1. Controller and contact
The controller under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) is Andrei Slipchenko, acting as an individual. ZeytinCheck is the service name. Contact: [email protected].
This notice covers the zeytincheck.com website, the linked consumer web app and the Android application. A postal service address and, if available, registered electronic mail (KEP) contact remain to be confirmed.
2. Data, purposes and legal grounds
Data may be collected automatically when you access the service, when you voluntarily submit a photo or report, or when you contact us by email. No user account is required for normal label scans.
| Data and collection method | Purpose | KVKK Art. 5 processing condition |
|---|---|---|
| IP address, request time, device/browser technical information and security logs collected by infrastructure automatically. | Site and catalogue access, security, error diagnosis and abuse investigation. | Art. 5(2)(f): legitimate interests in service operations and security, subject to respecting fundamental rights. |
| Optional bottle/label images, submission identifier, timestamp, product IDs, recognition-version data and, where applicable, bottle volume, supplied when you choose to submit a report. | Assess product suggestions, investigate recognition errors and improve catalogue accuracy. | Art. 5(2)(f): legitimate interests in resolving user-submitted catalogue issues, subject to a documented balancing assessment and data minimisation. The photo-submission UI needs separate review. |
| Email address, name (if given), message and attachments you send to the support email. | Reply to inquiries, investigate product-data issues, fulfil data-subject requests and defend legal rights where necessary. | Art. 5(2)(f) for general inquiries; Art. 5(2)(ç) for legal duties; Art. 5(2)(e) to establish, exercise or protect rights where necessary. |
Ordinary label matching is described as happening on your device; simply scanning does not send the photo to ZeytinCheck servers. Optional submissions are different. EXIF metadata is removed from submitted resized images, but personal information visible inside the image may remain. Do not submit faces, ID documents or sensitive information.
The current product description indicates no required user account, location/contact/microphone permission, advertising ID tracking or in-app payment. New features require an updated assessment.
3. Recipients and international transfers
Depending on the processing flow, service providers may process data for hosting and security (Cloudflare / OpenAI Sites), catalogue-related services (Supabase), optional administrative label-image review (OpenAI API), and email delivery (Cloudflare Email Routing and Google Gmail). These are provider categories used for stated operational purposes, not permission to republish visitor-submitted photographs.
The connected ZeytinCheck Supabase database is configured in Tokyo, Japan (ap-northeast-1). Other providers may also process data outside Türkiye, potentially involving transfers under KVKK Art. 9. Actual transfer locations, recipients and the applicable lawful transfer mechanism must be confirmed contractually. This notice does not itself amount to consent or an international-transfer safeguard. You may contact the controller for further information.
4. Retention and security
Under the current app policy, visitor-submitted images and related reports are retained for up to 90 days in operational systems, with regular cleanup starting after 89 days. Verified non-identifying product information may remain in the catalogue. Infrastructure/security logs, provider backups and email correspondence follow separate retention processes, which require a further supplier-by-supplier inventory and period assessment.
HTTPS and restricted administrator access protect private submissions. Avoid including identification documents, faces or sensitive information in optional reports.
5. Your rights under KVKK Art. 11
You can request confirmation of processing, information about processed data, its purposes and use, recipients in Türkiye or abroad, rectification of inaccurate data, deletion/destruction when legal conditions apply, notification of corrections or deletions to recipients, objection to solely automated adverse decisions, and compensation where unlawful processing causes damage.
6. How to make a request
Contact [email protected] with a description of the request and, where available, your submission identifier and approximate date. Do not send unnecessary identification documents. Proportionate identity verification may be necessary.
Formal methods under the Turkish rules include written applications, registered electronic mail (KEP), secure electronic signature, mobile signature, email previously provided and registered in our system, or approved dedicated application methods. The public contact email is a practical first contact; the legal sufficiency of any request depends on the required method.
Compliant applications are answered as quickly as possible and within 30 days at the latest, subject to statutory exceptions. Complaints to the Turkish Personal Data Protection Board may be available under KVKK Art. 14. See data deletion instructions for optional visitor reports.
7. Nature of this notice
This is a transparency notice under KVKK Art. 10, not a consent form. Consent, where legally required, must be presented separately. See Privacy Policy (Turkish), Terms of Use, and Report a correction.
Official materials: KVKK transparency duty and international transfers.