Data Processing Notice

Effective: 14 May 2026 · v1.0 · GDPR Art. 13

1. Data Controller

Gökhan Camcı (sole trader operating under the SOU brand) — Istanbul, Türkiye
Contact: kvkk@souprivate.com

Operating model: SOU does not store special-category personal data (biometric templates, criminal-record documents) on its own systems. Identity and background checks are carried out by authorised third parties (Persona KYC, the Turkish Ministry of Justice E-Devlet QR system); SOU only retains the verification outcome ("verified / not verified"). Should the storage model change, this notice will be updated accordingly.

2. Personal Data Processed

Category	Data Type	Legal Basis
Identity	Full name, date of birth	GDPR Art. 6(1)(b) · contract
Contact	E-mail address, phone number	GDPR Art. 6(1)(b) · contract
Location (approximate)	City, neighbourhood (user-declared); plus your device's approximate location used by the nearby-members / automatic check-in features. The precise GPS coordinate is not stored on the server; it is rounded to ~111 m precision and held only transiently (at most 5 min). The location you enter when adding a venue is sent to OpenStreetMap Nominatim (EU) for address lookup.	GDPR Art. 6(1)(a) · consent
Visual	Profile photographs (EXIF stripped)	GDPR Art. 6(1)(a) · consent
Identity verification result	Persona KYC output: verified=true/false flag. The identity document, government ID number and biometric selfie are not stored on SOU systems — processed by Persona and the result is returned.	GDPR Art. 6(1)(b) · contract
Criminal record verification result	The user uploads an E-Devlet QR-coded document; the Turkish Ministry of Justice QR system performs the verification. SOU only retains the clean=true/false outcome; the document itself is not stored.	GDPR Art. 6(1)(b) · contract
Intent preferences	Intent (acquaintance / friendship / professional / conversation), prompt answers	GDPR Art. 6(1)(a) · consent
Behavioural	Drop reactions, reliability metrics, vouch graph	GDPR Art. 6(1)(f) · legitimate interests
Inferred / profiling	Categories (values, interests, communication style) inferred from your profile text and in-app preferences, plus a reliability indicator computed from your drop decisions — used only for matching; a human editor is in the loop (not a solely-automated decision).	GDPR Art. 6(1)(f) · legitimate interests
Transactional	Apple subscription metadata, payment status (card data not stored)	GDPR Art. 6(1)(b) · contract
Technical	Device type, OS version, app version, IP, push token	GDPR Art. 6(1)(f) · legitimate interests

Note: SOU does not store identity documents, biometric templates, criminal-record documents, or other special-category raw data. Verification is performed with user consent by authorised third-party processors (Persona, Turkish Ministry of Justice QR); SOU only processes the resulting flag. Legal basis: GDPR Art. 13.

3. Purposes of Processing

Evaluating and approving membership applications
Preparing curated introductions (Drops)
Opening a match and messaging channel
Trust & Safety (identity verification, reporting, bans)
Compliance with legal obligations
Responding to consumer rights requests

4. International Transfers (GDPR Chapter V)

We use the following third-party service providers as international data processors. Transfers are made on the basis of explicit consent and Standard Contractual Clauses (SCC):

Provider	Location	Data	Basis
Firebase / Google Cloud	europe-west3 (Frankfurt)	All Firestore + Storage	SCC + EU residency
OpenAI	USA	Message content (safety moderation + conversation health analysis), profile bio/prompt text (matching embedding), voice intro recording (Whisper transcript), bucketed profile categories (Drop editorial text)	Explicit consent (AI Consent Sheet) + DPA/SCC
Google Cloud Vision	USA / global	Uploaded photographs (inappropriate-content / NSFW safety scan + face detection)	Explicit consent + DPA/SCC
OpenStreetMap Nominatim	EU	Location/search text you enter when adding a venue (coordinate→address lookup)	Legitimate interests + public API terms of use
Persona (KYC)	USA	Identity document, biometric selfie	Explicit consent + SOC 2 Type II + DPA
RevenueCat	USA	UID, subscription metadata	SCC + contract
Resend (email)	EU	Contact e-mail address	EU DPA
Sentry	EU (sentry.io DE region)	Error logs (PII redacted)	EU DPA
Apple App Store	USA/EU	Apple ID, purchase receipts	Apple Developer Agreement
Twilio (SMS, optional)	EU/UK	Phone OTP	DPA + SCC

5. Retention Periods (GDPR Art. 5(1)(e))

Web waitlist data: retained from the date of application until app launch + 6 months. If launch does not occur, deleted no later than 31 December 2027. Rejected applications are deleted 90 days after the decision date.
Active member data: for the duration of membership
After account closure: 30-day soft-delete grace period
After 30 days: permanent destruction (messages anonymised, drops/vouches anonymised)
Reports (T&S): 3 years anonymised (legal obligation)
Audit logs: 3 years (GDPR Art. 5(2) accountability)

6. Your Rights (GDPR Art. 15–22)

You may exercise the following rights by writing to kvkk@souprivate.com or via Settings → Data Request within the app:

Right to know whether your personal data is being processed
Right to access information about that processing
Right to know the purposes for which your data is processed
Right to know which domestic and international recipients have received your data
Right to rectification of inaccurate or incomplete data
Right to erasure / right to be forgotten (Settings → Close Account)
Right to data portability in machine-readable format (Settings → Download My Data, GDPR Art. 20)
Right to object to automated decision-making (GDPR Art. 22 — to object to the Drop selection logic: kvkk@souprivate.com)

We will respond to your request within 30 days.

7. Use of Artificial Intelligence

Our primary AI provider is OpenAI (USA). The following data is processed to keep the service safe and to improve matching quality:

Chat messages: the text messages you send are transmitted to OpenAI for community safety (moderation) and conversation health/risk analysis.
Profile bio / prompt answers: converted into an OpenAI embedding model (a numeric vector) to compute matching similarity. This is done only if you have given explicit consent; if you do not consent, or withdraw it, your text is not sent to OpenAI.
Voice intro: the voice intro you record is sent to OpenAI Whisper to be transcribed.
Photographs: the photographs you upload are transmitted to Google Cloud Vision for an inappropriate-content (NSFW) scan.
Drop editorial text: for the "why you were selected" text, bucketed categories containing no name or photograph (age band, occupational group, neighbourhood) are transmitted to OpenAI.

Data Processing Agreements (DPA) and Standard Contractual Clauses (SCC) apply with these providers. The final matching decision is taken by a human editor (House Council); AI does not produce an automated decision on its own (GDPR Art. 22 compliant). You may decline AI processing from the in-app AI Consent screen.

8. Security Measures (GDPR Art. 32)

Auth tokens stored in iOS Keychain / Android Keystore
EXIF metadata stripped from photographs before upload
Photo access via 5-minute TTL signed URLs
No PII sent to Sentry (45-key redaction list)
Device-server communication over TLS 1.3
Firestore Security Rules with field-level whitelist

9. Child Protection

SOU is intended for users aged 21 and over. Age verification is mandatory via Persona KYC. Applications from users identified as under 21 are rejected and their data deleted.

10. Contact and Complaints

Data protection enquiries: kvkk@souprivate.com · 30-day response time
If you do not receive a response, you have the right to lodge a complaint with the relevant supervisory authority (e.g. the ICO or your local DPA) (GDPR Art. 77).