Privacy Policy and KVKK / GDPR Disclosure Notice

1.1. Data Controller (Controller)

Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), Article 13(1)(a)-(b) of the European Union General Data Protection Regulation (“GDPR” - Regulation (EU) 2016/679), and Apple App Store Review Guidelines Section 5.1.1(i), the Data Controller responsible for the processing of your personal data and special category mental health data is PingMood(“Application” or “Controller”). All official communications regarding personal data protection, privacy preferences, and regulatory compliance are conducted via privacy@pingmood.app and general user support inquiries via support@pingmood.app.

1.2. Data Protection Officer (DPO) and Representative Contact

The official and dedicated channel for all data subject requests under KVKK Articles 11 and 13 and GDPR Articles 15 through 22, including withdrawal of explicit consent, inquiries regarding cross-border transfer safeguards, and communications with our Data Protection Officer (DPO) desk, is privacy@pingmood.app. Data subjects may also exercise their rights instantaneously 24/7 using the in-app self-service privacy switches, memory purge tools, and permanent account deletion controls without needing to submit a written email request.

1.3. Scope of the Policy

This Privacy Policy and Disclosure Notice covers: (i) the PingMood iOS mobile application distributed via the Apple App Store (integrated with Apple StoreKit 2), (ii) the Next.js Web platform accessible at pingmood.app, and (iii) all associated backend API services, cloud database layers (Supabase PostgreSQL), authentication systems, and generative artificial intelligence (Google Gemini API) processing workflows.

2.1. Identity and Contact Data

Data collected directly from the user during account registration and sign-in or via the user's chosen authentication provider: Email address, salted and hashed password credentials, Sign in with Apple (OpenID Connect) identity token and relay email, unique cryptographic user identifier (auth.uid()), and optional demographic profile attributes entered by the user (profile_data), including nickname/name, age or birth year, gender, marital status, children/pets status, profession, and primary life focus.

2.3. Goal, Habit, and In-App Interaction Data

Scrum board objectives created manually or approved from AI Roadmap drafts (Main Goals / epics, tasks, subtasks), task completion milestones, achievement cards, custom user tags (user_tags), and character traits discovered by AI or added manually by the user (user_traits).

2.4. Financial and Subscription Verification Data

To verify “PingMood Pro” subscriptions and consumable credit purchases via Apple StoreKit 2, PingMood processes only cryptographically signed transaction identifiers (transaction_id, original_transaction_id), product identifiers (product_id), subscription entitlement status, and the user's in-app digital credit balance (ai_credits). PingMood NEVER views, collects, processes, or stores your credit card numbers, bank account details, CVV security codes, or billing addresses; all payment processing is handled exclusively by Apple Inc.

2.5. Device, Transaction Security, and Telemetry Data

To maintain session security, prevent unauthorized access, and ensure service reliability, PingMood processes session authentication tokens (JWT), IP addresses, request timestamps, API rate-limiting counters, error logs, and the language preference cookie (NEXT_LOCALE).

2.6. On-Device Biometric Authentication and Health Data Boundary (Apple Guideline 5.1.3)

Face ID and Touch ID authentication used for locking the app is executed strictly locally on the iOS operating system (Secure Enclave / LocalAuthentication framework); biometric data is never accessed by PingMood and is never transmitted to PingMood servers. In strict compliance with Apple App Store Review Guideline 5.1.3, health, mood, and wellness data is never used for advertising, marketing, or data brokering purposes, and is never stored unencrypted on iCloud.

3.1. Establishment and Performance of a Contract (KVKK Art. 5/2-c & GDPR Art. 6/1-b)

Account creation, authentication, session management, administration of StoreKit 2 entitlements and AI credit balances (ai_credits), Scrum goal synchronization, and delivery of core application functionalities are processed on the legal basis that processing is necessary for the performance of a contract to which the data subject is party.

3.2. Granular Explicit Consent for Special Category Health Data (KVKK Art. 6/2 & GDPR Art. 9/2-a)

Pursuant to KVKK Article 6/2 (as amended by Law No. 7499) and GDPR Article 9(2)(a), mood records, Plutchik emotion logs, Water Cup stress/crisis dumps, and AI-inferred mental health pattern analyses are processed solely on the basis of the user's freely given, specific, informed, unambiguous, and granular Explicit Consent, obtained independently from general Terms of Service acceptance.

3.3. Compliance with Legal Obligations (KVKK Art. 5/2-ç & GDPR Art. 6/1-c)

Fulfilling statutory tax, accounting, financial audit, and information security retention obligations, as well as responding to lawful requests from competent judicial or regulatory authorities, relies on compliance with a legal obligation to which the Controller is subject.

3.4. Legitimate Interests of the Data Controller (KVKK Art. 5/2-f & GDPR Art. 6/1-f)

Provided that fundamental rights and freedoms of the user are not overridden (and strictly excluding special category health data), cybersecurity monitoring, abuse/bot prevention, rate limiting, and database-level credit protection triggers are processed based on the legitimate interests of the Controller.

4.1. Explicit Identity of the AI Provider

For its “AI Insight”, automatic trait discovery, and “AI Roadmap” modules, PingMood utilizes Google LLC (Google Gemini API - Paid Enterprise Tier / Paid Services) governed by the Google Cloud Data Processing Addendum (Cloud DPA). All AI API requests are routed exclusively through PingMood's secure backend servers linked to a billed Google Cloud project.

4.3. Prompt/Response Processing Flow and “AI Memory” System

Data is transmitted to the AI endpoint only on-demand when the user explicitly triggers an analysis or roadmap generation, and strictly limited to the data categories enabled in the user's 4-layer privacy switches (Section 3.5).

4.4. Abuse Monitoring and Transient Caching

While Google does not use Paid API data for model training, solely to detect violations of the Prohibited Use Policy and security abuse (abuse monitoring), Google may temporarily cache prompts and outputs on an encrypted, transient basis at Google facilities for a strictly limited period (or up to 24 hours for technical session continuity), after which they are automatically purged.

5.1. List of Sub-processors

5.2. Data Residency

Our primary database hosting center is configured in the European Union (AWS EU region); however, limited metadata and operational data may be transferred to facilities in the United States and Singapore for centralized account management, global CDN caching, on-demand AI inference, and operational support.

5.3. KVKK Article 9 (Law No. 7499 and Regulation of 10.07.2024) Appropriate Safeguards

PingMood does not rely on the occasional explicit consent exception for continuous and systematic cross-border transfers. In addition to satisfying the processing conditions under KVKK Articles 5 and 6, transfers are executed under the “Standard Contracts” (Controller-to-Processor) promulgated by the Turkish Personal Data Protection Board pursuant to KVKK Article 9(2)(b) and notified to the Authority within the statutory 5-business-day period under Article 9(5).

5.4. GDPR Chapter V Safeguards

Transfers outside the EEA, the United Kingdom, and Switzerland are safeguarded by Data Processing Addenda (DPA), the European Commission's Standard Contractual Clauses (EU SCC - Module 2: Controller-to-Processor) adopted by Implementing Decision (EU) 2021/914, and the UK International Data Transfer Addendum.

5.5. Legal Obligations and Imminent Physical Threat Exception

In the event of a good-faith belief that a user poses a serious and imminent threat of physical harm to themselves or another person, PingMood reserves the right to share necessary information with emergency services or law enforcement authorities in accordance with applicable law.

6.1. Technical Measures

Encryption via TLS 1.3 (in-transit) and AES-256 (at-rest) including daily backups, FIPS 140-2 compliant Hardware Security Module (HSM) key protection, strict UUID-based tenant isolation via Row-Level Security (RLS) on Supabase PostgreSQL, server-side secret isolation (private_app_secrets), and in-app “Privacy Mode (Blur)” protection.

6.2. Administrative Measures and 72-Hour Data Breach Notification

Pursuant to KVKK Article 12 and GDPR Article 33, in the event of a personal data breach, PingMood will notify the competent Supervisory Authority / Data Protection Board and affected individuals within 72 hours of becoming aware of the breach.

6.3. Data Retention Schedule Table by Category

7.1. Comprehensive 8 Statutory Rights

Pursuant to KVKK Article 11 and GDPR Articles 15 through 22, every PingMood user (Data Subject) holds the following 8 statutory rights:

1. Right to Information and Access (KVKK Art. 11/1-a,b,c & GDPR Art. 15): To learn whether your personal data is processed, request information and a copy of processed data, and verify whether it is used in accordance with its stated purpose.
2. Right to Know Third-Party Recipients and Safeguards (KVKK Art. 11/1-ç & GDPR Art. 15/1-c): To know the domestic or international third parties (sub-processors) to whom personal data is transferred and the applicable cross-border transfer safeguards (Standard Contracts / EU SCCs).
3. Right to Rectification (KVKK Art. 11/1-d & GDPR Art. 16): To request the correction or completion of incomplete or inaccurate personal data.
4. Right to Erasure / Right to be Forgotten (KVKK Art. 7, 11/1-e,f & GDPR Art. 17): To request the deletion or destruction of personal data when the reasons for processing cease to exist or consent is withdrawn, and to request that sub-processors (Supabase, Google, etc.) be notified of such erasure.
5. Right to Restriction of Processing (GDPR Art. 18): To request restriction of data processing where the accuracy of data or the lawfulness of processing is contested.
6. Right to Data Portability (GDPR Art. 20): To receive the journal, mood, and goal data provided to PingMood in a structured, commonly used, and machine-readable format (e.g., JSON or CSV) and transmit it to another controller.
7. Right to Object to Automated Decision-Making and Profiling (KVKK Art. 11/1-g & GDPR Art. 21-22): To object to adverse outcomes resulting from the analysis of processed data exclusively through automated systems (including generative AI algorithms), as well as to object to processing based on legitimate interests.
8. Right to Withdraw Consent and Claim Compensation (KVKK Art. 11/1-ğ & GDPR Art. 7/3, 82): To withdraw explicit consent at any time without penalty and to claim compensation for damages suffered due to unlawful processing of personal data.

7.2. Application Channels, 30-Day Response Time, and Right to Complain

In addition to using our instant in-app self-service privacy and account deletion tools, users may submit formal requests via email to privacy@pingmood.app. PingMood processes and concludes all verifiable requests free of charge as soon as possible and within at most 30 (thirty) days. If a request is rejected, the response is deemed insufficient, or no response is provided within 30 days, the User has the right to lodge a complaint with the Turkish Personal Data Protection Board (KVKK) (within 30 days of learning the response and in any event within 60 days of the application date) or with the competent Data Protection Supervisory Authority in their EU/EEA or UK country of residence.

7.3. US State Privacy Laws (CCPA/CPRA & Consumer Health Data Laws) Disclosure

Under the California Consumer Privacy Act (CCPA/CPRA) and applicable US state consumer health data privacy statutes, PingMood explicitly declares: PingMood NEVER sells, rents, or shares users' personal data or mental health data with third parties, data brokers, or advertising networks for cross-context behavioral advertising (“Do Not Sell or Share My Personal Information”). Users are never discriminated against for exercising their privacy rights.

7.4. Children's Privacy and Age Restrictions

The PingMood Service is designed for individuals aged 18 and older (or at least 16 years of age with verifiable parental or legal guardian consent in their jurisdiction). PingMood does not knowingly collect personal data from children under the age of 13 (or below the applicable GDPR Article 8 digital age of consent). If we discover that data from a child under 13 has been collected, the account and all associated data are immediately and permanently purged.

7.5. Cookies and Local Storage

PingMood NEVER uses third-party advertising cookies, marketing pixels, or cross-site tracking cookies. We use only strictly necessary first-party cookies and local storage keys:

• Supabase Auth Session Cookies: Strictly necessary encrypted authentication cookies required to maintain your secure session and prevent CSRF/unauthorized access.
• Language Preference Cookie (NEXT_LOCALE): Functional cookie that remembers your active UI and legal document language (tr or en).
• On-Device Privacy Mode (Blur) State: Local browser preference storing whether screen blurring is toggled on or off.