*This is an English translation for convenience. In case of any conflict, the Turkish version prevails.*
Data Controller: Ramazan Karayıldız
Contact E-mail: support@melyuna.com
Version: 2.0
This Explicit Consent text has been prepared to obtain your consent, separately and optionally for specific processing activities, while you use the Melyuna application ("the App"), within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK").
Melyuna is a dating, friendship and language-exchange social app usable worldwide by adults aged 18 and over. If you are located in Türkiye or your personal data is processed in Türkiye, the KVKK applies; if you are located in the European Union, the GDPR (General Data Protection Regulation) may additionally apply.
Please read the following points carefully:
Under the KVKK, explicit consent is obtained only for the following two matters:
Note: Core processing activities such as the creation of your account, authentication (sign-in), provision of the matching/discovery service, messaging, and security/moderation rely not on explicit consent but on other legal bases such as the establishment/performance of a contract and legitimate interest. That is, even if you do not give the cross-border transfer consent below, we will endeavour to provide the service to the extent the relevant processing can be carried out with the alternative safeguards prescribed by law (standard contract + notification to the Board); this is explained separately under each heading.
The following summary is provided so that the processing for which consent is requested can be better understood. For details, see the Privacy Notice and Privacy Policy.
| Matter | Relevant Data | Relevant Service Provider(s) | Direction of Transfer |
|---|---|---|---|
| Special-category profile (Art. 6) | Profile fields (display name, biography, dating intent, interests, prompts, voice prompt, photos, spoken/learned languages) and messages — content that may carry a hint as to sexual orientation/preference | Supabase, OpenAI | Domestic + abroad |
| Database / identity / storage / server functions | Account identity (e-mail/phone/provider ID), profile data, messages, moderation records, device identifier | Supabase (Postgres/Auth/Storage/Edge Functions) | Abroad (EU — Ireland, eu-west-1) |
| Hosting / CDN | App (web) assets, basic request data | Cloudflare Pages | Abroad |
| Push notifications | FCM/Web Push (VAPID) device token; sender name + short message preview in the notification | Firebase Cloud Messaging (FCM) + Web Push | Abroad (US) |
| Content moderation | Text and visual content (message/profile) | OpenAI (moderation) | Abroad (US) |
| Phone / social sign-in (if enabled) | Phone number and/or provider account ID | Twilio (SMS), Google, Apple, Telegram, Meta (Facebook) | Abroad |
| Text translation (if "Translate" is tapped) | Text to be translated: message, profile text, post, comment | Google (Translate) | Abroad (US) |
| Photo moderation | Uploaded photos | Anthropic | Abroad (US) |
| Error/crash diagnostics | Error record, device and operating system information | Sentry | EU (Germany) |
| Country determination from location | Approximate coordinate (rounded to ~11 km) | BigDataCloud; Google/Apple device service | Abroad (EU/US) |
| Map display | Map tile requests | CARTO | Abroad (EU/US) |
| Verification e-mail | E-mail address, verification code | Resend | EU (Ireland) |
Important: The App collects your coarse GPS location only with your permission; the server applies snap-to-grid and jitter to this location. Your raw coordinates are never returned to other users; only a banded (approximate) distance is shown. Country information is derived from location. Furthermore, no national ID number (TCKN), e-Devlet, identity document, or biometric identity verification is carried out. The optional selfie verification (see 2.6 below) is not a biometric identity verification/storage. Therefore, this document does not contain any consent regarding those categories of data.
Melyuna is a dating/friendship/language-exchange social app. The dating intent you state in your profile (e.g. why you are here), your interests, your prompt answers, your optional voice prompt, your biography, your photos, and the messages you exchange with the other party may carry a hint as to your sexual orientation or preferences, even if you do not declare it directly. Under KVKK Art. 6, sexual life and data relating to it are deemed "special categories of personal data" and, as a rule, may be processed with the explicit consent of the data subject.
For this reason, creating your profile and communicating through the App may require the processing of special-category data that could carry such hints.
In line with your explicit consent, content that may qualify as special-category data is processed for the purposes of:
This content is encrypted in transit with TLS and stored encrypted at rest (on the server). The content may be processed on the abroad infrastructure of the service providers listed in Section 3; therefore, the consent in Section 3 is additionally obtained for the transfer of this content abroad.
Your messages are NOT end-to-end encrypted (E2EE). For the purposes of security, moderation, fraud/bot/fake-account prevention, and complaint review, our authorised technical team may access messages. All such access is logged. Ban decisions are made manually; no automatic bans are applied. This matter is also expressly stated in the Privacy Notice.
Because, by the nature of the dating service, profile and message content may carry special-category data hints, if you do not give this explicit consent, you cannot benefit from profile creation, matching/discovery, and messaging services. As these operations form the core of the service, the App's basic function cannot be provided if consent is not given. In this case, you may choose not to create an account or to delete your existing account (see Privacy Policy — Account Deletion).
If you wish, you may increase the credibility of your profile by sending a selfie. Our team may review the selfie you send and grant your profile a "Verified" badge. This is entirely optional and is not a biometric identity verification or biometric data storage operation; not sending a selfie does not prevent you from using the App.
Scope: I understand that my dating profile and messages may contain special categories of personal data that could carry a hint as to sexual orientation/preference; I give my explicit consent to the processing of this data for the purposes described above, in a manner accessible by the authorised technical team (without E2EE).
In order for the App to operate on a global scale, certain service providers managed with a preference for fast and economical infrastructure are used. The servers of some of these providers are located abroad (the European Union and/or the United States or other countries). Under KVKK Art. 9, transfer abroad is possible provided that explicit consent, or the other safeguards prescribed by law (a standard contract containing appropriate safeguards, etc., and, where required, notification to the Board), is provided.
You may give or withhold consent separately for each of the following transfers.
Data transferred: Your account identity (e-mail/phone/provider ID), your profile fields, your photos, your messages, your moderation and security records, and core app data such as a device identifier.
Location: EU (Ireland, eu-west-1 region).
Purpose: Hosting your account, authentication (including the e-mail one-time code), storing media and data, and running the application logic.
Scope: I give my explicit consent to the transfer abroad of the above data to be processed on the Supabase infrastructure (EU).
If you do not: Supabase is the App's core database, authentication, and media-storage infrastructure. If you do not give this transfer consent, then to the extent the alternative safeguards prescribed by law (standard contract + notification to the Board within 5 business days) cannot be provided, your account cannot be created and the service cannot be provided.
Data transferred: Basic request data generated while serving the App (web) assets (e.g. IP address, browser information).
Purpose: Hosting the web version of the App and distributing content quickly worldwide (CDN).
Scope: I give my explicit consent to the transfer abroad of my relevant request data to be processed on Cloudflare Pages.
If you do not: Since the web version of the App is served through the hosting/CDN provider, access over the web may not be technically possible without this transfer.
Data transferred: FCM/Web Push (VAPID) device notification token; as notification content, the sender's name and a short message preview.
Purpose: Sending instant (push) notifications to your device/browser.
Important: The notification may display the sender's name and a short message preview on your device's lock screen. You can restrict this from your device settings.
Scope: I give my explicit consent to the transfer abroad of my notification token and notification content to be delivered via Firebase Cloud Messaging / Web Push (US).
If you do not: You will not receive instant push notifications (including new message/match notifications). You can still see the current status when you open the App; only background notifications are disabled.
Data transferred: Text and visual content (message and/or profile content).
Purpose: Providing a safe community by detecting harmful/inappropriate content (e.g. child abuse, harassment, spam).
Scope: I give my explicit consent to the transfer abroad of my content to be assessed by OpenAI (US) for moderation purposes.
If you do not: Your content may not be subjected to automatic moderation assessment. Due to our security and legal obligations (in particular the detection and reporting of child-abuse content), this processing is largely based on legitimate interest/legal obligation; therefore, even without your transfer consent, content may need to be processed with alternative safeguards to ensure security, and otherwise it may not be possible to provide the service safely. (For details, see the Privacy Notice.)
Data transferred: Depending on the sign-in method you choose, your phone number and/or your provider account ID.
Relevant providers: Twilio (phone verification via SMS), Google, Apple, Telegram, Meta (Facebook).
Purpose: Securely signing in to / registering your account through the provider you choose.
Scope: I give my explicit consent to the transfer abroad, via the relevant provider (Twilio/Google/Apple/Telegram/Meta), of my phone number/provider ID relating to the sign-in method I choose.
If you do not: You cannot use the relevant sign-in method; however, you can continue to access your account using one of the other sign-in methods offered (e.g. the e-mail one-time code).
Data transferred: Only the relevant text at the moment you tap "Translate" — a chat message, profile text/prompt answer, World post or comment. Your name, e-mail, location, photos and account ID are not sent.
Purpose: Enabling users who speak different languages to understand each other (the App's language-exchange function).
How it works: Translation is not automatic. It happens only when you tap "Translate", and only for that text. Melyuna does not store the translation result on its servers.
Scope: I give my explicit consent to the transfer abroad to Google (US) of the relevant text, for translation, when I tap "Translate".
If you do not / do not use it: This transfer occurs only when you tap "Translate". If you never use the feature, none of your text is transferred abroad for this purpose; the other functions of the App are unaffected.
Transfer abroad is carried out within the framework of KVKK Art. 9. Where your explicit consent is absent or has been withdrawn, for the processing that remains possible we endeavour to provide the other safeguards prescribed by law (for transfers to countries without an adequacy decision, a standard contract containing appropriate safeguards and, as required by the relevant legislation, notification to the Board). Work is underway to put data processing/transfer agreements in place with the relevant service providers.
You may withdraw any explicit consent you have given at any time, without stating a reason. Your approval is recorded together with its version and date; withdrawal is likewise logged.
How can you withdraw?
Consequences of withdrawal:
The App provides in-app account deletion as required by store rules (Apple 5.1.1(v)) and the "right to be forgotten" under the KVKK. When you delete your account, your identity (auth) record is deleted; your profile, messages, photos, and notification tokens are correspondingly cleared (by deletion/disassociation).
To prevent abuse, ban-list records (an irreversibly "peppered" hash of the account identity/device — no raw identity is stored) and minimum security logs may be kept to the extent and for the period permitted by the relevant legislation. For details, see the Privacy Policy — Retention and Disposal section.
Under KVKK Art. 11, you have the right to: learn whether your personal data is processed; if it is, request information about it; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties to whom it is transferred domestically/abroad; request its correction if incompletely/incorrectly processed, its deletion/destruction, the notification of these operations to the third parties to whom it was transferred; object to a result arising against you as a consequence of analysis exclusively by automated systems; and request the remedying of damage. If you are located in the European Union, you may also have the rights of access, rectification, erasure, restriction of processing, data portability, and objection under the GDPR.
You can submit your requests via support@melyuna.com. Your requests are concluded according to the procedures and periods specified in the Privacy Policy. You also reserve the right to lodge a complaint with the Personal Data Protection Board (and, where applicable, the competent EU supervisory authority).
I declare that I have read and understood this Explicit Consent text together with the Privacy Notice and Privacy Policy, that I am aged 18 or over, that the consents I have ticked above are given freely, on an informed basis, and in relation to specific matters, and that I know I may withdraw these consents at any time.
*This document should be read together with the Privacy Notice, Privacy Policy, and Community Guidelines documents.*