🔒 Privacy Policy

Last updated: 1 August 2026

1. Introduction & Data Controller

This policy explains which data Evlek ("we", "our") processes when you use evlek.app, why it is processed, and who may receive it. Processing is assessed primarily under the TRNC Personal Data Protection Law (89/2007). The territorial application of the GDPR, UK GDPR, Türkiye's KVKK or another regime depends on the relevant activity and data flow; it is not assumed from a user's nationality alone. Data Controller: Entity: Evlek — Sole Proprietorship Address: Karaman Mahallesi, Harbiye Sokak, Mustafa Ciddi İş ve Yaşam Merkezi, G Blok, Girne, KKTC Phone: +90 533 844 40 84 Email: hello@evlek.app Platform: evlek.app

2. Data We Collect

We collect the following data when you use our platform: • Account information: Email address, full name, password (stored encrypted) • Listing information: Property details, photos, price, location, contact details (phone, WhatsApp, Telegram) • Usage data: Page visits, search queries, favorites lists • Technical data: IP address, browser type, device info, cookies • Communication data: Messages sent through the contact form • Identity and professional authority documents: Identity-card, passport or driving-licence images supplied with an agent application, plus KTEB, Estate Agent Registry, current annual-permit and business-authority evidence. Selfies are not collected; biometric facial matching and AI document/OCR review are disabled. Authorized personnel review the documents manually • Phone and contact data: Phone number (E.164 format), WhatsApp number — for SMS phone verification and agent contact records • Subscription data: Apple IAP/Google Play purchase records, plan information, subscription status

3. How We Use Your Data & Legal Basis

The purpose and legal basis depend on the feature you use. Evlek requests consent where required; account and service operations may be necessary to enter into or perform a contract, security and abuse prevention may rely on legitimate interests, and tax or accounting records may be required by law. Any additional notice is shown before the relevant data is collected. Purposes of use: • Creating and managing your account • Providing listing publishing and management services • Personalizing your experience (language preference, favorites) • Assisting you via AI assistant (see AI Disclosure section below) • Security and fraud prevention • Fulfilling legal obligations • Analyzing and improving platform performance

4. Artificial Intelligence (AI) Assistant & Third-Party AI Services

The Evlek platform uses third-party AI services to provide AI features. This section contains mandatory disclosure per Apple App Store Guideline 5.1.2(i). AI Services Used: • Google Gemini 2.5 Flash-Lite (Google LLC) — large language model (LLM) for the chatbot assistant, AI search help, and listing-text suggestions • Google Gemini 2.5 Flash (Google LLC) — for visual analysis of listing photos (photo-AI) only • Biometric identity verification and AI/OCR professional-document review are disabled. Identity and professional-authority documents are not sent to Google Gemini or OpenAI in the active verification flow; authorized personnel review them manually • Active AI service endpoint: generativelanguage.googleapis.com • Google's AI Privacy Policy: https://ai.google/responsibility/privacy/ Data sent to the chatbot / search assistant: • ✅ Text content of your chat message or search query • ✅ Your selected language preference (TR/EN/RU/DE/AR) • Evlek does not intentionally add your name, email, phone, precise device location or payment information to the model request • Personal information that you type into the message field becomes part of your query. Do not enter sensitive information, identity documents or payment details Listing-text assistant: To generate a listing title/description, the structural listing fields you enter (property type, room count, city, district, area, features, price, currency) and your free-text note are sent to the Google Gemini API. The generated title and description are suggestions only; you review, edit, and approve them before publishing. Do not add sensitive or personal data to the free-text field. AI processing of listing photos: Evlek may send a downscaled copy of an uploaded listing photo to the Google Gemini API for caption and tag suggestions, visual-quality assessment, and duplicate-listing detection. The original photo is not altered. Generated results are suggestions and remain subject to human review before publication. The provider handles submitted data under its current service terms and privacy materials. To object or request deletion, write to hello@evlek.app. AI Data Processing Principles: • Chatbot messages and generated replies may be logged where needed for security, abuse prevention, and support • Provider-side processing and retention depend on the provider's current terms and Evlek's active configuration • A consent screen explains the data sharing before the chatbot is used • The AI assistant is for general information only and does not constitute legal or financial advice • AI replies may contain errors; verify important information through independent sources

4b. Verification & Personal Data Processing

Only registered property businesses whose professional eligibility has been checked, and authorized users attached to the same business, may publish listings on Evlek. Before publication, Evlek checks the profile, SMS-verified phone, saved WhatsApp number, manual identity/authority review, active professional status, and available listing allowance. A moderator also reviews each listing before it goes live. Document-based identity and authority review: • Requested identity and professional-authority documents are collected after the notice shown at submission and, where required, consent. • Selfies are not collected; biometric facial matching is disabled. • AI/OCR professional-document analysis is disabled. Authorized personnel manually review KTEB, Estate Agent Registry, current annual-permit, and business-authority evidence. • Retained information includes application status, review records, and the verification documents supplied by the user. Data Retention & Deletion: • Users may request deletion of their verification documents by emailing hello@evlek.app. Where legal or security retention duties apply, the request is handled subject to those obligations. Legal Basis: The applicable basis depends on the document and review purpose and is shown before upload; consent is requested where required.

4c. Phone Verification & WhatsApp Number

SMS phone verification and agent WhatsApp number records are provided for platform security and contact accuracy. Service Provider: • Twilio Inc. — Twilio Verify API • Twilio Privacy Policy: https://www.twilio.com/legal/privacy Data Processed: • Phone number (E.164 format, e.g., +905XXXXXXXXX) • WhatsApp number (agent profile contact record) • Verification code (6-digit OTP — single use) Data Processing Principles: • OTP codes are single-use and automatically expire after 10 minutes • The phone number and verification data are sent to Twilio to deliver the code and return the verification result; provider-side processing is subject to Twilio's current privacy terms • Verification result (success/failure) is stored in the Evlek database • Users can update their verified number from profile settings Legal Basis: Legitimate interest (platform security) and contractual obligation.

4d. In-App Purchases & Subscriptions

New paid publisher-plan purchases and upgrades are closed until the written legal and official review is complete. Apple App Store, Google Play and RevenueCat data may still be processed to reconcile and manage subscriptions that were established previously. Payment Processing: • All payment transactions are processed by Apple/Google • Evlek does not see or store your credit card number, bank account details, or payment specifics • Subscription management is provided through RevenueCat Inc. • RevenueCat Privacy Policy: https://www.revenuecat.com/privacy Subscription Data Retained: • Plan or product identifier • Subscription status (active, cancelled, expired) • Subscription source (Apple IAP, Google Play, admin gift, application approval) • Start and end dates Existing subscribers: • Cancellation, renewal and store-based refund rights are managed through the relevant store account and mandatory consumer rules. • The free beta does not convert to a paid plan without separate, clear acceptance. Legal Basis: Contractual obligation and legitimate interest.

4e. Service Providers & International Data Flows

Depending on the feature you use, the following service providers may process data: • Supabase — database, authentication and file storage (infrastructure) • Vercel — web hosting and technical delivery • Twilio Inc. — SMS verification code (OTP) delivery • Resend — transactional email delivery (confirmation, password reset, notifications) • Google (Gemini) — chatbot, search help, listing-text assistance and listing-photo analysis • Mapbox — map and location visualisation • RevenueCat / Apple / Google — subscriptions and in-app purchases • Upstash and Sentry — rate limiting, error monitoring and security operations • Google Analytics and Vercel Analytics — measurement subject to consent and configuration International data flows: Some providers may use infrastructure outside TRNC. Any required permission, contract or other transfer safeguard depends on the data, destination and specific flow. Contact hello@evlek.app for current provider or transfer information.

5. Data Storage and Security

Evlek uses technical and organizational controls intended to reduce unauthorized access and loss. No internet service can guarantee absolute security. • Database: Supabase (PostgreSQL) — encrypted connections, row-level security (RLS) • File storage: Supabase Storage — secure access controls • Web hosting: Vercel — automatic SSL/TLS encryption, DDoS protection • Authentication: Passwords are not stored as plain text in the Evlek application database; sessions are managed with access tokens

6. Data Retention Periods

Data is retained for as long as reasonably needed to provide the account and service, preserve security or dispute records, and meet legal or accounting duties. The period varies by data category, account and listing status, potential disputes, and applicable obligations. After an account or content is deleted, limited data may remain temporarily in backups or be retained for security, fraud prevention, legal claims, or mandatory records. To ask about the retention or deletion of a specific data category, contact hello@evlek.app.

7. Data Sharing

We do not sell your personal data. It may be shared in the following limited cases: • Service providers: For the infrastructure, communications, maps, AI, measurement and subscription purposes described in this policy • Legal requirements: Court orders or legal regulations • Listing visibility: Contact info in your listings (phone/WhatsApp/Telegram) is visible to other users — you choose to share this info

8. International Data Transfers

Depending on the feature used, data may be processed on infrastructure outside TRNC. The destination, provider and purpose can vary; any applicable permission and safeguard is assessed for the specific data flow. Contact hello@evlek.app for current information or to object.

9. Cookies

Our platform uses the following cookies: • Essential cookies: Session management, language preference — required for platform functionality • Measurement cookies/technologies: Usage events and technical identifiers, subject to consent and active configuration You can disable cookies through your browser settings, but some features may not work properly.

10. Your Rights

Depending on the applicable law and circumstances of the request, you may have rights to: • Request access to your personal data • Request correction of inaccurate data • Request deletion of your data • Object to data processing • Request data portability To exercise these rights, email us at hello@evlek.app.

11. Children's Privacy

Our platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

12. Policy Changes

We may update this policy from time to time. When significant changes occur, we will notify you through platform announcements or email.

13. Contact

For questions about our privacy policy: Email: hello@evlek.app Web: evlek.app/contact