Gizlilik Politikası

[TODO: Legal entity name, registered office address in Istanbul, company registration number, VAT/tax number if applicable.]

[TODO: Data controller identification for KVKK and GDPR purposes, contact details for the designated data protection officer or privacy contact.]

[TODO: Account data — email, name, authentication credentials. Fitness intake data — goals, training history, equipment access, language preference. Plan data generated by coaches — workouts, nutrition, supplement recommendations. Coaching chat history. Device information for authentication and bug reporting.]

[TODO: Clarify which fields are required vs. optional. Note any sensitive-health-adjacent data (e.g., injury history, dietary restrictions) and the legal basis for processing it.]

[TODO: Purposes — delivering the coaching service, matching users to coaches, billing, customer support, product improvement, legal compliance. Each purpose should map to a legal basis under GDPR Article 6 and KVKK Article 5.]

[TODO: List of sub-processors and third parties — cloud hosting (specify provider and region), payment processor (Apple/Google App Store), email service, error monitoring, analytics if any. Note cross-border transfer mechanisms and safeguards.]

[TODO: Retention periods by data category. Account data: as long as the account is active plus X months after cancellation. Coaching chat logs: specify period. Billing data: as long as required by Turkish accounting law (typically 10 years). Clarify deletion process.]

[TODO: Under GDPR (EU users) and KVKK (Türkiye users), rights include access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Explain how to exercise each right and expected response time.]

[TODO: Right to lodge a complaint with the supervisory authority — in Türkiye this is KVKK (Kişisel Verileri Koruma Kurumu), in the EU users may contact their local data protection authority.]

[TODO: Technical and organizational measures — encryption in transit and at rest, access controls, incident response, staff training, regular audits. Note any certifications (ISO 27001, SOC 2) if/when applicable.]

[TODO: Minimum age for use of POWAIN — typically 16+ or 18+ depending on jurisdiction and service type. Policy on accidental data collection from minors.]

[TODO: How users are notified of material changes. Effective date handling. Where prior versions are archived if applicable.]