Your Data, Explained Transparently.

This Privacy Notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the "Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform" to inform you, our users of the Klaris mobile app (the "App"), about the processing of your personal data.

Klaris provides a personalised cosmetic assessment of a product's suitability for your skin and hair type by scanning its barcode, based on a scientific ingredient database. It is a premium cosmetic decision-support app. The App serves as a cosmetic information / shopping assistant; it does not provide medical advice, diagnosis or treatment and does not replace a dermatologist.

Klaris is open to users of all ages; users who are minors are expected to use it under the supervision of a parent or guardian.

Under the KVKK, your personal data are processed by the natural person whose identity and contact details are given below, acting as data controller:

• Data controller: Mustafa Eren KOÇ (natural person).
• Capacity: individual app developer / service provider.
• Email for requests and contact: kvkk@klaris.com.tr.
• Website: klaris.com.tr.

The data controller operates as a natural person, not within a company (limited liability company / joint-stock company). Throughout this notice, "we", "Klaris" and "data controller" therefore refer to Mustafa Eren KOÇ, a natural person.

Depending on the features you choose to use, the following personal data may be processed during your use of the App:

2.1. Identity and account data. These vary according to the platform on which you create your account. On iOS, Sign in with Apple provides your account identifier (user identity linked to your Apple ID), the name and/or email information you choose to share through Apple (the relay address generated by Apple if you use Apple's "Hide My Email" feature). On Android, Sign in with Google provides your Google account identifier, email address, whether that address is verified, and your first and last name, obtained by verifying Google's signed identity token. Your Google account profile photo and language/region information are not collected; Klaris does not request access permission (OAuth) to your Google account. On both platforms, the visible username / nickname you set within the App is processed.

2.2. Profile and preference data (skin / hair onboarding). Onboarding profile information you enter about your skin type, hair type, sensitivity, tendencies and similar cosmetic preferences so that we can produce a personalised assessment. This information is not intended for diagnosis; it is used only to personalise product-user suitability.

2.2.1. Age and date of birth (optional). When creating your profile, you may enter your date of birth or choose not to enter it at all. If you enter it, both your date of birth and the age derived from it are stored in encrypted form in your Klaris account. Since care priorities change with age, this information is used to prepare product notes that more closely reflect your current needs. It is not mandatory: leaving it blank does not disable any App feature; only this personalisation will not work. If you select "Prefer not to say" in the questionnaire, neither age nor date of birth is sent to your account. Storing age alone would mean that the record silently became outdated each year; the full date keeps age accurate and is held in the same encrypted block as your other profile preferences, not in a separate column. It is deleted with your other profile data when you delete your account.

2.2.2. Acne tendency (optional). If you answer "Do you have a tendency to acne?" in the profile questionnaire, your chosen answer (none, rarely or often) is processed with your profile preferences; if you leave the question blank, it is not sent to your account. Its purpose is to tailor comments about pore-clogging potential in product notes to your profile; in the current version, your answer is stored in your profile, but product comments do not yet change according to it. It is a cosmetic profile preference; it is not subject to an explicit-consent gate, relies on the same legal ground as your skin/hair profile (Article 4.2, performance of a contract), and is deleted with your other profile data when you delete your account.

2.3. Optional profile additions. Only the allergens, pregnancy information and fragrance sensitivity you choose to share. In the Klaris product contract, these are profile preferences that do not produce a medical diagnosis or health assessment. The field that directly changes product notes today is the ingredients you select; your fragrance sensitivity preference is stored in your profile and does not, by itself, change product comments in the current version. These data are processed only on the basis of your explicit consent specific to this processing; they may be left blank, are not saved to the server without explicit consent and are deleted when consent is withdrawn.

2.4. Optional selfie and skin diary data. Your monthly selfie photo and skin diary notes, which you may use for your own cosmetic tracking, are entirely optional and skippable. This feature is not mandatory: you can always skip it by choosing "Take Later" / skip. Choosing to take a selfie means giving your explicit consent through a clear action (consent-by-action) for this feature; if you do not take it or delete it, these data are not processed.

2.5. Contribution (add / complete product) data. Product information, photos and ingredient contributions you submit through the "Add / Complete Product" feature (subject to administrator review; publication is not mandatory).

2.6. Community and "Skin Twin / Hair Twin" data. Content you share in Community features and profile information used to enable you to appear in the feed of users with the same Skin or Hair Identity. You may choose to participate with the Community display name you select in the App, with a system name containing no personal information if you have not yet chosen a name, OR completely anonymously. Your real name and email received from the sign-in provider (Apple on iOS, Google on Android) are not displayed in the Community. The author name is recorded when a post is created; later name changes do not retrospectively change author names on earlier posts. Twin feeds are a Premium feature; if you are not subscribed, you do not appear in these feeds. You are included in the Twin community count only when you create your skin/hair profile; the count is subject to a k-anonymity threshold, and no one is visible as an individual. You may choose not to create a profile, and you may delete a profile you have created together with your account.

2.7. Transaction and technical security data. Limited transaction, device/app version and session information, together with device-verification identifiers, required to verify session and app integrity, protect the account and prevent abuse: App Attest on iOS; a security key generated on the device and the Google Play Integrity check on Android. The device record held on Android is derived from the public part of this key; no IMEI, advertising ID or device serial number is processed.

2.7.1. Use without an account. Barcode scanning, product viewing, search and discovery are also available without creating an account. Device verification still operates in this use: a device record is created and, on Android, an integrity token is sent to Google for decoding. For requests without an account, the network address is not stored in plain text; only a one-way hash of the address and network block is processed as a short-lived counter key to limit abuse, and these hashes are not used once you sign in.

2.7.2. Barcode scanning library (Android). The Android version uses Google's ML Kit library for barcode scanning; this library may send device and app diagnostic data to Google. Camera frames are processed on the device, and only the scanned barcode number is sent to the Klaris server. Klaris's own code does not use advertising or user-behaviour analytics SDKs.

2.8. Web newsletter records. Newsletter registration processes the email address, consent timestamp/version/scope, communication channel and registration source. To limit abuse, a one-way hash of the network address, not the address itself, is retained for no more than two hours.

2.9. Push notification data. The device notification token processed to send you app notifications comes from Apple's APNs infrastructure on iOS and Google's Firebase Cloud Messaging infrastructure on Android. The notification title and short text are sent to your device together with this token through the same infrastructure; these texts contain no personal data: they do not include your name, email address, formula or analysis information.

2.10. Skin/hair routine and plan data. Plans you create in the App, products and steps you add to a plan, the days and times you select, records of completed steps and your product inventory. These data are processed so that you can maintain your routine through your account; if you choose to receive reminders, the notification preference also falls under Article 2.9.

2.11. Purchase verification and Premium access status. The store processes your payment and card information; Klaris does not see it on either platform. Klaris processes only the transaction record verified by the store (the App Store on iOS, Google Play on Android) and your associated Premium access status; these are necessary to verify your subscription, restore it when you change devices and terminate access. On Android, only a random linking identifier generated for this purpose is sent to Google Play to match the purchase with your account; your name or email address is not sent.

Important note. Within cosmetic decision support, Klaris treats and processes your skin/hair axes, acne tendency, optional profile additions (allergens, pregnancy, fragrance sensitivity) and optional selfies as personal data of a general nature. None of these data are used for medical diagnosis, health assessment or biometric identification. The allergen, pregnancy and fragrance sensitivity fields are not excluded from this assurance; their only distinction is the legal ground: those fields are subject to a separate explicit-consent gate, stored in encrypted form and deleted from the server when consent is withdrawn.

Your personal data are processed for the following purposes:

• Producing personalised cosmetic analysis reports: providing a personalised assessment of the suitability of a product whose barcode you scan for the skin/hair profile you enter.
• Verifying ingredient-skin/hair suitability against scientific sources: producing a suitability assessment by comparing product ingredients with the scientific ingredient database and sources.
• Creating and managing your account: conducting sign-in securely (Sign in with Apple on iOS, Sign in with Google on Android), identifying your account and ensuring session security.
• Providing optional personal cosmetic tracking: enabling you, if you choose, to track your own cosmetic experience through a monthly selfie and skin diary.
• Processing optional profile additions: refining personalised product notes using only the allergen, pregnancy and fragrance sensitivity information you choose to share.
• Processing the optional acne tendency answer: tailoring comments about pore-clogging potential in product notes to your profile if you have answered.
• Providing Community and Twin feeds: enabling interaction with users who have the same Identity, at your chosen visibility level (your chosen Community display name, a system name containing no personal information or anonymous).
• Assessing user contributions: submitting your product contributions to administrator review and, if considered suitable, adding them to the database.
• Measuring app operation and resolving faults: processing app transactions and device and app diagnostic records to monitor correct service operation and identify and resolve errors.
• Communicating with you and, with your explicit consent, sending marketing messages: contacting you about your account, support and important updates; and, if you separately give explicit consent for this, emailing newsletters, useful content and campaign/promotional messages relating to Klaris's own products and services.
• Managing web newsletter consent and abuse limits: keeping a consent/refusal trail only for newsletter registration and limiting abuse through automated submissions.
• Delivering push notifications: sending you app notifications if you choose.
• Service security and legal obligations: ensuring the App's security, preventing abuse and fulfilling obligations arising from relevant legislation.

4.1. Method of collection. Your personal data are collected by fully automated means, electronically, through the Klaris mobile app and klaris.com.tr website, by means of the data you enter/upload to the App, your use of the App and your web newsletter registration (only if you subscribe).

4.2. Legal grounds (KVKK). Your data are processed on the following legal grounds, depending on the relevant data category:

• Performance of a contract (KVKK Article 5/2-c): data are processed because this is directly related to the conclusion and performance of the user agreement in order to provide the App's core services (account creation and management, skin/hair profile and acne tendency if answered, barcode scanning, personalised cosmetic assessment, Community and Twin, and the contribution process).
• Explicit consent (KVKK Article 5/1): the optional selfie + skin diary is initiated through a clear action (consent-by-action) when you begin using the relevant feature yourself (for example, choosing to take a selfie). You may withdraw your explicit consent at any time.
• Explicit consent (KVKK Article 5/1: push notifications): notification consent is obtained differently from selfie consent: by reading and approving a separate explanation within the App, before the device's permission prompt. These are two separate steps: if you do not grant device permission, no notifications are sent to you. On iOS, your device token is never processed if permission is not granted; on Android, a device record may be created after your in-app consent is recorded, but no notification is displayed without permission. When you withdraw consent, your device notification record is deleted.
• Explicit consent (KVKK Article 5/1: optional profile additions): when you select an allergen, pregnancy or fragrance sensitivity field, the App displays a separate explicit-consent screen specific to processing these profile preferences; without consent, these fields are never saved to the server. You may withdraw this explicit consent at any time; when you do, these fields are deleted from the server.
• Explicit consent (KVKK Article 5/1: web newsletter): applies only when the separate newsletter consent checkbox is selected. The consent text version and scope are stored with the registration.

Your skin/hair profile, optional profile additions and selfie data are not used for medical diagnosis, health assessment or biometric identification. The allergen, pregnancy and fragrance sensitivity fields are processed only through a separate explicit-consent gate under KVKK Article 5/1, stored in encrypted form and deleted from the server when consent is withdrawn.

5.1. Where app data are stored: Türkiye. Account, profile, content and image data in the Klaris mobile app are hosted and stored in Türkiye, on servers in Türkiye. All live (production) service systems, including the application server, database and product-image infrastructure, are located within Türkiye; this is the primary data processing and storage infrastructure in which your personal data are processed and stored.

5.2. Domestic transfers: data processor (hosting provider). The Türkiye-based hosting provider from which we obtain server services acts as a data processor under the KVKK, providing services only in accordance with our instructions and in a way that keeps the data in Türkiye.

5.3. Transfers of limited technical identifiers abroad (Apple and Google). Your limited technical identifiers may be transferred to servers abroad in Apple Inc. and Google LLC infrastructure to manage app sign-in securely (Sign in with Apple on iOS, Sign in with Google on Android), verify device integrity and subscriptions, and send you push notifications. By its nature, this transfer is minimal and:

• Sign-in provider transfers (Apple account identifier or Google account identifier) are necessary for the conclusion and performance of the contract initiated by the user and therefore rely on the user-initiated contract exception under KVKK Article 9.
• For push notifications (APNs on iOS, Firebase Cloud Messaging on Android), the notification payload consists of the device token and the notification title and short text; these texts do not include your name, email address, ingredient formula or any other personal data. This transfer relies on your explicit consent, and your device notification record is deleted when you withdraw consent.
• Device integrity and subscription verification on Android. The device integrity token is sent to Google for decoding, and your Premium subscription is verified through Google Play. These transfers are necessary to provide the service securely and operate your subscription; the purchase linking identifier sent to Google is randomly generated and contains no identity information.
• Barcode scanning library on Android. The Google ML Kit library used for barcode scanning may send device and app diagnostic data to Google as part of its operation. Camera frames are processed on the device; only the scanned barcode number is sent to Klaris servers.

Apart from this, your personal data are not transferred abroad without your explicit consent or a legal requirement.

5.4. The distinction between the website and newsletter. klaris.com.tr is served through Cloudflare's global infrastructure. During newsletter registration, email and consent records may also be processed outside Türkiye in Workers KV; this distinction is clearly stated in the registration form and Newsletter Privacy Notice. In-app user data are stored on servers in Türkiye.

The Klaris Newsletter contains informative content, selections from the Academy and Klaris updates. No more than two emails are sent each month. The separate subscription consent in the web form covers only this newsletter; it does not replace other permissions in the app. To unsubscribe, you can write to info@klaris.com.tr. Newsletter delivery will stop upon your request.

To deliver the newsletter, your email address is processed in the infrastructure of the email service provider we use. This processing is carried out to send you the Klaris Newsletter to which you have subscribed.

Cloudflare Web Analytics is used to assess site usage and page performance. Page and referring-page addresses, browser/device type, country-level information and performance measurements are processed. According to Cloudflare, the measurement script does not use cookies or browser storage and does not track visitors across sites. Processing may also take place outside Türkiye in Cloudflare's infrastructure.

Browser session storage is used to retain your example profile and Identity selections, Atlas search and return position within the same tab. These records are limited to the session and are not saved to a user account. In example analysis links, the selected product and example profile information form part of the address.

Your personal data are stored while your account is active and for as long as necessary to provide the service. Your data are retained until you submit an express deletion request.

When you submit a deletion request, it is fulfilled within 30 (thirty) days at the latest. You can submit your request by emailing kvkk@klaris.com.tr or using the in-app account deletion feature. (In-app account deletion is also part of the Apple App Store and Google Play requirements.)

Subject to statutory retention obligations, your data are deleted, destroyed or anonymised following your deletion request. Deleted data are removed from backups within 90 days at the latest; the scope and retention period of the limited recovery record kept if you choose subscription recovery before deletion on Android are set out on the account deletion page.

Under Article 11 of the KVKK, you have the following rights by applying to the data controller:

• Learning whether data are processed: to learn whether your personal data are processed.
• Requesting information: to request information if your personal data have been processed.
• Learning the purpose: to learn the purpose of processing your personal data and whether they are used in accordance with that purpose.
• Knowing third-party recipients: to know the third parties to whom your personal data are transferred within Türkiye or abroad.
• Requesting correction: to request correction of your personal data if they have been processed incompletely or incorrectly.
• Requesting deletion: to request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK.
• Requesting notification to third parties: to request that correction and deletion be notified to third parties to whom the personal data have been transferred.
• Objecting: to object to a result against you arising from the analysis of processed data exclusively through automated systems.
• Requesting compensation for damage: to request compensation if you suffer damage due to unlawful processing of your personal data.

You can submit requests concerning the rights listed above, together with information establishing your identity, through the following channels:

• Email: kvkk@klaris.com.tr.
• In the app: the in-app account deletion feature for account deletion requests.

Depending on its nature, your application will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest. However, if the process incurs an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

For your application to be assessed, your request must be clear and understandable and your identity must be verifiable. Your applications and the responses to them are sent through kvkk@klaris.com.tr and in-app channels by email; no additional postal/physical address is requested. If your request is not accepted, you will be informed of the reason by email.

The data controller takes appropriate technical and organisational measures under Article 12 of the KVKK to prevent unlawful processing of and access to your personal data and to ensure their safekeeping. These include encryption of data, logging of administrator access (access control / audit), protection against unauthorised access and carrying out legally required notification procedures in the event of a data breach.

This Privacy Notice may be updated from time to time in line with legislative changes or updates to our services. The current text is always published on klaris.com.tr. We inform you of significant changes within the App or by appropriate means. The effective date is stated in the details section of this notice; the date at the top of the page is the last-updated date.

Data controller: Mustafa Eren KOÇ · Contact: kvkk@klaris.com.tr · klaris.com.tr · Effective date: 5 October 2026.