Data Protection Notice

Last updated: October 2026

WHAT THIS TEXT IS FOR

This is the data protection notice required by article 10 of Turkish Personal Data Protection Law no. 6698 (KVKK): what is processed, for which purpose, on which legal ground, who it is passed to, and what rights you have. A notice and a consent are two different things, and they are deliberately two separate texts — here you read what happens, and you give your consent separately, on the screen that appears before your first scan. The privacy policy tells the same story in more everyday language; this does not replace it, it stands beside it.

WHO IS RESPONSIBLE

The data controller is İbrahim Melikşah Köse, an individual developer in İstanbul, Türkiye; there is no company behind Kelvia. This is also the address you write to about anything below.
İbrahim Melikşah Köse
Fındıklı Mahallesi, İpek Sokak, Meriçlife Sitesi 25-45C, Kat 2, Daire 21
Maltepe / İstanbul, Türkiye
melberlabs@gmail.com

WHAT NEVER LEAVES YOUR PHONE

Your onboarding answers, your skin profile, your scan history, your routine, your progress photos and your consent record are stored on this device only. We have no server that holds them and no account system; we cannot look at them, copy them, or bring them back. Everything below is about the moments when some of that data does leave the phone, during a scan.

In the iPhone app, since version 1.0.2, also kept only on this phone: reminders, which are planned with iOS's own local notifications and never show a finding about your skin (while a free trial runs, its end date is kept for the day-before reminder); your routine marks, weekly notes, the reason you gave for stopping a product and your answer when a new product's first two weeks are up; your avoid list and the barcodes you add to your shelf; the home-screen widget's file, which holds only how many products are in today's routine and whether you marked them; and your photo diary — those photos are encrypted like progress photos, never analysed and never sent. "Delete all my data" removes all of it.

THE FACE SCAN

Processed: the photo you take, the answers to the four opening questions (age range, main goal, routine experience, sensitivity), and the language the analysis should be written in. The purpose is to have what the photograph appears to show read back to you as a skin reading. Your face photo, the skin findings the reading produces, and your sensitivity answer are health data — special categories of personal data under article 6 of the law — and the only legal ground for processing them is your explicit consent. Without that consent the scan never starts, and the rest of the app keeps working.

THE PRODUCT SCAN

Processed: the photo of the product's label, your skin profile (skin type, concerns and their 1-5 severities), your four answers, the names of the products in your routine along with their known actives, and the language. The purpose is to read the label and assess how the product fits your profile and whether it clashes with your routine. The profile that travels with it carries health data, so the legal ground here is again your explicit consent. The score you see is not set by the model: it is calculated on your phone, from the ingredient list that was read and from your profile.

SEARCHING FOR A PRODUCT BY NAME

When you type a product's name instead of photographing it, what is processed is the text you typed and the language. The purpose is to find that product's publicly published ingredient list on the web. The list found is shown to you first; if you confirm it, the same product analysis described above runs, with the confirmed ingredient list in place of a photo. The text you type is never used to identify a person. The legal ground is performance of the service you asked for under the terms of use (article 5/2(c)).

A PASTED INGREDIENT LIST

When you paste or type a product's ingredient list instead of photographing it or searching for its name, what is processed is that text and the language. The text is first shown to you as a parsed list; if you confirm it, the same product analysis described above runs, with the list you confirmed in place of a photo. The list belongs to a product and is never used to identify you; please do not type personal details into it. Your profile travels with it on your explicit consent, as in a product scan. For the list itself, the legal ground is performance of the service you asked for under the terms of use (article 5/2(c)).

THE ANONYMOUS DEVICE IDENTIFIER

The app generates a random identifier for itself the first time it runs and sends it with every analysis request. Its only purpose is applying the weekly scan allowance and preventing abuse of the service. It is not derived from your phone's hardware and it is not linked to your name, email or Apple ID. The legal ground is the controller's legitimate interest (article 5/2(f)). Because it is kept in the Keychain it survives deleting and reinstalling the app — a deliberate choice, since otherwise every reinstall would hand out a fresh quota. "Delete all my data" replaces it with a new one.

USAGE ANALYTICS

Apart from the ad measurement below, this version of the app sends no usage analytics. Which screens are opened and which actions are taken is written only to the phone's own system log; that record stays on the phone and is not passed to us or to anyone else. If a future version starts sending anonymous usage statistics, this notice will be updated before that version is released, stating the purpose, the legal ground and the recipient.

AD MEASUREMENT (META)

Only in the iPhone app, and only if you choose "Allow" in Apple's tracking prompt. Processed: the fact that the app was installed and opened, your device's advertising identifier, and the technical details Meta's SDK attaches to such events (device model, operating system version, language, time zone; a crash report if the SDK itself crashes). The purpose is measuring the results of Kelvia's Instagram and Facebook ads. The legal ground is your explicit consent, given by your choice in Apple's prompt after a short explanation and withdrawn at any time in Settings → Privacy & Security → Tracking. The recipient is Meta Platforms, Inc. (United States). Nothing that counts as health data — no scan, photo, skin finding, profile or routine — and no purchase is ever sent to Meta. How long Meta keeps these events is governed by Meta's own terms.

WHEN YOU WRITE TO US

The feedback link in Settings and the feedback card on a result screen open a draft in your phone's email app. If you send the draft, your email address and what you wrote reach us, and are used only to understand the problem and answer you; if you do not send it, it goes nowhere. The "did this feel right" buttons on a result screen, in this version, only write a note to the phone's own log and send nothing anywhere. The legal ground is the legitimate interest in answering your message.

WHO IT IS PASSED TO

A scan request passes through three places in turn. First, Cloudflare, Inc.'s relay in the United States hands it to our server without writing it down. Then the OVHcloud infrastructure our server runs on (Milan, Italy, inside the European Union) relays it on our behalf, as our data processor, again without writing it down; its calls to Google leave through Cloudflare's network. Finally, Google's Gemini API produces the analysis. What does stay on the server is listed under "How long it is kept". At Google's end we are on the paid tier, whose terms say Google will not use what is sent to improve its products, and under which no human reviewer reads it. A log is kept only for abuse monitoring, for a limited period — up to 55 days by default. Nothing is passed to anyone else: no ad network, no data broker, no partner.

Separately, if you have iCloud Backup switched on, the app's on-device data goes into your own backup. That is not a transfer we make; the backup is between you and Apple, and we cannot reach it.

TRANSFER ABROAD

All three recipients above are outside Türkiye: Cloudflare and Google in the United States, OVHcloud in Italy. If you allow ad measurement, a fourth is added: Meta Platforms, Inc., in the United States. Today these transfers rest on your explicit consent, and the consent screen and Apple's tracking prompt name the recipients. Article 9 of the law may additionally require a safeguard mechanism for transfers that are regular and ongoing. This is the one unfinished item in this notice and it is left open on purpose: the mechanism will be set as [the standard contract published by the Board / the mechanism our lawyer determines], and this passage will be updated when it is. We do not write down things we do not yet know.

HOW IT IS COLLECTED

All of it is collected directly from you, through the app, electronically and by automated means; we collect nothing about you from any other source. A photo is re-encoded on your phone before it is sent, which strips the metadata a camera embeds — including where and when the picture was taken. Your location never enters the request.

HOW LONG IT IS KEPT

What is on your phone stays until you delete it; "Delete all my data" in Settings removes all of it at once. The photo, profile and routine that reach our server during an analysis are never written to a disk or a log, and once the request ends nothing is left. Some things do stay on the server. The first is the scan counters: an irreversible digest of the device identifier (for a subscription, of the subscription) and how many scans were used; the daily counter expires by itself after about twenty-five hours, the weekly one after about eight days. The second is a network counter kept to limit abuse: a SHA-256 digest of the internet (IP) address and the number of scans made from it that day; the address itself is not written, and the counter expires by itself after about twenty-five hours. The legal ground is the legitimate interest in preventing abuse of the service (article 5/2(f)). The third is the name-search cache: its key is a simplified form of the product name you typed and its value is that product's publicly published ingredient list; it expires by itself after seven days and is never tied to which device searched for it. If you subscribe, a fourth: a digest of the subscription's transaction number, its plan and its end date, which expires by itself one day after the subscription ends; the legal ground is entering into and performing the contract (article 5/2(c)). The welcome-week record (a digest of the download record and the week's end) is deleted after sixty days.

These server records are backed up once a day on the same server, so that we can recover from a failure, and each backup is deleted after 7 days. A record whose time has run out can therefore remain in a backup for up to 7 more days.

AGE

Kelvia is for people aged 18 and over. The limit rests on your own statement; there is no identity check.

YOUR RIGHTS

Under article 11 of the law you have the right to: learn whether your personal data is processed; request information about it if it is; learn the purpose and whether it is used in line with that purpose; know the third parties it is passed to at home or abroad; have it corrected if it is incomplete or wrong; have it erased or destroyed; require that a correction or erasure be notified to the third parties it was passed to; object to a result reached against you solely through automated analysis; and claim compensation if you suffer loss because it was processed unlawfully. You can also withdraw your explicit consent at any moment; withdrawing does not retroactively invalidate processing already carried out.

HOW TO APPLY

Writing to the email address above is enough. Your request is answered within thirty days at the latest. If the answer does not satisfy you, you can complain to the Personal Data Protection Board.

IF THIS TEXT CHANGES

If something the app does with data changes, this text changes and the date above is updated. If the change touches what you consented to — for instance if a different provider takes over the analysis — the old consent is not carried over; the app asks again before your next scan.

MOST OF YOUR RIGHTS ARE ALREADY IN YOUR HANDS

This text is long, but what we hold about you is short. Almost all of your data sits on your own phone, which is why you can exercise most of the rights above without asking us for anything — from Settings, yourself, immediately: edit your answers, turn off photo storage, withdraw analysis permission, and delete everything with one tap.