KVKK Information Notice

Data Controller

• Vitality ("Vitality", "Platform", "we") acts as the data controller for personal data processed through the services offered at thevitality.net.
• Contact: yusufkaynar74@gmail.com
• Legal entity details (trade name, MERSİS / tax number, registered address) are shared upon request via yusufkaynar74@gmail.com.

Categories of Personal Data Processed

• Identity data: username; optionally first and last name.
• Contact data: email address.
• Customer transaction data: subscription status, payment history (card data is stored by Stripe; Vitality has no access to it).
• Security data: IP address, browser type, session logs, error traces (Sentry).
• Account content: habit logs (water, focus, healthy, mind, habit), HQ Lite notes, tasks, and calendar entries.
• Location data: country and city as declared by the user.
• Education data: school as declared by the user.

Purposes of Processing

• Creation and management of your account.
• Service delivery: habit tracking, organising School Wars leagues, Robin Hood Engine impact calculations.
• Management and billing of premium subscriptions.
• Sending email and push reminders (subject to your preferences).
• Compliance with legal obligations.
• Anonymous analytics for service improvement.
• Security purposes including abuse, fraud, and fake-account detection.

Legal Basis for Processing

• Your personal data is processed under KVKK Art. 5/2(c) where necessary for the establishment or performance of a contract (account, subscription, payment),
• KVKK Art. 5/2(ç) where mandatory for compliance with our legal obligations (tax, KVKK retention),
• KVKK Art. 5/2(f) for our legitimate interests, provided that your fundamental rights and freedoms are not harmed (analytics, security),
• Marketing emails and cross-border data transfers are processed based on your explicit consent under KVKK Art. 5/1. You may withdraw your consent at any time.

Recipients of Personal Data

To deliver the service, your personal data is transferred to the following service providers located outside Turkey. This transfer is technically required to provide the service and is performed within the scope of the explicit consent obtained at registration.

• Supabase, Inc. (United States) — database and authentication infrastructure.
• Stripe Payments Europe Ltd. (Ireland) — payment processing.
• Resend, Inc. (United States) — email delivery.
• Vercel Inc. (United States) — hosting and CDN.
• Functional Software, Inc. d/b/a Sentry (United States) — error tracking and performance monitoring.
• Upstash, Inc. (United States) — anti-spam rate limiting.
• Microsoft Corporation (United States) — user experience analytics through Microsoft Clarity (anonymous session recordings and heatmaps). Password fields and sensitive inputs are automatically masked; no personally identifiable information is collected.

Method of Collection

Personal data is collected by automated means through the registration form, in-app interactions, cookies, and browser data; and by non-automated means through support requests and email correspondence.

Your Rights Under KVKK Article 11

• Learn whether your personal data is being processed.
• Request information about processing if it is.
• Learn the purpose of processing and whether it is used in accordance with that purpose.
• Know the third parties to whom your data is transferred domestically or abroad.
• Request correction if the data is incomplete or inaccurate.
• Request deletion or destruction within the scope of conditions provided under KVKK Article 7.
• Request that correction, deletion, or destruction be notified to third parties to whom the data was transferred.
• Object to outcomes against you arising from analysis solely through automated systems.
• Claim damages if you suffer loss due to unlawful processing of your data.

How to Apply

• To exercise the rights above under the Communiqué on Procedures and Principles for Application to the Data Controller, you may submit your request to yusufkaynar74@gmail.com.
• Your application will be concluded within 30 days at the latest depending on the nature of the request. If the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
• If your application is rejected, our response is found insufficient, or no response is given within the legal period, you have the right to file a complaint with the Personal Data Protection Board within 30 days from the date you learn our response, and in any case within 60 days from the application date.

Data Retention Periods

• Account information and content: retained for as long as your account is active. Deletion requests are completed within 30 days of receipt.
• Payment and billing records: retained for 10 years pursuant to tax legislation.
• Security and error logs: retained for a maximum of 90 days.

Updates

When this notice is updated, the revision date above is updated; significant changes will additionally be communicated via email.