Note: This is a translation of the Turkish "KVKK Aydınlatma Metni". In case of any conflict, the Turkish version prevails.
Document type: Privacy Notice under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). As Melyuna operates worldwide, this document also provides information under the EU General Data Protection Regulation ("GDPR") and general global privacy principles.
Related documents: This notice should be read together with the Terms of Use, Privacy Policy, Explicit Consent Text, Community Guidelines and Data Retention and Disposal Policy.
Version: 2.0
Pursuant to KVKK Art. 10, your personal data is processed by the data controller identified below, within the scope and for the purposes described in this notice.
| Information | Value |
|---|---|
| Data controller | Ramazan Karayıldız |
| Contact email | support@melyuna.com |
In this notice, "Melyuna", "we", "the app" or "the platform" refer to the data controller above; "you" or "the data subject" refer to the user aged 18 or over who uses the app.
Important note — VERBİS registration: Because Melyuna may, by its nature, process special categories of personal data (see Sections 3 and 4), it may be subject to the obligation to register with the Data Controllers Registry (VERBİS). Once registration is completed, the registration number will be stated in the table above.
Melyuna is a global dating, friendship and language-exchange social app open to everyone aged 18 and over worldwide. By the nature of the service, you create a profile, match with other users and exchange messages. To provide this service, keep it safe and fulfil our legal obligations, we need to process certain personal data about you.
This Privacy Notice explains the categories of data we process, our processing purposes, the lawful bases, to whom and to which countries data is transferred, the method of collection, retention periods and your rights under KVKK Art. 11.
Melyuna's actual data practices are as follows. Any category not listed below (for example national ID number, e-Government data, university email, biometric data, ID documents) is not collected. Raw GPS coordinates are not stored: if you grant location permission the coordinate is sent to the server, snapped to a grid and offset by a fixed jitter, and only the coarsened value is stored; the raw coordinate is never returned to any user.
Display name, date of birth/age, gender, photos, biography (bio); spoken and learned languages (and CEFR levels), interests/hobbies, profile prompts, dating/meeting intent, and an optional voice prompt.
Your profile photos, photos you share during chats, photo/audio "moments" you post in the feed ("World/Today"), and your optional voice prompt. Media is stored on the storage provider Supabase Storage (see Section 6 — International Transfers).
The messages you exchange with other users and any images/audio included in message content; conversation requests and notes.
Important — Messages are NOT end-to-end encrypted (E2EE). See Section 8.
By the nature of a dating profile, the preferences you share (for example the gender you wish to meet, your intent, profile content) may reveal clues about your sex life/sexual orientation. For this reason, the relevant profile data is treated as special category personal data under KVKK Art. 6, and its processing is based on your explicit consent (see Section 5 and Explicit Consent Text). This processing is carried out in accordance with the applicable legislation on the security of special category data and the additional technical and administrative measures prescribed in Board decisions.
Your personal data is processed for the following purposes:
Automatic temporary suspension: An account is automatically suspended temporarily in one case only — this is not a permanent ban and the permanent decision is always taken by a human:
Reports never trigger an automatic sanction. If several different users report the same account within a short period, the case is escalated for priority human review and an alert is sent to the authorized person; no action is taken against the account automatically. Any warning, suspension or ban is always decided by a human.
When suspended, the app shows you your status and the appeal route. After review your account is either restored or a sanction is applied.
There is no automatic ban. Ban decisions are made through manual review by the technical/authorized team following a report. Automatic measures are applied only in the exception of CSAM/child-abuse content. Users can use tools to report, block and unmatch other users.
Your personal data is processed on the basis of one or more of the following lawful grounds:
| Purpose / Data | Lawful basis |
|---|---|
| Account creation, verification, matching/discovery, messaging, feed service | Processing being necessary for the establishment or performance of a contract (Art. 5/2) |
| Coarse-location processing; optional selfie verification | Explicit consent (Art. 5) — the location permission and selfie submission are at the user's discretion |
| Security, moderation, fraud/bot/fake-account prevention | The data controller's legitimate interest (provided it does not harm your fundamental rights and freedoms) (Art. 5/2) |
| 18+ age check; obligations such as CSAM/CSAE reporting | Fulfilment of a legal obligation (Art. 5/2) and applicable legislation |
| Special category profile data (Section 3.7) | Explicit consent (Art. 6) |
| International data transfers (Section 6) | Explicit consent or appropriate transfer mechanisms under KVKK Art. 9 |
For processing based on explicit consent, you may withdraw your consent at any time; withdrawal does not affect processing carried out up to the moment of withdrawal, and withdrawing consent may make it technically impossible to provide certain services.
To provide the service, Melyuna shares certain data with providers it engages as data processors. Because Melyuna operates worldwide and some of these providers are located abroad (EU/US), the relevant data is transferred internationally.
| Provider | Processing purpose / transferred data | Location |
|---|---|---|
| Supabase | Database (Postgres), authentication (Auth), storage (Storage), server functions (Edge Functions); account, profile, message, media and verification data | EU (Ireland, eu-west-1) |
| Cloudflare Pages | Web hosting and content delivery network (CDN) | Abroad (EU/US) |
| Firebase Cloud Messaging (FCM) + Web Push (VAPID) | Sending push / web-push notifications; notification token | Abroad (Google / US) |
| OpenAI | Text/image moderation; relevant content | Abroad (US) |
| Twilio / Google / Apple / Telegram / Meta | Relevant authentication data when phone (SMS) or social sign-in providers are enabled | Abroad |
| Google (Translate) | Translating the relevant text (message, profile text, post, comment) when the user taps "Translate" | Abroad (US) |
| Anthropic | Visual content moderation of uploaded photos | Abroad (US) |
| Sentry | Application error/crash reports (diagnostics) | EU (Germany) |
| Google / Apple (device location service) | Resolving the device coordinate into a country/city name | Abroad (EU/US) |
| BigDataCloud | Determining the country from an approximate coordinate (rounded to ~11 km) | Abroad (EU/US) |
| CARTO | Serving the map tiles on the discovery screen | Abroad (EU/US) |
| Resend | Sending verification/sign-in code e-mails | EU (Ireland) |
| Google Fonts | Serving font files in the web version | Abroad (US) |
International transfer (KVKK Art. 9): The above transfers are carried out within the framework of KVKK Art. 9 and applicable legislation, on the basis of your explicit consent or appropriate transfer mechanisms (for example standard contracts/appropriate safeguards). Where a standard contract is relied upon, the obligation to notify the Board is fulfilled as prescribed by the applicable legislation.
Apart from these, your personal data may be transferred only to legally authorized public institutions and organizations (within the scope of requests and legislation) and, as required by legal obligation, to competent authorities (for example within the scope of CSAM reporting). Melyuna does not sell your personal data to third parties for marketing purposes.
Your personal data is collected;
Raw GPS coordinates are not returned to other users.
This section is brought specifically to your attention under KVKK Art. 10.
One-to-one chat messages in Melyuna are NOT end-to-end encrypted (E2EE). This means the following:
You should therefore use the app knowing that your messages may be read by the authorized team for security/moderation purposes.
When a message arrives, the sender's name and a short preview of the message may appear on your device's lock screen (or in a web-push notification). You can limit or turn off this preview from your device's/browser's notification settings.
Details on retention and destruction are set out in the Privacy Policy and the Data Retention and Disposal Policy.
Pursuant to KVKK Art. 11, by applying to the data controller you have the following rights:
Note for users located in the EU: Under the GDPR you may additionally have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing, and you may lodge a complaint with the competent supervisory authority.
You may submit your requests regarding the above rights, together with information verifying your identity, to the data controller via the following channels:
Your application will be concluded within the periods prescribed by the applicable legislation (as a rule, at the latest within thirty days). If the process additionally requires a cost, a fee at the tariff set by the Board may be charged.
If your application is rejected, if you find our response insufficient, or if you do not receive a timely response; you retain the right to file a complaint with the Personal Data Protection Board within thirty days from the date you learned of the response and, in any event, within sixty days from the date of application.
This Privacy Notice may be revised in line with changes in legislation or updates to our data processing practices. The current version is always made accessible within the app and together with the Privacy Policy. We will inform you by appropriate means of significant changes.
*This notice, together with the Terms of Use, Privacy Policy and Explicit Consent Text, forms a whole. In case of conflict, KVKK and applicable legislation prevail.*