Privacy Policy

Last updated: June 16, 2026

Bavulla ("we", "our") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and how we protect it. The data controller (Veri Sorumlusu) is Bavulla, the operator of this service.

1. Information We Collect

  • Account information: email address, display name, registration date, terms acceptance date.
  • Transaction information: request details (product URL, name, price, quantity), transaction amounts, reviews, chat messages.
  • Payment information: transaction amounts, fees, exchange rates. Card details are held by the payment provider—we never receive them.
  • Usage data: page access logs, error logs.

2. How We Use Your Information

  • To provide and operate the service (transaction management, email notifications, chat).
  • To detect and prevent fraud and unauthorized use.
  • To analyze and improve the service.
  • To comply with legal obligations.

3. Sharing with Third Parties

  • Supabase Inc. — Database and authentication infrastructure (United States).
  • Resend Inc. — Email delivery service (United States).
  • Payment provider — Payment processing (Turkey).
  • KYC provider — Identity verification (passport, face photo, etc.); not stored on our servers.
  • Microsoft Corporation (Azure AI Translator, data processor) — Machine translation of transaction chat (Japan region). Only the body of a given message is sent, and only when you press the translate button.
  • Each provider's own privacy policy applies. We do not share your data with any other party, except as required by law.

4. Data Retention

  • Account information: deleted 30 days after account closure.
  • Transaction records: retained for 7 years after completion (tax and legal requirements).
  • Chat messages: retained for 3 years after transaction completion (dispute resolution).

5. Your Rights (GDPR / KVKK)

  • Residents of the EU and Turkey have the following rights:
  • ① Access to and copies of your data.
  • ② Correction of inaccurate data.
  • ③ Erasure (except data subject to legal retention periods).
  • ④ Objection to processing.
  • To exercise these rights, contact us at support@bavulla.app.

6. Security

  • All data in transit is protected by SSL/TLS encryption.
  • Database access is controlled via Supabase Row Level Security (RLS).
  • Sensitive keys are stored as environment variables and never embedded in code.
  • KYC documents (passport photos, etc.) are handled by third-party KYC vendors—we do not store them.
  • We cannot guarantee absolute security on the internet.

7. Cookies

  • We use cookies only to maintain your authentication session.
  • We do not use cookies for tracking or advertising purposes.

8. International Data Transfers

  • Our infrastructure providers (Supabase Inc. and Resend Inc., both US-based, our identity-verification (KYC) provider, and our machine-translation provider Microsoft Corporation in the Japan region) are located abroad, so your personal data is stored and processed on servers outside Türkiye (primarily in the US, and in Japan for machine translation).
  • We obtain your explicit consent for this transfer at sign-up (KVKK Art. 9).
  • To provide a stronger level of protection, we are working to put in place the Standard Contract safeguard under KVKK Art. 9.
  • Each receiving provider protects data under its own privacy policy and security standards.

9. Changes to This Policy

  • If we make changes, we will update the date shown on this page.
  • For significant changes, we will notify you by email.

For privacy-related inquiries, please contact support@bavulla.app.

Terms of Service·support@bavulla.app