Data Protection Notice (KVKK)

Yürürlük tarihi / Effective date: 2026-06-26 · Sürüm / Version: 1.0

This Notice explains how your personal data is processed when you use the Laflai mobile application (https://laflai.app), in accordance with Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the related secondary legislation.

Note for EU/EEA users: This is a KVKK-specific notice governed by Turkish law. If you are located in the European Union / EEA, the GDPR also applies. Under the GDPR, our lawful bases are: performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), our legitimate interests (Art. 6(1)(f)) and, where indicated below, your consent (Art. 6(1)(a); Art. 9(2)(a) for any special-category content). You have the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and the right to lodge a complaint with your supervisory authority. Transfers outside the EEA are protected by appropriate safeguards (Standard Contractual Clauses). See our Privacy Policy for the full GDPR detail.

Laflai is a single-user flirting / messaging co-pilot tool: you upload a screenshot of one of your own conversations from another app (Tinder, Bumble, Instagram, WhatsApp, iMessage, etc.), and Laflai analyzes it and suggests reply options that you copy and paste into your own chat yourself. It is not a dating app — there is no matching, no profiles of other people, and no in-app chat with others. The service is intended strictly for adults aged 18 and over.

1. Data Controller

Your personal data is processed by Laflai ("Laflai", "we", "us") in its capacity as data controller.

Data controller: Laflai
Contact: info@laflai.app
KVKK / data protection applications: privacy@laflai.app
Website: https://laflai.app

Under KVKK, "personal data" means any information relating to an identified or identifiable natural person, and "processing" covers any operation performed on such data from collection to erasure.

2. Categories of Personal Data Processed

To provide the service, we process the following categories of personal data:

Identity and account data: your email address; the user id assigned to you by the relevant identity provider when you sign in with Google or Apple (authentication handled via Supabase Auth).
Profile preferences: age band, your goal (serious / casual / undecided), tone preference and language.
Chat screenshots you upload: the images you upload for analysis. By their nature these may contain faces, names and message content — including information about you or third parties that may be sensitive. For this reason, screenshots are processed only with your explicit consent, sent once to our AI provider for analysis, and permanently deleted from our storage as soon as analysis completes (see Section 6). We do not keep the screenshots.

Special-category data warning: You alone control what your screenshots contain. Laflai does not intend to process special-category data under KVKK Art. 6 / GDPR Art. 9. We strongly ask you not to upload content that may reveal such data (e.g. health, religion, sex life or political opinion); if you do, you do so on your own initiative and explicit consent.
Analysis outputs: conversation analyses (tone, intent, interest %, compatibility %, strategy, red flags) and generated reply suggestions.
Telemetry / usage data: in-app interaction logs, the reply style you selected, and usage counters.
Consent records: which consent (disclosure / image processing / cross-border transfer) you gave, its version and timestamp.
Subscription status: your premium entitlement information (subscription/entitlement status obtained via the app stores / RevenueCat). We have no access to your full card data; the app stores take payment.
Notification data: the Expo push token, if you enable notifications.
Support correspondence: the content of any email communication with us.

3. Purposes of Processing

We process your data for the following purposes:

to create your account, verify your identity and manage your session;
to analyze the chat screenshot you upload, assess tone, intent, interest and compatibility, and provide reply suggestions;
to tailor outputs to your preferences (goal, tone, language);
to provide secondary features such as "People" and the "Flirt Scorecard";
to manage your subscription and premium entitlement;
to send you push notifications if you enable them;
to ensure the security, continuity and performance of the service, monitor errors and crashes, and prevent misuse;
to handle your support requests and communicate with you;
to fulfil our legal obligations and retain consent records for evidentiary purposes.

4. Legal Grounds for Processing

Your personal data is processed on the following legal grounds set out in KVKK Art. 5 and Art. 6 (with the GDPR equivalents noted in the box above for EU/EEA users):

Establishment or performance of a contract (Art. 5/2-c): account creation, session management, subscription and provision of premium features.
Compliance with a legal obligation (Art. 5/2-ç): statutory retention and recordkeeping duties.
Establishment, exercise or protection of a right (Art. 5/2-e): retaining consent/transaction records in case of a dispute.
Legitimate interests of the controller (Art. 5/2-f): service security, crash/error monitoring, product analytics and prevention of misuse (provided your fundamental rights and freedoms are not harmed).
Explicit consent (Art. 5/1 and Art. 6): the following are based solely on your explicit consent:
- processing of your chat screenshots for analysis (given that content may be sensitive);
- transfer of personal data to service providers located abroad (see Section 5);
- sending marketing commercial electronic messages/notifications, if you opt in (under Law No. 6563 and the Commercial Communication Regulation, always with a free opt-out).

You may withdraw consent for consent-based processing at any time; however, since screenshot analysis and cross-border transfer are essential to the service, withdrawing consent may make the relevant feature unavailable. For details, see the Explicit Consent Text.

5. Transfer of Personal Data and Cross-Border Transfer

To deliver the service, your data is shared with the service providers (processors / sub-processors) below. As most of these providers are located in the United States, such transfers constitute cross-border transfers within the meaning of KVKK Art. 9 and are carried out on the basis of your explicit consent.

Service provider	Country	Purpose / data transferred
Anthropic, PBC	USA	AI language + vision model provider; chat screenshots and profile context are sent here for analysis.
Groq, Inc.	USA	Fallback AI inference provider, used for resilience/cost.
Supabase, Inc.	USA	Database, file storage and authentication infrastructure.
RevenueCat, Inc.	USA	Subscription management (receipt validation / entitlements).
Expo	USA	Push notification delivery (Expo Push) and app delivery.
Sentry	USA	Crash / error monitoring.
PostHog	EU (European Union)	Product analytics; data is hosted in the European Union (eu.i.posthog.com).
Apple App Store / Google Play	USA	App distribution and, for subscriptions, the merchant of record; they take payment, not us.

For cross-border transfers, we take the technical and organizational measures required to protect your data under KVKK Art. 9 and related legislation. For users or providers located in the European Union (e.g. PostHog), appropriate safeguards (including Standard Contractual Clauses / SCCs) apply. For details of the data categories transferred, see the Privacy Policy and the Explicit Consent Text.

6. Retention Periods

We retain your personal data only for as long as the processing purposes require and within the periods prescribed by applicable legislation:

Chat screenshots: permanently deleted from our storage as soon as analysis completes; we do not retain them.
Analysis outputs and reply suggestions: retained during the service and until your account is deleted.
Account and profile data: for as long as your account is active; deleted or anonymized within a reasonable time after account deletion.
Telemetry / usage data: retained for a limited period for product and security purposes.
Consent records: retained for the duration of our legal proof obligation.
Subscription status and support correspondence: retained for the applicable statutory limitation and legislative periods.

Data whose retention period has expired is deleted, destroyed or anonymized.

7. About Automated Analysis and Reply Suggestions

The analyses and reply suggestions Laflai provides are generated automatically by AI models. These outputs are for information and suggestion purposes only; they are not professional (legal, psychological, etc.) advice and do not guarantee any outcome. You are responsible for which suggestion you choose to use and for the consequences of the messages you send. We do not carry out fully automated decision-making that produces legal effects concerning you; under KVKK Art. 11 you retain the right to object to a result against you produced solely by automated analysis. For the service's liability limitations and rules of use, see the Terms of Use.

8. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of KVKK, by applying to us as data controller you have the right to:

learn whether your personal data is being processed;
request information if it has been processed;
learn the purpose of processing and whether the data is used in line with that purpose;
know the third parties to whom the data is transferred, domestically or abroad;
request rectification of incomplete or inaccurate data;
request erasure or destruction of your data within the conditions set out in KVKK Art. 7;
request that rectification, erasure and destruction operations be notified to third parties to whom the data has been transferred;
object to a result against you arising from the analysis of your data solely by automated systems;
claim compensation if you suffer damage due to unlawful processing of your data.

(If you are in the EU/EEA, your GDPR rights — including data portability, restriction and the right to complain to your supervisory authority — also apply; see the box at the top and the Privacy Policy.)

9. How to Exercise Your Rights (Application Procedure)

You may submit requests relating to the rights above, in accordance with the "Communiqué on the Procedures and Principles of Application to the Data Controller," by the following means:

in writing, from the email address registered in our system or using a secure electronic / mobile signature, to privacy@laflai.app;
via Registered Electronic Mail (KEP), if you have one;
through the in-app support / contact channels.

Your application should include your full name, your signature (if in writing), your Turkish ID number (passport/ID number for foreign nationals), your address for service, your email/phone if any, and the subject of your request.

We will conclude your requests free of charge within 30 (thirty) days at the latest, depending on the nature of the request. Where the operation entails additional cost, a fee may be charged per the tariff set by the Board.

If your application is rejected, you find our response insufficient, or you do not receive a timely response, you have the right to lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any event, within 60 days of the application date.

For our full data-processing practices, please review the Privacy Policy, the Explicit Consent Text, the Cookie Policy and the Subscription Terms.

İletişim / Contact

For general questions about this Notice, contact us at info@laflai.app; for requests regarding your personal data and KVKK rights, contact us at privacy@laflai.app.

Laflai · https://laflai.app