KVKK Privacy Notice and Explicit Consent Statement
Under Article 10 of the Turkish Personal Data Protection Law No. 6698 and the Communiqué on Procedures and Principles for Fulfilling the Obligation to Inform · Last updated: October 8, 2026 · Version 2026-10 · The Turkish text prevails
This text is a privacy notice: it explains how your data is processed and does not ask for consent to those operations. Only for the optional operations listed in Section 8, which legally need explicit consent, do we ask for your consent separately on the relevant screen. For details see the Privacy Policy.
1. Identity of the data controller
Company: We Do Global Ltd · Address: halfreal.wtf
Company number (Companies House): 14424600 · ICO: [ICO no.] · Türkiye representative: [Representative] · VERBIS: [Status]
Email: [email protected]
2. Personal data processed
- Identity / account: nickname, account ID, email address (Google sign-in), country and language preference.
- Visual data: photos you upload, generated avatar/item images (which may contain a facial image).
- Customer transaction / finance: purchases, coin/diamond and trade movements, payout and Partner transactions, payment method and payment/payee details (card details are not kept by us).
- Transaction security: IP address, anonymised device identifier, device/platform/version, root/emulator information, sign-in records, security alerts and sanction records.
- Communication and content: chat, room and private messages, media, reports and support correspondence.
- Voice: live voice stream (not recorded); text produced from speech fragments where enabled.
- Marketing / notifications: push token and preferences.
- Usage: in-app events, progress, error and performance logs.
- Legal process and compliance: disputes, objections, requests from authorities and related correspondence.
3. Purposes of processing
Carrying out membership and account operations; providing game, chat, voice, mini-game and trading services; managing payment, refund and payout processes; preventing information security incidents, fraud, cheating and abuse; moderation and user safety; handling requests, complaints and objections; meeting requests from authorities and other legal obligations; reporting suspected crime and unlawfulness to the relevant authorities; establishing, exercising and protecting rights; improving the Service and statistics; and (if you permit) sending notifications and commercial electronic messages.
4. Legal bases
Under KVKK Art. 5/2: (a) expressly provided by law, (c) establishment or performance of a contract, (ç) compliance with a legal obligation, (e) establishment, exercise or protection of a right, (f) legitimate interest, provided it does not harm the fundamental rights and freedoms of the data subject. For operations needing explicit consent Art. 5/1 and, for special categories, Art. 6 apply.
5. Recipients and purposes of transfer
| Recipient group | Purpose |
|---|---|
| Infrastructure and hosting providers (Supabase, Cloudflare) | Technical delivery, storage, real-time communication, speech-to-text |
| Payment providers and app stores (Stripe, Google Play, Apple App Store) | Taking payments, refunds, fraud prevention |
| Authentication provider (Google) | Sign in with Google |
| AI providers (OpenRouter and the model providers behind it) | Avatar/item image generation, content checks |
| Notification services (FCM, APNs) | Push notifications |
| The other party of a transaction and other users | Carrying out a user-to-user transaction and social interaction (nickname, transaction information, payment details you shared) |
| Legal, accounting and audit advisers | Legal and financial obligations |
| Competent public bodies (courts, prosecutors, law enforcement, BTK, MASAK, the KVKK Board etc.) | Legal obligations; reporting suspected crime, fraud or unlawfulness; protecting rights |
Transfers to recipients abroad are made with the safeguards in KVKK Art. 9 and related legislation (see Privacy Policy Section 10).
6. Method of collection
Your data is collected electronically through the mobile app and website, by automatic and partly automatic means: information you enter, technical data obtained from your device and use, information from sign-in/payment providers, and other users' reports.
7. Your rights as a data subject (KVKK Art. 11)
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used accordingly,
- Know the third parties it is transferred to in Türkiye or abroad,
- Request correction if incomplete or incorrect,
- Request deletion or destruction under KVKK Art. 7,
- Request that correction, deletion and destruction be notified to the third parties the data was transferred to,
- Object to a result against you arising from analysis exclusively by automated systems,
- Claim compensation if you suffer damage from unlawful processing.
How to apply: send a written application containing your name, surname, (if any) nickname, contact details and the subject of your request, under the Communiqué on Procedures and Principles of Application to the Data Controller, to the postal address above, our KEP address or [email protected]. Requests are answered free of charge at the latest within thirty days; if the operation needs extra cost, the fee in the Board's tariff may be charged. If you are not satisfied you can complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of applying. The exceptions in KVKK Art. 28 are reserved.
8. Optional operations that need explicit consent
The operations below rest on consent you give separately, on the relevant screen, only when you use the related feature. Not giving consent does not stop you from using other parts of the Service, and you can withdraw consent at any time.
- Processing a photo containing a face for AI avatar/item generation and transferring it to AI service providers (abroad).
- Push notifications (with device permission).
- Commercial electronic messages (separate approval under Law No. 6563).
- Where the law requires explicit consent: transfer abroad and voice/speech processing.
The checkbox on the app's sign-up/sign-in screen confirms that you have read the User Agreement and this notice; separate approval is obtained for the operations above that need explicit consent. The version and time of your confirmation are kept as evidence.