Data Processing Notice

Effective: 14 July 2026 · v2.1 · GDPR Art. 13

1. Data Controller

Gökhan Camcı (sole trader operating under the SOU brand) — Istanbul, Türkiye
Contact: kvkk@souprivate.com

Operating model: The current in-app identity flow processes an identity-document image transiently and does not persist that document. SOU does store three private verification selfies and, where separately consented, may store an encrypted face template in server-only storage. A legacy Persona integration remains conditional until its production decommissioning or use is verified.

2. Personal Data Processed

Category	Data Type	Legal Basis
Identity	Full name, date of birth	GDPR Art. 6(1)(b) · contract
Contact	E-mail address, phone number	GDPR Art. 6(1)(b) · contract
Location (approximate)	City and neighbourhood you provide; nearby presence rounded to roughly 111 m, excluded from scans after five minutes and then physically deleted by scheduled cleanup; and a separate rounded matching-location record retained for no more than 90 days. Exact coordinates are not shown to members. Venue searches or selected coordinates may be sent to Nominatim.	GDPR Art. 6(1)(a) · consent
Visual	Profile photographs (EXIF stripped)	GDPR Art. 6(1)(a) · consent
Identity and biometric verification	Name, date of birth and identity-document image processed transiently by the in-app verification service; three private verification selfies retained in server-only storage; and an optional encrypted face template if separately consented. The identity-document image itself is not persisted by SOU.	GDPR Art. 6(1)(a), Art. 9(2)(a) · explicit consent; other identity fields as applicable under Art. 6(1)(b)
Criminal record verification result	The user uploads an E-Devlet QR-coded document; the Turkish Ministry of Justice QR system performs the verification. SOU only retains the clean=true/false outcome; the document itself is not stored.	GDPR Art. 6(1)(b) · contract
Intent preferences	Intent (acquaintance / friendship / professional / conversation), prompt answers	GDPR Art. 6(1)(a) · consent
Behavioural	Drop reactions, reliability metrics, vouch graph	GDPR Art. 6(1)(f) · legitimate interests
Inferred / profiling	Compatibility, interest, communication and reliability signals inferred from profile text, sensitive preferences and answers. HOUSE is a direct introduction: the system or an authorised editor may select an eligible pair without mutual likes or user approval. You may object and request an explanation and human review.	GDPR Art. 6(1)(a) and/or Art. 6(1)(f), depending on the processing purpose
Transactional	Apple subscription metadata, payment status (card data not stored)	GDPR Art. 6(1)(b) · contract
Technical	Device type, OS version, app version, IP, push token	GDPR Art. 6(1)(f) · legitimate interests

Note: SOU does not persist the identity-document image used by the current in-app verification flow. It does retain three private verification selfies and may retain an encrypted face template where separately consented. These artifacts are server-only, are not profile content, and are deleted on consent withdrawal/account deletion through a durable deletion workflow. Legacy Persona processing remains conditional until production decommissioning or use is verified.

3. Purposes of Processing

Evaluating and approving membership applications
Preparing curated introductions (Drops)
Opening a match and messaging channel
Trust & Safety (identity verification, reporting, bans)
Compliance with legal obligations
Responding to consumer rights requests

4. International Transfers (GDPR Chapter V)

We use the following third-party service providers as international data processors. Transfers are made on the basis of explicit consent and Standard Contractual Clauses (SCC):

Provider	Location	Data	Basis
Firebase / Google Cloud	USA and European multi-regions (current Firestore: nam5; Functions: europe-west1)	Authentication, Firestore, Storage, Functions, key management and image safety, including private verification selfies	Applicable transfer mechanism and DPA; no EU-only residency claim
OpenAI	USA	Transient identity-document/selfie analysis, message moderation and conversation-health analysis, profile/prompt embedding, voice transcription and limited editorial inputs	Explicit consent where required + applicable DPA/transfer mechanism; production retention settings must be separately verified
Google Cloud Vision	USA / global	Uploaded photographs (inappropriate-content / NSFW safety scan + face detection)	Explicit consent + DPA/SCC
OpenStreetMap Nominatim	EU	Location/search text you enter when adding a venue (coordinate→address lookup)	Legitimate interests + public API terms of use
Persona (legacy/conditional)	USA	Legacy KYC inquiry identifiers, status, identity document and selfie only if the remaining integration is configured	Explicit consent where active + applicable DPA/transfer mechanism; otherwise decommissioning evidence is required
RevenueCat	USA	UID, subscription metadata	SCC + contract
Resend (email)	EU	Contact e-mail address	EU DPA
Sentry	EU (sentry.io DE region)	Error logs (PII redacted)	EU DPA
Apple App Store	USA/EU	Apple ID, purchase receipts	Apple Developer Agreement
Twilio (SMS, optional)	EU/UK	Phone OTP	DPA + SCC

5. Retention Periods (GDPR Art. 5(1)(e))

Web waitlist data: retained from the date of application until app launch + 6 months. If launch does not occur, deleted no later than 31 December 2027. Rejected applications are deleted 90 days after the decision date.
Verification selfies and optional encrypted face template: for the duration of approved membership; unresolved draft/submitted/KYC-pending records are deleted after 90 days, while human-review/waitlist records remain until a decision; consent withdrawal or account deletion triggers deletion.
Other active member data: for the duration of membership, unless a shorter period is stated
After account closure: 30-day soft-delete grace period
After 30 days: permanent destruction (messages anonymised, drops/vouches anonymised)
Reports (T&S): 3 years anonymised (legal obligation)
Audit logs: 3 years (GDPR Art. 5(2) accountability)

6. Your Rights (GDPR Art. 15–22)

You may exercise the following rights by writing to kvkk@souprivate.com or via Settings → Data Request within the app:

Right to know whether your personal data is being processed
Right to access information about that processing
Right to know the purposes for which your data is processed
Right to know which domestic and international recipients have received your data
Right to rectification of inaccurate or incomplete data
Right to erasure / right to be forgotten (Settings → Close Account)
Right to data portability in machine-readable format (Settings → Download My Data, GDPR Art. 20)
Right to object to automated decision-making (GDPR Art. 22 — to object to the Drop selection logic: kvkk@souprivate.com)

We will respond to your request within 30 days.

7. Use of Artificial Intelligence

Our primary AI provider is OpenAI (USA). The following data is processed to keep the service safe and to improve matching quality:

Chat messages: the text messages you send are transmitted to OpenAI for community safety (moderation) and conversation health/risk analysis.
Profile bio / prompt answers: converted into an OpenAI embedding model (a numeric vector) to compute matching similarity. This is done only if you have given explicit consent; if you do not consent, or withdraw it, your text is not sent to OpenAI.
Voice intro: the voice intro you record is sent to OpenAI Whisper to be transcribed.
Photographs: the photographs you upload are transmitted to Google Cloud Vision for an inappropriate-content (NSFW) scan.
Drop editorial text: for the "why you were selected" text, bucketed categories containing no name or photograph (age band, occupational group, neighbourhood) are transmitted to OpenAI.

Applicable data-processing and international-transfer mechanisms are used with these providers. HOUSE is a direct SOU introduction: an eligible pair may be selected by the system or an authorised editor, and a conversation may open without mutual likes or user approval. You may object to an automated selection and request an explanation and human review. Consent-based AI processing can be declined or withdrawn in the App.

8. Security Measures (GDPR Art. 32)

Auth tokens stored in iOS Keychain / Android Keystore
EXIF metadata stripped from photographs before upload
Photo access via 5-minute TTL signed URLs
No PII sent to Sentry (45-key redaction list)
Device-server communication over TLS 1.3
Firestore Security Rules with field-level whitelist

9. Child Protection

SOU is intended for users aged 18 and over. Age is checked through the current in-app identity-verification flow. Applications identified as under 18 are rejected and their data deleted.

10. Contact and Complaints

Data protection enquiries: kvkk@souprivate.com · 30-day response time
If you do not receive a response, you have the right to lodge a complaint with the relevant supervisory authority (e.g. the ICO or your local DPA) (GDPR Art. 77).