Privacy Policy

Merilin Food – PRIVACY POLICY & KVKK NOTICE Version: 1.0.0 | Effective: 27 Mayıs 2026 This notice is provided under Turkey’s Personal Data Protection Law No. 6698 (KVKK) and reflects international privacy-by-design practices (purpose limitation, data minimization, transparency, granular consent). 1. DATA CONTROLLER Merilin Food – İzmir, Türkiye Privacy requests: kvkk@merilinapp.com | Support: support@merilinapp.com 2. DATA WE PROCESS Buyers: device name, anonymous session ID, FCM token, location (with permission), favorites, alert preferences, radar radius, usage logs. Sellers: email, shop profile, phone, address, coordinates, verification data (national/tax IDs, tax office, birth year, MERSIS), social links, session/IP data. Support and abuse reports. 3. PURPOSES AND LEGAL BASES Account & OTP login – contract (KVKK Art. 5/2-c). Map discovery – legitimate interest / consent where required. Shop management & verification – contract and legal obligation. Operational push – contract / legitimate interest. Marketing push – explicit separate consent only (granular consent principle). Security & fraud prevention – legitimate interest. Legal retention of verification records – legal obligation. 4. HOW WE COLLECT DATA App forms, device permissions, automated logs, and support channels. 5. RECIPIENTS / PROCESSORS Hosting, email, Firebase/FCM, and map/geocoding providers (e.g. TomTom) process data only as needed to operate the service. Cross-border transfers follow KVKK Art. 9 safeguards. 6. RETENTION Active account data while the account exists plus statutory limitation periods. Verification records retained per tax/commercial law (typically at least 10 years). Session logs ~2 years. Marketing data until consent is withdrawn. 7. YOUR RIGHTS (KVKK Art. 11) Access, rectification, erasure, learn recipients, object to automated decisions, and claim damages where applicable. 8. REQUESTS Contact kvkk@merilinapp.com with identity verification. We respond within 30 days. 9. SECURITY Access controls, encryption, secure sessions, least privilege, and security testing. 10. CHILDREN Not intended for users under 18. 11. CHANGES We may update this policy; the current version is available in-app. 12. WITHDRAW MARKETING CONSENT Disable campaign notifications in app settings or email kvkk@merilinapp.com.