Privacy Policy

How we protect your psychological data and personal information.

Effective Date: 01.07.2026

The Valeur mobile application, website, and related digital services are operated by DEEP NODE STUDIOS YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ (“Deep Node Studios”). This Privacy Policy has been prepared to explain the general principles regarding the processing of personal data belonging to persons who visit, use, register with, contact us, or otherwise interact with the Valeur platform in any way.

This policy is a general privacy policy prepared under Law No. 6698 on the Protection of Personal Data (“Law No. 6698”). Depending on the nature of the personal data processing activities, separate privacy notices are additionally provided to data subjects where necessary, and separate explicit consent forms are used for processing activities requiring explicit consent.

1. Information on the Data Controller

The data controller for personal data processed within the scope of the Valeur platform is Deep Node Studios Yazılım Ve Teknoloji Limited şirketi.

• Address: Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1 Kadıköy / İSTANBUL
• Email: info@deepnodestudios.com
• Electronic Notification Address: 25878-72798-05769
• MERSIS No.: 0272122491000001

2. Scope of the Policy

This Privacy Policy covers personal data processing activities carried out within the scope of the Valeur website, mobile application, membership processes, user profiles, matching services, contact forms, support requests, security processes, payment processes, technical infrastructure services, and the operation of the platform.

This policy provides high-level information regarding the general operation of the platform. Separate privacy notices, explicit consent forms, cookie policies, or application forms may additionally be published for specific data processing activities.

3. Categories of Personal Data We Process

The categories of personal data that may be processed during the use of the Valeur platform are summarized in the table below:

4. Methods by Which We Collect Personal Data

Your personal data may be collected, wholly or partly through automated means, or through non-automated means provided that they form part of a data recording system, via the following channels:

• Your use of the website and mobile application,
• Membership and account creation forms,
• Profile editing fields,
• Device permissions and application settings,
• Support and contact channels,
• Technical logging systems,
• Integrated authentication, notification, storage, and infrastructure services,
• Service providers used in payment and subscription processes.

5. Our Purposes for Processing Personal Data

Your personal data may be processed based on the legal bases set out in Law No. 6698, depending on the nature of the processing activity. In this context, your personal data may in particular be processed on the following legal bases:

• Being directly related to the establishment or performance of a contract,
• Being mandatory for the data controller to fulfill its legal obligation,
• Being mandatory for the establishment, exercise, or protection of a right,
• Being mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject,
• Explicit consent having been given.

Special categories of personal data are processed only under the conditions permitted by applicable legislation, in particular where explicit consent exists, or where other exceptional processing conditions set out in the law are present.

The purposes for which your personal data is processed and the legal bases relied upon are summarized in the table below:

6. Profiling, Matching, and Automated Evaluation Processes

In line with the platform's core function, Valeur may operate matching and recommendation systems using user preferences, profile information, test responses, interaction data, and similar data. These systems may influence which profiles are recommended to the user, which content is highlighted, or how the application experience is personalized.

Such processes are used to improve the platform experience and to provide the matching service. Where users consider that an outcome adverse to them has arisen as a result of analyses carried out solely through automated systems, they may exercise their right to apply under Article 13 of this Privacy Policy in accordance with applicable legislation.

7. To Whom and for What Purposes Personal Data May Be Transferred

Your personal data may be transferred to the following recipient groups to the extent required by the processing purposes and in accordance with applicable legislation:

• Cloud infrastructure and data hosting service providers,
• Database, media storage, application infrastructure, and notification service providers,
• Authentication and login infrastructure providers,
• Service providers used in payment, subscription, accounting, and financial processes,
• Suppliers from whom information security, audit, technical support, legal, and consultancy services are obtained,
• Public institutions and organizations authorized by law,
• Legally authorized private persons or organizations.

Transfers are carried out within the framework of legal bases such as the provision of the service, ensuring system security, fulfilling legal obligations, establishing or protecting a right, or, where necessary, the existence of explicit consent.

The recipient groups to which your personal data may be transferred and the purposes of such transfers are set out below:

Cloud infrastructure and data hosting service providers

• Data categories that may be transferred: Identity and contact information, profile data, messaging data, technical data
• Purpose of transfer: Providing the service infrastructure and securely hosting the data
• Legal basis for transfer: Being directly related to the establishment or performance of a contract; legitimate interest of the data controller

Application infrastructure, notification, and technical service providers

• Data categories that may be transferred: Device information, notification tokens, usage data
• Purpose of transfer: Providing notification services, conducting technical operations
• Legal basis for transfer: Being directly related to the establishment or performance of a contract; legitimate interest of the data controller

Authentication service providers

• Data categories that may be transferred: Email address, account verification information, session data
• Purpose of transfer: Verifying the user's identity and ensuring secure login
• Legal basis for transfer: Being directly related to the establishment or performance of a contract

Payment and financial process service providers

• Data categories that may be transferred: Payment and transaction data, subscription information
• Purpose of transfer: Conducting purchase and subscription transactions
• Legal basis for transfer: Being directly related to the establishment or performance of a contract; fulfillment of a legal obligation

Suppliers from whom legal, audit, information security, and consultancy services are obtained

• Data categories that may be transferred: Relevant data categories to the extent necessary
• Purpose of transfer: Conducting legal consultancy, audit, security, and compliance processes
• Legal basis for transfer: Legitimate interest of the data controller; establishment, exercise, or protection of a right

Public institutions and organizations authorized by law

• Data categories that may be transferred: Relevant data categories limited to the scope of the request
• Purpose of transfer: Fulfillment of obligations arising from legislation
• Legal basis for transfer: Fulfillment of a legal obligation

Legally authorized private persons or organizations

• Data categories that may be transferred: Data required within the scope of a dispute or request
• Purpose of transfer: Conducting legal proceedings
• Legal basis for transfer: Establishment, exercise, or protection of a right

8. Transfer of Personal Data Abroad

Some of the technical infrastructure services used on the Valeur platform may operate through servers, service providers, or technology infrastructures located abroad. For this reason, your personal data may be transferred abroad in accordance with applicable legislation.

In cross-border transfers, the necessary legal grounds and appropriate safeguards are applied within the framework of Article 9 of Law No. 6698. Where an adequacy decision exists with respect to the destination country or service provider, the transfer may be carried out on that basis. Where no adequacy decision exists, reliance is placed on one of the appropriate safeguards set out in applicable legislation. Transfer based on explicit consent is considered only where legally necessary and where other transfer mechanisms are not applied.

Sign in with Google

• Country: USA
• Data shared: Identity and contact information; authentication data (email, Google identity information)
• Purpose: Verifying the user's identity and conducting secure login processes
• Safeguard: Authentication takes place at the user's direction; the relevant party is subject to its own privacy obligations

Sign in with Apple

• Country: USA
• Data shared: Identity and contact information; authentication data (Apple ID, refresh token)
• Purpose: Verifying the user's identity and conducting secure login processes
• Safeguard: Authentication takes place at the user's direction; the relevant party is subject to its own privacy obligations

AWS S3 (eu-central-1)

• Country: EU (Frankfurt)
• Data shared: Profile and membership information; content data (profile photos)
• Purpose: Storing and serving media files
• Safeguard: Cross-border transfer; Article 9/1 of Law No. 6698 where an adequacy decision exists, or, where none exists, the standard contract or exceptional explicit consent mechanism among the appropriate safeguards

MongoDB Atlas

• Country: EU (Frankfurt)
• Data shared: Identity and contact information, profile and membership information, transaction security and device information, usage data, messaging and content data, payment and transaction data, location data; personal data processed within the application, including special categories of personal data where explicit consent has been given, as the case may be.
• Purpose: Operating the main database infrastructure, storing data, conducting membership and application processes
• Safeguard: Cross-border transfer; Article 9/1 of Law No. 6698 where an adequacy decision exists, or, where none exists, the standard contract or exceptional explicit consent mechanism among the appropriate safeguards

All service providers and sub-processors are subject to contractual obligations permitting them to process data solely on behalf of Deep Node Studios and in accordance with the instructions given. Except as required by legal obligations and requests from authorized authorities, personal data is not sold to third parties, used for commercial purposes, or disclosed without authorization for purposes other than those specified herein.

9. Retention Periods and Destruction

Your personal data is retained for the period prescribed by applicable legislation or required for the purpose for which it is processed. In determining the retention period, the nature of the data category, the purpose of processing, the technical requirements of the platform, legal obligations, and evidentiary and dispute-related needs are taken into account.

Upon expiry of the retention period or where the reason for processing ceases to exist, personal data is deleted, destroyed, or anonymized in accordance with applicable legislation.

Data that has been genuinely anonymized may be used for statistical analysis, service improvement, and reporting purposes.

The general retention approach envisaged for personal data categories is shown below:

Identity and Contact Information

• Retention criterion / period: For the duration of the membership relationship and thereafter for the period of any legal obligation or dispute
• Reason for retention: Provision of the service, evidentiary purposes, and legal obligations
• Action taken at the end of the period: Deletion, destruction, or anonymization

Profile and Membership Information

• Retention criterion / period: For as long as the account is active; for the necessary period after the account is closed
• Reason for retention: Provision of the profile service and management of the user account
• Action taken at the end of the period: Deletion, destruction, or anonymization

Special Categories of Personal Data

• Retention criterion / period: For as long as the explicit consent and the processing purpose continue
• Reason for retention: Provision of the features requested by the user
• Action taken at the end of the period: Deletion, destruction, or anonymization

Location Data

• Retention criterion / period: For as long as the relevant feature is active and the explicit consent continues
• Reason for retention: Provision of location-based services
• Action taken at the end of the period: Deletion or anonymization

Transaction Security and Device Information

• Retention criterion / period: For the periods required for security, audit, and possible disputes
• Reason for retention: Information security and misuse prevention
• Action taken at the end of the period: Deletion, destruction, or anonymization

Usage Data

• Retention criterion / period: For a reasonable period required for service improvement and analysis needs
• Reason for retention: Performance monitoring and service improvement
• Action taken at the end of the period: Deletion or anonymization

Messaging and Content Data

• Retention criterion / period: For the period necessary for the provision of the service and for security and legal requirements
• Reason for retention: User communication, audit, and dispute management
• Action taken at the end of the period: Deletion, destruction, or anonymization

Payment and Transaction Data

• Retention criterion / period: For the period prescribed by applicable financial and tax legislation
• Reason for retention: Accounting, audit, and legal obligations
• Action taken at the end of the period: Deletion, destruction, or anonymization

Support and Communication Data

• Retention criterion / period: Until the request is resolved and, where necessary, for the evidentiary period
• Reason for retention: Management of support processes
• Action taken at the end of the period: Deletion, destruction, or anonymization

10. Data Security

Deep Node Studios takes the necessary technical and administrative measures to prevent the unlawful processing of and access to personal data, and to ensure the secure storage of data.

In this context, the following practices, for example, may be implemented within the framework of data security processes:

These measures are summarized categorically below, without being limited to the following:

In the event that personal data is obtained by third parties through unlawful means, the matter is notified to the competent authorities and, to the extent necessary, to the data subjects concerned, in accordance with applicable legislation.

11. Persons Under the Age of 18

Valeur is not a platform directed at individuals under the age of 18. Under the platform's terms of use, users must have reached the age of 18. Where it is determined that data belonging to persons under the age of 18 is being processed, such data is deleted or restricted from access by appropriate means.

12. Rights of Data Subjects

Under Law No. 6698, data subjects have the right to apply to the data controller and, with respect to themselves, to: learn whether their personal data is being processed; request information thereon if their personal data has been processed; learn the purpose of processing of their personal data and whether it is used in accordance with that purpose; know the third parties to whom their personal data is transferred domestically or abroad; request the correction of their personal data where it has been processed incompletely or incorrectly; request the deletion or destruction of their personal data; request that any correction or deletion carried out be notified to third parties to whom the data has been transferred; object to the emergence of a result to their detriment through the analysis of processed data exclusively by automated systems; and request compensation for damage suffered due to the unlawful processing of data.

13. Method of Application

You may submit your requests under Law No. 6698 to us together with information and documents sufficient to verify your identity. Your applications will be concluded free of charge, as promptly as the nature of the request permits. Should your application be rejected, the response provided be found insufficient, or no response be given within the applicable period, you retain the right to file a complaint with the Personal Data Protection Board pursuant to Article 14 of Law No. 6698.

Email: info@deepnodestudios.com

Applications are evaluated and concluded in accordance with applicable legislation.

You may delete your account and data within Valeur at any time via settings > delete account.

14. Additional Provisions for Users Located in the European Union, the European Economic Area, and the United Kingdom

The following provisions apply to users located in the European Union ("EU"), the European Economic Area ("EEA"), or the United Kingdom ("UK") who fall within the scope of the General Data Protection Regulation ((EU) 2016/679, "GDPR") and UK data protection legislation (the UK GDPR and the Data Protection Act 2018, together the "UK GDPR"). This section is supplementary to the rest of this Privacy Policy; in the event of any conflict, this section shall prevail with respect to the location of the data subject concerned.

The data controller responsible for the processing of these personal data is Deep Node Studios Yazılım Ve Teknoloji Limited şirketi, located at Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1 Kadıköy / İSTANBUL, and may be reached at info@deepnodestudios.com for requests regarding data protection matters.

Legal Bases for Data Processing

Personal data is processed on the basis of one or more of the following legal bases pursuant to Article 6 of the GDPR/UK GDPR:

• Performance of a contract: Necessary for the conclusion or performance of the user agreement entered into with the user (Art. 6(1)(b));
• Consent: Consent for specific processing activities (e.g., marketing communications, certain cookies) (Art. 6(1)(a));
• Legal obligation: Fulfillment of obligations arising from legislation applicable to the user (Art. 6(1)(c));
• Legitimate interest: Legitimate interests balanced against your fundamental rights and freedoms, such as service security, prevention of fraud/abuse, and service improvement (Art. 6(1)(f)).

Special categories of personal data are processed only where the conditions set out in Article 9 of the GDPR/UK GDPR are met (e.g., explicit consent).

Cross-Border Transfer of Data

In order to provide the application, personal data is processed through the service providers set out below. The categories of data transferred, the purposes, the relevant countries, and the safeguards relating to the transfer are shown below.

Sign in with Google

• Country: USA
• Data shared: Identity and contact information; authentication data (email, Google identity information)
• Purpose: Verifying the user's identity and conducting secure login processes
• Safeguard: Subject to its own DPF certification / transfer safeguards as an independent data controller

Sign in with Apple

• Country: USA
• Data shared: Identity and contact information; authentication data (Apple ID, refresh token)
• Purpose: Verifying the user's identity and conducting secure login processes
• Safeguard: Subject to its own DPF certification / transfer safeguards as an independent data controller

AWS S3 (eu-central-1)

• Country: EU (Frankfurt)
• Data shared: Profile and membership information; content data (profile photos)
• Purpose: Storing and serving media files
• Safeguard: As the data is held within the EU (Frankfurt), processing takes place within the EEA/UK; where a third-country transfer is involved, the service provider's DPA incorporates the EU SCCs and the UK Addendum

MongoDB Atlas

• Country: EU (Frankfurt)
• Data shared: Identity and contact information, profile and membership information, transaction security and device information, usage data, messaging and content data, payment and transaction data, location data; personal data processed within the scope of the application, including special categories of personal data where explicit consent has been given.
• Purpose: Operating the main database infrastructure, storing data, conducting membership and application processes
• Safeguard: As the data is held within the EU (Frankfurt), processing takes place within the EEA/UK; where a third-country transfer is involved, the service provider's DPA incorporates the EU SCCs and the UK Addendum

For all transfers, encryption, access restrictions, the choice of the region where the data is stored, and the international security certifications held by the relevant service providers are applied as additional technical and administrative measures for the protection of personal data.

Rights of Data Subjects

Pursuant to the GDPR/UK GDPR, the data subject has the following rights with respect to their personal data:

• Right of access: To request information regarding processed personal data and a copy thereof (Art. 15);
• Right to rectification: To request the correction of inaccurate or incomplete data (Art. 16);
• Right to erasure ("right to be forgotten"): To request the deletion of data under certain conditions (Art. 17);
• Right to restriction of processing (Art. 18);
• Right to data portability: To receive data in a structured, commonly used, and machine-readable format, or to request its transfer to another controller (Art. 20);
• Right to object: To object to processing based on legitimate interest and to processing for direct marketing purposes (Art. 21);
• Rights relating to automated decision-making: The right not to be subject to a decision based solely on automated processing which produces legal effects concerning the user or similarly significantly affects them (Art. 22).

With respect to consent-based processing, the data subject has the right to withdraw consent at any time; the withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

You may apply to us at info@deepnodestudios.com to exercise these rights.

Right to Lodge a Complaint with a Supervisory Authority

With respect to the processing of data, the right to apply to the competent supervisory authority in the EU/EEA member state where the data subject is located or where the alleged infringement occurred is reserved (GDPR Art. 77). Users located in the United Kingdom may lodge a complaint with the Information Commissioner's Office (ICO) (ico.org.uk). Before resorting to a complaint, we kindly ask that you first contact us to resolve the matter.

15. Additional Provisions for Users Located in the United States

The following provisions apply to users located in the United States ("US") who fall within the scope of applicable legislation, primarily the California Consumer Privacy Act (as amended by the CPRA, "CCPA"), as well as the comprehensive state privacy legislation of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive state privacy legislation. The rights granted to the data subject may vary depending on the legislation of the state in which the user resides. This section is supplementary to the rest of this Privacy Policy; in the event of any conflict, this section shall prevail with respect to the location of the user.

The business responsible for the processing of this personal information is Deep Node Studios Yazılım ve Teknoloji Limited şirketi, which may be reached for privacy requests at info@deepnodestudios.com.

Service Providers and Third Parties with Whom Personal Information Is Shared

In order to provide the application, personal information is shared with the following service providers and third parties:

Google Firebase (FCM)

• Role: Service provider
• Data shared: Transaction security and device information; notification data (FCM token, time zone, language, notification metadata)
• Purpose: Sending push notifications and operating the notification infrastructure
• Safeguard: Under the service provider agreement, personal information is processed solely for the specified business purpose; this does not constitute a sale or sharing within the meaning of applicable state legislation.

Sign in with Google

• Role: Third party / independent business
• Data shared: Identity and contact information; authentication data (email, Google identity information)
• Purpose: Verifying the user's identity and conducting secure login processes
• Safeguard: Authentication takes place at the user's direction; the relevant party is subject to its own privacy obligations

Sign in with Apple

• Role: Third party / independent business
• Data shared: Identity and contact information; authentication data (Apple ID, refresh token)
• Purpose: Verifying the user's identity and conducting secure login processes
• Safeguard: Authentication takes place at the user's direction; the relevant party is subject to its own privacy obligations

AWS S3 (eu-central-1)

• Role: Service provider
• Data shared: Profile and membership information; content data (profile photos)
• Purpose: Storing and serving media files
• Safeguard: Under the service provider agreement, personal information is processed solely for the specified business purpose; this does not constitute a sale or sharing within the meaning of applicable state legislation.

MongoDB Atlas

• Role: Service provider
• Data shared: Identity and contact information, profile and membership information, transaction security and device information, usage data, messaging and content data, payment and transaction data, location data; personal data processed within the scope of the application, including special categories of personal data where explicit consent has been given.
• Purpose: Operating the main database infrastructure, storing data, conducting membership and application processes
• Safeguard: Under the service provider agreement, personal information is processed solely for the specified business purpose; this does not constitute a sale or sharing within the meaning of applicable state legislation.

For all transfers, encryption, access restrictions, the choice of the region where the data is stored, and the international security certifications held by the relevant service providers (such as ISO 27001/27701, SOC 2) are applied as additional technical and administrative measures for the protection of personal data.

Rights of Data Subjects

Depending on the legislation of the state of residence, the data subject has the right to obtain information, to request the deletion of their data, to request the correction of inaccurate personal data, and to request the refusal and restriction of sharing. To exercise these rights, an application may be made at info@deepnodestudios.com. Before the request is processed, the user's identity may be verified to a reasonable extent in order to prevent misuse. The data subject may also submit their request through an authorized representative acting on their behalf; in that case, the representative's authority and the data subject's identity may be verified.

Right to Lodge a Complaint with a Supervisory Authority

If the request is rejected, the data subject may appeal against this decision to the extent provided by the legislation of the state of residence (e.g., Virginia, Colorado, Connecticut). The appeal may be submitted at info@deepnodestudios.com. If the appeal is also rejected, the data subject may apply to the Attorney General of their state of residence or, in the case of California, to the California Privacy Protection Agency (CPPA).

16. Relationship with Other Policies and Documents

This Privacy Policy is an overarching policy explaining the platform's general approach to data processing. Additional documents may also be published with respect to specific processes. These may include, in particular, the following:

• Privacy notice under Law No. 6698,
• Explicit consent forms,
• Cookie policy,
• Data subject application form,
• Commercial electronic message consent forms.

Where a specific privacy notice or explicit consent form is additionally provided for a particular processing activity, that specific document shall apply with priority with respect to the relevant processing activity.

17. Changes to the Policy

Deep Node Studios may amend this Privacy Policy in line with changes in legislation, technical developments, changes in the scope of the service, or operational needs. The current text becomes effective as of the date it is published on the website or application.

18. Contact

For your questions regarding Valeur's privacy practices and the processing of your personal data, you may contact us through the following contact channels:

DEEP NODE STUDIOS YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ

Address: Fenerbahçe Mah. İğrip Sk. No: 13 İç Kapı No: 1 Kadıköy / İSTANBUL

Application Email: info@deepnodestudios.com