Privacy Policy

1. Who We Are

TurkishLocal ("we," "us," "our") operates TurkishLocal.com. This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with the Platform, and describes your rights under applicable data protection law, including Türkiye's Personal Data Protection Law No. 6698 ("KVKK") and, where applicable to you, the EU General Data Protection Regulation ("GDPR").

2. Data We Collect

We collect the following categories of personal data:

• • Account data: email address, name, and locale preference.
• • Business listing data: business name, address, contact details, description, media, and verification documents you submit.
• • Payment data: processed directly by Stripe; we retain only subscription status and transaction metadata, never full card numbers.
• • Affiliate data: referral activity, click and conversion events, and payout details.
• • Usage data: pages viewed, interactions (calls, clicks, profile views), device and browser information, and approximate location derived from IP address.
• • Communications: any correspondence you send us.

3. How We Use Your Data

We process personal data to:

• • Provide, operate, and maintain the Platform, including authentication and business listings;
• • Process subscription payments and Boost purchases;
• • Calculate and pay affiliate commissions;
• • Verify business claims and prevent fraud;
• • Communicate with you about your account, transactions, and updates to the Platform;
• • Analyze usage to improve the Platform's features and performance;
• • Comply with legal obligations.

4. Legal Basis for Processing

We process personal data on the basis of: performance of a contract (providing the Platform's services to you), your explicit consent (where required, such as marketing communications), our legitimate interests (fraud prevention, service improvement), and compliance with legal obligations.

5. Third-Party Service Providers

We share personal data with the following categories of service providers, solely to the extent necessary for them to perform services on our behalf:

• • Supabase — database hosting and authentication (EU-based infrastructure);
• • Stripe — payment processing;
• • Cloudflare — media (photo) storage and content delivery;
• • Google — sign-in (OAuth), business location data (Places), and address geocoding (via Mapbox);
• • Mapbox — maps and geocoding.

These providers are contractually bound to process personal data only as instructed by us and to apply appropriate technical and organizational security measures. We do not sell personal data to third parties.

6. International Data Transfers

Where personal data is transferred outside Türkiye or the European Economic Area, we rely on the transfer mechanisms recognized under KVKK and, where applicable, GDPR (including standard contractual clauses), to ensure an adequate level of protection for your data.

7. Data Retention

We retain personal data for as long as necessary to provide the Platform's services and to comply with our legal obligations. Account data is retained for the life of your account and deleted or anonymized within a reasonable period after account closure, except where longer retention is required for legal, tax, or fraud prevention purposes.

8. Your Rights

Under KVKK Article 11 and, where applicable, GDPR, you have the right to: learn whether your personal data is being processed; request information about such processing; learn the purpose of processing and whether your data is used accordingly; know the third parties to whom your data is transferred; request correction of incomplete or inaccurate data; request deletion or anonymization of your data; object to a result that is to your detriment arising from analysis of your data exclusively through automated systems; and request compensation for damages arising from unlawful processing. To exercise these rights, contact us using the details below.

9. Cookies

We use essential cookies required for authentication and session management, and limited analytics cookies to understand Platform usage. We do not use cross-platform advertising cookies.

10. Children's Privacy

The Platform is not directed to individuals under the age of 18, and we do not knowingly collect personal data from children.

11. Data Security

We apply industry-standard technical and organizational measures — including encryption in transit, role-based access control, and row-level database security — to protect personal data against unauthorized access, loss, or misuse.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or by email at least fourteen (14) days before taking effect.

13. Contact

For any question or request regarding this Privacy Policy or your personal data, contact us at merhaba@turkishlocal.com.