Privacy Notice on the Processing of Personal Data under the Turkish Personal Data Protection Law (KVKK)

Last updated: 14 August 2026 · Version: 1.0

1. Purpose of this privacy notice

This Privacy Notice has been prepared to inform you about the purposes for which, the methods by which and the legal bases on which your personal data is processed, and to whom it may be transferred, within the scope of the piCue mobile application, the picue.app website and the related digital services operated or managed by Piklabs Yazılım ve Teknoloji Hizmetleri Limited Şirketi.

This text has been drawn up in order to fulfil the data controller's obligation to inform under Article 10 of the Personal Data Protection Law No. 6698.

This Privacy Notice is not an explicit consent text. The fact that this text is presented to you does not mean that you have given explicit consent for the processing of your personal data in every case. For personal data processing activities for which explicit consent is legally required, explicit consent that is specific to the relevant subject, informed and given by free will is obtained separately from this text.

The obligation to inform and the process of obtaining explicit consent are carried out separately from each other. If another condition for processing personal data provided for in the law exists for the creation of an account, the provision of core services, security operations or compliance with legal obligations, no separate explicit consent is obtained for such processing.

2. Data controller

The data controller that determines the purposes and means of processing your personal data:

Trade name: Piklabs Yazılım ve Teknoloji Hizmetleri Limited Şirketi
Company type: Limited liability company
MERSIS number: 0729137662600001
Trade registry office: İstanbul Ticaret Sicili Müdürlüğü
Trade registry/file number: 1150953
Registered address: Gayrettepe Mah. Nurgül Sk. Polat 8 Apt. No: 8 İç Kapı No: 2, Beşiktaş/İstanbul
Website: picue.app
Address for personal data applications and contact: hey@picue.app
Address for user support and moderation: support@picue.app

Piklabs Yazılım ve Teknoloji Hizmetleri Limited Şirketi acts in the capacity of data controller to the extent that it determines the purposes and means of processing personal data within the scope of the piCue mobile application, the picue.app website and the related digital services.

Personal data applications may be sent to hey@picue.app; applications relating to user content, moderation decisions, account security, technical support and community matters may be sent to support@picue.app.

During an application, reasonable additional information may be requested in order to verify that the applicant is in fact the data subject and to prevent the unlawful disclosure of personal data belonging to third parties.

3. Scope of this privacy notice

This Privacy Notice applies to the following services and data processing activities:

• the piCue mobile application,
• the picue.app website,
• user accounts and account management,
• the İzleme DNA feature,
• the Picsona feature,
• film and series recommendation systems,
• user profiles,
• thread, comment and voting features,
• follow and follower features,
• favourites, watchlists and collections,
• CueMates matches,
• in-app games and scoring features,
• the Plus subscription,
• in-app notifications,
• advertising display and advertising measurement,
• user support processes,
• complaint and moderation processes,
• account deletion and data applications,
• membership and contact transactions on the website.

The independent data processing activities of application stores, payment institutions, advertising providers, content providers and websites operated by third parties fall outside the scope of this Privacy Notice. Those organisations are separately responsible under their own privacy policies and user agreements.

4. Categories of personal data processed

Depending on the services you use, your account settings, your device and the permissions you have granted, the following categories of personal data may be processed.

• Identity and account data: Username, display name, account ID, profile information, account creation date, account status, account closure record and the technical identifiers associated with the account.
• Contact data: E-mail address, e-mail verification information, contact details shared in support requests and contact records used for account security purposes.
• Profile and visual data: Profile photo, cover photo, images uploaded by the user, descriptions relating to those images and visibility preferences.
• Age and region data: Date of birth, age information or age verification result, together with the province and district information entered by the user. Given the current design of the service, the collection of GPS data, precise location or continuous real-time location information is not intended.
• Content and preference data: Answers given to the İzleme DNA test, card selections, favourites, watched content, watchlists, collections, film and series preferences, recommendation results and user interactions.
• Community data: Threads, comments, votes, followed accounts, followers, CueMates matches, game scores, public collections and other user activities within the community.
• Support and moderation data: User complaints, reason for the complaint, complaint description, review records, moderation decisions, removed content, warnings, temporary suspensions, account closure records and objections to moderation decisions.
• Subscription and transaction data: Whether the Plus subscription is active, subscription type, subscription start and end information, application store transaction ID, purchase verification records and the technical information required to manage the subscription status.
• Device and technical data: Device model, operating system, application version, IP address, session records, security records, device identifier, notification device token, error logs, access times and the technical log records required for the operation of the service.
• Advertising and measurement data: Advertising identifier, advertising display and interaction information, advertising preferences, limited measurement data relating to application usage and records concerning consent to personalised advertising.

5. Data that is not intended to be processed

Given the current design of the service, it is not intended to request the following data from users or to process it within the scope of ordinary service provision:

• GPS or precise location data,
• continuous real-time location data,
• address book and contact lists,
• calendar information,
• microphone recordings,
• continuous camera images or audio recordings,
• the entire device gallery,
• health data,
• racial or ethnic origin information,
• political opinion,
• religious or philosophical belief,
• sexual life or sexual orientation,
• biometric data,
• genetic data.

When you use the photo upload feature, only the file you select is intended to be transmitted to the application. Access to the entire device gallery is not intended.

It is not piCue's purpose for special categories of personal data to be shared in threads, comments or profile fields. However, if you share such data publicly of your own volition, the content may become accessible or subject to review within the scope of the platform's technical operation and moderation processes.

6. Purposes of processing personal data

Your personal data may be processed for the following purposes:

• Creating and managing the user account,
• Carrying out sign-in and account verification operations,
• Ensuring account security,
• Applying age requirements and restrictions on access to the service,
• Operating the İzleme DNA feature,
• Providing the Picsona feature,
• Generating film and series recommendations,
• Applying user preferences,
• Providing the thread, comment, follow, collection and game features,
• Carrying out CueMates matches,
• Publishing user content in line with visibility preferences,
• Receiving and assessing user complaints,
• Ensuring content moderation and community safety,
• Preventing misuse, spam, fake accounts and fraudulent activities,
• Carrying out information security and cyber security processes,
• Verifying the Plus subscription,
• Providing subscription services,
• Displaying advertisements and measuring advertising display,
• Applying personalised advertising preferences,
• Sending notifications in line with the user's preferences,
• Performing technical error and performance analyses,
• Developing the application and the services,
• Responding to user support requests,
• Compliance with legal obligations,
• Responding to lawful requests from competent public authorities and institutions,
• Producing evidence in legal disputes,
• Ensuring the establishment, exercise or protection of a right,
• Ensuring the technical and commercial continuity of the application,
• Preventing misuse of the service.

Where a new processing purpose arises, the necessary information is provided for that purpose. If the new purpose is not compatible with the existing purposes and no other processing condition provided for in the law exists, explicit consent is obtained separately.

7. Methods of collecting personal data

Personal data may be collected by the following methods:

• the account creation screens in the piCue mobile application,
• profile and account settings,
• the membership, contact and support forms on the picue.app website,
• the answers given to the İzleme DNA and Picsona features,
• threads, comments, votes and community content,
• favourites, watchlists and collections,
• user complaints and moderation applications,
• account deletion and personal data applications,
• device and application usage records,
• subscription verification records obtained from application stores,
• advertising and notification permissions,
• cookies, local storage and similar internet technologies,
• technical or subscription verification records obtained from service providers,
• lawful notifications received from competent authorities and institutions.

Personal data is obtained directly from the user to the extent possible. Information obtained from service providers is processed only to the extent necessary for the performance of the relevant service.

8. Legal bases for processing personal data

Personal data is processed on the basis of the legal basis applicable to each processing activity.

• Conclusion or performance of a contract: The data required for creating an account, signing in, providing the core piCue features, generating film and series recommendations, operating the community features and granting the Plus subscription may be based on this legal basis.
• Compliance with a legal obligation: Data may be processed for the purposes of keeping financial and commercial records, responding to lawful requests from competent authorities and institutions, and fulfilling retention and notification obligations arising from legislation.
• Establishment, exercise or protection of a right: Data may be processed for the purposes of carrying out complaint and moderation processes, security reviews, fraud assessments, managing disputes and assessing legal claims.
• Legitimate interest of the data controller: The data required for ensuring the security of the service, preventing misuse, combating fake accounts, resolving technical problems, developing the application and operating the platform securely may be processed, provided that it does not harm the fundamental rights and freedoms of the data subject.
• Explicit consent: Explicit consent may be obtained in respect of personalised advertising, optional marketing communications, optional promotional notifications or other activities for which explicit consent is legally required.

As a principle, a processing activity that does not require explicit consent is not made conditional upon explicit consent. Not giving explicit consent does not, as a rule, prevent you from using the core services that do not require explicit consent.

9. Special categories of personal data

For the ordinary operation of the service, Piklabs does not request from users special categories of personal data such as health data, biometric data, genetic data, political opinion, religious or philosophical belief, or sexual life or sexual orientation.

It is possible for users to share special categories of personal data of their own volition in threads, comments, profiles, images or support fields. If such data is transmitted to the platform, then to the extent necessary, for the purposes of;

• content moderation,
• community safety,
• examining a complaint,
• compliance with legal obligations,
• security review,
• establishment, exercise or protection of a right

it may be reviewed.

Users should not share special categories of personal data belonging to themselves or to third parties in community areas. If special categories of data belonging to third parties are shared unlawfully, the content may be removed or action may be taken in respect of the account under the application rules.

10. Persons and organisations to which personal data may be transferred

Personal data may be transferred to the following groups of persons and organisations, limited to the processing purposes:

• Service and infrastructure providers: Providers of authentication, database, file storage, hosting, e-mail, notification, security, technical support and application infrastructure services.
• Application stores and subscription providers: Apple, Google, application stores and subscription verification services.
• Subscription management providers: RevenueCat or equivalent providers used for verifying the subscription, matching purchase information and managing the Plus service.
• Advertising and measurement providers: Google AdMob and other advertising or measurement providers used. In respect of personalised advertising, device permissions and user preferences are taken into account.
• E-mail service providers: Resend or equivalent service providers used for delivering account verification, user information, support and security e-mails.
• Content service providers: Providers such as TMDB that offer services for querying film and series credits, posters or content information. It is intended that only the necessary content queries are sent to these providers, without transferring personal user data to them.
• Competent public authorities and institutions: Public authorities and institutions that are legally competent and make lawful requests.
• Legal, financial and technical advisers: Advisers and service providers that are required to access personal data for the purposes of a legal dispute, audit, financial obligation, information security or the continuity of the service.
• Analytics providers: PostHog or equivalent analytics providers used for the purposes of measuring application usage and developing the service. In this context, screen view records, feature usage events and session duration information are transferred, together with the account ID, username and subscription status; user-generated content texts are not transferred. The processing is based on the legitimate interest of the data controller pursuant to Article 5/2-(f) of the KVKK, and the data subject can turn this preference off from within the application.
• Artificial intelligence service providers: Google or equivalent artificial intelligence model providers used for the purpose of generating automated replies from the character accounts in the application. When a user tags a character account, the message of the person doing the tagging, the relevant thread and comment texts, and the display names of the users who wrote that content are transferred. E-mail address, username and account ID are not transferred. Under the provider's paid usage terms, the transferred data is not used for model training. The transfer is based on the performance of a contract in respect of providing a service feature initiated by the user's own action, and on the legitimate interest of the data controller in respect of the thread and comment context required for the reply to be generated appropriately for that context.
• Notification infrastructure providers: Google Firebase Cloud Messaging or equivalent providers used as the notification delivery infrastructure. In this context, the device notification token and the notification content are transferred; the transfer is made in line with the user's explicit notification preferences and for the purpose of providing the service.

Personal data is transferred in a manner that is connected with, limited to and proportionate to the purpose of the transfer. The contractual and technical measures necessary to ensure that data processors act in accordance with Piklabs' instructions are taken.

11. Transfer of data abroad

Personal data may be transferred abroad or processed abroad where Supabase servers are located in the European Union or where service providers such as Apple, Google, RevenueCat, Resend, AdMob and PostHog use global infrastructure.

The following matters are taken into account in respect of transfers abroad:

• The categories of data to be transferred,
• the purpose of the transfer,
• the data recipient or the group of recipients,
• the country in which the data may be processed,
• the duration of the transfer,
• the sub-processors of the data recipient,
• the legal safeguard for the transfer,
• technical and administrative measures.

Piklabs carries out transfers abroad in accordance with the KVKK provisions in force. Where an adequacy decision exists for the country to which the transfer is to be made, that mechanism applies; where there is no adequacy decision, one of the appropriate safeguard methods provided for in the legislation is applied.

Where the required conditions are met, the standard contract published by the Board may be used. If a standard contract is used, notification is made to the Authority within the period provided for in the legislation as from the signing of the contract.

Basing a transfer abroad on explicit consent is possible only where the conditions provided for in the legislation are met. In such a case, the data subject is separately informed about the possible risks of the transfer.

12. Advertising and personalised advertising data

If you do not have a Plus subscription, advertisements may be displayed within the application. Within the scope of advertising display and measurement, the advertising identifier, device information, limited technical data and interaction information relating to the display of advertisements may be processed.

The following elements are taken into account in respect of the display of personalised advertising:

• The device's advertising identifier,
• operating system permissions,
• app tracking permission,
• the technical configuration of the advertising provider,
• the user's advertising preferences.

If you do not give permission for personalised advertising, advertisements may still be displayed; however, the personalisation of advertisements according to areas of interest may be limited.

Where explicit consent must be obtained for the purpose of personalised advertising, such consent is obtained separately from this Privacy Notice. Not giving consent affects advertising personalisation that is not necessary for the provision of the core piCue services; it does not, as a rule, prevent the creation of your account or the use of the core services.

13. Notification data

In order for notifications to be sent, the device token, notification preferences and notification delivery records may be processed.

Notifications may be sent for the following purposes:

• Account security,
• e-mail verification,
• password and account operations,
• subscription status,
• the operation of the service,
• community activities,
• follows and interactions,
• product information,
• promotion or marketing for which you have separately given permission.

Notifications necessary for the operation of the service are kept separate from optional marketing notifications. You can change the notification permission from your device settings or from the in-app notification preferences section.

The legislation and permission processes that additionally apply to the sending of commercial electronic messages are reserved.

14. Profile, community and user content

The following information shared publicly by the user may be seen by other users, depending on the settings of the relevant features:

• Username,
• display name,
• profile photo,
• cover photo,
• shared threads,
• comments,
• votes,
• public lists,
• follow and follower relationships,
• public collections,
• the Picsona card where the visibility setting is on,
• other user content published in community areas.

The e-mail address, date of birth, account security records and the identity of the person submitting a complaint are not displayed in the public profile area.

Where content uploaded by a user contains personal data belonging to third parties, the user is responsible for sharing such data lawfully. Piklabs may review, restrict or remove content that is alleged to involve a personal data breach, a violation of privacy, threats, harassment, a security breach or a breach of the community rules.

15. Complaint and moderation data

If you submit a complaint about a thread, a comment or a profile, the following data may be processed:

• The identity of the account submitting the complaint,
• the content complained of,
• the reason for the complaint,
• the complaint description,
• the date of the complaint,
• the review record,
• the moderation outcome,
• the sanction applied,
• the record of objection and re-assessment.

As a rule, the identity of the person submitting a complaint is not shared with the user complained of. However, cases where this is mandatory due to a legal requirement, a request from a competent authority, judicial proceedings, the right of defence or the establishment, exercise or protection of a right are reserved.

Moderation records may, for the purposes of;

• ensuring content safety,
• assessing repeated violations,
• preventing fake accounts and misuse,
• concluding complaints,
• examining objections,
• compliance with legal obligations

be processed.

16. Retention periods

Personal data is retained for the period necessary for the processing purpose and for the period provided for in the relevant legislation or required in view of the processing purpose.

The following matters are taken into account in determining the retention period:

• The purpose for which the data is processed,
• whether the user account is open or closed,
• whether the subscription relationship continues,
• financial and commercial record retention obligations,
• whether there is a legal dispute or an investigation,
• security and misuse risk,
• the user's deletion request,
• the technical cycle of the backup system,
• whether the data needs to be retained on another legal ground.

Piklabs establishes a retention and erasure plan according to the categories of personal data and the processing purposes. This plan covers account data, contact data, subscription records, support records, moderation records, security records, advertising preferences, explicit consent records, backups and legal dispute files.

If the account is deleted, the profile, photos, lists, collections, threads, comments, follow relationships and user preferences are deleted or rendered incapable of being associated with an identity, unless there is a legal ground requiring their retention.

Records that must be retained under legislation, ongoing disputes, security reviews, financial records or data that is mandatory for the establishment and protection of a right may not be deleted immediately upon account deletion.

17. Data security

Piklabs applies appropriate technical and administrative measures to prevent the unlawful processing of and access to personal data, and its unlawful transfer, loss or destruction.

Depending on the technical structure of the service, these measures may include the following:

• Encrypting the transfer of data between the application and the server,
• not storing passwords in plain text,
• limiting access authorisations on a role and need-to-know basis,
• applying database access rules,
• logging administrator access,
• applying security updates,
• implementing backup and recovery processes,
• reviewing the security conditions of service providers,
• informing employees about confidentiality obligations,
• monitoring security incidents,
• carrying out regular risk assessments,
• periodically reviewing access authorisations.

If a data security breach is detected in which personal data has been obtained by unlawful means, the nature, scope and effects of the incident are assessed. The necessary notifications are made within the framework of the legislation in force.

18. Automated assessment and personalisation

Features such as İzleme DNA, Picsona and similar features may generate film and series recommendations or matching results based on the preferences provided by the user.

The purpose of these features is to personalise the user experience and to offer content recommendations. These systems are not intended to make any decision about the user that produces legal effects or that is similarly significant.

İzleme DNA answers, card selections, favourites, watchlists, watched content and similar preference data may be used in the personalisation systems.

If Piklabs uses an automated decision-making mechanism that significantly affects users' fundamental rights, separate information is provided about the nature of the decision, the categories of data used, its possible consequences and the applicable methods of objection.

19. Rights of the data subject

Under the KVKK, you have the following rights to the extent that the relevant conditions are met:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• To know the third parties to whom your personal data is transferred in Türkiye or abroad,
• To request rectification of incomplete or inaccurate personal data,
• To request the erasure or destruction of your personal data where the statutory conditions are met,
• To request that rectification, erasure or destruction operations be notified to the third parties to whom the personal data has been transferred,
• To object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
• To claim compensation for the damage if you suffer damage due to the unlawful processing of your personal data.

You can change your profile information from within the application and close your account via the “Delete my account” option.

You can send your other personal data requests to hey@picue.app. In your application you must state your request clearly and comprehensibly. If the application is made by a third party, documents evidencing the authority of representation may be requested.

During the assessment of the application, reasonable additional information may be requested in order to verify that the person making the application is in fact the data subject and to prevent the disclosure of personal data belonging to third parties.

20. Method of application for personal data

Applications under the KVKK may be made through the following communication channel:

E-mail: hey@picue.app

It is recommended that the application contain the following information:

• Name and surname,
• the personal data processing activity that is the subject of the application,
• a clear statement of the right being invoked,
• the contact address to which the application will be answered,
• information suitable for identity verification,
• any explanations supporting the request.

Applications are assessed within the procedures and periods provided for in the legislation in force. If the outcome of the application is found insufficient, if the application is rejected or if no response is given within the applicable period, the data subject's right to apply or lodge a complaint with the Personal Data Protection Board is reserved.

21. Withdrawal of explicit consent

You may withdraw at any time the explicit consent you have given in respect of personalised advertising, optional marketing communications, optional promotional notifications or other processing activities requiring explicit consent.

The withdrawal of consent may be carried out via;

• device settings,
• in-app preference screens,
• advertising preferences,
• notification settings,
• an application sent to hey@picue.app

any of the above channels.

The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of that consent before its withdrawal.

If the processing activity is based not on explicit consent but on another legal basis such as the performance of a contract, a legal obligation, the establishment, exercise or protection of a right, or the legitimate interest of the data controller, the withdrawal of explicit consent may not automatically terminate that processing activity.

22. Age limit and data relating to children

piCue's age limit is applied in a manner consistent with the actual technical operation of the application and with the age ratings in the application stores.

You must be at least 16 years old to use piCue. Age information is collected through the date of birth you declare when creating an account, and accounts that do not meet this requirement cannot be created. The date of birth is retained for the purpose of verifying the age requirement and providing the service in an age-appropriate manner. The age classification in the app stores has also been set in line with this limit. No processing activity requiring parental or legal guardian verification is carried out.

If it is determined that data belonging to a person under the age of 16 has been processed unlawfully or more extensively than necessary, the account may be restricted and the data may be deleted or anonymised, unless there is another legal ground requiring its retention.

23. Updating this privacy notice

This Privacy Notice may be updated in the event of changes to the services, the technical infrastructure, the processing purposes, the groups of persons to whom data is transferred, the legal bases or the legislation.

If an update is made, the last update date and the version number of the text are changed. For changes that significantly affect the categories of data processed, the processing purposes, the groups of persons to whom data is transferred or the rights of the data subject, an in-app notification, an e-mail or another method of information may be used, as appropriate to the nature of the change.

The current version of the Privacy Notice is published on picue.app and, where necessary, made accessible within the application.

24. Contact information

For your questions about the processing of personal data, your rights under the KVKK, data security or this Privacy Notice:

Piklabs Yazılım ve Teknoloji Hizmetleri Limited Şirketi
MERSIS number: 0729137662600001
Trade registry office: İstanbul Ticaret Sicili Müdürlüğü
Trade registry/file number: 1150953
Address: Gayrettepe Mah. Nurgül Sk. Polat 8 Apt. No: 8 İç Kapı No: 2, Beşiktaş/İstanbul
E-mail: hey@picue.app

For matters concerning user content, moderation decisions, account security and technical support:

• E-mail: support@picue.app
• Effective date: 14 August 2026 · Version: 1.0