Personal data notice (KVKK)

Data controller

• The data controller is KELD Digital.
• Our address is Işıktepe Organize Sanayi Bölgesi Mah. 75. Yıl Bulvarı Demirciler Sitesi No:5 B Blok İç Kapı No:24, 16140 Nilüfer/Bursa, Türkiye.
• You can also reach us at hello@kelddigital.com.

Personal data processed

• Identity and contact: your display name, username, e-mail address, language and currency. If you sign in with Google or Apple, the account identifier those companies report.
• Age eligibility: your year of birth. It is not shown on your profile.
• Profile: your profile photo, your bio and, if you choose to show them, your country and region.
• User content: your collections, pieces, photos, descriptions, notes, posts, comments, reactions, saves, wish list, interests and tags.
• Messages: the messages you write, the photos and GIFs you send, reactions, and the earlier versions of edited messages.
• Community relations: the collectors you follow and who follow you, follow requests and the accounts you block.
• Preferences: your visibility choices, notification settings, read receipts, who sees your online status and value-poll setting.
• Photo review: the visual trace and edge colours derived from your photos on our own server, and the results of the adult-content and piece-count checks.
• Report and review records: content you reported or that was reported about you, the reason, the copy taken at the time of review and the outcome.
• Purchase information: if you choose to write it, what you paid for a piece, in which currency and roughly when.
• Value records: the value range found for your piece, who you show it to and the objections you raise.
• Identifier photo: if you photograph a piece’s label, base or plate to find its value, the photo is read on our own server and is not stored. Of the numbers read, only the one you choose is written to the piece’s record.
• Value research: when you look up a piece’s value or ask for model suggestions as you type, we send the name, brand and number you typed from our own server to search engines and open catalogues (Open Library, MusicBrainz, Wikidata). These queries carry no identity, no e-mail address and no photo.
• Value polls: unless you turn them off in settings, your occasional answers about values other collectors show. Answers are used anonymously; they are not shown, singly or as a count, to the person who added the piece or to anyone else. When the team settles a value we count how many of your answers proved right; your answers weigh by that count, which shows only in your own copy of your data.
• Subscription: whether you are on the Supporter plan, where the plan came from, when it ends and whether it will renew. Payment details are not processed.
• Invitation: during the closed beta, the invite code you opened your account with.
• Notifications: your phone’s notification token.
• Transaction security and technical records: session records, IP address, device type and app version, last sign-in time, and server access and error logs.
• Communication: the e-mails and applications you send us.
• Waiting list: the e-mail address you left for the launch announcement.
• Your location, contacts and microphone are not accessed. No special categories of personal data are requested; please do not share such information, or other people’s personal data, in free-text fields.

Purposes of processing

• Opening your account, verifying your sign-in and keeping your account secure.
• Storing your collections, posts and messages and showing them to the people you choose.
• Checking photos for adult content and for the number of pieces, showing similar pieces and suggesting the kind of a piece.
• Finding an approximate value for your pieces and suggesting models as you type a name.
• Determining your plan and applying the limits that come with it.
• Delivering e-mails about your account and the notifications you chose, and sending the launch announcement to the waiting list.
• Managing invite codes during the closed beta.
• Reviewing reported content, preventing abuse, and finding and fixing errors.
• Concluding your applications and meeting our legal obligations.

Method of collection and legal grounds

• Your personal data is collected electronically and by automated means from the information you enter in the app and on klennord.com, the content you upload and server operations. If you sign in with Google or Apple, your account identifier comes from those companies; your subscription state comes from the store.
• Processing related to your account, collections, posts, messaging, value estimates, subscription and notifications is based on the establishment and performance of a contract under Article 5/2-c of the Law.
• Processing for legal obligations falls under 5/2-ç, and processing for the establishment, exercise or protection of a right under 5/2-e.
• Account security, prevention of abuse, photo checks, review of reported content, anonymous value records, value polls and error logs are based on our legitimate interest under 5/2-f, provided your fundamental rights and freedoms are not harmed.
• Non-essential processing, such as measuring use of the app or sending marketing messages, is carried out only with your explicit consent; none of it is done today. You can withdraw consent at any time. Reading this notice or using the app does not by itself count as explicit consent.

Automated processing

• Photo checks, similar-piece comparison, kind suggestion, value estimation and the assistant’s answers are carried out by automated means. The models that do this run on our own servers.
• A moderator looks at a photo that an automated check held or refused. A decision to remove content or restrict an account is taken by a member of our team.
• If you think a result against you arose solely from automated processing, you can object.

Transfers

• Your personal data is transferred, only as far as needed, to the providers that help us run the service: Supabase for sign-in, database and photo storage, Railway for the server, Resend for e-mail, Expo, Apple and Google for phone notifications, RevenueCat for subscription state, Vercel for the website, KLIPY for GIF search.
• KLIPY receives search words, not who you are. RevenueCat receives the randomly generated identifier of your account and your purchase record. Search engines and open catalogues receive only the words you typed in value research.
• If you sign in with Google or Apple, sign-in goes through those companies, and so does payment if you buy Supporter.
• Data may be disclosed to competent public authorities to the extent the law requires.
• Your personal data is not sold, rented or used for advertising.

Transfers abroad

• Because these providers’ servers are outside Turkey, your personal data is transferred abroad. Our database and your photos are in Germany (Frankfurt); our server application runs in the Netherlands (Amsterdam).
• E-mail delivery, phone notifications, subscription state, the website and GIF search are run with providers based in the United States.
• Transfers are made only with the data the service in question requires.

Security measures

• Your messages and the texts you write are stored encrypted in the database, and the key that opens them is kept apart. Your photos sit in storage that is closed to the public; those not open to everyone are encrypted there as well.
• Only the members of our team whose job requires it access the data. Admin actions and each opening of a report’s copy are logged.
• The details are in the privacy notice.

Retention periods

• Your personal data is kept while your account is open and for as long as the purpose of processing requires. When the purpose ends, it is deleted, destroyed or anonymised.
• When you ask for your account to be deleted, your sessions close at once; your account, content and photos are deleted shortly afterwards.
• The files of photos you remove are deleted within about a week.
• Messages you take back are deleted after 30 days, and the copies of messages that came with a report 180 days after the review is closed.
• Server access and error logs are kept for 30 days, database logs and daily backups for 7 days. Records the law requires us to keep are kept only for the required period.

Your rights

• Under Article 11 of the Law you can learn whether your personal data is processed and, if so, request information about it.
• You can learn the purpose of processing and whether the data is used in line with it.
• You can learn the third parties, in Turkey or abroad, to whom it is transferred.
• You can ask for it to be corrected if it is incomplete or inaccurate, and deleted or destroyed if the conditions are met.
• You can ask for these operations to be notified to the third parties to whom the data was transferred.
• You can object to a result against you that arises from analysis solely by automated systems.
• You can claim compensation if you suffer damage through unlawful processing.

How to apply

• You can get a copy of your data yourself, without applying. “A copy of my data” in the app’s Settings downloads your account, collections, posts and the conversations you are in as one file. The file goes only to you; our team does not see it.
• You can send an application about your rights by the methods in the Communiqué on the Principles and Procedures for Application to the Data Controller, in writing to the address above or from the e-mail address registered with Klennord to hello@kelddigital.com. Information that is necessary and proportionate may be requested to verify your identity.
• Your application is concluded free of charge as soon as possible according to its nature, and within 30 days at the latest. If the operation involves an additional cost, the fee in the tariff set by the Board may be charged.
• If your application is refused, if you find the answer insufficient or if no answer is given in time, you can complain to the Personal Data Protection Board under Article 14 of the Law.

Changes