Version: 2.5-interim · 2026-10-02 (INTERIM VERSION — updated on the basis of the lawyer's text dated 24.07.2026 to reflect the actual data flows as measured; the change log is shared on request)
Under the KVKK, your personal data is processed, in the capacity of Data Controller, by our company, whose details are given below and which determines the purposes and means of data processing and is responsible for setting up and managing the data recording system:
Trade Name: SSA YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ
Address: Ulucami Mah. Hilal Küme Evleri No: 11, Taraklı / Sakarya
MERSİS No: 0781116504400001
E-mail Address: destek@digifitsphere.com
Trade Registry No. - Tax Office: 43191- 7811165044
Chamber: Sakarya Chamber of Commerce and Industry · Chamber Registry No: 51642
The following categories of personal data are processed as part of your use of our Platform. Vague wording has been avoided, and only the data listed is processed:
Identity Data: First name, last name, date of birth, gender.
Contact Data: E-mail address, phone number, contact preferences (preferences for marketing and informational notifications).
Customer Transaction Data: Order history, delivery address, in-app purchase records.
Financial Data: Billing address, Turkish ID Number (where issuing an invoice requires it), transaction amount and date. (Your credit/debit card details are not stored on our servers; they are processed directly by PCI-DSS compliant Payment Institutions.)
Physical Profile Data (core service): Height, weight, age, gender, physical development goals, training level and dietary preferences (such as diet type; EXCLUDING allergies and intolerances).
Special Category Personal Data (Health and Biometric Data): Your allergy and intolerance information, your health declaration (heart, metabolic, orthopaedic and other chronic conditions, medications you take, symptoms, need for physician supervision and physician approval), body circumference measurements (neck, waist, hips, chest, arm, leg, calf) and body analyses based on them, the pain and fatigue (recovery) records you report on training days, health/physical condition statements shared with the AI assistant, and posture analysis, angle calculation and movement (pose estimation) data obtained through the camera.
Visual Records: User profile photo, body progress photos and meal photos.
Transaction Security and Technical Data: IP address, device model, operating system version, log records, password digest (hash) information and cookie data; in-app usage events (for example, a screen not being reachable, the steps on the payment screen), for the purpose of improving the service, without using any third-party analytics tool; the app version you use and the last time you used the app; information on whether the notifications and e-mails sent to you were delivered (the recipient address and notification token are not written to this record).
Request and Complaint Management Data: Support requests, correspondence with customer services, in-platform feedback and complaint records. A message you send through the in-app "Write to us" ("Bize yaz") feature is recorded together with the name of the screen it was sent from, the app version and the device type (Android, iPhone, Windows, web), and linked to your account if you are signed in; you can also send it without signing in, in which case the record is not linked to any account and we receive contact details only if you type them yourself. Device model and operating system version are not collected. Your IP address is not stored with the support request; it is used, in a digested form, in a temporary counter kept for no more than 1 hour to prevent abuse. Your location is not collected. The e-mail and phone details in your account are passed to the support team only if you tick the "get back to me" option.
Legal Transaction Data: Correspondence with competent public authorities and institutions, information relating to court and enforcement files, records in legal dispute proceedings.
AI Analysis and Profiling Data: Progress predictions, posture risk scores, eating habit analyses and personalised profile data generated by AI algorithms as a result of processing your raw data.
Your personal data is processed on the legal grounds set out in Articles 5 and 6 of the KVKK, on an "activity-based" and "purpose-specific" basis, as matched below:
Under KVKK Art. 5/2-c (processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract):
Identity and Contact Data: Creating the membership registration, managing the user account and providing support services to the user.
Financial Data: Carrying out in-app subscription and order payments.
Under KVKK Art. 5/2-ç (processing is mandatory for the data controller to fulfil its legal obligation):
Identity, Contact and Financial Data: Issuing invoices under tax legislation, and responding to statutory information requests from competent public authorities and institutions.
Transaction Security Data: Keeping traffic (log) records under Law No. 5651.
Under KVKK Art. 5/2-f (processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject):
Transaction Security and Technical Data: Ensuring the cyber security of the Platform, preventing fraud, fixing in-app errors and improving service quality. (Within this scope, your data is never used for profiling or marketing purposes.)
Request and Complaint Management Data: Reviewing the feedback you send through the in-app "Write to us" ("Report a Bug/Suggestion") form, getting back to you (only if you ask) and improving the service.
Under KVKK Art. 6/2 (the EXPLICIT CONSENT of the data subject for special category personal data):
Health and Biometric Data and Visual Records: Tracking athletic progress through AI-assisted camera analysis and creating personalised diet/training programmes.
Important Note: Your use of the core app services (standard membership, manual tracking, etc.) is not conditional on giving explicit consent to the processing of your special category data. Your explicit consent for special category data is obtained through two separate texts and two separate approvals: (1) the Health Data Explicit Consent Text — creating your personalised programme within Türkiye, without using AI; (2) the AI Explicit Consent Text — AI-assisted features and the transfer to OpenAI (USA) for this purpose. Approving this Privacy Notice does not replace either of these consents. No processing you have not consented to is carried out; the related feature stays off. Starting with version 1.0.18 of the app, these approvals are requested on separate screens and are obtained again from existing users.
Health Declaration, Allergies and Body Analysis: Your allergy and intolerance information, your health declaration (heart, metabolic, orthopaedic and other chronic conditions, medication use, symptoms, need for physician supervision and physician approval), your body circumference measurements and body analyses based on them, and the pain and fatigue records you report on training days are processed solely on the basis of the explicit consent you give to the Health Data Explicit Consent Text. If you do not give explicit consent, this information is not recorded in our systems; you can continue using the app with a cautiously prepared general training programme that does not rely on your health declaration; a personalised nutrition plan requires health explicit consent. When your health status is not known, the programme is prepared within the starting safety band, at low-to-moderate intensity; heavy-loading techniques are not used. Because your height and weight are needed for the core functioning of the service, such as calorie and training load calculations, they are processed under the establishment and performance of the contract (KVKK Art. 5/2-c) and do not depend on explicit consent. You can withdraw your explicit consent at any time in Settings; when you withdraw it, your health declaration, allergy/intolerance information, body circumference measurements and body analyses based on them, and your pain and fatigue records are deleted; your height and weight are kept.
Transition rule: If, before the date this text took effect, your health declaration (including physician approval), allergy/intolerance information, body circumference measurements and body analyses based on them, or the pain and fatigue records you reported on training days were recorded without explicit consent, you will be asked for your explicit consent the next time you open the app. If you refuse, this information is deleted immediately; if you do not give explicit consent within 30 days, it is deleted at the end of the 30th day. Your height and weight, weight history, dietary preferences and pantry are kept. During this period, this information is not used for your personalised programme.
Your personal data is collected electronically, by fully or partly automated means, through the registration forms you fill in on our mobile app and website, the access permissions you grant to your device's camera and photo gallery, the recording of in-app usage events by the app itself, and cookies.
Your personal data is transferred to the parties below only to the extent required by the purpose, observing the "need-to-know" principle and data minimisation principles:
Domestic Transfer (KVKK Art. 8):
Hosting: The Platform's servers and database are hosted by a hosting provider (LightNode) located in Türkiye (Istanbul); all Platform data is processed on these servers.
Competent Public Authorities: If a legal obligation arises (a court order, etc.), the requested data is shared with the competent authorities.
Transfer Abroad (KVKK Art. 9):
Due to our Platform's technical infrastructure, payment and AI features, personal data is transferred to the service providers based abroad that are named below. The Personal Data Protection Board has not announced an adequacy decision for these countries. A legal assessment is ongoing on providing appropriate safeguards for regular transfers by signing the standard contracts announced by the Board with the relevant service providers and notifying the Authority within five business days of signing; this text will be updated once it is completed. The transfer relating to AI analysis additionally depends on the explicit consent you give for your special category data; if you do not consent, this transfer is not made.
OpenAI (USA): For AI-assisted analysis and recommendations; health/physical profile data (height, weight, goal, health declarations, dietary preferences), training and nutrition plan context, movement analysis frames (with the face area masked on the device) and meal/product photos.
Dodo Payments (USA): For collecting subscription payments made on the web; e-mail address and payment transaction details. Your card details are processed directly by Dodo Payments and do not reach our servers.
Apple Inc. (USA): For verifying subscription purchases made through the App Store, "Sign in with Apple", and delivering notifications to the device on iPhone (Apple Push Notification service: device notification token and notification content); purchase transaction records and Apple authentication information.
Google LLC (USA): For verifying subscription purchases made through Google Play (purchase record), "Sign in with Google" (authentication information), sending notifications (Firebase Cloud Messaging: device notification token and notification content), detecting app errors (Firebase Crashlytics: crash report and user ID), updating app settings remotely (Firebase Remote Config: app installation identifier) and verifying that requests come from the genuine app (Firebase App Check: app installation identifier and device integrity verification result).
Resend (USA): For sending e-mails relating to account actions (verification code, password reset); e-mail address and e-mail content.
Sentry (data region Germany/EU): For detecting server-side errors; error records and user ID.
Cloudflare (USA): For disaster recovery; the database backup taken overnight. The backup is encrypted before it leaves our servers.
Competition Law: Your data is never shared with competing undertakings for purposes that restrict competition, such as "no-poaching" or "market sharing". Ownership of your data belongs to you.
In line with the Personal Data Protection Board's Decision No. 2018/10 and the case law of the Constitutional Court (AYM), the highest level of security measures is applied in processing your special category personal data:
Face Masking (Edge Processing): During camera-based fitness movement analysis (pose estimation), your face area is irreversibly masked on your device (locally). The images sent to our servers and to the AI provider for movement analysis contain no face data that would directly reveal your identity.
Our Platform is not intended for users under the age of 18.
Our website uses only cookies that are strictly necessary for the site to work; no analytics or marketing cookies are used. The mobile app uses Firebase software development kits (SDKs) for sending notifications, detecting errors, updating app settings remotely and verifying that requests come from the genuine app (see IV); these are not used for analytics or marketing purposes.
Strictly Necessary Cookies, which are essential for the system to work, are processed on the basis of our legitimate interest (KVKK Art. 5/2-f).
If an analytics or marketing cookie or SDK starts being used, your explicit consent will be obtained before that processing and this text will be updated.
In line with the principle of "being kept only for as long as necessary for the purpose for which they are processed", your personal data is stored and destroyed according to the specific periods below, without being subject to vague periods:
Financial and Commercial Records: 10 years from the end of the contract, under the Turkish Commercial Code and the Tax Procedure Law.
Traffic (Log) Records: 2 years, under Law No. 5651.
Market Orders: The name, phone number and delivery address for market orders placed in August 2026 are kept as order records; the market feature is currently turned off.
AI Analysis Images: Images uploaded/taken for body progress or movement analysis are automatically and immediately deleted from our systems as soon as the analysis is complete and the result has been delivered to you; at OpenAI, to which they are transferred for analysis, that provider's own retention policy applies.
Write to Us Records: Kept for 1 year after your request is closed; open requests are kept until they are closed.
Notification and E-mail Delivery Records: 90 days.
Backups: Database backups on the server are kept for no more than 4 weeks, and encrypted backups kept off the server are kept for 90 days; deleted data leaves the backups within 90 days at the latest.
Membership Data: When you delete your account, your personal and health data is deleted and your account record is anonymised; order records that must be kept under tax and commercial legislation are kept in anonymised form. When you withdraw your explicit consent, consent-based processing ends. On your deletion request, your data is deleted from our systems; for data previously transferred to the service providers named in Section IV — Google (Firebase Crashlytics), Sentry, Dodo Payments, Resend and OpenAI (abuse monitoring records) — that provider's own retention policy applies. Records relating to explicit consent and deletion requests are kept for the statutory period as proof. Before 29 September 2026, the text version to which an explicit consent was given was not written to our records; from that date on, each explicit consent is recorded together with the text version to which it was given. Up to that date, we hold no explicit consent records obtained from our real users.
Under Article 11 of the KVKK, as a data subject you have the following rights:
To learn whether your personal data is processed,
If it has been processed, to request information about it,
To learn the purpose of processing and whether the data is used in line with that purpose,
To know the third parties to whom it is transferred in Türkiye or abroad,
To request correction if it is incomplete or processed incorrectly,
To request its deletion or destruction under the conditions set out in Article 7 of the KVKK,
To request that the correction, deletion or destruction be notified to the third parties to whom the data has been transferred,
To object to an outcome against you arising from the analysis of the processed data exclusively through automated systems,
To claim compensation for damage if you suffer damage due to unlawful processing,
Data Portability: To request your data on the Platform in a reasonable, structured and machine-readable format (CSV, JSON, etc.).
Application Procedure: To exercise the rights listed above, under the "Communiqué on the Procedures and Principles of Application to the Data Controller", you can send your requests:
from the e-mail address registered in our system to [destek@digifitsphere.com],
or in writing, together with documents proving your identity, to [Ulu cami Mah. Hilal Küme Evleri No: 11, Taraklı / Sakarya].
Under KVKK Art. 12, our Company takes technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data, prevent unlawful access to the data and ensure the data is safeguarded. Within this scope, communication between your device and our servers is encrypted with TLS, your password is stored only as an irreversible digest (hash), backups taken off the server are encrypted before they leave the server, and the fact that each user can access only their own data is enforced on the server side.
The AI algorithms on our Platform create "progress predictions", "posture risk scores" and "personalised programmes" for you based on the physical data, dietary preferences and movement analyses you provide. Under KVKK Art. 11/1-g, these activities constitute "profiling" in the sense of analysing your personal data exclusively through automated systems. If you believe that the results of such analysis create a situation against you, your right to object to that result is reserved.
Our Company reserves the right to update this Privacy Notice at any time in line with changes in legislation, Board decisions or new data processing activities. Updates will be notified to you through the Platform or via your registered e-mail address and will take effect on the date they are published.
If the personal data processed is obtained by others through unlawful means, our Company will notify the data subject and the Personal Data Protection Board as soon as possible (within 72 hours) under KVKK Art. 12/5. This process reflects the importance we place on data security and our principle of transparency.
Sending commercial electronic messages (SMS, e-mail, push notifications) for marketing, campaign and promotional purposes through our Platform is additionally subject to your approval under Law No. 6563 on the Regulation of Electronic Commerce and the related regulations. These approvals are independent of the consents obtained under the KVKK and can be withdrawn at any time through the Message Management System (İYS).
Where our Company acts as a "Hosting Provider" under Law No. 5651 on Regulating Internet Publications and Combating Crimes Committed Through Such Publications, it is obliged to keep the traffic information of users accessing the platform (IP address, start and end time of the service provided, type of service used, amount of data transferred, etc.) for the periods set out in the relevant legislation (at least 1 year, at most 2 years). This data is shared for judicial proceedings only at the request of competent public authorities and institutions.
To use features offered by our Platform such as AI-assisted analysis, you grant camera, photo gallery and notification permissions through your device's operating system (iOS/Android); you can turn off or manage these permissions at any time in your device's "Settings > Apps > DigiFitSphere > Permissions" section. Turning these permissions off will make the related feature (for example, movement analysis) unavailable but will not affect the app's core functions.
← Back to home