PRIVACY POLICY AND KVKK NOTICE

Last updated: 7 September 2026

This is an English translation provided for your convenience. Partibo operates under Turkish law and the Turkish version of this document is the binding one. If the two differ, the Turkish version prevails.

---

PART 1 — IN SHORT

This part is a plain-language summary of the formal notice below. Part 2 is the binding text; if the two differ, Part 2 applies.

This document was written from what Partibo actually collects. You won't find anything here we don't collect, and everything we do collect is written down.

Who is responsible?

The Partibo app and this website are operated by Ali Can Aksoy. For any question or request about your data, write to destek@partibo.app.

What we ask for when you sign up

Signing up takes six steps and asks for:

• Your name — shown on your profile and at events.
• Your date of birth — ⚠️ the date itself is never shown to anyone. Others only see your age, calculated from it. Age matters for matching at events; people under 18 can't use Partibo.
• Your phone number — this is your account's identity and is verified by SMS. ⚠️ It is never shown to other users.
• Your password — we can't see it; only a verifiable hash is stored.
• Your city — so Discover can surface events near you.
• Your gender — used only for matching at events such as "women first".

Marketing and announcement consent is the last step and comes unticked. If you don't tick it we won't send you marketing messages, and your signup doesn't depend on it. If you give it, we record it with the date, and you can withdraw it whenever you like.

Data created while you use the app

• Your profile photo and bio — both optional.
• Your compatibility answers — used to match you with people who suit you. Optional; you can skip them.
• Your referral code — a code you can enter during signup if you want. It tells us who pointed you to Partibo; it is optional and can be left blank.
• Events you host and join, your tickets, favourites and follows.
• Content you share — stories, event memories, posts.
• Your messages and voice messages in event chats.
• Your ratings — ⚠️ event ratings are anonymous: who wrote a rating is not readable by anyone, including the person rated.
• Support requests and messages you send us.
• Your notification token — your device's push address, so we can send you notifications.
• Your consent records — which document and version you accepted and when, plus your IP address and device information as proof.

⚠️ We don't take your location. The app never asks for location permission and no GPS coordinate is stored anywhere. Proximity uses only the city you entered yourself.

⚠️ Your card details never reach us. Payments go through the app stores and the payment institution.

Who can see what?

Visible to others on your profile: your name, initial, bio, gender, city, profile photo, compatibility answers, age and the date your account was opened.

Never shown to others under any circumstance: your phone number, your actual date of birth, your password, your email address, your notification token, your marketing consent and your analytics preference.

Your messages are visible only to people in that event's chat; your support correspondence only to you and the support team. Event content (stories, memories, posts) is open to that event's participants.

Usage statistics and the off switch

We collect information such as which screens you use, in order to improve the app.

⚠️ Personal data is forbidden in these records: message text, report text, search text, phone, email, full name, location and the identity of anyone whose profile you viewed are never written to them — only categories and counts.

Turning off Settings › Privacy › "Share analytics data" stops these records. While it is off, your name is also not shown to someone whose profile you viewed — the view isn't recorded at all.

⚠️ Two things are still kept while the switch is off. Neither is a statistic; both make your own app work:

• Which stories you've watched — so the ring fades and that person drops to the end of the story strip. Without it, every story would look unwatched to you forever.
• Which cards you've seen in Discover — so the same cards don't come round again.

Both are shown only to you. They are never disclosed to another user, a business or a third party, and are never used to build a profile of who you are.

Who we share with

We don't sell your data. These are the providers needed to run the service:

• Supabase — database, account verification and file storage. ⚠️ Your data is held in Germany.
• Twilio — sends verification SMS; sees only your phone number. (USA)
• Expo — delivers notifications to your phone and distributes app updates. It sees your notification token, and also your platform, app version and an install-specific identifier sent with the update check on each launch. That identifier is not your device's identity; it is regenerated if you delete and reinstall the app. (USA)
• Vercel — hosts this website; as the hosting provider it sees the server logs of your requests to the site, including your IP address. (USA)
• Apple and Google — distribute the app through the App Store and Google Play. (USA)
• Anthropic — the AI provider behind the Bo assistant; detailed below. (USA)
• Payment institution — to transfer ticket revenue to businesses. (Türkiye)

Beyond these, we disclose your data to third parties only where the law requires it.

The Bo assistant

When you write to Bo, the following goes to the provider: the first part of your name, your question, the last ten messages of your chat, and the list of events that could be recommended to you.

Your phone number, email, date of birth, gender, compatibility answers and other users' identities are not sent to Bo.

⚠️ Your Bo chats are not stored on our servers. The history lives only on your device and is removed with "Clear chat".

How long we keep things

• Your profile and content stay while your account is open.
• Usage records are deleted after 90 days. Only daily totals with no link to any person remain ("how many people opened this screen that day") — these can never be traced back to anyone.
• Event chats are not permanent: messages and voice message files are deleted 24 hours after the event ends.
• Sign-in problem records are kept for 7 days and contain only the last four digits of your phone number.
• Records belonging to business accounts — tickets, payment and bank details, business documents — are kept for 10 years from the last transaction, as commercial law requires. These records are retained for that period even if the business account is closed.

Deleting your account

You can delete your account from Settings › Delete my account. If you can't use the app, you can send us the request from the account deletion page.

Deleted: every file you uploaded (profile photo, stories, memory photos, voice messages), your messages, future events you created, your tickets, favourites, follows, ratings, support requests, task and point records, your notification token and the link to your phone number.

Your number is released — you can sign up again with the same number if you want; a brand new account is created.

What remains: in past events you joined or hosted, only your name, and that as "Deleted user". ⚠️ We leave this on purpose: deleting past events too would delete other people's memories and stories along with them.

We also keep a record that "the right to erasure was used on this date"; that record contains no personal data.

Deletion cannot be undone.

What are my rights?

You have the right to learn whether your data is processed, to request information, to ask for correction or erasure, and to object to processing. The full list and how to apply are in article 10 of the formal notice below.

If this document changes

If we update it, the "last updated" date on this page changes. For significant changes we notify you in the app and, where necessary, ask for your consent again.

---

---

PART 2 — NOTICE ON THE PROTECTION OF PERSONAL DATA

1. Data controller

Under Turkish Law no. 6698 on the Protection of Personal Data (the "Law"), your personal data is processed by the data controller identified below.

Data controller: Ali Can Aksoy Address: İhsaniye Mahallesi, Yonca Sokak, Yonca Sitesi No: 1, Bandırma / Balıkesir, Türkiye Email: destek@partibo.app

This notice concerns personal data processed through the Partibo mobile app and the partibo.app website ("Partibo").

2. Personal data processed

Identity and contact data. Your name, date of birth, gender and phone number. For business accounts, also your email address, business name, address, phone, tax number and tax certificate.

Profile and preference data. Your city, profile photo, short bio, compatibility answers, app language, notification preferences and appearance preferences. The referral code you optionally enter during signup.

Content created through use. Events you host and join, your written and voice messages in event chats, stories, memories and posts you share, ratings you write and support requests you send us.

Transaction and payment data. Your ticket records, point and task activity. For business accounts, also the bank details needed for payouts.

Technical data. Records of how you use the app (which screens you open, your platform and app version, session information), your device's notification address so we can send notifications, an install-specific identifier so that app updates can be delivered, records of the consents you give (type, document version, date, your IP address and device information), and the last four digits of your phone number only, for investigating sign-in problems.

Data we do not collect. Location permission is never requested and no location coordinate is stored anywhere; nearby events are shown using only the city you state. Your payment card details never reach us. Special categories of personal data as defined in article 6 of the Law are not processed.

3. Purposes of processing

• Creating, verifying and maintaining your account
• Creating and listing events and managing participation
• Calculating compatibility between you and other participants and showing you suitable events
• Operating event chats
• Carrying out ticket sales, refunds and the related accounting records
• Sending you notifications
• Preventing abuse, fraud and security breaches; investigating and resolving complaints
• Developing the app and detecting and fixing errors
• Sending campaign and announcement messages where you have given explicit consent
• Fulfilling our obligations arising from legislation

4. Legal grounds for processing

Necessary for the establishment and performance of a contract (art. 5/2-c). Your name, date of birth, gender, phone number and city, and records of the events you host and join and your tickets.

Compliance with a legal obligation (art. 5/2-ç). Commercial and financial records, sales and refund records, and documents that legislation requires us to keep.

Necessary for our legitimate interests (art. 5/2-f). Maintaining security, preventing fraud, investigating complaints and keeping the app technically operational.

Necessary for the establishment, exercise or protection of a right (art. 5/2-e). Records that may serve as evidence in a dispute, and consent records.

Your explicit consent (art. 5/1). Your profile photo, bio and compatibility answers; app usage statistics; campaign and announcement messages.

Processing based on explicit consent is not mandatory. You can open an account and use Partibo without providing this data. You may withdraw your consent at any time; withdrawing it does not prevent you from using your account. You can withdraw consent for usage statistics from Settings › Privacy › "Share analytics data", and for campaign messages from your notification preferences.

5. Method of collection

Your personal data is collected electronically, through the Partibo mobile app, the partibo.app website and your support correspondence with us, either by your entering it or through your use of the app.

6. Transfers

We do not sell your personal data and do not share it with third parties for marketing purposes. It is transferred only to the service providers necessary to deliver the service.

6.1 Domestic transfers. To carry out ticket sales and to make payouts to businesses, payment details belonging to business accounts are transferred to a payment institution established in Türkiye.

6.2 Transfers abroad. Because Partibo's technical infrastructure is located outside Türkiye, your personal data is transferred to the following service providers:

Service provider	Data transferred	Country
Supabase	Database records and files you upload	Germany
Twilio	Your phone number	United States
Expo	Your device's notification address; platform, app version and an install-specific identifier in update checks	United States
Vercel	Your website requests and their server logs, including your IP address	United States
Apple and Google	Distribution of the app	United States
Anthropic	What you write to the Bo assistant	United States

These transfers are carried out under article 9 of the Law, on the basis of standard contracts concluded with the relevant service providers and notified to the Personal Data Protection Board, providing appropriate safeguards.

6.3 The Bo assistant. When you write a question to the in-app Bo assistant, the first part of your name, the text of your question, the last ten messages of your chat history and the list of events that could be recommended to you are transmitted to the service provider. Your phone number, email address, date of birth, gender, compatibility answers and other users' identity data are not transmitted. Your chats with Bo are not stored on our servers; the chat history is kept only on your own device.

6.4 Transfers to authorities. Your personal data may be transferred to public authorities and judicial bodies entitled to request it, in order to fulfil an obligation arising from legislation.

7. Retention periods

Data	Retention period
Account and profile data	Until your account is deleted
Your events, stories, memories and ratings	Until you delete them or close your account
Event chats (written and voice messages)	Deleted automatically 24 hours after the event ends
App usage records	90 days; then deleted automatically, leaving only daily totals that cannot be linked to a person
Sign-in problem records	7 days
Business accounts' ticket, payment and bank details and business documents	10 years from the last transaction (under Turkish Commercial Code no. 6102); retained even if the business account is closed
Consent records	10 years (for evidentiary purposes during the general limitation period)

Personal data whose retention period has expired is deleted, destroyed or anonymised.

8. Deleting your account

You may delete your account at any time by following Settings › Account › Delete My Account in the app; deletion begins immediately. If you cannot access the app, you may send us your request from partibo.app/hesap-sil. In that case, to prevent someone else's account being deleted, we verify that the request belongs to the account holder and complete the process within 30 days at the latest.

Data deleted: every file you uploaded, your messages, future events you created, your tickets, favourites, follows, ratings, support requests, task and point records, your device's notification address and the link between your account and your phone number.

Data anonymised: your name, bio, gender, date of birth, profile photo, compatibility answers, your referral code and city. In past events you appear as "Deleted user".

Data retained: records in past events you joined or hosted; these contain no personal data of yours. Deleting past events in full would also delete the memories and stories of the other people who attended, and this choice was therefore made deliberately. Commercial records that legislation requires us to keep are retained for the periods stated in article 7.

Your phone number is released; you may sign up again with the same number, in which case a new account is created and your previous content does not return. Deletion cannot be undone.

9. Age limit

Partibo is not directed at anyone under 18 and does not accept users under 18. This limit is applied at registration. Where personal data belonging to someone under 18 is found to be processed, the account and the data are deleted.

10. Your rights

Under article 11 of the Law you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom your data is transferred, in Türkiye or abroad; request correction if it is incomplete or incorrect; request erasure or destruction within the conditions set out in the Law; request that correction, erasure and destruction be notified to the third parties to whom the data was transferred; object to a result being reached against you through analysis carried out solely by automated systems; and claim compensation if you suffer damage due to unlawful processing.

How to apply. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests: in writing with a wet signature to the address above; using a secure electronic signature or mobile signature; or from the email address registered to your account to destek@partibo.app. Your application should state your name, surname, the subject of your request and contact details where we can reach you.

Your requests are concluded as soon as possible and within 30 days at the latest. If your application is rejected, if you find the response insufficient, or if no response is given within the period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of application.

11. Changes to this document

When this document is updated, the "last updated" date at the top of the page is changed. For significant changes you will be informed through the app and, where necessary, your consent will be requested again.