Skip to content
Besin App LogoBesin App
TR

KVKK PRIVACY NOTICE

KVKK Privacy Notice

Last updated: October 18, 2026

Nomadsoft Limited (UK) | besin.app | iletisim@besin.app

This English translation is provided for accessibility. The Turkish notice is the governing version for purposes of Türkiye's Law No. 6698.

1. Data Controller

Under Türkiye's Personal Data Protection Law No. 6698 (KVKK), your personal data is processed lawfully by Nomadsoft Limited as the data controller. The Company is incorporated in the United Kingdom and operates Besin App and besin.app. Contact: iletisim@besin.app; corporate website: nomadsoft.com.tr.

2. Personal Data Processed

No password is stored; authentication uses a one-time code sent by email.

  • Identity data: first and last name.
  • Contact data: email address.
  • Usage data: product-search history and scanned barcodes.
  • User-provided content: product photos voluntarily taken or selected for photo product search or a product suggestion.
  • Product ratings and reviews: ratings you give, tags you pick, reviews you write, and reports about reviews.
  • Transaction-security and notification data: device make/model, operating-system version, device identifiers, and push token.
  • Network data: IP address, used for App security, unauthorized-access detection, and legal obligations.
  • Ad-measurement data (only if you separately opt in; off by default): app events (first open/install, app opens, registration completion), device information, IP address, an anonymous app ID created by Meta, and, on Android, the advertising ID.

3. Purposes of Processing

  • Complete membership and one-time-code authentication.
  • Create and manage user accounts.
  • Provide barcode scanning, product assessment, and algorithmic scoring.
  • Analyze product photos through the Google Gemini API to match a product and read information on its packaging.
  • Review user-submitted product photos, create or update product records, and display approved product images in the Besin application and on besin.app.
  • Receive and publish product ratings and reviews and check reviews against the content rules automatically and manually.
  • Detect errors, maintain security, and prevent unauthorized access using device and IP information.
  • Send push notifications about App updates and announcements.
  • Measure the performance of our ads on Meta.
  • Meet legal obligations and respond to properly issued authority requests.

4. Legal Grounds for Processing

  • KVKK Article 5/2-c, contract formation or performance: membership, OTP authentication, barcode scanning, product display, algorithmic scoring, and receiving and showing the product ratings and reviews you submit. Data covered: name, email, usage data, and product ratings and reviews.
  • KVKK Article 5/2-ç, legal obligation: valid authority requests and statutory retention. Data covered: personal data required by law.
  • KVKK Article 5/2-f, legitimate interests: system security, error detection, App improvement, and checking reviews against the content rules before they are published, without harming your fundamental rights. Data covered: device, IP, and usage data, review texts, and report records.
  • KVKK Article 5/1, explicit consent: voluntary product-photo submission, AI analysis through the Google Gemini API, transfer through Google, Cloudinary, and Cloudflare services, consent-based marketing push notifications, and, only if you opt in separately, transfer of app events and device information to Meta for ad measurement. Consent may be withdrawn at iletisim@besin.app, or for Meta under Ad measurement in the Profile screen of the App, without retroactive effect.

5. Transfers and International Transfers

Because the data controller is based in the United Kingdom, collected data is technically transferred from Türkiye to the UK. The following recipients may also receive data:

  • Nomadsoft Limited (UK): processes all App data as data controller. The transfer is necessary to perform the service under KVKK Article 5/2-c.
  • Supabase (Germany): authentication, database storage, and infrastructure. The database servers are in Frankfurt, Germany; Supabase is a US-based company. The legal grounds are contract performance and legitimate interests under Articles 5/2-c and 5/2-f. See supabase.com/privacy.
  • Cloudinary (USA): stores user-submitted product photos. The legal ground is explicit consent under Articles 5/1 and 9/1. Using photo upload signifies consent; do not use it if you do not consent. See cloudinary.com/privacy.
  • Cloudflare: stores, processes, and delivers user-submitted and catalog product images through its global infrastructure. The legal ground is explicit consent under Articles 5/1 and 9/1. See cloudflare.com/privacypolicy.
  • Google Gemini API: analyzes product photos submitted for photo product search and product suggestions to identify the product and packaging information. For AI product summaries, only the product's catalog information is sent; your account details are not shared. Reviews you write are also sent to Google for an automated check against the content rules, without your account details; the legal ground for this is your own action of sending the review and legitimate interests under Article 5/2-f. Google may process and review the content it receives under its own terms and privacy policy to provide, secure, and improve its services. The legal ground is explicit consent under KVKK Articles 5/1 and 9. See ai.google.dev/gemini-api/terms.
  • Meta Platforms (USA and other countries): the Meta app SDK, used to measure the performance of our ads, runs only if you turn on the optional ad-measurement consent, which is separate from the agreements, and sends app events (first open/install, app opens, and registration completion), device information (device model, operating-system version, language, and time zone), IP address, an anonymous app ID created by Meta, and, on Android, the advertising ID (Google Advertising ID). Meta may use this data under its own policies for ad measurement and ad improvement. Your name, email address, search history, and submitted photos are not shared with Meta. The iOS advertising identifier (IDFA) is not collected. The legal ground is explicit consent under KVKK Articles 5/1 and 9, given through an optional switch that is separate from the agreements and off by default. You may withdraw consent at any time under Ad measurement in the Profile screen of the App or by emailing iletisim@besin.app, and on Android you can reset or delete your advertising ID in device settings. See facebook.com/privacy/policy.
  • Expo, Apple (APNs), and Google (FCM) notification infrastructure: if you allow notifications, your push token is processed to deliver notifications. These services may use servers outside Türkiye, including in the United States. The legal grounds are your notification permission and contract performance under Article 5/2-c.
  • GitHub (USA): runs the automated job that checks the reviews you write against the content rules. The job processes the review texts, not your account details. The legal grounds are your own action of sending the review and legitimate interests under Article 5/2-f (checking reviews before they are public).
  • Competent public authorities: data may be shared where legally required under Article 5/2-ç.

6. Collection Methods

  • Information entered in the membership form, including name and email.
  • Device and IP information collected automatically while the App is used.
  • Ad-measurement data collected automatically through the Meta SDK only if you have separately opted in.
  • A photo the user explicitly chooses to upload through the camera or gallery.
  • The rating and review form on product pages in the App.

7. Algorithmic Scoring and Automated Decisions

Besin App's scoring system uses an independent algorithm to assess product data. It does not create a user profile or make an individual decision based on your personal data. Assessment occurs only at product level and creates no user-specific legal consequence.

Reviews you write are checked by an AI-assisted automated system before they are published. Reviews found to break the rules are not published and you are shown the reason. You may object to this result by writing to iletisim@besin.app; your objection is reviewed by a person.

Under KVKK Article 11/1-g, you may object to an adverse outcome produced by analyzing your processed data solely through automated systems.

8. Your Rights Under KVKK

  • Learn whether your personal data is processed and request information about processing.
  • Learn the purpose of processing and whether data is used for that purpose.
  • Learn which third parties receive your data in Türkiye or abroad.
  • Request correction of incomplete or inaccurate data.
  • Request deletion or destruction under the conditions in KVKK Article 7.
  • Request that correction, deletion, or destruction be notified to recipients.
  • Object to an adverse outcome produced solely by automated analysis.
  • Request compensation for loss caused by unlawful processing.

9. Applications and Complaints

Send a request with information that verifies your identity to iletisim@besin.app. Applications are handled free of charge as quickly as possible and no later than 30 days, depending on their nature.

If your application is rejected, answered inadequately, or not answered within 30 days, you may complain to Türkiye's Personal Data Protection Board at kvkk.gov.tr.

10. Data Security and Breach Notification

We use SSL/TLS, encrypted database storage, and regular security updates, although no internet transmission can be guaranteed 100% secure.

If a breach threatens personal-data security, Nomadsoft Limited will notify the Personal Data Protection Board without delay where required by KVKK Article 12 and inform affected users through appropriate channels.

11. Retention

  • Account data, including name, email, and search history, is kept while the account is active and deleted within 30 days after an account-deletion request.
  • Product photos may remain as anonymous product data after account deletion. Ask iletisim@besin.app to remove a photo as well.
  • Images submitted for photo product search are not retained permanently by Besin after matching. Retention of content sent to Google is governed by Google's own policies.
  • Product ratings and reviews are kept until you delete them. After account deletion, your ratings are deleted, review texts are removed from usage logs, and your written reviews and tags remain anonymously without a link to your account. Ask iletisim@besin.app to remove them.
  • Retention of ad-measurement data sent to Meta is governed by Meta's own policies.
  • Device and IP information is deleted within 30 days after account deletion once used for security.
  • Security and abuse-prevention records (IP address, user ID, usage counters) are kept to limit the rate of product-data reads and to detect abuse such as bulk data scraping. These records are kept only for the short period needed for that purpose and are then deleted automatically. Deleting your account does not change when these records are deleted.
  • Data required by law is retained for applicable statutory limitation periods.

12. Updates to This Notice

This notice may be updated. Material changes will be announced by in-app notification or email. The current notice is always available at besin.app.

← Back to Home