Privacy Notice

Last updated: 27 May 2026 Effective date: 27 May 2026

This Privacy Notice explains how your personal data is processed when you use the Aha mobile application and related services (the "Service"). It is published in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and other applicable law. For users resident in Türkiye, the Turkish version of this notice (/privacy in Türkçe) is the authoritative version.

1. Data Controller

The data controller for the purposes of KVKK is:

Yunus Emre YOLDAŞ – Sole Proprietor (Şahıs Şirketi) Tax ID: 63046344392 Address: Bursa / Nilüfer, Görükle Mahallesi, Atatürk (490) Caddesi, Yerleşim Plaza, Cemre Teknik Email: emesissolutions@gmail.com

Referred to below as "we", "us", or "Aha".

2. Categories of Personal Data We Process

When you use the Service we may process the following categories of data:

• Identity data: first name, last name, username, profile photo, year of birth (for age verification).
• Contact data: email address, optional phone number.
• Authentication data: password hash, Google account identifier (if you use Google Sign-In).
• Location data: device GPS coordinates (foreground, and — only if you grant a separate permission — background), location history.
• Device and technical data: device identifier, OS version, app version, language setting, IP address, Firebase Cloud Messaging push token.
• User content: gigs/listings you publish, offers you send, messages, reviews and ratings, photos you upload.
• Transaction and subscription data: RevenueCat subscriber ID, purchase history, subscription status. We do not see or store your card details — payment details are collected and processed solely by Apple App Store / Google Play.
• Usage data: in-app interaction events, search queries, session counts, crash logs.
• Cookies and similar identifiers (website only): session cookie, language-preference cookie (NEXT_LOCALE), theme-preference, anonymous measurement identifier used by Vercel Analytics.

3. Purposes of Processing

We process the data above for the following purposes:

• creating your account, verifying your identity and managing your sessions;
• enabling Seeker / Offerer matching, listing discovery and proximity-based features;
• providing messaging, offers and review functionality;
• processing broadcast purchases, credit packs and subscriptions and verifying entitlements;
• delivering push notifications (only with your explicit permission);
• security, fraud prevention, abuse handling and complaint resolution;
• improving the Service, debugging, and producing aggregate/anonymized statistics;
• complying with applicable law (tax, KVKK, Law No. 6563) and with binding requests from competent authorities.

4. Legal Bases (KVKK arts. 5–6)

We rely on the following legal bases:

• Performance of a contract (art. 5/2-c): account creation, matching, messaging, purchases.
• Legal obligation (art. 5/2-ç): tax, KVKK, ETK/IYS, retention of billing/subscription records.
• Legitimate interest (art. 5/2-f): security, fraud prevention, service improvement, aggregate analytics.
• Explicit consent (art. 5/1): background location, push notifications, commercial electronic messages, and the cross-border transfers described in Section 6.

You can withdraw consent at any time in the in-app settings or by contacting us.

5. Recipients and Data Processors

The following service providers act as data processors and may access your data only to the extent necessary for the purpose listed:

We do not sell, rent, or share your personal data with third parties for marketing.

6. Cross-Border Transfers

The processors listed above are headquartered outside Türkiye. Your personal data is therefore transferred abroad under Article 9 of KVKK. The transfer takes place either (a) to countries deemed by the Personal Data Protection Board to provide adequate protection, (b) on the basis of your separate explicit consent, or (c) under undertakings/standard contractual clauses approved by the Board.

By continuing to use the Service, you acknowledge that these cross-border transfers are essential to operate the Service and you grant your explicit consent. If you withdraw consent you may be unable to use part or all of the Service.

7. How We Collect Data

We collect personal data through in-app forms, the account-creation flow, messaging, purchase flows, device APIs (e.g. location, push token), and through our website, either automatically or semi-automatically.

8. Retention Periods

Longer retention applies where required by law.

9. Your Rights (KVKK Article 11)

Under KVKK art. 11 you have the right to:

• learn whether your personal data is processed;
• request information on the processing;
• learn the purpose and whether the data is used in line with that purpose;
• learn the third parties to whom data is transferred, in Türkiye or abroad;
• request correction of incomplete or inaccurate data;
• request deletion or destruction in accordance with art. 7;
• request notification of the above to third parties to whom the data was transferred;
• object to a decision against you made solely by automated processing;
• claim compensation if you suffer damage due to unlawful processing.

10. How to Exercise Your Rights

You may file a request in line with the Communiqué on Application Procedures and Principles to the Data Controller via:

• email: emesissolutions@gmail.com (from your registered email address);
• postal mail: the address listed in Section 1;
• KEP (registered e-mail), where applicable: to be announced.

We will respond within 30 days at no charge, unless your request entails a cost, in which case the tariff set by the Board applies. If we reject the request, our answer is insufficient, or we fail to respond in time, you may file a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

11. Cookies and Website Analytics

The website (https://ahabuldum.app) uses only strictly necessary cookies (NEXT_LOCALE for language, theme preference) and anonymous analytics (Vercel Analytics — page views, country, device type). We do not use advertising cookies or third-party marketing identifiers. You can clear cookies at any time from your browser; doing so will reset your language and theme preference.

12. Children's Privacy

The Service is not directed to anyone under 18. We do not knowingly collect data from anyone under 18. If you believe a minor's data is being processed, contact emesissolutions@gmail.com and we will delete it promptly.

13. Security

We apply reasonable administrative and technical measures: TLS in transit, password hashing (bcrypt/argon2) at rest, restricted access, audit logs, data-processing agreements with our processors. Absolute security cannot be guaranteed; in the event of a data breach we will notify the Personal Data Protection Board and affected users within 72 hours in accordance with KVKK art. 12/5.

14. Changes to This Notice

We may update this Notice as the Service evolves or the law changes. Material changes will be announced at least 30 days in advance via in-app notification or email. The current version is always available at this URL, with the effective date shown at the top.

This Notice is prepared in good faith. It is recommended that it be reviewed by a KVKK specialist before final publication. Explicit-consent flows are presented separately in-app for the items that require them.