Privacy notice

What do we collect?

Your name, e-mail address and time zone. If you sign in with Apple, we receive identity data from Apple: your Apple user ID, your e-mail address (this may be a private relay address that Apple creates for you) and, only at your first sign-in and if you share it, your name. For the parent you care for: their name, date of birth, blood type, allergies and notes, medications and medication records, appointments, documents, blood pressure and blood sugar readings, and "I'm OK" signals. Most of this is special category (health) data under the GDPR: medications, appointments, documents and readings, blood type, allergies and notes cannot be entered before the parent's consent is recorded.

Why?

So that family members can see the parent's day in one place and in real time, and so that medication, appointment and check-in reminders can be sent. Your data is not used for advertising and is never sold.

Where is it stored?

On Supabase servers in the European Union (Frankfurt, Germany). We are based in Türkiye; access to the data from outside the EU/EEA by us or by Supabase is protected by the European Commission's standard contractual clauses. Notifications are delivered through Google's notification service (Firebase), which is covered by Google's data processing terms, and on iPhones also through Apple's notification service (APNs); neither receives health data or names.

Who can see it?

Only family members who joined this family by invitation. The data is not shared with anyone except the infrastructure services we use to run the app (Supabase, and for notifications Google and, on iPhones, Apple).

Your rights

You can access your data, ask for it to be corrected or erased, and withdraw your explicit consent at any time. You can withdraw it from the Family tab or by writing to kvkk@basucunda.com.

Waitlist notice

Version: bekleme-2026-10-v1

When you join the waitlist we record your e-mail address, your phone's platform (Android/iPhone), and whether you'd like to join the pilot. We use these only to send you a one-off e-mail once the app is out on Google Play and the App Store, and to invite you to the pilot if you asked for it; never for advertising, and never sold.

The data is stored on Supabase infrastructure in the European Union (Frankfurt, Germany). Unconfirmed entries are deleted within 7 days; a confirmed entry is deleted 90 days after the launch e-mail.

You can remove your entry at any time, either from the unsubscribe link in a waitlist e-mail or by writing to kvkk@basucunda.com.

Full privacy notice

BAŞUCUNDA PRIVACY NOTICE

Version: gdpr-2026-10-v2

This notice is provided under Art. 13 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") to inform the people who use the Başucunda mobile app.

1. Data controller

Your personal data is processed by Berk Cengiz (sole proprietorship) ("Başucunda"), established in Türkiye, as the data controller.

Legal name (Turkish): Berk Cengiz (şahıs şirketi)

Turkish tax number (VKN): 2050726429

Privacy contact: kvkk@basucunda.com

2. Personal data we process

a) About the app user: name, e-mail address, phone number (if entered), time zone, notification preferences, in-app activity records (who created or viewed which record and when), the device's notification token, identity data from your Google account if you sign in with Google, identity data from Apple if you sign in with Apple (your Apple user ID, your e-mail address, which may be Apple's private relay e-mail address, and your name if you share it at your first sign-in), IP address and session logs.

b) About the parent being cared for: name, date of birth, blood type, allergies, notes, medications and their doses, medication intake records, appointment details, uploaded health documents (test results, reports, prescriptions), blood pressure and blood sugar readings, "I'm OK / call me" signals, and the record of the parent's consent (version, method, date, who recorded it). Much of this data is special category data (health data) under Art. 9 GDPR.

c) About the family: the members' roles, the care shift calendar and expense records.

3. Purposes

Your personal data is processed so that family members can follow the parent's care through a shared feed, to keep track of medications and stock, to keep an archive of appointments and documents, to send check-in notifications and reminders, to create your account and keep it secure, and to comply with legal obligations. Your data is not used for advertising or profiling and is never sold.

4. How we collect data and our legal bases

Data is collected electronically from what you and the other members of your family enter in the app and, if paired, from the parent's own device. Account and contact data is processed to provide the app to you under our contract (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c)) and on the basis of our legitimate interest in keeping accounts and the service secure (Art. 6(1)(f)). You need to give your name and e-mail address to create an account; without them we cannot provide the app. Special category data about you (if any) is processed only with your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)); the parent's health data is processed only with the parent's own explicit consent (Art. 6(1)(a) and Art. 9(2)(a)). The parent's consent is recorded in the app together with how it was given (verbally, in writing or on the parent's own device) and who recorded it; medications, appointments, documents and readings, blood type, allergies and notes cannot be entered before the parent's consent is recorded.

5. Recipients

The data is stored on servers of the app's infrastructure provider, Supabase Inc., in the European Union (Frankfurt, Germany). To deliver push notifications, Google's notification service (Google LLC, Firebase Cloud Messaging) and, on iPhones, Apple's notification service (Apple Inc., Apple Push Notification service, APNs) receive only the device's notification token and technical codes (the notification type and record identifiers), never health information or names; the visible text of a notification is produced on the phone. If you choose to sign in with Apple, Apple Inc.'s Sign in with Apple service confirms your identity; Apple sends us your Apple user ID, your e-mail address (which may be Apple's private relay e-mail address) and, only at your first sign-in and if you share it, your name. Signing in with Apple does not send the information you enter in the app to Apple. The data is shared only with users who are members of the same family; it is not disclosed to third parties except at the request of public authorities that are legally entitled to it.

6. International transfers

The data is stored in the EU (Frankfurt, Germany). The controller is established in Türkiye, outside the EU/EEA. When we (the controller) or Supabase access the data from outside the EU/EEA, this is covered by appropriate safeguards under Art. 46 GDPR, namely the European Commission's standard contractual clauses. You can request a copy of these safeguards at kvkk@basucunda.com. Google Firebase Cloud Messaging, which receives only the technical data described in section 5 and never health information, is covered by Google's data processing terms. Apple Push Notification service, which delivers notifications to iPhones, likewise receives only the technical data described in section 5, never health information or names.

7. Retention

The data is kept for as long as your account and your family record exist. You can delete your account in the app (Family tab → Account → Delete my account); your profile and membership data are deleted with it. If you are the only caregiver of a family that has other members, you first need to make another member a caregiver before you can delete your account. If you are the only member of a family, that family and all of its data (including uploaded files) are deleted together with your account after you explicitly confirm it. Records you entered in a family that continues (health records, expenses and shifts) stay with the family; your name and profile are removed from those records. Statutory retention obligations remain reserved. Deleted data is permanently removed from backups when the backup cycle completes. You can also send a deletion request by e-mail from the address registered in the app to kvkk@basucunda.com; we handle it within one month at the latest.

8. Your rights

Under the GDPR you have the right to access your personal data (Art. 15), to have it rectified (Art. 16) or erased (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3)). You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA country where you live or work or where you believe your rights were infringed (Art. 77). We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you (Art. 22). These rights apply to the parent too.

9. How to exercise your rights and withdraw consent

Send your requests from the e-mail address registered in the app to kvkk@basucunda.com; we respond without undue delay and within one month at the latest. You can withdraw your explicit consent at any time from the Family tab in the app or by writing to kvkk@basucunda.com. If you withdraw your consent you can no longer use the app; you can also ask for your data to be erased.