Draft — pending legal review.

KVKK Privacy Notice

Last updated: 20 October 2026

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how your personal data is processed in connection with the Sizemira mobile app and its server. For a more detailed, plain-language description, see the Privacy Policy.

1. Data controller

Name: [DATA CONTROLLER NAME]
Address: [ADDRESS]
MERSİS / tax number: [MERSİS / TAX NO]
Registered email (KEP): [KEP ADDRESS]
Email: destek@sizemira.com

2. Our approach

Sizemira has no account or sign-in. We don’t ask for your name, email address or phone number. Your body measurements, height, weight, body twin, analyses and closet are stored only on your phone, and size recommendations are calculated on your phone. This data is not sent to us. Only the data listed below reaches our server. It does not identify you directly, but because it is linked to a random device ID, we treat it under KVKK in case it counts as personal data.

3. Data categories, purposes and legal grounds

Category	Data	Purpose	Legal ground (KVKK Art. 5)
Processed only on the phone	Department, height, optional weight, body measurements, a known size, fit and zone preferences, analyses, closet, notes, settings	Calculating size recommendations on your phone, showing your analyses and closet	Not sent to us. Processing by the app on the phone is necessary to provide the service you ask for: Art. 5(2)(c). [NATURE OF MEASUREMENT AND WEIGHT DATA — whether it falls under Art. 6]
Transaction security	Random device ID, hash of the access token, creation time, last active day, time access was stopped (if any)	Linking catalogue lookups and shares to a device, counting each device once, limiting abuse, being able to carry out deletion requests	Establishment or performance of a contract: Art. 5(2)(c). Legitimate interest (service security): Art. 5(2)(f)
Transaction security	IP address (in working memory only, never written to disk)	Limiting excessive requests, protecting the service	Legitimate interest: Art. 5(2)(f)
Product lookup	Simplified product link or barcode number (not stored)	Finding the product in the catalogue for a link you paste or a barcode you scan	Performance of a contract: Art. 5(2)(c)
Product contribution (only with your explicit consent)	Product link and/or barcodes, brand, category, product department, cut, fabric composition, product name, product photo address, price, currency, device ID, time sent	Building the shared product catalogue and showing product details to users who look up the same product	Explicit consent: Art. 5(1)
Fit feedback (only with your explicit consent)	Answer ID, brand, category, department (women/men), cut, recommended and bought size, size difference, outcome, fit, reasons, tight and loose zones, engine version, device ID, time received	Working out, in aggregate, whether brands’ sizes run small or large, and improving recommendations	Explicit consent: Art. 5(1)
Backups	Nightly copy of the server database (the server data above)	Restoring the service after a failure	Legitimate interest: Art. 5(2)(f)
Communication	If you write to us: your email address, name and message. For KVKK applications, the identity and address details the Communiqué requires	Answering support requests and KVKK applications	Performance of a contract: Art. 5(2)(c). Legal obligation: Art. 5(2)(ç). Establishing, exercising or protecting a right: Art. 5(2)(e)

Your payment details are processed by Apple or Google. We never see them. The app only learns your subscription status from the store (plan, whether it is active, end date) and keeps it on your phone. This is not sent to our server.

4. How data is collected

Data is collected electronically, by automated means:

what you enter in the app and the results the app produces on your phone,
the requests the app sends to our server when you look up a link or barcode and when it updates the size charts,
if you turned sharing on, what the app sends for products you confirm and “How did it fit?” questions you answer,
what you send us by email.

5. Transfers

Within Türkiye and to third parties (Art. 8)

We don’t sell your data and don’t transfer it to anyone for advertising or marketing.
Product details in the shared catalogue (brand, category, cut, fabric, product name, photo address, price) are shown to other users who look up the same link or barcode. Your device ID is not shown.
The result of the nightly aggregate brand calculation is shipped to all users with the size charts. It cannot be linked to anyone.
Data may be disclosed to authorised public bodies where the law requires it, and only to the extent required.

We don’t transfer data to shops, Apple or Google. Product pages are fetched directly from the shop’s website by your phone. Purchases happen directly between you and Apple or Google. These parties are independent data controllers for their own processing.

Transfers abroad (Art. 9)

Our server runs on the infrastructure of our hosting provider, Contabo GmbH (Germany) [DATA CENTRE LOCATION — confirm in the Contabo panel]. Contabo provides the server and storage as a data processor. Data reaching our server (the device record, product lookups, IP addresses, contributions and feedback sent with your explicit consent, and their backups) is therefore processed outside Türkiye.

Under KVKK Article 9, data may be transferred abroad to countries with an adequacy decision of the Board; without one, with one of the appropriate safeguards listed in Art. 9(4) (for example, signing the standard contract published by the Board and notifying the Board within five business days of signing); or, for incidental transfers only, under one of the exceptions in Art. 9(6) (for example, explicit consent after being informed of the possible risks). The mechanism we rely on for this transfer: [LEGAL BASIS FOR TRANSFER ABROAD — to be chosen by counsel: Art. 9(4) safeguard (standard contract, etc.) or another route].

If you email us, your message is processed on our email provider’s servers: [EMAIL PROVIDER AND SERVER LOCATION].

6. Retention and destruction

Data on the phone: stays on your phone until you delete it with “Delete my data” or uninstall the app. If your phone’s own backups (iCloud, Google) are on, it may also be in those backups. They live in your account.
Product lookups: not stored. The server’s log lines contain no links, barcodes, IP addresses or access tokens.
IP address: kept only in working memory, never written to disk, gone when the server restarts.
Device record, contributions and feedback: kept until deleted with “Delete my data”. [MAXIMUM RETENTION PERIOD — no automatic deletion of inactive devices today]
Backups: one copy of the server database is made every night and kept for [BACKUP RETENTION PERIOD]. Deleted data may remain in backups until that period ends. Backups are used only to restore after a failure.
Support emails and KVKK applications: [RETENTION PERIOD FOR SUPPORT EMAILS AND APPLICATION RECORDS]

When “Delete my data” is used, the device record and all its contributions and feedback are deleted from the server. Only products that device alone described are removed from the catalogue. Products other devices also confirmed are recalculated without that device’s contribution. Links and barcodes added to them may stay in the catalogue, no longer linked to that device. Deleted rows are overwritten in the database file.

7. Your rights under KVKK Article 11

By applying to the data controller, you have the right to:

learn whether your personal data is processed,
request information about it if it is,
learn the purpose of processing and whether it is used for that purpose,
know the third parties in Türkiye or abroad to whom it is transferred,
ask for it to be corrected if it is incomplete or wrong,
ask for it to be deleted or destroyed under the conditions in KVKK Article 7,
ask for the actions under (5) and (6) to be notified to third parties to whom the data was transferred,
object to a result against you that arises from analysis of your data exclusively by automated systems,
claim compensation if you suffer damage because of unlawful processing.

You can withdraw your explicit consent at any time: turn sharing off in Profile → Privacy and data. Withdrawal takes effect for the future. To delete what was sent before, use “Delete my data” or apply to us.

8. How to apply

In the app, right away: Profile → “Export my data” creates a file with all your data on the phone and your device ID. Profile → “Delete my data” deletes your data on the phone and on the server.

Applying to the data controller: under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in Turkish:

as a signed letter, by hand or by post, to [ADDRESS],
by registered electronic mail (KEP) to [KEP ADDRESS],
signed with a secure electronic signature or mobile signature, or from an email address you previously gave us that is recorded in our system, to destek@sizemira.com.

Your application must include your name and surname, your signature for written applications, your Turkish ID number (for foreigners, nationality and passport or ID number), your address for notifications, your email address, phone or fax number if any, and what you are asking for.

Because there are no accounts, we can only link your data to you through your device ID. Please include the device ID shown in the app’s “Export my data” file in your application.

We will answer free of charge as soon as possible, and within thirty days at the latest, depending on the nature of the request. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient, or we do not answer in time, you may complain to the Board within thirty days of learning of the answer and in any case within sixty days of your application (KVKK Article 14).