Tutma: Tuvalet Bul! Information Notice on the Processing of Personal Data (Turkish KVKK)
Prepared pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and to the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
Last updated: 5 September 2026
About this document. This is the information notice ("aydınlatma metni") required by Turkish Law No. 6698 (KVKK). It is an English translation of the Turkish original (KVKK Aydınlatma Metni), provided for convenience; in the event of a discrepancy the Turkish version prevails. This document is not a GDPR privacy notice and does not describe rights under the GDPR. The statutory references in it (for example "KVKK md. 5/2-(c)", meaning Article 5(2)(c) of Law No. 6698) are references to Turkish legislation and are kept in their original form; the English wording next to them is explanatory only. "Kurul" means the Kişisel Verileri Koruma Kurulu, the Turkish Personal Data Protection Board.
1. Data Controller
| Name | Exludio |
| Address | Çankaya, Ayşe Mayda Sk. No: 6, 35280 Konak/İzmir, Türkiye |
| destek@tutma.app | |
| Web | https://tutma.app |
Tutma is provided by the sole proprietorship of Kayra Demirkan, trading under the commercial name Exludio.
2. Personal Data Processed, Purposes and Legal Grounds
| Data Category | Data | Purpose | Legal Ground (KVKK md. 5) |
|---|---|---|---|
| Identity (Kimlik) | Name (if it comes from your Google/Apple account) | Showing the ownership of a contribution | 5/2-(c) performance of a contract |
| Contact (İletişim) | E-mail address | Account creation, authentication, mandatory notifications | 5/2-(c) performance of a contract |
| Transaction Security (İşlem Güvenliği) | Anonymous device identifier, IP address, sign-in records | Prevention of fake records and of abuse, rate limiting, security | 5/2-(f) legitimate interest |
| Location (Konum) | Instantaneous location (only at the moment of the request) | Listing the toilets in the vicinity, directions | 5/1 explicit consent |
| Location (Konum) | Coordinate of the point at which a contribution is made (persistent) | Verification that the contribution was really made at that point | 5/1 explicit consent |
| Location (Konum) | Approximate location (≈1 km) in a request for an out-of-coverage area | Measuring in which countries and cities there is demand | 5/2-(f) legitimate interest |
| Visual Record (Görsel Kayıt) | The toilet photograph you upload | Verification of the record and display to other users | 5/1 explicit consent |
| Customer Transaction (Müşteri İşlem) | Subscription status | Provision of paid features | 5/2-(c) performance of a contract |
| Legal Transaction (Hukuki İşlem) | Request and complaint records, audit log | Answering applications, compliance with legislation | 5/2-(ç) legal obligation |
| Legal Transaction (Hukuki İşlem) | Your access information sharing declaration and the time of the declaration | Establishing whose declaration it is, meeting removal requests | 5/2-(f) legitimate interest |
Your data is collected through the mobile application by electronic means, by automated means, through the information you provide and the data generated by your device.
About location
The location you provide while browsing the map is not stored persistently. The query is made not with your raw coordinate but with a region code representing an area of approximately 1.2 km; no location history linked to your account is built from these queries.
When you make a contribution, on the other hand, the location of that contribution is stored persistently in your record (see below). That is, the location of the places you rate is kept linked to your account; your browsing history is not.
When you make a contribution (a rating, adding a new place, a photograph), the coordinate of that contribution is processed for the purpose of verifying that the contribution was really made at that point, and is stored in the contribution record.
About photographs
The image you upload is regenerated from the raw pixels at the moment it reaches the server; the EXIF metadata (including location, device model and time of capture) is completely destroyed by this operation and is not present in the published file.
Images pass through automated content moderation before going live. Images found to contain the image of a person, identity information or personal data are not published. You can appeal the outcome of this moderation with the "Appeal" ("İtiraz Et") option inside the App and request that the decision be reassessed by a human being (see section 8).
3. Explicit Consent: Where and How It Is Obtained
There are two processing activities that require explicit consent, and your consent for each of them is obtained separately, independently of each other and independently of the approval of the Terms of Use. Neither is a precondition for the other and neither is a condition of access to the service as a whole.
| Consent | When it is requested | How it is withdrawn | What happens if it is withdrawn |
|---|---|---|---|
| Processing of location data | When you first open the map, through your device's location permission screen | By turning off the location permission in the device settings | Listing what is around you and directions do not work; the rest of the App continues to work |
| Uploading and publication of a photograph | At every photograph upload, when you press the send button | By deleting the photograph inside the App or by writing to destek@tutma.app | Your photograph is withdrawn from publication and destroyed |
Your withdrawal of consent does not affect the lawfulness of the processing carried out up to the moment of withdrawal.
Approval of the Terms of Use is not a declaration of explicit consent. The rules screen shown before you contribute is a contractual acceptance; your consent in respect of the processing of personal data is obtained separately at the moments shown in the table above.
4. Transfer of Data
4.1 Domestic transfer (KVKK md. 8)
| Recipient | Purpose of Transfer |
|---|---|
| Competent public institutions and organisations | In the cases provided for by law, upon request and limited to the scope of the request |
4.2 Transfer abroad (KVKK md. 9)
No adequacy decision has yet been issued by the Kişisel Verileri Koruma Kurulu in respect of any country, sector or international organisation (md. 9/1). For this reason, the transfers below are carried out pursuant to KVKK md. 9/2-(c) by signing the standard contract announced by the Kurul and by notifying the Kurul within five business days of signature.
| Recipient | Purpose of Transfer | Country | Transfer Mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting; the server on which the database and the photographs are stored | Germany / Finland | md. 9/2-(c) standard contract |
| Cloudflare, Inc. | Access speed, attack protection, domain name management | Global | md. 9/2-(c) standard contract |
| Anthropic PBC | Automated content moderation of uploaded images | USA | md. 9/2-(c) standard contract |
| Google LLC | Sign in with Google, error reporting, app distribution | Global | md. 9/2-(c) standard contract |
| Apple Inc. | Sign in with Apple, app distribution, subscription verification | Global | md. 9/2-(c) standard contract |
| RevenueCat, Inc. | Verification and management of subscription status | USA | md. 9/2-(c) standard contract |
Your photographs are not kept in a storage service abroad. Images are stored only on the hosting server specified above; during content moderation a copy of the image is transmitted to the moderation provider and is not used by the provider for model training.
Where a standard contract is not in place for a transfer, that transfer is not carried out; should a necessary and incidental transfer be required, your explicit consent is obtained separately pursuant to KVKK md. 9/6.
5. Retention and Destruction Periods
| Data | Period |
|---|---|
| Account data | Until the account is deleted; destruction within 30 days at the latest after the deletion request |
| Anonymous device identifier | Until the App is uninstalled |
| Security and access records | 12 months |
| Moderation audit log | 2 years |
| Usage statistics | 90 days |
| Uploaded images | Until the relevant record or the account is deleted |
| Contributions (ratings, toilet listings) | Indefinitely; when the account is deleted they are anonymised by severing the link with the contributor |
Data whose period has expired is deleted or irreversibly anonymised through periodic destruction processes.
6. Children's Data
The App is not directed at children under 13 years of age and personal data is not knowingly collected from this age group.
Users between 13 and 18 years of age may use the App only with the knowledge and consent of their parent or legal guardian. In this age group, in respect of the processing that requires explicit consent (location and photographs), consent is deemed to have been given by the parent or legal guardian or with their authorisation; the parent or legal guardian may at any time apply to destek@tutma.app to withdraw this consent and to request the deletion of the child's data and the closure of the account. Such an application is concluded within the periods set out in section 8.
If it is noticed that data belonging to a child under 13 years of age has been collected, the data concerned is deleted without delay.
7. Data Security
Your data is encrypted with TLS during transmission. The database user of the application holds only the privileges it needs; access to the administration panel is protected by a separate password and session, and every operation that touches personal data is written to the audit log together with the identity of the person carrying it out (KVKK md. 12/1-ç).
8. Rights of the Data Subject (KVKK md. 11)
By applying to the data controller you have the right:
- To learn whether your personal data is being processed,
- To request information about it if it has been processed,
- To learn the purpose of the processing and whether the data is used in accordance with that purpose,
- To know the third parties to whom the data is transferred domestically or abroad,
- To request rectification if the data has been processed incompletely or incorrectly,
- To request the erasure or destruction of the data,
- To request that rectification, erasure and destruction operations be notified to the third parties to whom the data has been transferred,
- To object to an adverse outcome arising solely from the analysis of the data by automated systems (including contributions rejected as a result of automated image moderation): this right may be exercised with the "Appeal" ("İtiraz Et") option inside the App, and the decision objected to is reassessed by a human moderator,
- To request compensation for the damage should you suffer damage because of unlawful processing.
9. Application
You can submit your requests to destek@tutma.app or in writing to the address Çankaya, Ayşe Mayda Sk. No: 6, 35280 Konak/İzmir, Türkiye. Your application must clearly contain the information serving to establish your identity and the subject of your request.
Your applications are concluded free of charge, as soon as possible depending on their nature and within 30 days at the latest. Should the operation additionally entail a cost, the fee in the tariff determined by the Kurul may be charged.
Should your application be rejected, should you find the answer given insufficient or should no answer be given within the period, you may lodge a complaint with the Kişisel Verileri Koruma Kurulu within thirty days from the date on which you learned the answer and in any event within sixty days from the date of the application (KVKK md. 14).