01 Data Controller
This privacy notice is issued under Article 10 of KVKK by the data controller identified below.
Data Controller: Lightning Software
Email: info@canlidostum.com
02 Personal Data We Process
Depending on how you use the app and the website, the following categories of personal data may be processed:
| Data Category | Examples |
|---|---|
| Identity & Contact | Name, email address, city |
| Account Data | Password (stored hashed), account preferences |
| Pet Information | Your pet's name, species, breed, age, weight and health records, photos |
| Usage Data | Activity / walk records, in-app interactions |
| Technical Data | IP address, device type, operating system, cookie data |
At the pre-registration stage only your name, city and email are collected. All other data is processed only once you actively use the app, and only to the extent you enter it yourself.
03 Purposes of Processing
- Receiving pre-registration requests and sending launch announcements
- Granting early-access / premium benefits
- Creating your account and providing the service
- Tracking your pet's care, health and activity
- Providing personalised suggestions through the AI assistant
- Measuring and improving service quality and resolving technical issues
- Fulfilling our legal obligations
04 Legal Basis for Processing
Your personal data is processed on the following legal bases set out in Article 5 of KVKK:
- Your explicit consent (e.g. sending marketing / informational emails)
- Necessity for the conclusion or performance of a contract (providing the service)
- Compliance with a legal obligation
- Legitimate interests, provided this does not harm your fundamental rights and freedoms
05 Third-Party Services and Data Transfers
To provide the service we rely on a number of trusted third-party providers. Data is transferred to these providers only to the extent required by the relevant function:
| Service | Purpose | Data Transferred |
|---|---|---|
| Google Gemini (AI) | Generating PatiBot assistant responses | Chat messages, related pet context |
| Google AdMob | Showing ads in the free version | Advertising ID, device / technical data |
| Sign in with Google | Secure authentication | Name, email, profile photo |
| Google Play Billing | Premium subscription payments | Purchase / transaction information |
| RevenueCat, Inc. (USA) | Validating premium subscriptions, keeping subscription status up to date and preventing duplicate charges | Purchase and transaction data (product, date, subscription status, trial / renewal / cancellation events), app-specific user ID, device and platform information, country |
| Cloud / Hosting | Secure hosting of data | Account and application data |
| Email provider | Sending notifications and announcements | Name, email |
Your data is never sold or rented to third parties for commercial marketing purposes. Data may be processed abroad within the scope of Google and RevenueCat services; such transfers are carried out in accordance with Article 9 of KVKK and the data processing terms of the relevant providers. Lawful requests from authorised public authorities are reserved.
RevenueCat (subscription validation)
The validity of your premium subscription is verified and managed through RevenueCat, Inc. (United States of America).
Data that is NOT transferred: your name, email address, phone number, your pet records, health and vaccination information, location data, photos and your PatiBot conversations are not sent to RevenueCat.
International transfer: RevenueCat's servers are located in the United States of America. When you purchase a subscription, the purchase data listed above is transferred to that country. The transfer is made solely for the purpose of validating the subscription and is limited to that purpose.
Privacy policy: revenuecat.com/privacy
06 App Permissions
CanlıDostum requests device permissions only when you use the related feature. All permissions are optional; if you decline, only that feature stops working and the rest of the app remains usable.
| Permission | Why it is used | Status |
|---|---|---|
| Camera | Taking a photo of your pet | Optional |
| Gallery / Storage | Uploading and saving photos | Optional |
| Location | Walk and route tracking | Optional |
| Microphone | Asking PatiBot questions by voice. Your speech is converted to text on your device; audio recordings are not sent to our servers and are not stored. | Optional |
| Bluetooth | Smart collar / device connection | Optional |
| In-app reminders | Medication, vaccination and appointment reminders are shown inside the app | No permission required |
07 Retention Period
Your personal data is retained for as long as the purpose of processing requires and for the statutory retention periods prescribed by applicable legislation. At the end of these periods your data is deleted, destroyed or anonymised. Retention periods by data type are as follows:
| Data | Retention period |
|---|---|
| Website visit logs (IP address, page visited, device and browser type, referring site) | Up to 12 months; the last part of the IP address is removed after 30 days (anonymisation) |
| Account details, pet profiles, health records, photos | For as long as the account exists; removed immediately on deletion |
| PatiBot conversation history | For as long as the account exists; you can also delete individual chats |
| Walk routes (location) | For as long as the account exists; deleted with the pet record |
| Session key (refresh token) | 90-day rolling window; invalidated tokens are deleted after 120 days |
| Email verification / password reset code | Code valid for 3 minutes; the record is deleted after 7 days |
| Server logs | Rotated, 30 MB maximum; email addresses are masked |
| Administrator action log | The email address of a deleted account is not retained — only an irreversible digest |
| Server backups | Deleted data falls out of backups within 90 days |
08 Data Security
We apply industry-standard technical and administrative measures to keep your data secure:
- SSL/TLS encryption in transit
- Passwords stored in irreversible (hashed) form
- Access control and logging against unauthorised access
- Regular security reviews and updates
09 Cookies and Advertising ID
Our website may use strictly necessary and analytics cookies to improve your experience and understand site traffic. In the free version of the app, ads are served by Google AdMob using your device's Advertising ID. You can reset your advertising ID or turn off personalised ads from your device settings. You can also refuse or delete cookies from your browser settings.
Users in the European Union and the United Kingdom are asked for their ad personalisation preference the first time the app is opened. This preference can be changed at any time from within the app via Settings → Ad Privacy Options.
10 Account and Data Deletion
You can delete your account and all associated data at any time:
- From the app: go to Settings → Account → Delete My Account.
- From the web: fill in the form on the Account and Data Deletion page.
When you delete your account, your records and photos are deleted immediately and permanently; the action cannot be undone. Deleted data falls out of server backups within 90 days at the latest. We do not hold your purchase or invoice records; these are kept by Google Play and our payment verification provider for their own retention periods. Your Google Play subscription is not cancelled automatically when you delete your account; you must cancel it separately from Google Play → Subscriptions.
11 Your Rights
Under Article 11 of KVKK, as a data subject you have the right to:
- Learn whether your personal data is being processed
- Request information if it has been processed
- Learn the purpose of processing and whether the data is used in line with that purpose
- Know the third parties to whom your data is transferred domestically or abroad
- Request correction if the data is incomplete or inaccurate
- Request deletion or destruction of your data
- Request that correction / deletion be notified to third parties to whom the data was transferred
- Object to an adverse outcome arising solely from automated analysis of your data
- Claim compensation if you suffer damage due to unlawful processing
If your request is rejected, if you find our response insufficient, or if we fail to respond within the statutory period, you retain the right to lodge a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr).
If you are in the European Economic Area or the United Kingdom
In addition to the rights above, the GDPR gives you the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). On request we provide your data in a structured, commonly used, machine-readable format. Where processing is based on consent — such as personalised advertising — you may withdraw that consent at any time from Settings → Ad Privacy Options, without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with your national supervisory authority. Our data controller contact is destek@canlidostum.com.
12 Requests & Contact
You can send your requests — access, rectification, erasure, export, or objection to processing — to destek@canlidostum.com. Requests are answered within 30 days at the latest. Please write from the email address registered to your account; this is required so that we can verify your identity.
Requests: destek@canlidostum.com
CanlıDostum is not directed at children under 16 and does not knowingly collect data from persons under that age. The data controller is registered with the Turkish Data Controllers' Registry (VERBİS) where required by legislation. This document is for information purposes and may be updated from time to time; the current version is always published on this page.