SIMPLE PIN PRIVACY POLICY

Last updated: 1 October 2026

1. INTRODUCTION

Protecting your personal data and your privacy is a priority for us, and we apply the rules on the protection of personal data carefully in our day-to-day operations.

This Privacy Policy explains, for the Simple Pin mobile application and website, what data we process about you and for which purposes, the legal grounds we rely on, whom we share it with, and how you can exercise your rights. Please read it carefully before you start using the app.

In this text, "Simple Pin", "we" and "us" refer to GRUP2B İNŞAAT SANAYİ DIŞ TİCARET LİMİTED ŞİRKETİ, the owner of the application and the data controller.

2. WHO IS THE DATA CONTROLLER?

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is the party that determines the purposes and the means of processing your personal data.

Data controller:
GRUP2B İNŞAAT SANAYİ DIŞ TİCARET LİMİTED ŞİRKETİ
Email: yazilim@group2b.com

3. WHAT DATA DO WE PROCESS?

We collect the minimum data required for you to be able to use all features of the application.

3.1. Account and profile data

  • Your name and surname, username, email address and your password (passwords are stored in an irreversibly hashed form).
  • The name and email address that Google or Apple pass on to us when you sign in with those providers. If you choose to hide your email address when signing in with Apple, we only receive the relay address generated by Apple.
  • Information you optionally add to your profile, such as your profile photo, biography, school, website and social media links.
  • Your app preferences: language, map appearance, pin size, notification preferences, and whether your profile is public.
  • If you enable two-step verification on your account, the secret key paired with your authenticator app.

3.2. Content data

  • The places you save (pins) and their location information, their status such as been there / want to go / recommendation, and whether they are marked private or public.
  • The lists, tags and categories you create, and the names, icons and colors you give them.
  • The photos and videos you add to places, together with your ratings, comments and review texts.
  • Likes, saves and your other interactions in the feed.
  • Place lists you import through a Google Maps data export, and the links you share into the app (YouTube videos, Google Maps links).

3.3. Location data

  • Precise location. With your permission, your device's location (GPS-level, precise location) so that we can open the map around you, list places near you and save your pins at the correct coordinates.
  • Background location. When you set a proximity alarm for a place, background location so that we can send you a notification even when the app is closed or running in the background. The details of this permission are explained in section 6.
  • Approximate location. The approximate region derived from the IP address of the requests you make to our servers, used for security and abuse prevention.

Granting location permission is optional, and location permission can be withdrawn at any time in your device settings. We do not sell your location data, and we do not use it for advertising.

3.4. Camera, photo library and microphone

  • When you add a photo or a video to a place or to your profile, we access your camera and/or your photo library with your permission. Only the media you select is uploaded to our servers; we do not browse or upload the rest of your gallery.
  • When you record a video review inside the app, your microphone is used to capture the sound of that video. We make no other use of your microphone and we never record audio in the background.

3.5. Social interaction data

  • The accounts you follow, your followers, follow requests and shared-list invitations.
  • Your conversations with other users and the content you share in messages.
  • The users you block, the reports you submit and your report descriptions.

3.6. Device and usage data

  • Device model, operating system version, app version and device language.
  • Your device's push notification token, so that we can send you notifications.
  • The IP address and the server logs generated by the requests made to our servers.
  • Measurement data such as which screens are used and how often which features are run.

Simple Pin does not display advertising. It does not read the advertising identifier (AAID / IDFA), it performs no advertising measurement, and we explicitly remove the advertising ID permission from the Android build.

3.7. Subscription data

When you purchase a Simple Pin Premium subscription, the payment is processed by the Apple App Store or Google Play. We never have access to your credit card or payment details; we only receive the purchase record, the product identifier and the subscription status that confirm whether your subscription is valid.

3.8. Support correspondence

When you contact us by email, the message you send, your contact details and the information required to resolve your request.

4. FOR WHICH PURPOSES DO WE PROCESS YOUR DATA?

  • To let you create an account, sign in, and to keep your account secure.
  • To let you pin, list and tag the places you are interested in on the map.
  • To show you places near you and recommendations in the city you are in.
  • To let you add and follow friends, share places and exchange messages.
  • To recognise the places in the links you share and let you add them to your map.
  • To send interaction and proximity alarm notifications according to your notification preferences.
  • To verify your Simple Pin Premium subscription and apply your subscription entitlements.
  • To answer your questions and resolve your support requests.
  • To review reported content, prevent abuse and fake accounts, and enforce our community rules.
  • To fix errors in the app, measure its performance and improve our service.
  • To inform you about Simple Pin news and offers, to the extent you have consented.
  • To produce statistics and understand how the app is used.

5. ON WHICH LEGAL GROUNDS DO WE RELY?

Our processing is primarily based on the contract established between us through the Terms of Use that you accepted when you first created your account (KVKK art. 5/2-c: necessity for the conclusion or performance of a contract; GDPR art. 6(1)(b) for users in the European Union).

In addition:

  • To comply with our legal obligations (KVKK art. 5/2-ç; GDPR art. 6(1)(c)), for example keeping the records required by law.
  • For our legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)), for example preventing fraud and abuse, keeping the service secure and improving the app.
  • On the basis of your explicit consent (GDPR art. 6(1)(a)), for example when you grant location permission, allow notifications or accept marketing messages. You can withdraw a permission you have given at any time.

6. LOCATION DATA AND PROXIMITY ALARMS

You are not obliged to grant location permission; if you do not grant it, you can continue to use most of the app by panning the map manually.

Location permission granted while the app is open is used to move the map to where you are, to search for places nearby and to save your new pin at the correct coordinate.

When you set a proximity alarm for a place, we ask for background location permission so that we can alert you even when the app is closed. In that case your location is evaluated on your device; only the definition of the alarm (which place and which radius) is stored on our servers. We do not collect or store your location history, and we do not sell location history to third parties. Background location use ends when you delete the alarm or withdraw location permission from your device settings.

7. PUBLIC CONTENT

Simple Pin is a social application. Your profile, your public pins, lists, comments and ratings can be seen by other users; when you create a share link, the content becomes accessible to anyone who has that link.

You can make your profile private, and you can mark your pins and lists as private individually. Your private content does not appear in the feed or on other users' maps.

8. WHOM DO WE SHARE DATA WITH?

We do not sell your personal data. Simple Pin's business model does not rely on selling your data to third parties. The people who can access your data are our employees assigned to operate the application; all of our employees are bound by confidentiality obligations.

In order to provide the service, we work with the following service providers (data processors):

  • Server, database and file hosting: our cloud infrastructure provider, and Cloudflare as content delivery network (privacy policy)
  • Maps, place search and place information: Google Maps Platform and Google Places (privacy policy)
  • Map tiles: CARTO (privacy policy)
  • Recognising places in shared videos: YouTube Data API and Google Gemini (privacy policy)
  • Analytics: Google Firebase Analytics (privacy policy)
  • Notification delivery: Expo Push Notification service (privacy policy), Apple Push Notification service and Firebase Cloud Messaging
  • Account verification and informational emails: Brevo (privacy policy)
  • Subscriptions and payments: Apple App Store (privacy policy) and Google Play (privacy policy)

Only the data required by the relevant function is transmitted to these providers. For example, during map and place search the text you search for and the coordinate used for the proximity search are transmitted to Google; when a notification is sent, your device's notification token and the notification text are transmitted to the notification services.

In addition, we may share your data with competent authorities to the extent necessary to respond to duly submitted requests of legally authorised public institutions, to protect our rights, or to ensure the safety of our users.

We may anonymise and aggregate information about places and tags, in a way that does not reveal your identity, in order to produce usage statistics.

9. INTERNATIONAL TRANSFERS

Some of the service providers listed above have servers outside Türkiye (primarily in the European Union and the United States of America). Personal data is therefore transferred abroad to the extent necessary to provide the service.

These transfers are carried out under KVKK art. 9, relying on appropriate safeguards such as an adequacy decision, standard contractual clauses or a written undertaking, or on the exceptions provided by law.

10. HOW LONG DO WE KEEP YOUR DATA?

We process your data for a limited period. We determine that period according to the legal and contractual obligations we are subject to, and, where there are none, according to our needs:

  • Account and content data: kept for as long as your account is open. When you delete your account, your content is removed from publication and your account data is deleted or irreversibly anonymised within 30 days at the latest.
  • Server and access logs: for the period required by the applicable legislation, 1 year.
  • Subscription and invoice records: for the period required by financial and commercial legislation, 10 years.
  • Support and request correspondence: 3 years from the closure of the request.
  • Report and moderation records: 2 years from the completion of the review.

11. YOUR RIGHTS

Under KVKK art. 11 you have the right to:

  • learn whether your personal data is being processed, and request information if it is;
  • learn the purpose of processing and whether the data is used in line with that purpose;
  • know the third parties to whom your data is transferred, in Türkiye or abroad;
  • request the correction of incomplete or inaccurately processed data;
  • request the erasure or destruction of your data within the conditions set out in the law;
  • request that corrections, erasures and destructions be notified to the third parties to whom your data has been transferred;
  • object to an adverse outcome produced solely by the automated analysis of your data;
  • claim compensation for damage you suffer because your data has been processed unlawfully.

You may also request a copy of your data and ask to receive it in a portable format.

To exercise these rights, you can write to yazilim@group2b.com from the email address registered to your account. Only the person whose data is processed may submit a request; for requests that do not come from the address registered to the account, we may ask for additional information to verify your identity. We conclude requests within 30 days at the latest.

12. DELETING YOUR ACCOUNT

You can delete your account at any time from the Settings section inside the app. Account deletion cannot be undone; your pins, lists, comments and messages are deleted. If you signed in with Apple, the authorisation on Apple's side is also revoked when you delete your account.

13. HOW DO WE PROTECT YOUR DATA?

We apply the technical and administrative measures we consider appropriate to prevent your data from being unlawfully destroyed, lost, altered or disclosed by unauthorised persons. These include encryption in transit and at rest, keeping session keys in the device's secure storage, access restrictions, support for two-step verification, and regular updates.

In the event of a data breach, we notify the Turkish Personal Data Protection Board within the period and under the conditions provided by law. If the breach carries a high risk for our users, we also inform the affected users and share the necessary recommendations and information.

14. CHILDREN'S PRIVACY

Simple Pin is not directed at children under the age of 13, and we do not knowingly collect data from users under 13. If the legislation of your country sets a higher age limit, that limit applies. If we become aware that we are processing data belonging to a user under 13, we delete the account and the data.

15. USERS IN THE EUROPEAN UNION

If you are located in the European Union, you have the rights of access, rectification, erasure, restriction of processing, objection to processing and data portability under the GDPR. You can also exercise these rights via yazilim@group2b.com. You further have the right to lodge a complaint with the data protection authority of your country.

16. RIGHT TO COMPLAIN

If your request is rejected, if you find our response insufficient, or if we do not respond in time, you can lodge a complaint with the Turkish Personal Data Protection Board:

Kişisel Verileri Koruma Kurumu
Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No: 4, 06520 Çankaya / Ankara, Türkiye
www.kvkk.gov.tr

17. CHANGES

We reserve the right to update this policy in the event of legislative changes or in line with the opinions and recommendations of the Personal Data Protection Board. You will be informed through the app before a new policy takes effect.

18. CONTACT US

For any question or request regarding your data:
Email: yazilim@group2b.com
GRUP2B İNŞAAT SANAYİ DIŞ TİCARET LİMİTED ŞİRKETİ

We respond to your request within a reasonable period appropriate to the nature of the question.