Privacy policy

1Controller and Contact

Controller: MAVI VALIZ APP I.K.E. (international name: MAVI VALIZ APP P.C.); registered office: Pylis 48, 18534 Piraeus, Greece; General Commercial Registry (Γ.Ε.ΜΗ.) no.: 196558309000; tax no. / AFM: 803420340. For general questions: bilgi@mavivaliz.com; for any request, question or complaint about your personal data: gdpr@mavivaliz.com.

We respond to your requests within 30 days at the latest (within 30 days for applications under the Turkish KVKK, and within one month under the GDPR). You can also download your data and delete your account yourself in the app under Ayarlar > İzinler & Veriler (Settings > Permissions & Data); you do not need to write to us to exercise these two rights.

No separate data protection officer (DPO) has been appointed; if we become required to appoint one under Art. 37 GDPR, this notice will be updated.

2Which Law Applies

The controller is established in the European Union (Greece), so all processing is subject to the EU General Data Protection Regulation (GDPR, 2016/679). The supervisory authority is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, dpa.gr). Your right to lodge a complaint with the data protection authority of the country you are in is preserved in all cases.

Because the app can also be downloaded in Türkiye and is promoted there, the provisions of the Turkish Personal Data Protection Law No. 6698 (KVKK) are also observed for users located in Türkiye; this notice is also an information notice within the meaning of Art. 10 KVKK.

Mavi Valiz can be used worldwide; listings, job listings, the forum and messaging can be accessed from any country, including Türkiye. The only exception is the business directory: business listings can only be created for countries on the list of countries we serve, and Türkiye is not on that list.

3Data We Collect

• Account: name and surname, username, email, password (stored as an irreversible hash), date of birth (only to verify the age limit; never shown on your profile).
• Optional profile: profile and cover photo, biography, phone, website, country, gender, occupation, your expectations and an emergency contact number.
• Content: the listings, job listings, forum topics and replies, profile posts and reviews you publish, and the images you upload.
• Communications: your private messages with other members, what you write to the AI assistant, SOS / emergency help conversations, reports you submit and contact form messages.
• Business: the name, address, contact details and location (coordinates or a Google Maps link) of a business you add.
• Technical: at the moment you give consent, your IP address and browser/device identifier (User-Agent) are recorded; this is required to prove when and where your consent was given (Art. 7(1) GDPR). If you enabled notifications, your device’s push token is stored.

4Purposes and Legal Bases

• Performance of a contract (Art. 6(1)(b) GDPR, Art. 5(2)(c) KVKK): opening and maintaining your account, publishing listings, delivering messages and running the business directory.
• Legitimate interest (Art. 6(1)(f) GDPR, Art. 5(2)(f) KVKK): preventing abuse, moderation, combating fake accounts and fraud, and service security.
• Explicit consent (Art. 6(1)(a) GDPR, Art. 5(1) KVKK): only for marketing/promotional notifications. Not giving this consent does not restrict any part of the service, and you can withdraw it at any time.
• Legal obligation (Art. 6(1)(c) GDPR): proving consent and statutory retention obligations.

No decision producing legal effects concerning you is taken by automated decision-making or profiling (Art. 22 GDPR).

5Age Limit and Children’s Data

Mavi Valiz is not intended for anyone under 16, and stating your date of birth is required to create an account. Although Art. 8 GDPR allows member states to lower this limit to as low as 13 (Greece 15, Estonia 13, Germany and the Netherlands 16), we apply a single limit of 16, the highest, because we serve more than one country. If we find an account belonging to someone under 16, we close it and delete the data. If you believe an account belongs to your child, write to gdpr@mavivaliz.com; we handle such requests as a priority.

6Who Your Data Is Shared With

We never sell your data and do not pass it to third parties for marketing. The following processors are used to run the service:

• (1) Supabase: database and file storage, servers in Frankfurt, Germany (within the EU).
• (2) Render: application server, Frankfurt, Germany (within the EU).
• (3) Google (Gemini API): the messages you write to the AI assistant, and the most recent messages of that conversation, are sent to Google to generate a reply. We recommend not writing identifying details in the conversation.
• (4) Expo, Apple (APNs) and Google (FCM): push notifications. The notification text may contain the first line of a new message, so the notification infrastructure receives the content of the notification, not only the device token.
• (5) Google Maps Platform: maps in the app are drawn with the Google Maps SDK built into your device; when you open a map, your device’s IP address, device identifiers and the map area you are viewing reach Google directly. Google is an independent controller for this data and the Google Privacy Policy applies. Address search, finding an address from coordinates and resolving a Google Maps link you paste are carried out through our server: in these requests Google receives our server’s address rather than your IP address, and only the address text you typed and the coordinate you selected are sent.
• (6) OpenStreetMap / Nominatim: fallback provider for address search; called only through our server, so your device’s IP address does not reach this service.

7Transfers Outside the European Economic Area

The database, file storage and application servers are all in Germany; in day-to-day operation your data stays within the EEA. Transfers outside the EEA happen at only three points: the AI assistant (Google), the map and address service (Google Maps Platform) and the push notification infrastructure (Expo/Apple/Google). These transfers are made under the European Commission Standard Contractual Clauses (2021/914) incorporated into the providers’ data processing agreements.

For users located in Türkiye: your data is processed outside Türkiye (in Germany); as there is no adequacy decision of the Turkish Personal Data Protection Board in force for this transfer, it is based on appropriate safeguards under Art. 9 KVKK. You can request details of the transfer and its legal basis from gdpr@mavivaliz.com.

8Retention Periods

• Your account and content: for as long as your account is open. When you delete your account, your profile, listings, forum content, messages, AI conversation history, SOS conversations, the business listings you added and the images you uploaded are permanently deleted; deletion is immediate, with no waiting period.
• “Contact” form messages not linked to an account: 1 year.
• AI assistant conversations used without signing in: 90 days.
• Read notifications: 6 months.
• Password reset links: 1 hour (expired links are removed in the weekly clean-up).
• Record of your consent (email, date, IP): 7 years; because we are required to prove that consent was given, this record remains even if the account is deleted.

These periods are enforced by an automated clean-up job that runs every week.

9Information You Provide About Others

If you enter an emergency contact number, it may belong to another person; informing that person is your responsibility. When you report a user or content, the text you write creates personal data about the reported person and is kept for moderation; the reported person can learn that this record exists under Art. 15 GDPR, but who made the report is not disclosed, in order to protect the moderation process and the safety of the person who reported it.

10Cookies, Local Storage and Tracking

The mobile app does not use conventional web cookies. Your session is maintained with a token stored in your device’s secure storage (expo-secure-store / iOS Keychain / Android Keystore); this is necessary for the service to work and does not require separate consent. Preferences such as the country you choose are stored locally on your device.

There are no ads; no analytics, advertising or tracking SDK (Google Analytics, Firebase, Meta, Amplitude, etc.) is included in the app. This is a commitment that can be verified from our dependency list.

11Security

Passwords are hashed irreversibly with bcrypt; plain-text passwords are never stored or written to logs. All connections are encrypted with TLS. Row-level security (RLS) is enabled in the database, and the database’s public API is fully disabled. No security measure is absolute; if a data breach is likely to result in a high risk to your rights and freedoms, we will inform you directly in accordance with Art. 34 GDPR.

12Your Rights

Under Art. 15–22 GDPR and Art. 11 KVKK you have the right to access your data and obtain a copy, to have it corrected, to request its erasure (the right to be forgotten), to request restriction of processing, to object to processing, to receive your data in a structured format, and to withdraw the consent you gave.

You can exercise the rights of access and erasure yourself, immediately, under Ayarlar > İzinler & Veriler (Settings > Permissions & Data); for the others, write to gdpr@mavivaliz.com. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If your request is not resolved, you can lodge a complaint with the Hellenic Data Protection Authority (dpa.gr), the data protection authority of the country you are in, or, if you are in Türkiye, the Turkish Personal Data Protection Authority (kvkk.gov.tr).

13Changes to This Notice

When the policy is updated, the version number and effective date change and the app asks for your consent again when it opens. The date on which you accepted the previous version is shown under Ayarlar > İzinler & Veriler (Settings > Permissions & Data).

14This website

mavivaliz.com is an informational website; it has no accounts, forms or comment areas and does not collect personal data from you. When you visit, the hosting server keeps your IP address and browser details in short-lived server logs for security and technical operation. The site uses no analytics, advertising or tracking tools, and every file, including fonts, is served from our own server, so your visit is not passed to any third-party service. The only cookie is “mv_dil”, which remembers the language you chose (Turkish or English) for one year; it is strictly necessary and does not require separate consent.