Legal
KVKK Privacy Notice
This is an English translation provided for convenience. In case of any discrepancy, the Turkish version prevails.
Version: kvkk-2026-10-20-en · Effective: 20 October 2026
Source (TR): https://heygigo.app/kvkk/ (version 2026-10-20)
1. Data controller
- Data controller: Onur Yılmaz (natural person)
- Address: Ezine / Çanakkale
- Contact: info@heygigo.app
- Company name / MERSIS / tax no.: [To be updated upon incorporation of the company]
GIGO (heygigo.app) is a discovery service that shows live music, DJ and dance venues on a map; it is offered as a website, a web app that can be added to the home screen (PWA), and an iOS/Android mobile app.
2. What data we process and for what purpose
| Data category | Data | When | Purpose | Legal basis |
|---|---|---|---|---|
| Account | Email, display name, password (stored encrypted/hashed, at the authentication provider), account ID, language preference (locale), platform (iOS/Android), sign-up and sign-in times | When you create an account | Creating the account, session management, password reset | Establishment/performance of a contract |
| Profile (optional) | Profile photo | If you upload one | Displaying it on your profile | Explicit consent (separate checkbox; withdrawn by deleting the photo) |
| Preferences (optional) | Favourite music genres, district, saved venues | If you enter them | Recommendations and sync across devices. In the mobile app, preferences are stored only on your device. | Saved venues and sync across devices: establishment and performance of a contract. Favourite genre and district (for recommendations): explicit consent; you can withdraw it by deleting them from your profile |
| Sign in with Google / Apple | Email and name provided by the provider (with Google, possibly a profile photo link); when signing in with Apple, an Apple refresh token (encrypted; used only to revoke the Apple connection when the account is deleted) | If you sign in this way | Creating the account and session management | Establishment/performance of a contract |
| Privacy notice/consent record | Acceptance of the terms of use, its version and time; privacy notice version and time read; age-18 declaration and its time; method by which consent was given (web/iOS/Android/Google/Apple) | When you create an account | Proof | Legal obligation / legitimate interest |
| Security | Cloudflare Turnstile verification signals: IP address, TLS fingerprint, User-Agent and similar browser/device signals | Sign-up/sign-in/forms | Preventing bots and abuse | Legitimate interest |
| Technical logs | IP address, browser/device information, request time (server logs of hosting and API providers) | When you use the site/app | Providing the service, security, rate limiting | Legitimate interest |
| Web analytics (only if you consent) | Google Analytics 4 cookie ID, pages visited, approximate location (country/city, by Google), device/browser information | Only on heygigo.app and after "Accept" | Usage statistics to improve the site | Explicit consent (cookie banner) |
| Location (mobile app) | Precise device location (only while the app is open, if you grant permission) | If you granted permission, each time the app is opened and when you use "Near me" | Showing nearby venues, calculating distance | Explicit consent (operating-system permission) |
| Email communication | Email address, message content | Verification/reset emails, when you write to the info@ address | Account emails, responding to requests | Contract / legitimate interest |
| Request/objection form | Full name, email, role at the venue, description | When the form is submitted | Reviewing and responding to the request | Legitimate interest / legal obligation |
| Sponsorship pre-application (details) | Brand/business name, Instagram account (optional), authorised person's full name, email, phone (optional), message; declaration that the privacy notice has been read, its version and time | When you submit the form on the Sponsors page | Evaluating the application and getting back to you | Establishment of a contract / legitimate interest |
Location note: The mobile app does not track your location in the background. If you granted permission, the app reads your location when it is opened and, to fetch nearby venues, your location coordinates (with approximately 1-metre precision) and the surrounding map area are sent to our venue server; this information is not associated with your account and is not stored on your device or in our database. It may appear in the technical platform logs of our infrastructure provider Supabase for approximately 1 day and is then deleted; no request log is kept on the Cloudflare side. Location permission can be revoked at any time in your device settings; if you do not grant permission, the app works with a default map location.
Age limit: GIGO is for users aged 18 and over; we do not knowingly process the data of persons under 18. If such an account is detected, it is deleted.
Use without an account: Venues you save without creating an account are kept only on your device (browser/app storage).
Venue information: The venue information on the map (name, address, type, public Instagram account, location/address information sourced from Google Places) belongs to the businesses and is compiled from publicly available sources. For sole-proprietor businesses, this information may qualify as personal data. For corrections, logo/image removal or removal requests: request form or info@heygigo.app. Logo/image removal requests are applied within 24-48 hours.
3. To whom we transfer data (service providers)
Your data is not sold and is not shared for advertising purposes. We use the following providers solely to provide the service:
| Provider | For what | Which data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage (profile photo), venue API | Account, profile, preferences, technical logs | EU — Frankfurt, Germany (eu-central-1). Sub-processors used by Supabase: supabase.com/legal/subprocessors |
| Cloudflare | Hosting and delivery of the site (Pages/CDN), bot protection (Turnstile), admin panel access control, domain/DNS | IP, browser information, request logs, Turnstile signals (IP address, TLS fingerprint, User-Agent and similar browser/device signals) | Global network; abroad |
| Sign in with Google (OAuth) | Signing in with your Google account (if you choose) | Email, name and possibly a profile photo link provided by Google | Abroad |
| Sign in with Apple | Signing in with your Apple account (if you choose) | Email (may be hidden) and name provided by Apple | Abroad |
| OpenFreeMap | Loading map tiles | IP, map area viewed (during the request) | Abroad |
| unpkg.com | Loading the map library (MapLibre) in the mobile app | IP (during the request) | Abroad |
| Google (Analytics 4) | Consent-based web analytics | Cookie ID, page, device, approximate location | Abroad |
| Google (Workspace) | info@heygigo.app email service | Emails you send us | Abroad |
| Google (Places API) | Compiling venue location/address information | No user data is sent; venue information only | Abroad |
| Resend | Sending account emails (verification, password reset) and forwarding sponsorship application notifications to us | Email address, email content | Abroad |
| Expo (EAS) | Building and distributing the mobile app | No user data is sent while the app is running (there are currently no push notifications/OTA updates) | Abroad |
| GitHub | Storing encrypted database backups | Encrypted database backups | Abroad |
| Apple App Store / Google Play | Downloading the app | Via your store account; GIGO does not receive this data (the store's own privacy notice applies) | Abroad |
Data may be shared with competent public authorities where required by law.
4. Transfer abroad
Your data is processed on servers outside Türkiye of the service providers listed above (in section 3); it is therefore transferred abroad. Which provider processes which data for which purpose is set out in the table above. Transfers are made only to the extent necessary to provide the service. For detailed information on transfers, you can write to info@heygigo.app.
5. Retention periods
- Account and profile data: for as long as the account remains open. When you delete your account, your profile, photo, preferences and saved venues are deleted (Account deletion).
- When you delete your account, your data is deleted from the live system immediately; it is automatically deleted from encrypted nightly backups within 30 days at the latest.
- Apple refresh token (if you signed in with Apple): until the account is deleted or the Apple connection is removed; then deleted immediately.
- Our infrastructure provider's technical logs (IP address, request information; in the mobile app, may include location coordinates) are deleted after 1 day. Authentication audit logs are kept for 1 hour.
- Google Analytics data is retained for 14 months.
- Cookie consent preference: in your browser, until you delete it.
- Request/objection records are retained for 2 years from the conclusion of the request for the handling and proof of the request and possible disputes, and are then deleted automatically.
- Sponsorship applications: retained for 2 years from the conclusion of the application, then deleted automatically.
- Your consent and notice records (which version of which text you accepted and when) are retained for 3 years after the account is deleted, for proof of consents and declarations and possible disputes, and are then deleted automatically.
- Account deletion record (time and method of the deletion request and of its completion; an ID and an email hash instead of personal details): retained for 3 years as proof of deletion, then deleted automatically.
6. Your rights
Your rights as a data subject under the Turkish Personal Data Protection Law No. 6698 (KVKK): to learn whether your data is processed, to request information, to learn the purpose of processing and whether data is used in line with that purpose, to know the third parties to whom it is transferred, rectification, erasure/destruction, to request that these be notified to the persons to whom data was transferred, to object to an outcome against you resulting from automated analysis, and to claim compensation for damage arising from unlawful processing.
Application: info@heygigo.app or request form. Applications are answered free of charge within 30 days at the latest. We may ask for additional information to reasonably verify your identity (with the minimum documentation).
7. Cookies
Details: Cookie Policy. Analytics cookies are used only with your consent; you can change your preference at any time.
8. Changes
If this text is updated, the new version is published with its date; account holders are notified by email of material changes.