Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how KUTAY YAZILIM MÜHENDİSLİK ("Company", "we", "us") collects, processes, stores, transfers and protects personal data of users ("User", "you") of the Bi Kahve mobile application ("App") and the bikahveapp.com website ("Site"), in compliance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU General Data Protection Regulation ("GDPR" — where applicable) and other relevant legislation.

Bi Kahve uses artificial intelligence to generate entertainment-only coffee fortune readings. By downloading, installing or using the App, you confirm that you have read, understood and accepted this Policy.

2. Data Controller

The data controller under the KVKK and GDPR is:

• Name: KUTAY YAZILIM MÜHENDİSLİK
• App: Bi Kahve
• Website: https://bikahveapp.com
• Email: info@bikahveapp.com

3. Personal Data We Collect

We process the following categories of personal data to provide, maintain, and improve the Service and to fulfil our legal obligations.

3.1. Camera and Image Data

• Coffee cup photographs: Images of your Turkish coffee cup that you capture or upload through the App in order to generate a fortune.
• These images are transmitted to the AI model only to generate a reading. As a rule, they are not retained server-side after the reading is created; a subset may be retained for up to 90 days strictly for quality improvement, but only with your explicit consent.

3.2. Device and Technical Information

• Device model, operating system version, language and region preferences
• App version, unique device identifiers (IDFV, Android ID)
• Advertising identifier (IDFA / GAID — only with your explicit consent)
• IP address, network information, mobile carrier information
• Crash reports, performance and error logs

3.3. Usage and Analytics Data

• In-app interaction data (screens viewed, taps, session duration)
• Reading frequency, features used, premium conversion metrics
• Pseudonymized / anonymized behavioural analytics

3.4. Account and Identity Information (optional)

• Email address, username (when an account is created)
• Identity information received from third-party providers when using Sign in with Apple or Google (email, name)
• Push notification tokens

3.5. Payment and Subscription Information

• Subscription status, subscription start and end dates, purchase history
• Transaction identifiers provided by Apple App Store and Google Play Store
• We do not collect or store your payment card or billing information. All transactions are processed by Apple App Store, Google Play Store and our subscription manager RevenueCat.

3.6. Support and Communication Data

• Emails, support tickets and feedback you send us
• Date, time and content of related communications

4. Purposes of Processing

We process your personal data for the following purposes:

• Operating the App, generating fortune readings and providing the Service
• Improving user experience and resolving technical issues
• Managing subscriptions, purchases and payment flows
• Analysing crash and error reports to stabilise the App
• Creating anonymised usage statistics
• Complying with legal obligations (tax, consumer law, court orders)
• Evaluating and improving the quality of the Service
• Sending promotional content and push notifications where you have given consent
• Detecting and preventing fraud, abuse and unauthorised use
• Responding to customer support requests

5. Collection Methods and Legal Basis

Personal data is collected via the App, the Site, email, support channels and third-party providers (App Store, Google Play, Firebase, RevenueCat, etc.) through automated and partly automated means.

Legal bases relied upon include:

• Your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)) — marketing, ad personalisation, camera access
• Performance of a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)) — provision of subscription / Service
• Compliance with a legal obligation (KVKK Art. 5/2(ç); GDPR Art. 6(1)(c))
• Establishment, exercise or defence of legal claims (KVKK Art. 5/2(e))
• Legitimate interests (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)) — security, fraud prevention, service improvement

6. Third-Party Services

We rely on the following third-party providers. Each provider's own privacy policy applies in addition to ours.

6.1. AI Providers

• Large language and vision model providers such as OpenAI, Google AI or Anthropic, used to analyse your cup image.

6.2. Analytics and Reporting

• Google Analytics for Firebase — usage statistics
• Firebase Crashlytics — crash reporting
• Firebase Performance Monitoring — performance analysis

6.3. Subscription Management

• RevenueCat — subscription state management and validation
• Apple App Store / Google Play Store — in-app purchases

6.4. Advertising

• Google AdMob — ads for free users (personalised ads only with your consent)

6.5. Notifications

• Firebase Cloud Messaging — push notifications

7. Data Transfers

Your personal data may be transferred to the following recipients in accordance with KVKK Articles 8 and 9 and applicable GDPR provisions:

• Competent public authorities (in fulfilment of legal obligations)
• Cloud infrastructure providers (Google Cloud, AWS, Firebase — servers may be located outside Türkiye / the EEA)
• AI model providers (for image and text processing — may be located abroad)
• Payment and subscription providers (Apple, Google, RevenueCat)
• Analytics and performance providers
• Legal advisors, accountants and audit firms

International transfers are made subject to KVKK Art. 9, your explicit consent and/or appropriate safeguards (such as standard contractual clauses) as required by applicable law.

8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve user experience, analyse traffic and manage sessions.

• Strictly necessary cookies are required for basic site functionality and do not require consent.
• Analytics cookies are used to analyse visitor behaviour.
• Advertising cookies are used for personalised ads only with your explicit consent.

Within the App we do not use cookies; instead we rely on device identifiers and SDK-level tracking. You can manage tracking preferences from your device settings (iOS: "Settings > Privacy > Tracking" / Android: "Reset / Delete advertising ID").

9. Data Retention Periods

• Cup images: Deleted after the reading is generated; may be retained up to 90 days for quality improvement only with consent.
• Fortune reading texts: Kept while your account is active; permanently deleted within 30 days of account deletion.
• Account information: Stored while the account is active; deleted within 30 days of an account deletion request.
• Subscription and payment records: Retained for 10 years to comply with tax legislation.
• Support communications: Retained for 3 years.
• Analytics data: Anonymised data may be retained indefinitely.

10. Data Security

We implement industry-standard technical and organisational measures to protect your data:

• TLS / HTTPS encrypted transmission
• Server-side AES-256 encryption for applicable data
• Role-based access for authorised personnel
• Regular security and penetration testing
• Confidentiality agreements with employees
• Firewalls and intrusion detection systems
• Regular backups and disaster recovery plans

Despite these measures, no method of transmission over the internet is 100% secure and we cannot guarantee absolute security.

11. Children's Privacy

Bi Kahve is not directed at children under the age of 13 (or 16 in the European Union) and we do not knowingly collect personal data from such users.

If we discover that we have collected data from a child under the applicable age, we will delete it immediately. If you believe your child has provided us with personal data, please contact us at info@bikahveapp.com.

12. Your Rights under KVKK and GDPR

Under Article 11 of the KVKK and the GDPR (where applicable) you have the right to:

1. Learn whether your personal data is being processed
2. Request information about the processing
3. Learn the purposes of processing and whether data is used in line with those purposes
4. Know the third parties (domestic or foreign) to whom your data has been transferred
5. Request correction of inaccurate or incomplete data
6. Request deletion or destruction of your data under the conditions of KVKK Art. 7
7. Request that correction, deletion and destruction be communicated to third parties
8. Object to a result produced exclusively by automated processing that adversely affects you
9. Request compensation for damages arising from unlawful processing

If you are within the scope of GDPR, you additionally have the right to data portability, the right to restrict processing, and the right to lodge a complaint with a supervisory authority.

13. How to Exercise Your Rights

To exercise any of the rights above, please send your request to info@bikahveapp.com. Your request should include:

• Full name and signature (for written requests)
• Information sufficient to verify your identity
• A reply address or email
• The subject of your request

We will respond to your request within 30 (thirty) days, free of charge in principle. A reasonable fee set by the Personal Data Protection Authority may be charged if the request requires substantial work.

If your request is rejected or no response is provided within the legal timeframe, you may file a complaint with the Personal Data Protection Authority (KVKK Authority) or your local supervisory authority.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated via the App, by email or on the Site. Please review this Policy periodically. The "Last updated" date appears at the top of this page. Continued use of the App after changes constitutes your acceptance of the updated Policy.

15. Contact

• Company: KUTAY YAZILIM MÜHENDİSLİK
• Email: info@bikahveapp.com
• Website: https://bikahveapp.com