Privacy & Personal Data Notice

Privacy at a Glance

The data controller is Ömer Taha Tonbaklar. Privacy enquiries can be sent to legal@bitescore.co. This summary highlights the main points; the sections below provide the details.

• Account, content, interaction and security information is processed to provide product discovery, reviews and community services.
• The Explore feed in the mobile app is ordered using how recent posts are, community engagement, your friendships and the posts already displayed on your screen. No interests or personal characteristics are inferred for this purpose, and this information is not used for advertising, the sale of data or BiteData.
• Optional website and mobile usage statistics each require separate, explicit consent. Declining or withdrawing consent does not prevent access to core services.
• New accounts do not appear in search or the league. You can enable visibility separately on the Community Rules screen or in Settings. Published reviews are shown to other users with your username and profile picture, independently of search and league visibility. Your friend list and profile details initially appear only to you and accepted friends, following their own privacy settings.
• The BiteData business service and demographic collection for it are disabled. Your existing contributions cannot automatically become eligible for future commercial BiteData use.
• Settings lets you request a copy of your data, manage privacy choices and initiate account deletion. Your statutory rights under the Turkish Personal Data Protection Law (KVKK) remain available separately.
• By law, your account's age is verified with the e-Devlet age verification token before you use the social features where you interact with other members. Only your age group reaches BITESCORE.; your ID number and date of birth are not shared. Product ratings and reviews do not require verification.

1. Data Controller

The following operator is the data controller for BITESCORE.'s website, mobile application and related services under Turkish Personal Data Protection Law No. 6698 (KVKK).

Current operator contact details, including the address for service and applications and telephone number, are available at https://bitescore.co/en/contact.

• Legal name: Ömer Taha Tonbaklar
• Email: legal@bitescore.co

2. Personal Data We Process

• Account and sign-in information: email address, username, account identifier, selected sign-in provider, securely stored password hash and verification status.
• Age declaration and legal choices: your declaration that you have reached your 18th birthday, accepted terms, editions of information provided to you, consent choices and dates. Account eligibility does not require a birth date, month, year or age range, and your age is not inferred from your behaviour.
• Age verification information: the fixed request code unique to your account, the age-group result derived from the e-Devlet age verification token (reached 18, aged 15–18, or the non-resident exemption), the verification time, the policy edition applied, the identifier of the key that signed the token and, where applicable, a suspension record. The token itself is not stored after verification.
• Profile and content: display name, biography, profile and product photographs, reviews, ratings and rating details, lists, messages, reports and related product information.
• Community and service activity: likes, friendships or follows, votes, gifts, BiteCoin, XP and level activity, and account and notification preferences. If a task reward is associated with a review, the task and reward amount may also be recorded.
• Technical and security information: IP address, browser information, device and app version, access and security records, session details, the device identifier needed to send notifications, and abuse-investigation records.
• Device permissions: photographs you select and camera access while scanning barcodes. Microphone or continuous location access is not requested. A device permission does not constitute consent to separately described optional usage statistics.
• Support and moderation: requests and support correspondence, abuse reports, reviewed content, assessment results and product-level summaries derived from public contributions.
• Search information: text entered when searching for products, members or lists is sent to the server to return results. As part of an access request, it may appear in limited technical records with IP address, browser information and time. Search text is not included in optional usage statistics, advertising or BiteData.
• Explore feed information: when you use the Explore feed while signed in to the mobile app, we record the posts displayed on your screen (post identifier, first and last display time and the number of separate views) and the ordered list of posts provided to you (list identifier, the posts in it, and its creation and expiry times). How long you stay on a post, your taps or scrolling, screenshots and post content are not added to these records. Views of your own posts are not recorded.
• Basic sign-in records: successful sign-in dates, total sign-in counts and mobile sign-in counts are recorded for account security, service operation and capacity planning. These records are separate from optional usage statistics; they do not track browser activity or support advertising.
• Optional mobile usage statistics: with separate consent, we may process screens and features used, outcomes and counts, use and response times, technical errors, app and operating-system versions, device class and language. Random identifiers distinguish installations, sessions and individual actions; occurrence and server-receipt times and an association with your signed-in account are recorded. Protected values derived from those identifiers are stored in place of the identifiers themselves.
• Optional website usage statistics: with separate consent, we may process page types visited, features used, outcomes and counts, active use and response times, errors, browser or device class, software version, language and sign-in method. Protected identifiers relate records and distinguish duplicate submissions.
• Optional statistics exclude review, message and search text, barcodes, photographs, audio, location, passwords or sign-in details, form contents, full web addresses, referring addresses, advertising identifiers, screenshots, recordings of on-screen activity and touch or click coordinates.
• BITESCORE. does not collect receipts or similar documents to verify purchases or product use for reviews. Task-reward disclosures and virtual gifts do not establish how a product was obtained. Sections 5 and 8 explain any historical BiteData records.

3. Where the Data Comes From

Data is obtained electronically through forms, your contributions and service activity, device permissions you choose and sign-in providers. Cookies, device storage and server records use automated methods; support and complaint handling also involves partly automated processing within a filing system.

Optional usage statistics are not collected before separate information and explicit consent. Where offered, the choice is available to signed-in members who have made the age declaration and completed the required terms and information steps. Guests are not included in this collection.

After consent, optional statistics may be held briefly on the device and sent in batches over an encrypted connection. Short-lived information needed to protect your choice is not stored as usage statistics. Website and mobile choices are independent.

The 18+ declaration is obtained from you. The age group is derived from the electronically signed token that you generate through the Cybersecurity Directorate service after authenticating on the e-Devlet Gateway and upload to BITESCORE. BITESCORE. verifies the token on its own servers with the Directorate's public key and sends no data about you to the Directorate or e-Devlet for this purpose. No identity-document or legal-representative verification is performed. Task reward information comes from the applicable in-service task rules and cannot be freely determined by the reviewer.

Explore view information is generated automatically by the app when at least 60 percent of a post remains on screen for at least 0.7 seconds, and is sent in batches over an encrypted connection. It is generated only for signed-in members, only in the Explore feed and only while the ranked feed is in use; it is not generated on reply screens, for guests or on the website. The friendship, like, reply and blocking information used for ranking comes from existing service records.

4. Why We Process It and the Legal Grounds

• Creating accounts, maintaining sign-in and providing profiles, reviews, ratings, lists, social interactions, gifts and notifications rely on necessity for entering into or performing the service agreement (KVKK Article 5(2)(c)).
• Security, preventing unauthorised access and abuse, moderation and capacity management rely on legitimate interests, provided your fundamental rights and freedoms are not harmed (Article 5(2)(f)). Establishing, exercising or defending a right may also apply to legal claims (Article 5(2)(e)).
• Responding to lawful requests from competent authorities and meeting mandatory recordkeeping or consumer obligations rely on the controller's legal duties (Article 5(2)(ç)).
• Verifying your account's age with the e-Devlet age verification token, keeping unverified accounts out of the social network features and out of reach of other members, ensuring no service is provided to children under 15 and that BITESCORE.'s 18+ condition is met, requesting re-verification on reasonable suspicion and handling objections are necessary to comply with the legal obligation under Article 4 of the supplementary provisions of Law No. 5651 and the related Regulation (KVKK Article 5/2-ç). The age-group result is not used for profiling, advertising or age estimation.
• Optional website and mobile usage statistics each rely on separate, explicit consent to assess and improve the service (Article 5(1)). They are not used for targeted advertising, sale of data, tracking across apps or sites, personal scoring or significant automated decisions about you.
• Protecting the preference process and keeping basic sign-in records are assessed as part of the requested service and proportionate security interests (Articles 5(2)(c) and (f)). Declining optional statistics does not remove necessary security processing.
• Producing in-service product scores and summaries from community contributions and recording task rewards support the requested service (Article 5(2)(c)). Preventing reward and review manipulation may also rely on legitimate interests where appropriately balanced with your rights (Article 5(2)(f)).
• Ordering the Explore feed, reducing repetition of posts you have already been shown and taking your friends' posts into account are necessary to provide the community service you request (KVKK Article 5(2)(c)). Measuring whether new posts receive fair visibility and how well the ranking works, and preventing engagement manipulation, rely on legitimate interests, provided your fundamental rights and freedoms are not harmed (Article 5(2)(f)). This processing is separate from optional usage statistics and does not depend on whether you consent to them.
• This Notice is not permission to send marketing communications. If that option is offered later, the required information and permission will be obtained separately from service and security communications. Nor does this Notice authorise future BiteData processing in advance.

4A. Data Use and Recipients by Activity

Each provider receives only the information needed for its role, not every category of your data. The main activities and recipient groups are set out below. Section 7 explains transfers and safeguards.

• Accounts and community services: account, sign-in, preference, content and relationship information is processed by hosting and database providers, your selected sign-in provider and, where needed, email or notification providers to supply your account and requested features. Legal ground: Article 5(2)(c).
• Security and moderation: relevant accounts, content, reports, blocks and limited technical records are processed only by authorised personnel, necessary providers and, where required, advisers or authorities to investigate abuse and enforce rules. Legal ground: Articles 5(2)(f), (e) or (ç), as applicable to the circumstances.
• Optional usage statistics: the usage, device and performance information in section 2 is processed by BITESCORE. and hosting or database providers appointed for that purpose to measure and improve the service. Legal ground: Article 5(1). It is not sent to advertising networks or data brokers.
• AI-assisted moderation: only the review under examination and necessary product or public-content context may be sent to a provider meeting section 7 requirements for security and moderation. The legal ground is Article 5(2)(f) and, where applicable, (ç) or (e), according to the review concerned. Private messages are excluded from this external transfer.
• Requests and legal duties: contact, identity or authority checks, requests, delivery information and necessary evidence are processed by authorised personnel, delivery providers and necessary advisers, courts or authorities to respond and comply with duties. Legal grounds: Articles 5(2)(ç) and (e), where applicable.
• Explore feed: the view and ordered-list records in section 2, together with like, public reply, friendship and blocking information about posts, are processed by BITESCORE. and hosting and database providers to order the feed, reduce repetition and measure how the ranking works. When likes are weighted, the liking account's creation date and whether it is banned are taken into account. Your views are used only as a count when calculating how many different members a post has reached. Legal grounds: KVKK Articles 5(2)(c) and (f). These records are not transferred to advertising networks, data brokers or other members; other members cannot see which posts you have seen.

5. BiteData and Demographic Information

The BiteData business service is disabled. No organisation or commercial customer receives product analysis, review text, quotations, user references, demographic groups or other outputs through it. Current reviews support only core BITESCORE. scoring, discovery, security and moderation.

No new birth year, demographic gender category or province information is collected for this service, and no new demographic consent is requested. Any historical records are not active service inputs; an earlier consent record is not permission for new or future processing. Access, correction, withdrawal and deletion rights remain available for those records.

Any future launch requires updated Terms, Privacy Notice, Community Rules and store privacy disclosures, and completion of provider, recipient and international-transfer requirements. Relevant acceptance and, where necessary, separate purpose-specific consent must precede the new processing. Existing contributions cannot become retrospectively eligible for commercial use merely because the service opens or you accept later general terms; only later contributions made under the new conditions may qualify.

A public review or task-reward disclosure does not authorise reuse of your review, username, name, image or identity in advertising, promotional material or testimonials. Such use requires separate, specific and lawful authority.

6. AI, Explore Ranking and Automated Processing

Reviews may be analysed to detect abuse and produce in-service product summaries. Automated tools can make mistakes. Significant account sanctions are not based solely on automated results; you can appeal and request human review. Product summaries are not expert health, allergy or nutrition advice.

Private messages are checked against limited security rules before delivery to prevent clear abuse. A message blocked by this check is neither delivered nor stored as a message on the server. Its text is not sent to an external AI provider for that check. Message security is separate from optional analytics consent; analytics records do not include message content.

In-service product scores and summaries do not create personal advertising audiences or decide an individual's price, employment, credit, insurance, core service or account access. BiteData commercial and demographic analyses remain disabled.

The Explore feed is ordered by an automated ranking system. Section 4A of the Terms of Use explains the main criteria and their influence: how recent a post is, recent likes and replies from different members, the like rate among viewing members where there is enough data, your friendships, posts you have already viewed or interacted with, and feed diversity.

This ranking does not produce predictions or scores about your interests, personal characteristics or behaviour, and does not infer your age, health or other special categories of personal data. Product scores, whether reviews are positive or negative, and reports are not ranking criteria. The ranking has no legal or similarly significant effect on your account or content; content restrictions and account sanctions follow the separate moderation process.

Interest-based personalisation drawing on products and categories you have reviewed, added to lists, posted about or liked, or on members you often interact with, is not currently active. If it is offered in future, it will not start before a separate assessment that includes its effect on children and before this Notice is updated in advance; you will be given a choice to turn it off.

You can pull down on the feed to request an updated ranking, and view posts in date order without personalisation in the community area of the website.

7. Recipients and International Transfers

Identity, sign-in, security, private-message and profile information is not sold or commercially licensed. Section 9 explains public content. Processing by providers necessary for the service is limited as follows.

• Amazon Web Services (AWS) Lightsail hosts the website, API and background services; Amazon RDS provides the application database and Amazon S3 provides file and image storage. Private realtime communication also runs on the application infrastructure. These services process necessary account, content, private-message, media, age-verification and technical records on the operator's behalf. The selected application, database and storage region is Frankfurt; this does not establish that all support access, logs, subprocessors or backups remain in that region.
• Supabase provided the database, file and image storage, realtime communication and related account operations for previous releases. Retained sources, migration and recovery copies, and historical account and media records are handled separately. Older signed apps that have not been retired may continue to contact those services. Moving to AWS does not establish deletion of those sources, access arrangements or historical copies. The latest verified Supabase project regions were Stockholm and London; support, subprocessors and backups are not assumed to be limited to those places.
• Amazon Simple Email Service (SES) is used in Frankfurt to send verification and service emails, including the JSON account-archive attachment you request. It processes recipient addresses, message and attachment content, and delivery and feedback information. The sending region does not establish that all support, security, subprocessor or backup records remain in that region. Mobile push notifications pass through Expo and Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM); the device notification identifier, platform, notification title/body and delivery information reach the relevant providers. Confirmation of the account-applicable processing locations and retention conditions across this chain is incomplete.
• Google or Apple process necessary account and sign-in information only when you choose that sign-in method. Open Food Facts receives the barcode needed for a product lookup, not your BITESCORE. account identifier.
• You generate the age verification token on the e-Devlet Gateway; authentication and token generation are carried out by the Cybersecurity Directorate and e-Devlet under their own responsibility, and you enter your account's request code into the Directorate's service. BITESCORE. verifies the token on its own servers and sends no data about you to the Directorate or e-Devlet for this purpose. The age-verification record is stored on the operator's behalf in the AWS infrastructure described above; it is not made available to other members, advertising or data-broker purposes. Lawful requests from competent authorities are considered separately.
• Optional usage statistics are collected by BITESCORE., not sent to an advertising network, data broker or external analytics service. Collection remains disabled until the hosting and database providers, locations, retention conditions and necessary transfer safeguards for that purpose are verified.
• External AI moderation may receive only the submitted review and limited context needed for the check. Free text may contain personal or sensitive information and is not treated as anonymous. Sending remains disabled until provider identity, processing region, contractual terms, subprocessors, retention, model-training practices and necessary transfer safeguards are established. Private messages and analyses for the disabled BiteData service are excluded.
• Only people whose duties require access may process data for support, security, moderation and requests. Where a legal duty or protection of a right requires it, necessary information may be shared with advisers, courts and competent authorities.
• If you request a data copy by email, the email provider Amazon SES processes your account archive as an attachment as well as recipient and delivery information. Depending on the records held, it may contain profile information, reviews, lists, sent and received private messages, service activity, reports, acceptance and consent records and personal analytics included in the export. It is sent to your verified account email address. A copy downloaded directly in the browser is not sent through the email provider. The attachment is a JSON file; direct download does not send that content to the email provider.
• Processing outside Türkiye requires an applicable transfer mechanism under KVKK Article 9. Adequacy, appropriate safeguards or other legally permitted circumstances must be assessed for the particular transfer. Optional analytics consent does not replace the safeguards required for an international transfer. You can request current provider, processing-location and transfer-arrangement information through the privacy contact channel. Documentation of concrete, applicable Türkiye-specific transfer safeguards for the existing regular overseas processing by AWS (Lightsail, RDS, S3, SES), Supabase, Resend and the relevant push/sign-in services is not complete. Publishing this Notice, using the service or selecting a consent checkbox does not resolve that gap; this information grants no new processing or transfer authority. Choosing a European project region or obtaining a general GDPR agreement does not by itself satisfy KVKK Article 9.
• Messages and account-archive attachments previously sent through Resend (Plus Five Five, Inc.) are not treated as deleted when the provider changes. Resend's reviewed public information states that messages and service logs are stored in the United States: ordinary retention on Free, Pro and Scale plans is 30 days, backups persist for 7 days, and remaining data may be retained for up to 90 days after termination; Enterprise and account-specific conditions may differ. Earlier deletion and account-specific exceptions require a separate provider process.
• When you email support or privacy contacts, your request, attachments and mail information are also processed by the inbox service. Confirmation of that provider's contracting entity, processing locations and retention/backup conditions is incomplete; SES's sending service is distinct from this inbox service. Do not send unnecessary identity copies, passwords or verification codes.
• Confirmation of the account-applicable retention conditions for any SES message archives and for delivery and feedback, security, abuse-investigation, support, subprocessor and backup records is not complete. The recipient's email service also processes messages and attachments under its own conditions. Deleting your BITESCORE. account does not simultaneously erase messages or attachments already received by these services.

8. Retention, Deletion and Anonymisation

Account and community information is retained as needed to provide the service. Account deletion covers your profile, directly related content and relationships, and uploaded images, including published product photographs. Publication or a content licence alone is not a reason to retain those photographs.

Deletion of files, provider account records and some analytics records may finish after the account closes. Incomplete work is retried or reviewed and is not treated as complete before it finishes. Caches and restricted-access backups are handled separately. We do not promise instantaneous deletion of every copy. Operational confirmation of each provider's backup rotation period and reapplication of deletion requests after a restore is incomplete; removing the main account record does not establish that its backups have been erased.

• Limited evidence of accepted terms, information provided and the minimum-age declaration may be kept separately with restricted access after account deletion. IP and device information is removed from those records. Document edition, a value verifying text integrity, language, action channel and date and a protected association value that does not directly identify you remain. These records are not described as fully anonymous.
• Acceptance records are kept for 10 years from account deletion; optional analytics consent and successful withdrawal records for 10 years from the decision. They are then deleted. This is the current policy for establishing, exercising or defending rights under Article 5(2)(e), informed by the general limitation period in Article 146 of the Turkish Code of Obligations. It is not a statutory duty to keep all personal data for 10 years; necessity and scope must be assessed separately.
• Separate analytics consent records contain the decision, relevant document editions and integrity information, language, platform and app version, time and protected association values. They do not include direct account or installation identifiers, IP addresses or browser information. Only accepted consent or successful withdrawal of an existing consent is recorded; repeating a request does not create another long-term record.
• Verification codes expire within 10 minutes. Other security and investigation records are limited to the shortest period justified by the specific risk, legal duty or claim.
• For optional website and mobile analytics, detailed usage records are kept for up to 14 days, session records for 30 days and daily activity records for 90 days. Hourly aggregate statistics without account or installation identifiers are kept for up to 13 months. They may describe small groups and are therefore protected rather than treated as fully anonymous; they may remain until normal expiry after withdrawal.
• Mobile withdrawal applies to that app installation and website withdrawal to that browser. Other installations or browsers have separate choices. Collection stops and information waiting to be sent is cleared on withdrawal. If the request cannot reach the server, only the limited information needed to retry is retained until confirmation and device cleanup are complete; it cannot restart collection. The Cookie Policy gives further device-storage periods.
• Associated usage, session and daily activity records may be deleted from servers in stages after withdrawal. The obsolete active consent record is removed when that cleanup finishes; the limited legal evidence record above is separate. An inactive mobile preference without an account or installation association, outside the withdrawal process, may remain for up to 90 days. A later deliberate new consent does not cancel deletion of earlier records.
• Basic daily sign-in records are retained for up to 90 days and aggregate capacity statistics for up to 13 months. Daily account records are removed on account deletion. Account-related analytics become inaccessible and permanent deletion may finish later. A limited record tracking completed deletion is retained for up to 90 days.
• Explore view records are kept for up to 37 days from the last view, and ordered lists of posts provided to you for up to 6 hours; expired records are deleted by an automated clean-up process. No more than 5 lists are kept for an account at any time. When you delete your account these records are deleted with it, and when a post is deleted its view records are deleted. Operational records about how the ranking system runs contain no user or post identifiers, only counts and durations.
• Deleting or correcting reviews updates product scores and views. Task reward information remains associated with a retained review; editing a review does not rewrite its reward history. It is deleted with the review or account unless a separate legal retention need applies.
• Historical access or demographic records from disabled BiteData are not retained for commercial use. Deletion and withdrawal requests apply; only limited past decision records needed for a specific legal reason may remain separately for the applicable evidence period. They do not authorise new use and do not include demographic values in the separate evidence record.
• Exceptional records needed for a statutory duty or specific legal claim are restricted to the necessary scope and period with limited access. Retaining an age declaration does not mean that a birth date, age range or verified parental permission was recorded.
• Verified separate retention periods for all infrastructure access/error logs, support correspondence and investigation/report files are not yet complete; rotation by file size is not a retention period. This gap does not justify indefinite retention. Unless a specific legal retention requirement applies, data must be deleted, destroyed or appropriately anonymised when its purpose ends. Records of deletion, destruction or anonymisation operations required by law must be retained for at least three years; this duty does not authorise retention of the entire erased content.
• The age verification record is kept for the life of the account and deleted with it. If the token shows you have not reached your 18th birthday, the account is closed for use; its content and data are not deleted until any objection is concluded, and are deleted without delay if there is no objection or it is rejected. The token itself is discarded once verification completes and is kept in no record.
• The verified RDS automatic-backup retention setting is 7 days. This setting does not establish that manual backups, protected migration and recovery archives, S3 preservation copies, logs or legacy Supabase and Resend copies are deleted after the same period. Each copy's purpose, access restrictions, retention and final deletion are handled separately; applicable deletion requests must be reapplied after a backup restore.

9. Public Content and Third-Party Sources

New accounts do not appear in search or the league. You can enable visibility separately on the Community Rules screen or in Settings. Published reviews are shown to other users with your username and profile picture, independently of search and league visibility. Your friend list and profile details initially appear only to you and accepted friends, following their own privacy settings.

If you separately enable search and league visibility, your username, profile picture, bio, level, community score and rank may be shown publicly in search, the league and limited profile identity views. Search engines may index this information and others may copy it. Email, sign-in information and private demographic details are not published. Social sign-in accounts do not appear in search or the league until username selection is complete.

Enable or disable search and league visibility separately on the Community Rules screen or in Settings. Friends and profile details follow a separate privacy setting. Existing accounts' disabled preferences are not enabled by this edition; previously enabled visibility is not disabled by this change. Turning visibility off does not prevent access to the core service or immediately remove previous third-party copies or search-engine caches.

Reviews and ratings are subject to moderation and publication requirements. Before submitting a review, you are informed that your published review will be shown to other users with your username and profile picture. Review visibility is independent of search and league visibility. Turning search and league visibility off does not hide published reviews or their username and profile-picture attribution. Content held for review or removed is not shown to other users. Lists and Clashes follow their own visibility settings. Do not share personal or sensitive information in public areas.

Visibility is separate from the 18+ membership declaration. Becoming eligible does not enable a disabled preference. Community visibility is processed to establish and perform the service (KVKK Article 5/2-c); optional usage analysis requires separate explicit consent.

Initial visibility is an account default, not a consent or visibility decision made by the member. Later changes record the account-linked enable/disable preference, decision identifier, language, version, full copy of the notice and its hash, presentation verification status, action channel (web or mobile) and decision time. This setting collects no date of birth, identity document, IP or device information. Limited preference evidence is retained to protect a right (KVKK Article 5/2-e) and removed on account deletion. Declarations from previous editions are not rewritten. The Privacy Notice explains service providers, transfer conditions and Article 11 rights.

Historical demographic information and related consent status are not part of your public profile. A task-reward disclosure on a review does not establish verified purchase or product use.

External links and sources such as Open Food Facts are subject to the relevant providers' terms. Public visibility does not change the BiteData limits in section 5.

10. Age Eligibility and Child Protection

You must have reached your 18th birthday to create an account and use BITESCORE. People on or after their 18th birthday meet the age policy. Parental or legal-representative permission does not permit membership before 18.

We record your self-declaration that you have reached your 18th birthday. In addition, under Article 4 of the supplementary provisions of Law No. 5651 and the Regulation on Differentiated Services for Children and Age Verification by Social Network Providers published in Official Gazette No. 33396 of 10 October 2026, your account's age is verified with the e-Devlet age verification token before you can use the social network features that let you interact with other members. These features are direct messages, Explore posts and replies, Clash comments, friends, gifts, shared lists, Blend and appearing in people search. The product catalogue, product ratings and reviews, personal lists and account functions are provided separately from these features and do not require age verification. Other members cannot contact an unverified account, and it is not shown in people search. For accounts opened from 1 November 2026, the social network features stay closed until verification is complete. Accounts opened before 1 November 2026 keep using these features without verification until 31 March 2027; after that date the features close until verification is complete.

The token shows only your age group against the 15 and 18 thresholds; your name, Turkish ID number, date of birth or identity document are neither sent to nor requested by BITESCORE. If the token shows you have not reached your 18th birthday, your account is closed for use. If there is a reasonable suspicion that a verified account is used outside its age group, the account is suspended until it is verified again with a new token. Acceptance of the Terms, delivery of the Privacy Notice, age verification and optional choices are separate records.

Ordinary service access is restricted until the current 18+ declaration and document steps are completed. A search and league visibility choice does not establish adulthood. Accounts known to belong to someone under 18 remain restricted pending review and correction.

Even while age-restricted, you can read legal documents, contact support, report safety concerns, block users, sign out, request your data and delete your account. Request human review of an incorrect age record or restriction at legal@bitescore.co. Deletion does not require acceptance of new terms. Objecting to an age verification result or to the suspension or closure of an account is free of charge and possible in Turkish; objections are reviewed by a person, not solely by automated systems. Account content and personal data are not deleted until the objection is concluded. You may complain to the Cybersecurity Directorate about the outcome and apply to the courts. The measures taken are published on the Age Verification Measures page.

Suspected underage-account reports are reviewed through existing support and moderation. Unnecessary new registration data is not collected. Membership eligibility does not override an existing disabled visibility preference or enable advertising, demographic data use, external AI transfers or usage analytics automatically.

A fixed request code unique to you is created when you open your account or the verification screen. The token is checked for the Directorate's signature, expiry, the BITESCORE. platform code and your request code, and is used solely for age verification.

11. Security and Accountability

Technical and organisational safeguards are applied in proportion to the nature and risks of processing. These include access limited by duties, secure transmission, record protection and abuse checks. No internet service can guarantee absolute security.

Suspected data-security incidents are investigated, necessary access restrictions applied and affected people and authorities notified where legally required. New recipient groups or materially different processing purposes are explained before use. Historical accounts or acceptance records do not authorise data use for a disabled service.

12. Your KVKK Rights and Controls

Under KVKK Article 11, you may learn whether your data is processed, request information, learn the purpose and whether use is consistent with it, identify domestic or overseas recipients, request correction of incomplete or inaccurate information and request deletion or destruction when legal conditions are met. You may request that relevant recipients be informed of correction or deletion, object to a result against you arising solely from automated analysis, and seek compensation for damage caused by unlawful processing.

You can request information about Explore ranking and, if you believe a result against you arises solely from analysis by automated systems, object under KVKK Article 11(1)(g). Your Explore view records and the current ordered lists held for your account are included in the data copy available from Your Data.

Send requests and questions to legal@bitescore.co. Email sent from the address registered with BITESCORE. is one method recognised by the Communiqué on Applications to Data Controllers. If you use another address, necessary and proportionate verification may be requested or you may be directed to another method permitted by the Communiqué. Include your name, contact details, request and information identifying the relevant processing.

Requests are answered as soon as possible and within 30 days at the latest. A fee may be charged only where permitted by the official tariff. After applying to the controller, you may complain to the Personal Data Protection Board within the applicable statutory conditions and time limits.

Settings lets you manage available privacy choices and initiate account deletion. Your Data provides access to a copy of your data. Data copies use a machine-readable file format. Security or temporary service limits may affect self-service access but do not restrict formal KVKK rights.

The copy also covers sign-in and analytics records associated with your account, consent decisions and any historical demographic or task-reward records still held. Another person's use of a shared device is not attributed to you merely because the same browser is used. Guests may also contact the controller about their own data.

13. Changes and Contact

Material changes to purposes, recipients or your rights are communicated before new processing where required. Editorial corrections or updated information do not themselves create contractual acceptance or consent. A new consent-based purpose requires separate information and a new choice; section 5 applies to BiteData.

Send questions and requests to the controller using the contact details in section 1. Earlier editions remain archived so that the information previously provided can be established.