KVKK Privacy Notice
Prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
About this notice
Note: The Turkish version of this document is the legally binding one. This English translation is provided for convenience only; if the two versions conflict, the Turkish text prevails.
This notice is issued by TEBHOS (independent developer, Türkiye) in its capacity as data controller to inform the people who use the TEBHOS chat service (the web app, the Windows desktop app and the tebhos.com website) about which of their personal data is processed, for which purposes and on which legal grounds, to whom and why it is transferred, how it is collected, and their rights under Article 11 of Law No. 6698 ("KVKK").
It should be read together with the plain-language Privacy Policy, which explains each of these headings with examples. Where the two documents appear to differ, the reading more favourable to the data subject applies.
1. Identity of the data controller
| Data controller | TEBHOS (independent developer, Türkiye) |
| Address | The postal address for written applications is provided on request via [email protected] |
| Identity details | The data controller's identity and contact details are provided to data subjects on request via [email protected] |
| [email protected] | |
| Website | tebhos.com |
The controller's current registered details (including the tax number) are published on the Company Information page.
2. Categories of personal data processed
| Data category | Personal data processed |
|---|---|
| Identity | Username, display name (optional), date of birth (self-declared, for age verification) |
| Contact | Email address |
| Transaction security | IP address, session and sign-in records, authentication events, device/browser/operating-system details, rate-limit and abuse signals, password hash (Argon2 — no plain-text password is kept) |
| Customer transaction | Purchase records: product, transaction status, timing, Polar transaction ID. Card numbers are never received or stored |
| Visual and audio records | Avatar and profile images; voice/video call and live-stage streams (transient — processed only while being relayed, never recorded) |
| User content | Messages, files, reactions, server and channel data, profile details |
| Support correspondence | The content and attachments of emails you send us |
Special categories of personal data (health, religion, ethnic origin, sexual orientation, etc.) are not requested; if you share them in content of your own accord, they are not used for profiling or different treatment.
3. Purposes of processing
Your personal data is processed only for the following purposes:
- creating your account, verifying your identity and managing your account
- delivering messages, files and voice/video calls to their recipients; running the service's features
- enforcing the minimum-age rule (13) and managing age-restricted (18+) content
- providing paid services (TEBHOS Pro, boosts, store items, Business), managing your subscription and keeping billing records
- securing the service; preventing and investigating unauthorised access, fraud, spam and abuse
- enforcing the Terms of Service and Community Guidelines, and handling reports and appeals
- sending security alerts, service updates and the administrative messages your account needs to function
- answering support requests
- maintaining and improving the service through aggregate metrics such as error rates and feature-usage counts, without reading content
- meeting legal obligations, above all under tax legislation, and responding to valid requests from competent authorities
Your personal data is not processed for advertising, targeted marketing, behavioural profiling, training AI models or sale to third parties. Decisions with legal effects on you are not made solely by automated systems.
4. Legal grounds
Your personal data is processed on the following legal grounds listed in Article 5 of the KVKK:
| Processing activity | Legal ground |
|---|---|
| Account creation, message delivery, calls, provision of purchased services, support | Directly related to the formation or performance of a contract (Art. 5/2-c) |
| Security logs, abuse and fraud prevention, rate limiting, bot protection, aggregate metrics | Necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f) |
| Keeping purchase and transaction records, responding to requests from competent authorities | Necessary to comply with our legal obligations (Art. 5/2-ç) |
| Enforcing the rules and keeping records relating to disputes | Necessary to establish, exercise or protect a right (Art. 5/2-e) |
| Optional marketing messages; international transfers in the cases described in Section 5 | Explicit consent (Art. 5/1) — you can withdraw it at any time |
Processing based on your explicit consent stops when you withdraw it; withdrawal does not affect the lawfulness of processing carried out before that date.
5. Recipients of personal data and purpose of transfer
Your personal data is never sold, rented or traded to any third party. Transfers are limited to the following.
5.1 Domestic transfers
| Recipient | Purpose | Legal ground |
|---|---|---|
| Other TEBHOS users | Delivering the messages, content and profile details you send to the recipients/servers you choose | Art. 5/2-c |
| Competent public authorities and courts | Meeting legal obligations and responding to valid official requests | Art. 5/2-ç, Art. 5/2-e |
| Legal and financial advisers | Handling disputes and regulatory compliance | Art. 5/2-e, Art. 5/2-ç |
5.2 International transfers
The service's infrastructure is hosted by service providers (data processors) located abroad; using TEBHOS therefore technically requires your personal data to be transferred abroad.
| Recipient (processor) | Location | Purpose | Data transferred |
|---|---|---|---|
| Vultr | Frankfurt, Germany | Server hosting | All service data stored on our servers |
| Cloudflare | Abroad (global network) | Domain/DNS, CDN and security layer; R2 object storage | Site traffic, uploaded media files, encrypted backups |
| Polar | Abroad | Payment processing (merchant of record) | Payment and invoice details; transaction status is returned to us |
| Resend | Abroad | Sending transactional emails | Email address and the content of the message sent |
| hCaptcha | Abroad | Bot protection at sign-up/sign-in | Browser/interaction signals during verification |
The voice/video infrastructure (LiveKit software), the explicit-content classifier, the IP geolocation lookup, error tracking and metrics run on our own servers; no data is sent to third parties for these operations.
Legal ground for the transfer. Transfers abroad are made under Article 9 of the KVKK: the transfer is necessary to provide the service to you — to perform the contract between us — and in that respect relies on Article 5/2-c in connection with Article 9/4-a. Where a transfer does not fall within that ground, it is made with your explicit consent. You are informed about this transfer at registration and, where required, your explicit consent is obtained separately. Transferred data is encrypted in transit and at rest and is not moved beyond the providers listed here.
6. Method of collection
Your personal data is collected electronically, by wholly or partly automated means:
- directly from you: the registration form, profile and account settings, the content you create in the app, the payment flow, support emails
- automatically: the technical records and security logs our servers keep while you use the app and website
- from other users: content created by users who interact with you (e.g. mentioning you)
- from service providers: limited operational information such as payment status from Polar and delivery status from the email infrastructure
Collection relies on the legal grounds set out in Section 4.
7. Retention periods
Your personal data is kept for as long as the purpose of processing and applicable legislation require; when the period ends it is deleted, destroyed or anonymised.
| Data | Retention |
|---|---|
| Account details and your content | For as long as your account is active (unless you delete them) |
| Deleted account | 14-day grace period; then removed from active systems |
| Deleted messages and records | Removed from active systems quickly; at most 30 days in encrypted backups |
| Deleted media attachments | Removed from active storage; not included in backups |
| Database backups | 30 days (encrypted) |
| Voice/video streams | Not recorded; processed transiently only while being relayed |
| Security and operational logs | Limited period, deleted on a regular cycle; longer during an active security investigation or legal obligation |
| Purchase and transaction records | 5 years as required by Turkish tax legislation (Tax Procedure Law, VUK); card details are never stored |
| Support correspondence and KVKK application records | For the limitation period for disputes after the request is concluded |
See the retention section of the Privacy Policy for details.
8. Rights of the data subject and how to apply
Under Article 11 of the KVKK you have the right, by applying to the data controller, to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether the data is used in line with it,
- know the third parties to whom it is transferred, in Türkiye or abroad,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions in Article 7 of the KVKK,
- request that corrections, deletions and destructions be notified to third parties who received the data,
- object to a result that is to your detriment arising exclusively from automated analysis,
- claim compensation if you suffer damage due to unlawful processing.
How to apply. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your application by email to [email protected] from the email address registered to your account so we can verify your identity, or in writing to the postal address we provide on request via the same email. The application must state your full name, email address (and username, if any) and the subject of your request.
Applications are concluded free of charge as soon as possible and within 30 days at the latest; if the process involves an additional cost, the fee in the Personal Data Protection Board's tariff may be charged. If your application is rejected, the response is found insufficient, or no response is given in time, you can lodge a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date (kvkk.gov.tr).
9. Changes
This notice is updated when our processing activities, our service providers or the legislation change. The current version is always published on this page and the date at the top is refreshed; important changes are announced at least 30 days in advance following the procedure in the Privacy Policy and recorded in the Changelog.