Your Data, Our Promise.

Klaris is a cosmetic decision-support app for the Turkish cosmetics market. By scanning a product barcode, it assesses product ingredients against a scientific ingredient database and provides personalised cosmetic compatibility commentary based on the user's skin/hair profile. Klaris is not a medical product; its main activity is providing general product information.

Under the KVKK, the data controller is not a legal entity (company), but a natural person operating individually:

• Data controller: Mustafa Eren KOÇ (natural person / individual developer).
• Contact and application channel (KVKK): kvkk@klaris.com.tr.
• Website: klaris.com.tr.

Klaris is not a company / limited liability company / joint-stock company; the capacity of data controller belongs directly to the natural person named above.

Klaris follows the principle of data minimisation and processes only data necessary to provide the service. The categories of data processed are:

• Account and authentication data: these vary according to the platform on which you sign in. On iOS, the Apple ID identifier (Sign in with Apple sub / user identifier) and the email or private relay email Apple transmits if you choose to share it are processed; Apple offers the option to hide your real email address, and the choice is yours. On Android, Sign in with Google is used: we verify the identity token signed by Google and extract only your Google account identifier (sub), email address, whether Google has verified that address, and your first and last name. Although present in the token, your profile photo and language/region information are not collected; Klaris does not request access permission (OAuth) to your Google account or access Google services on your behalf. On both platforms, your first and last name are stored in your account record: on iOS, they come from the App only at first sign-in and only if Apple provides them (they are not verified); on Android, they are verified on the server because they arrive in the signed token. An automatic system name (handle) containing no personal information and, if you choose one, your Community display name are also processed.
• Skin/hair onboarding profile: the skin and hair profile preferences you create when first signing in to the App (for example, personal care preferences such as skin-type tendency, sensitivity, tendency to oiliness and hair type). This information is used to personalise product commentary.
• Optional profile additions: only the allergens, pregnancy information and fragrance sensitivity you choose to share. In the Klaris product contract, these are profile preferences that do not produce a medical diagnosis or health assessment. The field that directly changes product notes today is the ingredients you select; your fragrance sensitivity preference is stored in your profile and does not, by itself, change product comments in the current version. They may be left blank; when selected, they are not saved to the server without explicit consent.
• Optional date of birth and age: only if you choose to fill in the field, the date of birth you enter and the age calculated from it are processed with your profile; if you leave it blank, neither is sent. Age is used to establish the age-related context of product commentary.
• Optional acne tendency: if you answer "Do you have a tendency to acne?" in the profile questionnaire, your chosen answer (none, rarely or often) is processed with your profile; if you leave the question blank, it is not sent. Its purpose is to tailor comments about pore-clogging potential in product notes to your profile; in the current version, your answer is stored in your profile, but product comments do not yet change according to it. It is a cosmetic profile preference; it is not subject to an explicit-consent gate and relies on the same legal ground as your skin/hair profile.
• Optional selfie and skin diary: your monthly selfie photo and skin diary notes, which are entirely optional, skippable and may be discontinued at any time. This feature is only for your own personal cosmetic tracking; it is a secondary feature offered to help you track changes in your skin's appearance over time. The selfie feature is not a medical diagnostic tool; no biometric identification is performed from your face. The photo is stored only for your visual tracking.
• Usage content data: your scan history and favourites (products you scan and save); product information, photos and texts you send us through the "Add / Complete Product" process (subject to administrator review); and comments, posts and profile information you share in Klaris Community and the "Skin Twin / Hair Twin" features. You may participate in the Community with your chosen Community display name, a system name containing no personal information if you have not yet chosen a name, OR completely anonymously; this is your choice. Your real name and email received from the sign-in provider (Apple on iOS, Google on Android) are not displayed in the Community. The author name used when a post is created is stored on that post; later name changes do not retrospectively change author names on earlier posts.
• Skin/hair routine and plan data: plans you create, products and steps you add to a plan, the days and times you select, records of completed steps and your product inventory. These data are processed so that you can maintain your routine through your account; if you choose to receive reminders, the notification preference also falls under the push-token item below.
• Purchase verification and Premium access status: the store processes your payment and card information; Klaris does not see it on either platform. Klaris processes only the transaction record verified by the store (the App Store on iOS, Google Play on Android) and your associated Premium access status; these are necessary to verify your subscription, restore it when you change devices and terminate access. On Android, only a random linking identifier generated for this purpose is sent to Google Play to match the purchase with your account; your name or email address is not sent.
• Device and technical security data: limited device/app version and session information, together with device-verification identifiers, required to verify session and app integrity, prevent abuse and protect the account: App Attest on iOS; a security key generated on the device and the Google Play Integrity check on Android. The device record stored on Android is a pseudonymous identifier derived from the public part of this key; it is not an IMEI, advertising ID or device serial number, and these identifiers are never requested from the App. In the Play Integrity check, the device integrity token is sent to Google for decoding; we retain only the verification result, not the token's contents.
• Use without an account: you do not need to create an account for barcode scanning, product viewing, search or discovery; however, device verification still operates, meaning that the device record above is created and, on Android, the integrity token is sent to Google. For requests without an account, your network address is not stored in plain text: only a one-way hash of the address and network block is processed as a counter key retained for no more than a few days to limit abuse. These network hashes are not used at all when you sign in.
• Barcode scanning library (Android): the Android version uses Google's ML Kit library for barcode scanning, and this library may send device and app diagnostic data, including installation and device identifiers, to Google. Klaris's own code does not use a separate crash analytics, behavioural analytics or advertising SDK on either platform.
• Device notification (push) token: a technical identifier enabling the device to receive notifications, processed only if you enable push notifications; it comes from Apple's notification infrastructure (APNs) on iOS and Google's (Firebase Cloud Messaging) on Android. The notification title and short text are sent to your device together with this token through the same infrastructure; these texts contain no personal data: they do not include your name, email address, profile, formula or analysis information.
• Web newsletter and abuse-limit data: During newsletter registration, email address, consent timestamp/version/scope, channel and source; to limit automated abuse, a one-way hash of the network address, rather than the address itself, retained for no more than two hours.

Skin/hair axes, acne tendency, optional profile additions, selfies and the skin diary are not used for medical diagnosis, health assessment or biometric identification. The allergen, pregnancy and fragrance sensitivity fields are processed through a separate explicit-consent gate under KVKK Article 5/1, with encrypted storage, access logging and deletion rules.

We process your personal data only for the purposes matched below:

• Account and authentication: creating your account, enabling secure sign-in (Sign in with Apple on iOS, Sign in with Google on Android) and protecting account security.
• Skin/hair onboarding profile: personalising product compatibility commentary according to your profile.
• Optional profile additions: refining personalised product notes using only the allergen, pregnancy and fragrance sensitivity information you choose to share.
• Optional acne tendency: tailoring comments about pore-clogging potential in product notes to your profile if you have answered.
• Scan history and favourites: enabling access to your past scans and saved products.
• Optional selfie and skin diary: recording changes in your skin's appearance for your own tracking (only when you initiate it).
• Product contributions: enriching the product database and subjecting your contribution to administrator review.
• Community content / Twin: bringing together users with the same skin/hair profile and providing a community experience.
• Device notification (push) token: sending you push notifications, only if you have given approval within the App and your device's notification permission is enabled.
• Technical security data: verifying session security and app integrity and preventing abuse.
• Usage and diagnostic records: measuring whether the App functions correctly and resolving faults and errors.
• Web newsletter: The Klaris Newsletter contains informative content, selections from the Academy and Klaris updates. No more than two emails are sent each month. The separate subscription consent in the web form covers only this newsletter; it does not replace other permissions in the app. To unsubscribe, you can write to info@klaris.com.tr. Newsletter delivery will stop upon your request.

Klaris does not use or share your personal data for advertising profiling, sale to third parties or marketing.

Klaris processes your personal data only on the following legal grounds:

• Performance of a contract: KVKK Article 5/2-c. The service's core functions, such as your account, authentication, skin/hair profile (including acne tendency if answered), scan history, favourites, product contributions and community features, are necessary for the establishment and performance of the usage relationship (contract) between you and us and rely on this legal ground.
• Explicit consent. Consent for the optional selfie and skin diary is given when you initiate the feature: taking the optional selfie means you give explicit consent for that feature; if you do not want to take it, you may skip it by choosing "Take Later". Your pregnancy answer (other than "Prefer not to say"), selected allergens and "I am sensitive to fragrance" answer are considered sensitive: if any of these are to be saved, the App also shows an explicit-consent checkbox, and without consent your profile is not saved. The answer "I have no problem with fragrance" and selecting no allergens are not considered sensitive; these are saved without requesting consent. "Prefer not to say" is never sent to the server. You may withdraw your consents at any time.
• Explicit consent for push notifications: KVKK Article 5/1. Notification consent is obtained through a separate approval step within the App and before the device's permission prompt; these are two separate steps. You receive notifications only if both you have given approval within the App and your device notification permission is enabled. On iOS, while iPhone permission is disabled, your device token is never processed; on Android, a device record may be created after your in-app consent is recorded, but no notification is displayed if you have not granted permission. On both platforms, when you withdraw consent, your device notification record is deleted.
• Explicit consent for the web newsletter: KVKK Article 5/1. Applies only with separate newsletter consent. Registration is open; the consent text version and scope are stored with the registration.

Important: Klaris's primary activity is providing general product information. Your skin/hair profile and optional selfie and skin diary are not used for medical diagnosis, and no biometric identification is performed from your face. The allergen, pregnancy and fragrance sensitivity fields are separate from this general statement and are behind the explicit-consent gate.

Klaris retains your personal data until you make an express deletion request, because the service providing continuous access to your historical data (favourites, profile, skin diary, community content) is a natural part of the usage relationship.

• When you wish to delete your account or request deletion of your data, your request is fulfilled within 30 days at the latest.
• Deletion requests may be submitted via kvkk@klaris.com.tr or the in-app account deletion option (in-app account deletion is a feature required by both Apple and Google). For step-by-step instructions and details of deleted and retained data, see the Deleting Your Klaris Account page.
• The minimum technical records that must be retained to meet our legal obligations (for example, limited records for security and fraud prevention) may be retained for the applicable legal period.
• Your product contributions (after deletion): the product photos and product information (brand, product name, barcode, category) you add through the "Add / Complete Product" process are product data that do not identify you. When you delete your account, these contributions may continue to be retained, with their link to you removed (anonymised), to maintain and improve the product database's accuracy; however, the personal free-text notes and personal images (selfies / skin diary) you added are deleted/destroyed.
• Limited records remaining after deletion. Deleted data are removed from backups within 90 days at the latest. If you choose subscription recovery before deleting your account on Android, a limited recovery record is retained so that you can recover your subscription with the same Google account; this record may identify you, is deleted when its retention period expires and is never created if you do not choose recovery. Which data remain and for how long are listed on the Deleting Your Klaris Account page.

Klaris does not sell, rent or share your personal data for marketing purposes. Your data are not shared with third parties except in the limited situations below, necessary for the technical provision of the service.

• App hosting: Türkiye. Account, profile, content and image data in the mobile app are hosted in Türkiye, on servers in Türkiye. The hosting company providing server services acts as a data processor under the KVKK, providing services only in accordance with our instructions and on the basis that the data remain in Türkiye.
• Sign-in provider (abroad). The service enabling you to sign in to your account (Sign in with Apple on iOS, Sign in with Google on Android) is necessary to establish the contractual relationship you initiate at your request and is therefore a limited transfer under the contract-related exception in KVKK Article 9; within this scope, your Apple ID identifier may be transferred to Apple Inc. infrastructure and your Google account identifier to Google LLC infrastructure.
• Push notifications: APNs and FCM (abroad). The notification infrastructure (Apple's APNs service on iOS, Google's Firebase Cloud Messaging service on Android) carries the device token and the notification title and short text; your name, formula information or other personal data are never included in the notification text. This transfer relies on your explicit consent; when you withdraw consent, your device notification record is deleted and the transfer stops.
• Device integrity and purchase verification: Google (Android, abroad). In the Android version, the device integrity token is sent to Google for decoding, and your Premium subscription is verified through Google Play. These transfers are necessary to provide the service securely and operate your subscription; the purchase linking identifier sent to Google is randomly generated and does not contain your name or email address.
• Barcode scanning library: Google ML Kit (Android, abroad). The Android version uses Google's ML Kit library for barcode scanning; the library may send device and app diagnostic data to Google. Camera frames are processed on your device, and only the scanned barcode number is sent to the Klaris server.
• Website and newsletter (Cloudflare). The site is served through Cloudflare's global Pages infrastructure. During newsletter registration, email/consent records may also be processed outside Türkiye in Workers KV.
• To deliver the newsletter, your email address is processed in the infrastructure of the email service provider we use. This processing is carried out to send you the Klaris Newsletter to which you have subscribed.
• Cloudflare Web Analytics is used to assess site usage and page performance. Page and referring-page addresses, browser/device type, country-level information and performance measurements are processed. According to Cloudflare, the measurement script does not use cookies or browser storage and does not track visitors across sites. Processing may also take place outside Türkiye in Cloudflare's infrastructure.
• Browser session storage is used to retain your example profile and Identity selections, Atlas search and return position within the same tab. These records are limited to the session and are not saved to a user account. In example analysis links, the selected product and example profile information form part of the address.

Apart from this, your personal data are not transferred to any third party unless there is a legal requirement (for example, a lawful request from competent public authorities).

In-app user data and the website are separate layers. The commitment to storage in Türkiye applies to the app layer; the express transfer terms above apply to the web newsletter.

Klaris applies reasonable technical and organisational measures to protect your personal data. These include:

• Encryption in transit and at rest: communication between the server and the App is encrypted; user data such as selfies and skin diaries are stored in encrypted form on the server.
• Access control and audit logging: access to user data is restricted through authorisation (RBAC), and administrator access is audit-logged.
• Data minimisation: the App collects only necessary data; the entire ingredient database is not downloaded to the device.
• Notification security: the push notification payload consists of the technical identifier enabling the device to receive the notification, along with the notification title and short text; it does not carry your name, email address, product formula or analysis information.
• Breach procedure: in the event of a personal data breach, a response procedure is applied to notify the Personal Data Protection Board within 72 hours under KVKK Article 12 and to notify affected users.

We remind you that no system is 100% secure; however, we exercise the necessary care to protect your data.

Under KVKK Article 11, you may exercise the following rights by applying to the data controller:

• To learn whether your personal data are processed.
• To request information if they have been processed.
• To learn the purpose of processing and whether they are used in accordance with that purpose.
• To know the third parties to whom your personal data are transferred within Türkiye or abroad.
• To request correction if they have been processed incompletely or incorrectly.
• To request deletion or destruction under the conditions set out in the KVKK and relevant legislation.
• To request that correction, deletion and destruction be notified to third parties to whom the data have been transferred.
• To object to a result against you arising from the analysis of processed data exclusively through automated systems.
• To request compensation if you suffer damage due to unlawful processing of your personal data.

You may apply by sending your requests to kvkk@klaris.com.tr. Account and data deletion requests may also be made through the in-app account deletion feature. After your identity has been verified (an identity-verification step may be applied for your account's security), your application will be concluded free of charge within 30 days at the latest.

Klaris is available to users of all ages and does not carry out age-based verification. Users who are minors (under 18) are expected to use the App with the knowledge and supervision of a parent or guardian; information provided is processed under this Policy. If we discover that data belonging to a minor have been processed without parental/guardian consent, we act in accordance with the relevant legislation.

You may delete your account and associated personal data at any time:

• Within the app: using the account deletion option on the Account screen (a feature required by both Apple and Google). For the steps, see the Deleting Your Klaris Account page.
• By email: by sending a request to kvkk@klaris.com.tr.

After identity verification, your deletion request will be fulfilled within 30 days at the latest. After deletion, your data are removed from our systems except for the minimum technical records that must be retained by law.

Klaris may update this Privacy Policy in line with legislative changes or development of the service. The current version is always published on klaris.com.tr, with its effective date stated at the beginning of the text. You may be informed of significant changes through an in-app notification. Continuing to use the App after a change means that you accept the updated Policy.

For any questions, requests or applications concerning this Privacy Policy, the processing of your personal data or your KVKK rights:

• Data controller: Mustafa Eren KOÇ (natural person).
• Email: kvkk@klaris.com.tr.
• Website: klaris.com.tr.