Last updated · October 24, 2026 · Version 2026-10-24
KVKK Privacy Notice
1. Data controller
This notice is prepared by Oriaverse, as data controller under Turkish Personal Data Protection Law No. 6698 ("KVKK" or the "Law"), to inform users of the Asoria app, the oriaverse.com website and the Nexoria network. Contact: help@oriaverse.com.
2. Data processed, purposes and legal grounds
| Data category | Purpose | Legal ground (Law, Arts. 5 and 6) |
|---|---|---|
| Identity: first name; optional surname and date of birth | Creating and identifying the account, introducing you to other users, the 18+ check | Formation and performance of a contract (5/2-c); legal obligation (5/2-ç) |
| Contact and sign-in: if you sign in with Apple or Google, that account's ID and email address; as a guest, a digest of a random key created on your phone | Account creation, sign-in verification, account security, verifying identity for your requests | Formation and performance of a contract (5/2-c); legitimate interest (5/2-f) |
| Images: optional profile photo, photos you send in chat | Being recognised when meeting in person, delivering messages | Performance of a contract (5/2-c) |
| Persona data: texts describing yourself, links and their public content, chats with Asoria | Creating and improving the persona, producing match suggestions and reasons | Performance of a contract (5/2-c); explicit consent for special categories of data you share in these texts (6/2) |
| Event and match data: event code, ticket, attendance, matches, groups | Providing the event service, giving the organiser attendance information | Performance of a contract (5/2-c); legitimate interest (5/2-f) |
| Messages and notes | Communication between users, preventing misuse, reviewing reports | Performance of a contract (5/2-c); legitimate interest (5/2-f) |
| Location data | Helping you meet at the event venue, with the people and for the time you choose | Explicit consent (5/1) |
| Customer transactions: purchase records, subscription status, token history | Providing Premium and tokens, handling refunds and disputes, tax and accounting obligations | Performance of a contract (5/2-c); legal obligation (5/2-ç) |
| Transaction security: session information, app version, server logs including IP address, notification token | Information security, preventing misuse, delivering notifications | Legitimate interest (5/2-f); legal obligation (5/2-ç) |
| Legal records: consent records, report and moderation records | Proof of agreements, community safety, establishing and protecting rights | Legal obligation (5/2-ç); establishing and protecting a right (5/2-e); legitimate interest (5/2-f) |
| Website data: chat on the site, email and event details you give, waitlist, visit data | Answering your questions, getting back to you, telling you when our new product opens if you joined the waitlist, improving the site | Formation of a contract (5/2-c); legitimate interest (5/2-f) |
3. Transfers and recipient groups
Your personal data is transferred only for the purposes above and only as far as necessary, to these recipient groups:
- Service providers (data processors): AI infrastructure provider (Google LLC), server and database hosting providers and notification service providers.
- The app store: for purchases and payments.
- Other users: the profile and persona information listed in the Privacy Policy, to your matches and people at the same event; location only to the people you choose.
- Event organisers: attendance information and non-personal aggregate numbers.
- Competent public authorities and courts: when legally required.
Because our servers and some of our service providers are located outside Türkiye (in the European Union and the USA), data is transferred abroad. Transfers are made in line with Article 9 of the Law, using the standard contracts published by the Board and notifying the Board; in incidental cases where that isn't possible, they rely on explicit consent.
4. Method of collection
Personal data is collected electronically: from the information you enter while using the app and the website, from the phone features you allow (location, photos, camera, notifications), from the public pages of the links you add, from the app store's purchase notifications and from records created automatically while the service runs.
5. Retention
Data is kept for as long as the purpose of processing requires; the periods are listed in the Privacy Policy. When you delete your account, data is deleted immediately; only records we are legally required to keep (such as purchase records) are kept for the required period and then deleted, destroyed or anonymised.
6. Your rights under Article 11 of the Law
- to learn whether your personal data is processed,
- to request information if it has been processed,
- to learn the purpose of processing and whether it is used in line with that purpose,
- to know the third parties in Türkiye or abroad to whom it is transferred,
- to request correction if it is incomplete or inaccurate,
- to request deletion or destruction under the conditions of Article 7 of the Law,
- to request that actions under (e) and (f) be notified to third parties the data was transferred to,
- to object to a result against you arising solely from analysis of the processed data by automated systems,
- to claim compensation for damage arising from unlawful processing.
7. How to apply
To use your rights, send your application by email to help@oriaverse.com, stating the email address linked to your account, or with a secure electronic or mobile signature. Your application should include your name, surname, the email address linked to your account and request; we may send a confirmation email to that address to verify your identity. Applications are concluded free of charge within 30 days at the latest; if the process requires an additional cost, the Board's fee schedule may apply. If your application is refused, the answer is insufficient or it isn't answered in time, you can complain to the Personal Data Protection Board.
8. Explicit consent
Processing based on explicit consent (AI processing and the transfer to Google it requires, special categories of data you share in persona texts, location and incidental transfers abroad) is explained item by item in a document separate from this notice: Explicit Consent. You can withdraw your consent at any time.
9. Nexoria (founder–investor network)
The founder–investor network at oriaverse.com/nexoria is also covered by this notice. Data processed specifically for the network:
| Data category | Purpose | Legal ground |
|---|---|---|
| Account and sign-in data (name, email, password hash, two-step sign-in, session data) | Opening the account, verifying and protecting sign-in | Conclusion and performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Application and profile: for founders the startup's name and description, sector, stage, revenue, team and round, pitch deck, logo, website and LinkedIn; for investors the organisation, title, thesis, ticket size, portfolio and LinkedIn | Reviewing applications, calculating matches, showing the profile to the people you match with | Performance of a contract (Art. 5/2-c); for public information on linked pages, data made public by you (Art. 5/2-d) |
| Persona, match reports, simulated conversations and rehearsal conversations | Providing matching, reports and rehearsals | Performance of a contract (Art. 5/2-c); explicit consent for AI processing and the transfer abroad it requires (Art. 5/1, Art. 9) |
| Meeting data: proposed and confirmed times, feedback; once a meeting is accepted, the email, phone and LinkedIn shared with the other side | Setting up the meeting, the calendar invite and the video call link | Performance of a contract (Art. 5/2-c) |
| Tokens, billing and payouts: token history; for invoices the Turkish ID or tax number, name and address; for an investor's earnings payout the tax details and IBAN (stored encrypted) | Invoicing, paying rehearsal earnings, tax obligations | Performance of a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Support messages and email notifications | Answering requests, service notices | Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
- Recipients: in addition to the groups in section 3, an email delivery service (your email address and the email's content) and a calendar and video call service (once a meeting is confirmed, both sides' email addresses and the meeting's time and title).
- Other users: a founder's profile and deck (watermarked) are shown only to the investors they match with. An investor's name and organisation are not shown to a founder until the founder accepts that investor's meeting request.
- Retention: invoice, tax and payout records for the period required by law; other network data until you delete your account.