Privacy Policy
This notice has been prepared to fulfil the obligation to inform under Article 10 of the Personal Data Protection Law No. 6698 (“KVKK (Law No. 6698)”) and related legislation, and to explain how your personal data is processed in the Rotavele app.
1. Data controller
The data controller within the meaning of KVKK:
- Data controller: Veli Bacık (VBX Teknoloji)
- Contact email: [email protected]
2. Personal data processed
Depending on how you use the app, the following data is processed. No advertising SDK or advertising ID is used; no push notifications or emails are sent. Firebase Analytics and Firebase Crashlytics are used to improve the app and fix errors.
| Category | Data | Source |
|---|---|---|
| Authentication | Email address, name and unique account ID (UID) provided when signing in with Google or Apple. An anonymous account ID while browsing as a guest. | Google / Apple, you |
| Profile | Display name, profile photo, bio, city, records of your 18+ age confirmation and acceptance of the terms. | You |
| Project content | Pitch video, cover image, project title, description, category, updates. | You |
| Interaction | Comments, likes, projects you follow. | You |
| Investor profile | Optional: budget range, areas of interest, company/fund, role, LinkedIn URL, verification request and status; your investor lists (not visible to others). | You |
| Contact requests | The message sent to the founder, the investor’s name and the email address they provide for replies. | You |
| Moderation | Your reports (reason, related content), reports made about you, and review records. | You, other users, admin |
| Notifications | Notifications in the in-app inbox (new comment, added to a list, contact request, project status). | The app |
| Waitlist | The email address you leave for beta access. | You |
| Usage and error data | Firebase Analytics: screen views and in-app interactions, app instance ID (not an advertising ID; not linked to your account). Firebase Crashlytics: crash reports, device model, operating system and app version, your account ID (UID). | Your device |
| Technical / security | Firebase App Check verification data, service providers’ security and error logs (IP address, device and app version information). | Your device, Google |
Rotavele does not collect location or contacts data. Camera, microphone and photo library permissions are used only when you record a video or select a video or photo, and only to upload that content. Videos are compressed on your device before they are uploaded.
Your profile information, published projects and comments are visible to other users. Your investor lists and your email address are not shown to others. If an investor contacts you, their message and reply email are shown to you inside the app.
3. Purposes of processing
- Creating your membership, verifying your identity and managing your session.
- Publishing project videos and content, and providing the feed and discovery experience.
- Operating the comment, like, follow, list and contact request features.
- Displaying your investor profile and evaluating verification requests.
- Content review, handling reports, and preventing abuse and spam.
- Delivering in-app notifications.
- Managing the beta access queue.
- Ensuring information security and protecting the service (e.g. App Check).
- Measuring how the app is used in aggregate, and fixing crashes and errors.
- Fulfilling legal obligations and establishing, exercising or protecting a right.
4. Legal bases
Your data is processed under Article 5/2 of KVKK on the following bases:
- It is directly related to the establishment or performance of a contract (5/2-c): account, profile, project, comment and other core services.
- The legitimate interests of the data controller (5/2-f): security, preventing abuse, moderation, improving the service; provided that your fundamental rights and freedoms are not harmed.
- Compliance with a legal obligation (5/2-ç) and the establishment, exercise or protection of a right (5/2-e).
- Explicit consent (5/1): for transfers abroad and other processing that depends on your consent, the consent you give at the approval step in the app. You may withdraw your consent at any time; in that case the service may not be provided.
5. Transfer of data
Domestic
Your data may be shared with authorised public authorities upon lawful requests. Apart from that, it is not sold to third parties in Türkiye or transferred for marketing purposes.
Service provider: Google Firebase (transfer abroad)
The app’s infrastructure runs on Google Firebase (Authentication, Cloud Firestore, Cloud Storage, App Check, Analytics, Crashlytics). Service provider: Google LLC / Google Cloud EMEA Limited. The database is kept in the Google Cloud europe-west1 (Belgium) region; your files (videos, cover images) are also kept on Google Cloud Storage. Because of the service provider’s support, security and operational activities, the data may be accessed from outside Türkiye. For this reason, your data is considered to be transferred abroad.
The transfer is carried out in accordance with Article 9 of KVKK and the relevant Personal Data Protection Board regulations: [transfer mechanism — explicit consent / standard contract / Board notification, to be clarified by legal counsel]. Google’s processing terms: firebase.google.com/support/privacy.
Sign-in providers
When you sign in with Google or Apple, the relevant provider processes data under its own privacy policy; Rotavele receives only your email, name and account ID from these providers.
Other users
Your public content (profile name, photo, bio, city, published projects, comments) is visible to other people using the app.
6. Retention periods
| Data | Period |
|---|---|
| Account, profile, projects, videos, images, comments, likes, follows, investor profile and lists, notifications | Until your account is deleted. When you delete your account, the app deletes this data immediately. |
| Contact requests you sent | Until your account is deleted; deleted during account deletion. |
| Contact requests sent to you | Kept as the sending investor’s record until their account is deleted. When your account is deleted, the personal fields in them (name, reply email) are cleared. |
| Report and moderation records, projects removed from publication by an admin | For up to 1 year after your account is deleted, to combat abuse and to establish legal rights; deleted at the end of that period. |
| Investment prospect view counter (account ID and counts only) | For up to 1 year after your account is deleted, to prevent the quota from being reset by deleting an account. |
| Waitlist email | During the beta; deleted when the beta ends or upon your request. |
| Analytics data | Up to 14 months; not linked to your account. |
| Crashlytics crash reports | Up to 90 days. |
| Service provider security logs and backups | Deleted data is permanently removed from Google infrastructure logs and backups within 180 days at the latest. |
If there is a legal retention obligation or an ongoing dispute, the relevant data is kept only for that period; at the end of the period it is deleted, destroyed or anonymised.
7. Security
Data is encrypted in transit; access is restricted through Firebase security rules and authorisation. Abuse of the app is mitigated with Firebase App Check. No system is entirely risk-free; in the event of a breach, the Board and the affected individuals are notified in accordance with Article 12 of KVKK.
8. Your rights (KVKK Article 11)
As a data subject, you have the right to:
- Learn whether your personal data is being processed,
- Request information about it if it has been processed,
- Learn the purpose of processing and whether it is used in accordance with that purpose,
- Know the third parties to whom it is transferred, domestically or abroad,
- Request correction if it has been processed incompletely or incorrectly,
- Request deletion or destruction under Article 7 of KVKK,
- Request that corrections and deletions be notified to the third parties to whom the data has been transferred,
- Object to a result against you arising from the analysis of the processed data exclusively by automated systems,
- Claim compensation if you suffer damage due to unlawful processing.
You can delete your account and data from within the app at any time: Deleting your Rotavele account.
9. Deleting your Rotavele account
You can delete your Rotavele account and the data linked to it from within the app at any time, free of charge. Deletion cannot be undone.
Step by step in the app
- Open the Rotavele app and sign in with your Google or Apple account.
- Go to the Profile tab in the bottom menu.
- Tap Settings.
- Tap Delete my account.
- On the screen that opens, read the data that will be deleted and type DELETE in the box to confirm.
- Tap the Permanently delete my account button.
- For security, re-verify your identity with your Google or Apple account.
- Do not close the app until the process finishes. When it is done, you will see the message “Your account has been deleted.” and your session will be closed.
The process may take a few minutes. If it is interrupted (e.g. the connection drops), you can reopen the app and resume the deletion from where it left off by following the same steps.
Data deleted immediately
- Your account record and the link between your Google/Apple sign-in and Rotavele (authentication record),
- Your profile: display name, profile photo, bio, city,
- Your project, pitch video, cover and gallery images, updates, investment prospect and your project’s follower records,
- The comments you wrote, the likes you gave and your follows,
- Your investor profile (budget range, company, role, LinkedIn), your investor lists and your prospect view records,
- The contact requests you sent,
- Your in-app notifications,
- All your files on the server (video, cover, images, profile photo).
Data retained and retention periods
| Data | Why | Period |
|---|---|---|
| Contact requests sent to you | The sending investor’s record | The name and reply email are cleared during deletion; the remaining record stays until the sender’s account is deleted. |
| Reports you made, moderation records about you, your project removed from publication by an admin | Combating abuse, establishing rights | Up to 1 year after the account is deleted |
| Investment prospect view counter (account ID and counts only) | Preventing the quota from being reset by opening a new account | Up to 1 year after the account is deleted |
| Waitlist email | Beta access queue | Until the beta ends or upon your request |
| Analytics data (not linked to your account) | Aggregate usage measurement | Up to 14 months |
| Crashlytics crash reports | Error fixing | Up to 90 days |
| Logs and backups in Google infrastructure | Infrastructure security | Permanently deleted within 180 days at the latest |
If there is a legal retention obligation or an ongoing dispute, the relevant records are kept only for that period.
If you cannot access the app
If you cannot open the app, you can send your deletion request to [email protected] with the subject “Rotavele account deletion request”, stating the email address you signed in with and your sign-in method (Google / Apple). We may ask for additional information to verify your identity; your request will be completed within 30 days at the latest. Details: support page.
10. How to apply
You can submit your requests regarding your rights, together with information that verifies your identity, through the following channel:
- Email: [email protected]
Depending on its nature, your request will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, a fee according to the tariff set by the Board may be charged. If you find the response inadequate, you retain the right to file a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any case, within 60 days of the date of your application.
11. Changes
This notice may be updated. The current version is published on this page; for significant changes, you will be informed within the app. The effective date is stated at the top of the page.