bespace
Get the App

PRIVACY POLICY – BESPACE

Last Updated: September 19, 2026

This Privacy Policy regulates the principles regarding the collection, use, storage, sharing, and protection of personal data in connection with the use of the bespace mobile application provided by CAAT BİLİŞİM TEKNOLOJİ VE TİCARET LİMİTED ŞİRKETİ ("Company"). By using the Application, the User is deemed to have accepted the terms set forth in this Privacy Policy.

1. DATA COLLECTED

The Company may collect the following personal data of Users:

Account and profile information

  • Phone number (required for every account)
  • Email address
  • Username, and first and last name
  • Date of birth (used to check the User's age and apply age-based protections)
  • Gender
  • Country
  • Interests, universities, and spoken languages (optional)
  • Profile photos for the Anonymous Profile and the Open Profile
  • Password (stored only in hashed form)
  • Anonymous ID assigned to the User

Content created by the User

  • Posts and stories, including photos, videos, drawings, text, links, polls, and questions
  • Comments, reactions, and replies
  • Messages in one-to-one and group chats, including photos, videos, and voice messages

Location

  • Precise location while the Application is in use (with user consent). Only the most recent location is stored, not a location history. A User's location is never shown to other users.

Device and usage information

  • Device type and name, operating system and app version, device identifier, push notification token, and preferred language
  • IP address, session and connection logs, online status, and last-seen time
  • Camera, microphone, and gallery access (only for capturing and sharing content chosen by the User)
  • In-app usage statistics and preferences

Safety information

  • Reports submitted by the User or concerning the User, blocks, and support requests
  • Results of automated content scanning (Section 5)

2. METHODS OF DATA COLLECTION

Data is collected automatically or manually during the User's download, registration, interaction within the Application, or communication with technical support.

3. SIGN IN WITH APPLE AND GOOGLE

Users may register or sign in with their Apple or Google account. In that case, the Company receives from the provider:

  • A unique account identifier, used to sign the User in;
  • The User's email address, used to identify the account and contact the User. With Apple, this may be a private relay address if the User chooses "Hide My Email";
  • From Apple only, the User's first and last name if the User chooses to share them, used to fill in the name on the User's profile.

The Company never receives the User's Apple or Google password. Users who sign in this way must still add a phone number to complete registration.

4. PURPOSES OF DATA PROCESSING

Collected data may be processed for the following purposes:

  • User authentication and account creation
  • Provision of messaging and sharing services
  • Delivering posts to recipients who match the criteria chosen by the sender (such as age, star sign calculated from the date of birth, gender, interests, or distance)
  • Content moderation and user safety, including automated content scanning, age-based protections, reviewing reports, and enforcing the User Agreement
  • Troubleshooting technical issues
  • Responding to user support requests
  • Performance and security analysis of the Application
  • Preparation of future paid features
  • Compliance with legal obligations

5. AUTOMATED CONTENT MODERATION

Photos, drawings, and videos shared in posts are automatically scanned when they are uploaded, using Amazon Rekognition, a service provided by Amazon Web Services (AWS), to detect sensitive content such as nudity, sexual content, graphic violence, and hate symbols. For videos, individual frames are analyzed. The results (content labels and confidence scores) are stored with the post.

Content flagged as sensitive is never shown to users under 18, or to users whose age cannot be determined, and is shown to users aged 18 and over only behind a warning. Automated scanning does not by itself lead to any action against a User's account; such decisions are made by the Company's moderators.

6. ANONYMOUS PROFILES

Each account has an Anonymous Profile and an Open Profile. The Company never shows other users that the two profiles belong to the same person.

Within the Company's systems, both profiles belong to the same account and are linked to the User's phone number, email address, and other account data. This link is used only for security, enforcement of the User Agreement, and compliance with legal obligations. Authorized moderators can see which account a profile belongs to when reviewing reports or abuse, and each such access is logged. The Company may disclose this information to competent authorities where required by law.

7. REVIEW OF REPORTED CHATS

Chat messages are removed from the Application 24 hours after they are sent, but a copy is kept on the Company's servers so that reported conversations can be reviewed. When a chat is reported, authorized moderators may review its messages and media, including expired and view-once messages, in order to assess the report. Each such access is logged.

8. DATA RETENTION PERIOD

Collected data is retained for the duration necessary to fulfill the above purposes. When a User deletes their account, their profiles and content are removed from the Application immediately. The Company keeps the account's data and content for up to 30 days in order to handle abuse reports and legal requests; after that period, they are permanently deleted or anonymized, unless a longer retention period is required by law.

9. DATA TRANSFER AND SHARING

Other users can see the information that the User chooses to share:

  • The Open Profile shows the User's username, name, and profile photo.
  • The Anonymous Profile shows only the User's anonymous ID and its profile photo.
  • The User's gender and interests may be shown with either profile in search results.

User data is shared with third parties only in the following cases:

  • With the explicit consent of the User
  • Legal obligations (court orders, prosecutor's requests, etc.)
  • Domestic and international service providers supporting the infrastructure (including cloud services), listed in Section 18

Contracts with such partners include commitments to data security.

10. INTERNATIONAL DATA TRANSFER

The Company may provide some services via servers located abroad. In such cases, User data may be transferred internationally in accordance with applicable data protection laws (KVKK, GDPR, etc.). Transfers are conducted only to countries with adequate protection levels or where appropriate safeguards are in place.

11. USER RIGHTS

Under KVKK and GDPR, Users have the following rights:

  • Request access to their personal data
  • Request correction of inaccurate or incomplete data
  • Request deletion or destruction of their data
  • Object to processing of their data
  • Request transfer of their data to another institution

Users may exercise these rights by submitting written requests to [email protected]. Requests will be responded to free of charge within the legally prescribed timeframes.

12. DATA SECURITY MEASURES

The Company implements the following measures to protect personal data against unauthorized access, disclosure, alteration, or destruction:

  • Up-to-date firewalls and antivirus systems
  • Encryption of databases and files
  • Secure session management
  • Access control systems
  • Maintenance of access logs and periodic security testing

13. COOKIE USAGE

Cookies may be used in the Application and related web services to enhance user experience. These cookies serve the following purposes:

  • Session management
  • Remembering preferences
  • Statistical analysis
  • Security and authentication

Users may limit or disable cookie usage via browser settings.

14. CHILDREN'S PRIVACY

The bespace Application is intended solely for individuals aged 13 and above. The Company does not knowingly request or collect personal data from individuals under 13. If users under 13 are detected, their accounts will be closed immediately and their data deleted as described in Section 8.

Users aged 13 to 17 receive additional protections: content flagged as sensitive is never shown to them (Section 5).

15. DATA BREACH PROCEDURES

In the event of any data security breach:

  • The breach will be reported promptly to the Data Protection Authority (KVK Institution) and relevant supervisory bodies.
  • Affected Users will be notified via email or in-app notifications.
  • The root cause will be investigated, corrective measures taken, and technical arrangements implemented to prevent recurrence.

16. UPDATES AND CHANGES

This Privacy Policy may be updated in line with legal regulations and application changes. Updated versions will be announced within the Application or on the website. Continued use of the Application constitutes acceptance of the changes.

17. ANONYMIZATION AND STATISTICAL USAGE

The Company may anonymize User data by removing personally identifiable information. Such anonymized data may be used for statistical analysis, reporting, product development, and marketing activities. Anonymized data is not considered personal data.

This use does not compromise User privacy and is conducted within legal frameworks.

18. THIRD-PARTY SERVICES

The bespace Application uses the following third-party services. Limited User data is shared with them only as needed for the purposes below:

  • Amazon Web Services (AWS): storage of photos, videos, and voice messages (servers in Frankfurt, Germany), and automated content scanning with Amazon Rekognition (Section 5)
  • Firebase Cloud Messaging (Google): push notifications
  • Pusher: real-time delivery of messages and updates
  • Google Maps Platform (Places API): looking up places near a location
  • Sign in with Apple and Google Sign-In: authentication (Section 3)

All such services are subject to their own privacy policies. The Company ensures that data sharing is minimal and that service providers guarantee data security.

19. DATA CONTROLLER AND CONTACT INFORMATION

The data controller under this Privacy Policy is:

CAAT BİLİŞİM TEKNOLOJİ VE TİCARET LİMİTED ŞİRKETİ
Address: Yalı Mah. Eski Belediye Sk. Ortaklar Apt. No:10 İç Kapı No:5 Maltepe / Istanbul, Turkey
Email: [email protected]