Wherlyst
Get the app
Menu

Information Notice on the Processing of Personal Data (Art. 10 KVKK)

Kişisel Verilerin İşlenmesine İlişkin Aydınlatma Metni (KVKK md. 10)

Contents

Contents

Controller: 90Piksel Bilgisayar Bilişim Elektronik Taş. Tur. Tic. Ltd. Şti. ("Wherlyst") · Mansuroğlu Mah. 288/4 Sok. No: 16 D: 27, Bayraklı, İzmir, Türkiye · MERSİS: 0001096226500001 · KEP: 90pikselbilgisayar@hs01.kep.tr · wherlyst@90pixel.com

As controller under Turkish Personal Data Protection Law No. 6698 ("KVKK"), Wherlyst processes your personal data as described below.

1. Personal data processed

  • Identity and contact: display name, email address, Apple/Google account identifier.
  • User content: places you save (name, address, coordinates), notes, folders, source links, photos and videos.
  • Link resolution data (transient): the address of a link you share; text from the share sheet (including text-only shares without a link); the title, description and address information of the linked page (general websites and Instagram, TikTok, X and YouTube post pages; name, address, coordinates). This is processed only to suggest a place; in Wherlyst's systems it is held in memory only and not stored; for place detection it may be sent, without your identity, to a language-model service (Google - Gemini API, paid service); this service may process in Google facilities in various countries, Google does not use the data for product development and keeps it for no longer than 55 days to prevent abuse (Wherlyst does not store it). Information about third parties that may appear on the page, in the post or in text you share (e.g. a business owner's name, an @username, a person's name in the text) is processed momentarily for this purpose; web addresses, email addresses and phone numbers inside text are removed before anything is sent to the model. Link address: if the quick methods find no place, the address of the link you saved (query string and # fragment removed) is also sent to the same service, and Google may read the public page itself (including Instagram, TikTok and X post pages, excluding YouTube); the address sent and the content Google reads fall under the retention of no longer than 55 days, and Wherlyst does not store page content; links that require sign-in or look like private tokens are not sent; information about people named on the page or in the address (e.g. the post owner's username) may reach Google this way (legitimate interest, Art. 5(2)(f)). Instagram preview: the public title, description and image address of an Instagram link you added or opened yourself are read from your device and the image is shown directly from Instagram's content network (Instagram/Meta sees your IP address in that request); this data is not sent to Wherlyst's servers or stored, and may be cached on the device for up to 7 days.
  • Multi-place list and "Find later" data: If a post you share lists several places, the place names (name, district/city; up to 10) are extracted with the AI service and each is looked up, without your account identity and without the link, in Google's Places service (transfer abroad, §5). The extracted rows (place name, district, verified/not found status, location data returned by Google), including places you do not pick, are kept in your account until the related record or share is deleted; only you can see them. The Google name of the place you pick is written as your own name for the record. On iOS the Google-sourced coordinates may be drawn on Apple Maps on your device to show the list. The full text of the post is not stored. Caption, location tag and hashtags of a share left with "Find later": On your device only; deleted when the place is confirmed, when you delete the record or discard the share, when you sign out, delete your account or uninstall the app, and in any case no later than 30 days (Privacy Policy §8).

Sending data to a language model (and the related transfer abroad) happens for all accounts, free and paid**; the rule-based method is only a fallback when the service is switched off or returns an error, and then nothing is sent out.

  • Sharing: folder memberships and roles, invitations, web links, who added each place.
  • Transaction security: IP address, device and session information, security and access logs, error logs; the country code determined at account creation (no IP stored; only for breach notification and non-personal aggregate counts; does not mean country of residence).
  • Age confirmation: your confirmation, when creating an account (given together with the sign-up acceptance), that you meet the minimum age (16; 18 in the US), the time of acceptance and the version of the text package you accepted. Your date of birth or age is not asked or stored.
  • Usage measurement (identity-free): events about which screens and steps are used in the app (e.g. share screen opened, save completed or abandoned, place suggestion accepted, map and plan screens viewed), event time, device type, operating system and version, app version and language. These events are not linked to your account, your email address or any identifier of your device; your IP address is not stored together with the measurement record (traffic logs kept under a legal obligation are separate and access-restricted); the content of your places, notes, links, photos/videos, folder names and location is not part of the measurement. Events are kept only on our own servers (EU) for up to 13 months, then deleted or turned into aggregate values that cannot be linked to you; no advertising, profiling or sharing with third parties. While offline, events may be held on your device for up to 7 days and sent once you are online. You can ask for measurement to be stopped for you at wherlyst@90pixel.com (there is no in-app switch); your request is recorded per device, separately from the measurement events.
  • Quota and device setting: to apply the daily limit, your time zone (e.g. Europe/Istanbul; not location; used only on a free account so the daily limit resets at local midnight, and for no other purpose; not processed during the paid plan or trial) and the number of places your account created that day (up to 3 days); shares held on your device to be added tomorrow when the daily limit is reached (on your device only; not deleted until you delete them; we ask every 14 days).
  • Customer transactions: subscription status, store transaction IDs, purchase date and amount, version of the confirmed pre-purchase text; support and request correspondence, content reports.
  • Marketing: not processed.
  • Location: locations of saved places; approximate location rounded to ~1 km in place search (not stored); the ID or coordinates of the place you select on the share screen, sent to check whether it is already among your saved places (not stored for this check). Your device's live location is used only on your device and not transferred to us.
  • Special category data: not intended to be processed; no inference or profiling from saved places.

2. Purposes

Creating and managing your account (including applying the minimum age); providing places, folders, map, search and sharing; suggesting places from shared links; running paid plan processes (purchase, renewal, refund, transfer); sending transactional notifications; information security and abuse prevention; reviewing content reports and enforcing community rules; responding to authorities; answering rights and support requests; improving the service with content-free aggregate counts (including an account-creation-path count, not linked to you, derived on our servers from data already held for the service); developing the product with identity-free usage measurement; monitoring app stability through crash reports; notifying authorities and affected people of a data breach.

  • Necessary for the conclusion or performance of a contract (Art. 5(2)(c)).
  • Compliance with a legal obligation (Art. 5(2)(ç)): Law No. 5651, consumer and tax law, KVKK requests, authority requests.
  • Establishment, exercise or protection of a right (Art. 5(2)(e)): proof of pre-purchase information and mandatory notices, disputes.
  • Legitimate interests, provided your fundamental rights are not harmed (Art. 5(2)(f)): security logs, debugging, content-free aggregate measurement, abuse prevention; momentary processing, without storage in Wherlyst, of information about third parties named on the page, in the post or in text you share, solely to suggest a place, including sending that information to a language model for place detection (balancing test: the request is yours, the data is mostly public, nothing is stored, identity-free processing in an EU region, objection route). You can object under Art. 11.
  • Identity-free usage measurement (§1): legitimate interests (Art. 5(2)(f)) - understanding and improving where the product is hard to use; balancing test: no identifier (no account, email, device or random ID), no content, IP not stored together with measurement data (only in legally required traffic logs, kept separately with restricted access), no advertising/profiling, processing on our own servers in the EU; there is no in-app switch, objection is by email. You can object under Art. 11 (wherlyst@90pixel.com or account deletion).
  • AI place detection with a third-party language model (§1, §5): the processing is part of the Service and the place-suggestion feature whatever your plan, hence performance of a contract (Art. 5(2)(c)); for third parties named on the page, post or text, legitimate interests (Art. 5(2)(f), below). No separate permission or consent is requested; it applies on every plan when you use the feature. No consent is sought for the transfer abroad (Art. 9 KVKK; §5).
  • Explicit consent (Art. 5(1)): no processing relies on explicit consent. The sign-up acceptance (Terms acceptance + notice acknowledgement) is not explicit consent; there is no consent switch in Settings. In-app crash reports (device model, OS, app version, stack trace; no content or email; up to 90 days) are processed under legitimate interests (Art. 5(2)(f): app stability and security); you can object under Art. 11.
  • Using your contact details to notify a personal data breach (Art. 12(5)): legal obligation (Art. 5(2)(ç)). Storing the country code determined at sign-up in preparation for that notification: legitimate interest (Art. 5(2)(f)); you can object under Art. 11 and the code is then deleted.
  • Age confirmation and acceptance record (time, text version): necessary for the conclusion of a contract (Art. 5(2)(c)) and proof for the establishment or protection of a right (Art. 5(2)(e)).

4. Method of collection

Through the mobile app, web view pages and email; from information you enter, Apple and Google sign-in, App Store and Google Play, the public or official interfaces of links you share, the public page metadata of general websites and of Instagram, TikTok, X and YouTube post pages (from our servers; the target server's robots.txt rules are evaluated before content is requested, and for short links only the redirect request precedes that evaluation; the site sees our server's IP address), and system logs, by automated or partly automated means. Pages of Facebook, Threads, LinkedIn, Reddit, Pinterest and Snapchat are not read from our servers.

5. Recipients

  • Other users: members of folders you share; anyone with a web link if you turn one on.
  • Service providers (processors), in Türkiye and abroad: hosting and database (EU), content delivery and file storage, email delivery, notification infrastructure, error monitoring, AI-assisted place detection (Google - Gemini API, paid service; without your identity, shortened and cleaned text), support mailbox. Current list: wherlyst.com/subprocessors.
  • Independent controllers: Apple and Google (sign-in, store payments, notifications).
  • Competent public authorities and courts, under legal obligations.

International transfers: Our servers are in the European Union; some providers are in the US or global; the AI service is provided through Google's Gemini API, where processing may take place in Google facilities in various countries and is not limited to the European Union, so this also counts as a transfer abroad. Transfers abroad are made under the standard contracts published by the Turkish Personal Data Protection Board under Art. 9 KVKK and notified to the Authority.

6. Retention

Data is kept for as long as the purpose requires and as laws prescribe, then deleted, destroyed or anonymised. On account deletion, data is removed from live systems within 30 days and from backups within 35 days, except records subject to statutory retention. Accounts unused for 12 months are deleted after warnings. Full table: Privacy Policy §8.

7. Your rights under Art. 11 KVKK

To learn whether your data is processed and request information; learn the purpose and whether it is used accordingly; know recipients in Türkiye or abroad; request correction; request erasure or destruction under Art. 7 KVKK; request notification of these actions to recipients; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

Objection and withdrawal (there is no separate in-app switch): To object to or withdraw from usage measurement, crash reports and AI place detection, write to wherlyst@90pixel.com (answered within 30 days at the latest) or delete your account; for AI processing you can also simply not use the feature. On account deletion these processing activities end for your account.

How to apply: Settings > Account & privacy in the app; email wherlyst@90pixel.com (from your registered address); registered e-mail (KEP) 90pikselbilgisayar@hs01.kep.tr; or a signed letter to Mansuroğlu Mah. 288/4 Sok. No: 16 D: 27, Bayraklı, İzmir, Türkiye. Requests are concluded free of charge within 30 days. More: Privacy Policy.