Authorities: Competent public authorities and courts, when legally required.
Processors abroad: Our servers and database are hosted by Amazon Web Services in Frankfurt, Germany (eu-central-1). Transfers to the processors below are made under KVKK Art. 9 as amended in 2024 by Law No. 7499, on the basis of the standard contractual clauses published by the Turkish Personal Data Protection Board, notified to the Authority within five business days of signature.
| Recipient | Country | Data and purpose |
|---|---|---|
| Amazon Web Services (AWS EMEA SARL and affiliates) | Germany (Frankfurt data centre) | Hosting of all account and app data; login code e-mails (SES) and SMS; encrypted TURN relay for calls; logging and monitoring |
| RevenueCat, Inc. | USA | Subscription validation: app user ID, purchase receipts, subscription status |
| 650 Industries, Inc. (Expo) | USA | Push notification delivery: push token and notification text |
| PostHog Inc. (EU cloud) | Germany (Frankfurt data centre) | Only with your explicit consent: usage data for product analytics and your anonymous user number |
| Apple Inc. / Apple Distribution International Ltd. | USA / Ireland | App Store purchases and subscriptions; push delivery via APNs |
| Google LLC / Google Ireland Ltd. | USA / Ireland | Google Play purchases and subscriptions; push delivery via FCM |
6. Retention
- Account, profile, door and preference data: while your account exists; on deletion, immediately made inaccessible and erased or anonymised within 30 days (including backups).
- Messages: while your account exists. When a friend is removed, the chat is hidden for both sides and kept for 90 days for report handling, then deleted. Deleted within 30 days of account deletion.
- Login codes: valid 5 minutes, records deleted within 24 hours.
- Call metadata, IP and access logs: 1 year (or longer if required under Law No. 5651, maximum 2 years).
- Reports, moderation and ban records, and reported messages: 2 years from the decision, or until the end of any legal proceedings.
- Irreversible hash of a banned account's e-mail/phone: for the duration of the ban, up to 5 years, to prevent re-registration.
- Push token: deleted when you log out, disable notifications or delete your account.
- Purchase records: while your account exists; records required by commercial and tax law for the statutory period (up to 10 years).
- Support correspondence: 2 years after the request is closed.
7. Security
Data is encrypted in transit (TLS) and at rest. We use passwordless one-time codes that are never stored in plain text, least-privilege access controls, AWS Secrets Manager for secrets, and audit logging. Only authorised moderators can access messages and report contents, and only as needed to handle a report.
8. Your rights (KVKK Art. 11)
You may ask us whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties in Turkey or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request erasure or destruction under Art. 7; request that third-party recipients be notified of such correction or erasure; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
Send requests from the e-mail address registered in the App to iletisim@eparaf.com, via KEP to eparafteknolojiveyazilimhizmetleri@hs01.kep.tr, or by signed letter to 7 Eylül Yolu Caddesi No:35 İç Kapı No:301 Turgutlu / Manisa. We respond free of charge within 30 days. You may lodge a complaint with the Turkish Personal Data Protection Board (KVKK). You can delete your account at any time in the App: see Account deletion.
9. Age requirement
The App is only for people aged 18 or over. Date of birth is checked at sign-up. If we learn that a user is under 18, we close the account and delete their data, subject to our legal obligations. Report suspected minors in the App (“Underage user”) or at iletisim@eparaf.com.
10. Cookies and tracking
The website uses only one strictly necessary first-party cookie (bg_consent, 180 days) to remember your cookie choice; it currently uses no analytics, marketing or advertising cookies or trackers. If such cookies are added in the future, they will only be used after you opt in via the cookie banner; you can change your choice at any time via the “Cookie settings” link in the footer. See the Cookie Policy (Turkish). The App does not access your advertising identifier, does not track you across other companies' apps or websites, and does not share data with data brokers.
11. Changes and contact
We may update this policy. Material changes are announced in the App; the current version is always published on this page. Questions: iletisim@eparaf.com.